credkeep 0.1.0

package/dist/secrets.js

@@ -0,0 +1,37 @@
+/** A key in camelCase (`cardCvv`) → `SECRET_CARD_CVV` in the environment, under the app's prefix. */
+export function envSecrets(env = process.env, prefix = "SECRET_") {
+    return {
+        async get(key) {
+            const name = `${prefix}${key
+                .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+                .replace(/[^a-zA-Z0-9]+/g, "_")
+                .toUpperCase()}`;
+            const value = env[name];
+            if (!value)
+                throw new Error(`secret ${key}: set ${name}`);
+            return value;
+        },
+    };
+}
+export function memorySecrets(values) {
+    return {
+        async get(key) {
+            const v = values[key];
+            if (v === undefined)
+                throw new Error(`secret ${key}: not set`);
+            return v;
+        },
+    };
+}
+export function trackingSecrets(source) {
+    const keys = new Map();
+    return {
+        async get(key) {
+            const value = await source.get(key);
+            keys.set(value, key);
+            return value;
+        },
+        keyOf: (value) => keys.get(value) ?? null,
+    };
+}
+//# sourceMappingURL=secrets.js.map

package/dist/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AASA,qGAAqG;AACrG,MAAM,UAAU,UAAU,CAAC,MAAyB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS;IACjF,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,MAAM,IAAI,GAAG,GAAG,MAAM,GAAG,GAAG;iBACzB,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;iBACtC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;iBAC9B,WAAW,EAAE,EAAE,CAAC;YACnB,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;YACxB,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,SAAS,IAAI,EAAE,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAA8B;IAC1D,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,IAAI,CAAC,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,WAAW,CAAC,CAAC;YAC/D,OAAO,CAAC,CAAC;QACX,CAAC;KACF,CAAC;AACJ,CAAC;AAQD,MAAM,UAAU,eAAe,CAAC,MAAoB;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACrB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI;KAC1C,CAAC;AACJ,CAAC"}

package/dist/tail.d.ts

@@ -0,0 +1,4 @@
+/** The last `n` non-empty lines of `path`, oldest first; [] for a missing file. */
+export declare function tailLines(path: string, n: number): Promise<string[]>;
+/** Each of the last `n` lines parsed as JSON; a torn line is skipped. */
+export declare function tailJson<T>(path: string, n: number): Promise<T[]>;

package/dist/tail.js

@@ -0,0 +1,56 @@
+/**
+ * The last lines of an append-only file, read from its end in blocks: a
+ * ledger that grows for months costs the same to consult as a fresh one.
+ */
+import { open } from "node:fs/promises";
+const BLOCK = 64 * 1024;
+/** The last `n` non-empty lines of `path`, oldest first; [] for a missing file. */
+export async function tailLines(path, n) {
+    if (n <= 0)
+        return [];
+    let fh;
+    try {
+        fh = await open(path, "r");
+    }
+    catch {
+        return [];
+    }
+    try {
+        const { size } = await fh.stat();
+        const chunks = [];
+        let pos = size;
+        let newlines = 0;
+        // Stop once the read-back text holds n+1 line breaks: the first partial line is then cut whole.
+        while (pos > 0 && newlines <= n) {
+            const len = Math.min(BLOCK, pos);
+            pos -= len;
+            const buf = Buffer.alloc(len);
+            await fh.read(buf, 0, len, pos);
+            chunks.unshift(buf);
+            for (let i = 0; i < len; i++)
+                if (buf[i] === 10)
+                    newlines++;
+        }
+        // With n+1 line breaks in hand the last n lines are whole; the window's first line may be a
+        // fragment and is the one `slice(-n)` leaves behind.
+        const lines = Buffer.concat(chunks).toString("utf8").split("\n").filter(Boolean);
+        return lines.slice(-n);
+    }
+    finally {
+        await fh.close();
+    }
+}
+/** Each of the last `n` lines parsed as JSON; a torn line is skipped. */
+export async function tailJson(path, n) {
+    const out = [];
+    for (const l of await tailLines(path, n)) {
+        try {
+            out.push(JSON.parse(l));
+        }
+        catch {
+            // a line still being written, or a fragment at the window's start
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=tail.js.map

package/dist/tail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tail.js","sourceRoot":"","sources":["../src/tail.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAExC,MAAM,KAAK,GAAG,EAAE,GAAG,IAAI,CAAC;AAExB,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,CAAS;IACrD,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACtB,IAAI,EAAoC,CAAC;IACzC,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,GAAG,GAAG,IAAI,CAAC;QACf,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,gGAAgG;QAChG,OAAO,GAAG,GAAG,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACjC,GAAG,IAAI,GAAG,CAAC;YACX,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAChC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE;gBAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;oBAAE,QAAQ,EAAE,CAAC;QAC9D,CAAC;QACD,4FAA4F;QAC5F,qDAAqD;QACrD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjF,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAI,IAAY,EAAE,CAAS;IACvD,MAAM,GAAG,GAAQ,EAAE,CAAC;IACpB,KAAK,MAAM,CAAC,IAAI,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAM,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/totp.d.ts

@@ -0,0 +1,24 @@
+export declare function base32Decode(text: string): Buffer;
+export type TotpAlgorithm = "sha1" | "sha256" | "sha512";
+export interface TotpOptions {
+    /** Unix ms; defaults to now. */
+    at?: number;
+    period?: number;
+    digits?: number;
+    algorithm?: TotpAlgorithm;
+}
+/** The code for `secret` (base32) at `at`. */
+export declare function totp(secret: string, opts?: TotpOptions): string;
+/** Milliseconds until the current code rolls over; wait it out when a site rejects a code that is about to expire. */
+export declare function totpRemainingMs(at?: number, period?: number): number;
+export interface TotpParams {
+    secret: string;
+    issuer: string | null;
+    account: string | null;
+    digits: number;
+    period: number;
+    algorithm: TotpAlgorithm;
+}
+export declare function parseOtpauth(uri: string): TotpParams;
+/** The seed in page text or HTML: a URI wins, then a manual-entry key. Null when neither is there. */
+export declare function findTotpSecret(text: string): string | null;

package/dist/totp.js

@@ -0,0 +1,111 @@
+/**
+ * TOTP (RFC 6238) with node:crypto, no dependency: the codes an
+ * authenticator app would show, so a login's second factor is ours to
+ * type. `findTotpSecret` pulls the seed out of an enrollment page (the
+ * otpauth:// link behind the QR, or the "enter this key manually" text).
+ */
+import { createHmac } from "node:crypto";
+const ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+export function base32Decode(text) {
+    const clean = text.toUpperCase().replace(/[\s=-]/g, "");
+    let bits = 0;
+    let value = 0;
+    const out = [];
+    for (const ch of clean) {
+        const idx = ALPHABET.indexOf(ch);
+        if (idx < 0)
+            throw new Error(`base32: bad character ${JSON.stringify(ch)}`);
+        value = (value << 5) | idx;
+        bits += 5;
+        if (bits >= 8) {
+            out.push((value >>> (bits - 8)) & 0xff);
+            bits -= 8;
+        }
+    }
+    return Buffer.from(out);
+}
+/** The code for `secret` (base32) at `at`. */
+export function totp(secret, opts = {}) {
+    const period = opts.period ?? 30;
+    const digits = opts.digits ?? 6;
+    const counter = Math.floor((opts.at ?? Date.now()) / 1000 / period);
+    const msg = Buffer.alloc(8);
+    msg.writeBigUInt64BE(BigInt(counter));
+    const mac = createHmac(opts.algorithm ?? "sha1", base32Decode(secret))
+        .update(msg)
+        .digest();
+    const offset = (mac[mac.length - 1] ?? 0) & 0x0f;
+    const code = (mac.readUInt32BE(offset) & 0x7fffffff) % 10 ** digits;
+    return String(code).padStart(digits, "0");
+}
+/** Milliseconds until the current code rolls over; wait it out when a site rejects a code that is about to expire. */
+export function totpRemainingMs(at = Date.now(), period = 30) {
+    const step = period * 1000;
+    return step - (at % step);
+}
+export function parseOtpauth(uri) {
+    const u = new URL(uri);
+    if (u.protocol !== "otpauth:" || u.host !== "totp")
+        throw new Error("not an otpauth://totp URI");
+    const secret = u.searchParams.get("secret");
+    if (!secret)
+        throw new Error("otpauth URI has no secret");
+    const label = decodeURIComponent(u.pathname.replace(/^\/+/, ""));
+    const [labelIssuer, account] = label.includes(":") ? label.split(":", 2) : [null, label];
+    const algo = (u.searchParams.get("algorithm") ?? "SHA1").toLowerCase();
+    return {
+        secret: secret.replace(/[\s=-]/g, "").toUpperCase(),
+        issuer: u.searchParams.get("issuer") ?? labelIssuer,
+        account: account || null,
+        digits: Number(u.searchParams.get("digits") ?? 6),
+        period: Number(u.searchParams.get("period") ?? 30),
+        algorithm: algo === "sha256" || algo === "sha512" ? algo : "sha1",
+    };
+}
+const OTPAUTH = /otpauth:\/\/totp\/[^\s"'<>]+/i;
+/**
+ * 16+ base32 characters in one case, optionally in spaced or dashed groups
+ * of 4. One case because a page prints its key in one case, and the words
+ * around it ("Make sure Time based") are mixed: they must not join the run.
+ */
+const MANUAL_KEYS = [
+    /\b(?:[a-z2-7]{4}[\s-]?){4,}[a-z2-7]*\b/g,
+    /\b(?:[A-Z2-7]{4}[\s-]?){4,}[A-Z2-7]*\b/g,
+];
+/**
+ * Seed lengths sites hand out, most common first (Google/Cloudflare 32,
+ * GitHub/Microsoft 16, AWS 64). A run is cut to the first of these some
+ * prefix of its groups adds up to, so a 4-letter word after the key
+ * ("then") does not join it. A wrong cut fails the confirm step, nothing worse.
+ */
+const SEED_LENGTHS = [32, 16, 64, 26, 52, 20, 24, 40];
+function manualKey(text) {
+    for (const re of MANUAL_KEYS)
+        for (const m of text.matchAll(re)) {
+            const tokens = m[0].trim().split(/[\s-]+/);
+            const prefixes = tokens.map((_, i) => tokens.slice(0, i + 1).join(""));
+            for (const len of SEED_LENGTHS) {
+                const key = prefixes.find((p) => p.length === len);
+                if (key)
+                    return key.toUpperCase();
+            }
+            const whole = tokens.join("");
+            if (whole.length >= 16 && whole.length % 2 === 0)
+                return whole.toUpperCase();
+        }
+    return null;
+}
+/** The seed in page text or HTML: a URI wins, then a manual-entry key. Null when neither is there. */
+export function findTotpSecret(text) {
+    const uri = text.match(OTPAUTH);
+    if (uri) {
+        try {
+            return parseOtpauth(uri[0].replace(/&amp;/g, "&")).secret;
+        }
+        catch {
+            // fall through to a manual key
+        }
+    }
+    return manualKey(text);
+}
+//# sourceMappingURL=totp.js.map

package/dist/totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.js","sourceRoot":"","sources":["../src/totp.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,QAAQ,GAAG,kCAAkC,CAAC;AAEpD,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,GAAG,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5E,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC;QAC3B,IAAI,IAAI,CAAC,CAAC;QACV,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACxC,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAYD,8CAA8C;AAC9C,MAAM,UAAU,IAAI,CAAC,MAAc,EAAE,OAAoB,EAAE;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5B,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;SACnE,MAAM,CAAC,GAAG,CAAC;SACX,MAAM,EAAE,CAAC;IACZ,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IACjD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC;IACpE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,eAAe,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE;IAC1D,MAAM,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,IAAI,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;AAC5B,CAAC;AAWD,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IACjE,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IACvE,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE;QACnD,MAAM,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,WAAW;QACnD,OAAO,EAAE,OAAO,IAAI,IAAI;QACxB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClD,SAAS,EAAE,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;KAClE,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,GAAG,+BAA+B,CAAC;AAChD;;;;GAIG;AACH,MAAM,WAAW,GAAG;IAClB,yCAAyC;IACzC,yCAAyC;CAC1C,CAAC;AACF;;;;;GAKG;AACH,MAAM,YAAY,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;AAEtD,SAAS,SAAS,CAAC,IAAY;IAC7B,KAAK,MAAM,EAAE,IAAI,WAAW;QAC1B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACvE,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;gBAC/B,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;gBACnD,IAAI,GAAG;oBAAE,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;YACpC,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;QAC/E,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC"}

package/package.json

@@ -0,0 +1,61 @@
+{
+  "name": "credkeep",
+  "version": "0.1.0",
+  "packageManager": "pnpm@9.15.0",
+  "description": "Keep the credentials an automation signs in with: sealed at rest, shared through SSM, every use audited, expiries watched.",
+  "type": "module",
+  "license": "MIT",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "build": "node scripts/clean.mjs && tsc -p tsconfig.build.json",
+    "prepare": "pnpm build",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run src",
+    "lint": "biome check .",
+    "prepublishOnly": "pnpm lint && pnpm typecheck && pnpm test"
+  },
+  "dependencies": {
+    "@aws-sdk/client-ssm": "3.1136.0",
+    "zod": "4.6.5"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "2.5.14",
+    "@types/node": "22.20.3",
+    "typescript": "5.9.3",
+    "vitest": "5.0.1"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/wrenautomation/credkeep.git"
+  },
+  "homepage": "https://github.com/wrenautomation/credkeep#readme",
+  "bugs": {
+    "url": "https://github.com/wrenautomation/credkeep/issues"
+  },
+  "keywords": [
+    "credentials",
+    "secrets",
+    "vault",
+    "ssm",
+    "totp",
+    "keychain",
+    "audit"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}