credvault 0.14.1 → 0.15.0

package/README.md

@@ -38,6 +38,7 @@ npm install credvault
 | `projectKeys(keys)`, `applyProjection(store, keys)`, `projectionDiff(store, keys)` | The env view of the keys, one way. Per vendor: `<BASE>_API_KEY` from the `default` key, `<BASE>_API_KEY_1..n` from the rest in ring order, `NUM_<BASE>` = n. `applyProjection` writes only names that differ and removes stale ones. `projectionDiff` lists what would change as ids, never values: empty means env equals the vault. `parseVendorKeyName` and `isProjectedName` tell a projected name from any other. |
 | `keyUses(uses)` | From the audit: per key id, the count of allowed uses and the time of the last. A key use is a `SecretUse` with `keyId`, `owner` and `reason` set. |
 | `keysFromEnv(entries, { owner, madeAt })` | The migration piece. Each `<BASE>_API_KEY` is account `env-0` with purpose `default`, each `<BASE>_API_KEY_<n>` is `env-<n>`. A name above `NUM_<BASE>`, or a second name with the same value, is skipped and listed with its reason. Pure. |
+| `credvault gate --config <file>`, `gate(config)` | The key gate. Each role's processes hold sentinels (`wsk_…`, `sentinel(gateKey, role, name)`, stable) in `<dir>/<role>.env`, never keys. mitmproxy (pinned, upstream mode to the role's egress proxy) ends TLS only on keyed vendor hosts (`VENDOR_HOSTS`, or `hosts` in the config) and swaps a sentinel in a header, the query or the body for the real key. A sentinel on another role or host: 403 and an alert. Every swap and refusal is a `fileAudit` line with the `keyId`. Clients trust `<dir>/ca.pem` (`NODE_EXTRA_CA_CERTS`) or `<dir>/ca-bundle.pem` (`SSL_CERT_FILE`). Design: `designs/2026-11-08-gate.md`. |
 
 ## Example
 

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+/** `credvault gate --config <file>`: runs the key gate until stopped. */
+import { gate, loadGateConfig } from "./gate/run.js";
+const USAGE = "usage: credvault gate --config <file>";
+async function main(argv) {
+    const [cmd, ...rest] = argv;
+    if (cmd !== "gate") {
+        console.error(USAGE);
+        return 2;
+    }
+    const i = rest.indexOf("--config");
+    const path = i >= 0 ? rest[i + 1] : undefined;
+    if (!path) {
+        console.error(USAGE);
+        return 2;
+    }
+    const g = await gate(await loadGateConfig(path));
+    const roles = [...g.plan.files.keys()].join(", ");
+    console.error(`credvault gate: up; roles ${roles}; ${g.plan.keys.size} keys on ${g.plan.hosts.length} hosts`);
+    for (const sig of ["SIGTERM", "SIGINT"])
+        process.on(sig, () => g.stop());
+    return g.done;
+}
+main(process.argv.slice(2)).then((code) => process.exit(code), (err) => {
+    console.error(`credvault gate: ${err.message}`);
+    process.exit(1);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,yEAAyE;AACzE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,KAAK,GAAG,uCAAuC,CAAC;AAEtD,KAAK,UAAU,IAAI,CAAC,IAAc;IAChC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5B,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO,CAAC,KAAK,CACX,6BAA6B,KAAK,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAC/F,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAU;QAAE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClF,OAAO,CAAC,CAAC,IAAI,CAAC;AAChB,CAAC;AAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC9B,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAC5B,CAAC,GAAG,EAAE,EAAE;IACN,OAAO,CAAC,KAAK,CAAC,mBAAoB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CACF,CAAC"}

package/dist/gate/plan.d.ts

@@ -0,0 +1,48 @@
+import { z } from "zod";
+import { type EnvEntry } from "../env-store.js";
+/** Where each vendor's keys may go. A key whose vendor is not here needs a `hosts` entry in the config. */
+export declare const VENDOR_HOSTS: Readonly<Record<string, readonly string[]>>;
+/** `wsk_` + 28 base32 characters: what a process holds in place of a key. */
+export declare const SENTINEL: RegExp;
+export declare const gateConfigSchema: z.ZodObject<{
+    dir: z.ZodString;
+    mitmdump: z.ZodString;
+    audit: z.ZodString;
+    keychain: z.ZodDefault<z.ZodObject<{
+        service: z.ZodString;
+        account: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    sources: z.ZodArray<z.ZodString>;
+    hosts: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+    roles: z.ZodRecord<z.ZodString, z.ZodObject<{
+        port: z.ZodNumber;
+        upstream: z.ZodString;
+        keys: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        plain: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type GateConfig = z.infer<typeof gateConfigSchema>;
+export interface GateKey {
+    role: string;
+    name: string;
+    value: string;
+    hosts: string[];
+    /** The vendor, or the first host for a key with none. */
+    site: string;
+    keyId: string;
+}
+export interface GatePlan {
+    /** Per role: the env file's entries, sentinels in place of keys. */
+    files: Map<string, EnvEntry[]>;
+    /** Sentinel → the real key. Only the gate and its addon hold this. */
+    keys: Map<string, GateKey>;
+    /** Every host a sentinel may go to: the proxy ends TLS on these only. */
+    hosts: string[];
+}
+/** Stable per gate key, role and name: a restart or a rotated value keeps the file as it is. */
+export declare function sentinel(gateKey: Buffer, role: string, name: string): string;
+/** Layers the sources: an earlier file wins a name. */
+export declare function layer(sources: EnvEntry[][]): Map<string, string>;
+export declare function planGate(config: GateConfig, values: Map<string, string>, gateKey: Buffer): GatePlan;
+/** mitmproxy's `allow_hosts`: TLS is ended on these hosts only; the rest pass as opaque tunnels. */
+export declare function allowHostsRegex(hosts: string[]): string;

package/dist/gate/plan.js

@@ -0,0 +1,151 @@
+/**
+ * The key gate's plan: which names each role holds, as stand-ins (sentinels)
+ * or as plain values, and the sentinel → real key map the proxy addon swaps
+ * from. Pure: the gate key and the source entries come in, nothing is read here.
+ */
+import { createHmac } from "node:crypto";
+import { z } from "zod";
+import { ENV_KEY } from "../env-store.js";
+import { keyId, parseVendorKeyName } from "../keys.js";
+/** Where each vendor's keys may go. A key whose vendor is not here needs a `hosts` entry in the config. */
+export const VENDOR_HOSTS = {
+    anthropic: ["api.anthropic.com"],
+    cerebras: ["api.cerebras.ai"],
+    cohere: ["api.cohere.com", "api.cohere.ai"],
+    exa: ["api.exa.ai"],
+    gemini: ["generativelanguage.googleapis.com"],
+    groq: ["api.groq.com"],
+    mistral: ["api.mistral.ai"],
+    openai: ["api.openai.com"],
+    openalex: ["api.openalex.org"],
+    openrouter: ["openrouter.ai"],
+    perplexity: ["api.perplexity.ai"],
+    typesafe: ["api.typesafe.ai"],
+    youtube: ["www.googleapis.com", "youtube.googleapis.com"],
+};
+/** `wsk_` + 28 base32 characters: what a process holds in place of a key. */
+export const SENTINEL = /wsk_[a-z2-7]{28}/g;
+const HOST = /^(\*\.)?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/;
+/** A name, or a name with `*` in it (`EXA_API_KEY*`). */
+const NAME_GLOB = /^[A-Z*][A-Z0-9_*]*$/;
+const roleSchema = z.object({
+    /** The port this role's processes send through (`HTTPS_PROXY`). */
+    port: z.number().int().min(1024).max(65535),
+    /** The role's own egress proxy (smokescreen): every request leaves through it. */
+    upstream: z.string().url(),
+    /** Names the role holds as sentinels. */
+    keys: z.array(z.string().regex(NAME_GLOB)).default([]),
+    /** Names the role holds as they are (`NUM_EXA`, a URL). Never a key. */
+    plain: z.array(z.string().regex(NAME_GLOB)).default([]),
+});
+export const gateConfigSchema = z.object({
+    /** Where the role env files, the CA and its bundle go. 0700. */
+    dir: z.string().min(1),
+    /** The `mitmdump` binary (a pinned venv). */
+    mitmdump: z.string().min(1),
+    /** The hash-chained audit file (`fileAudit`). */
+    audit: z.string().min(1),
+    /** The Keychain item that holds the gate key: sentinels are an HMAC of it. */
+    keychain: z.object({ service: z.string().min(1), account: z.string().optional() }).default({
+        service: "credvault-gate",
+    }),
+    /** Env files with the real values. An earlier file wins a name. */
+    sources: z.array(z.string().min(1)).min(1),
+    /** Hosts per name or glob, for a key with no vendor (`RESTATE_AUTH_TOKEN`), or to replace the vendor's list. */
+    hosts: z.record(z.string().regex(NAME_GLOB), z.array(z.string().regex(HOST)).min(1)).default({}),
+    roles: z.record(z.string().regex(/^[a-z][a-z0-9-]{0,31}$/), roleSchema),
+});
+const glob = (pattern) => new RegExp(`^${pattern.replace(/\*/g, "[A-Z0-9_]*")}$`);
+const matchesAny = (name, patterns) => patterns.some((p) => glob(p).test(name));
+const BASE32 = "abcdefghijklmnopqrstuvwxyz234567";
+function base32(buf) {
+    let bits = 0;
+    let acc = 0;
+    let out = "";
+    for (const byte of buf) {
+        acc = (acc << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            out += BASE32[(acc >>> (bits - 5)) & 31];
+            bits -= 5;
+        }
+    }
+    return out;
+}
+/** Stable per gate key, role and name: a restart or a rotated value keeps the file as it is. */
+export function sentinel(gateKey, role, name) {
+    const mac = createHmac("sha256", gateKey).update(`${role}/${name}`).digest();
+    return `wsk_${base32(mac).slice(0, 28)}`;
+}
+function hostsFor(name, overrides) {
+    const exact = overrides[name];
+    if (exact)
+        return exact;
+    const byGlob = Object.entries(overrides).find(([p]) => p.includes("*") && glob(p).test(name));
+    if (byGlob)
+        return byGlob[1];
+    const vendor = parseVendorKeyName(name)?.vendor;
+    const listed = vendor ? VENDOR_HOSTS[vendor] : undefined;
+    return listed ? [...listed] : null;
+}
+/** Layers the sources: an earlier file wins a name. */
+export function layer(sources) {
+    const out = new Map();
+    for (const entries of sources)
+        for (const { name, value } of entries)
+            if (!out.has(name))
+                out.set(name, value);
+    return out;
+}
+export function planGate(config, values, gateKey) {
+    const files = new Map();
+    const keys = new Map();
+    const hosts = new Set();
+    const ports = new Set();
+    for (const [role, r] of Object.entries(config.roles)) {
+        if (ports.has(r.port))
+            throw new Error(`role ${role}: port ${r.port} is taken by another role`);
+        ports.add(r.port);
+        const entries = [];
+        for (const name of [...values.keys()].sort()) {
+            const value = values.get(name);
+            if (!ENV_KEY.test(name))
+                continue;
+            if (matchesAny(name, r.keys)) {
+                const to = hostsFor(name, config.hosts);
+                if (!to)
+                    throw new Error(`role ${role}: ${name} has no hosts; add it to "hosts"`);
+                const s = sentinel(gateKey, role, name);
+                const vendor = parseVendorKeyName(name)?.vendor;
+                keys.set(s, {
+                    role,
+                    name,
+                    value,
+                    hosts: to,
+                    site: vendor ?? to[0],
+                    keyId: keyId(value),
+                });
+                for (const h of to)
+                    hosts.add(h);
+                entries.push({ name, value: s });
+            }
+            else if (matchesAny(name, r.plain)) {
+                if (hostsFor(name, config.hosts) && parseVendorKeyName(name))
+                    throw new Error(`role ${role}: ${name} is a key; list it in "keys", not "plain"`);
+                entries.push({ name, value });
+            }
+        }
+        files.set(role, entries);
+    }
+    return { files, keys, hosts: [...hosts].sort() };
+}
+/** mitmproxy's `allow_hosts`: TLS is ended on these hosts only; the rest pass as opaque tunnels. */
+export function allowHostsRegex(hosts) {
+    const alt = hosts
+        .map((h) => h.startsWith("*.")
+        ? `(?:[a-z0-9-]+\\.)+${h.slice(2).replace(/\./g, "\\.")}`
+        : h.replace(/\./g, "\\."))
+        .join("|");
+    return `^(?:${alt})(?::\\d+)?$`;
+}
+//# sourceMappingURL=plan.js.map

package/dist/gate/plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../src/gate/plan.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAiB,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEvD,2GAA2G;AAC3G,MAAM,CAAC,MAAM,YAAY,GAAgD;IACvE,SAAS,EAAE,CAAC,mBAAmB,CAAC;IAChC,QAAQ,EAAE,CAAC,iBAAiB,CAAC;IAC7B,MAAM,EAAE,CAAC,gBAAgB,EAAE,eAAe,CAAC;IAC3C,GAAG,EAAE,CAAC,YAAY,CAAC;IACnB,MAAM,EAAE,CAAC,mCAAmC,CAAC;IAC7C,IAAI,EAAE,CAAC,cAAc,CAAC;IACtB,OAAO,EAAE,CAAC,gBAAgB,CAAC;IAC3B,MAAM,EAAE,CAAC,gBAAgB,CAAC;IAC1B,QAAQ,EAAE,CAAC,kBAAkB,CAAC;IAC9B,UAAU,EAAE,CAAC,eAAe,CAAC;IAC7B,UAAU,EAAE,CAAC,mBAAmB,CAAC;IACjC,QAAQ,EAAE,CAAC,iBAAiB,CAAC;IAC7B,OAAO,EAAE,CAAC,oBAAoB,EAAE,wBAAwB,CAAC;CAC1D,CAAC;AAEF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,QAAQ,GAAG,mBAAmB,CAAC;AAE5C,MAAM,IAAI,GAAG,0EAA0E,CAAC;AACxF,yDAAyD;AACzD,MAAM,SAAS,GAAG,qBAAqB,CAAC;AAExC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,mEAAmE;IACnE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IAC3C,kFAAkF;IAClF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC1B,yCAAyC;IACzC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,wEAAwE;IACxE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACxD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,gEAAgE;IAChE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,6CAA6C;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,iDAAiD;IACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC;QACzF,OAAO,EAAE,gBAAgB;KAC1B,CAAC;IACF,mEAAmE;IACnE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,gHAAgH;IAChH,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAChG,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,UAAU,CAAC;CACxE,CAAC,CAAC;AAsBH,MAAM,IAAI,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC;AAClG,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,QAAkB,EAAW,EAAE,CAC/D,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAE3C,MAAM,MAAM,GAAG,kCAAkC,CAAC;AAClD,SAAS,MAAM,CAAC,GAAW;IACzB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QACxB,IAAI,IAAI,CAAC,CAAC;QACV,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YACjB,GAAG,IAAI,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YACzC,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,QAAQ,CAAC,OAAe,EAAE,IAAY,EAAE,IAAY;IAClE,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7E,OAAO,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,SAAmC;IACjE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9F,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,KAAK,CAAC,OAAqB;IACzC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,OAAO,IAAI,OAAO;QAC3B,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,OAAO;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,MAAkB,EAClB,MAA2B,EAC3B,OAAe;IAEf,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmB,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,UAAU,CAAC,CAAC,IAAI,2BAA2B,CAAC,CAAC;QAChG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAClB,MAAM,OAAO,GAAe,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAW,CAAC;YACzC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YAClC,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBACxC,IAAI,CAAC,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,IAAI,kCAAkC,CAAC,CAAC;gBAClF,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBACxC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;gBAChD,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE;oBACV,IAAI;oBACJ,IAAI;oBACJ,KAAK;oBACL,KAAK,EAAE,EAAE;oBACT,IAAI,EAAE,MAAM,IAAK,EAAE,CAAC,CAAC,CAAY;oBACjC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;iBACpB,CAAC,CAAC;gBACH,KAAK,MAAM,CAAC,IAAI,EAAE;oBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YACnC,CAAC;iBAAM,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrC,IAAI,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC;oBAC1D,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,IAAI,2CAA2C,CAAC,CAAC;gBACpF,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACnD,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,eAAe,CAAC,KAAe;IAC7C,MAAM,GAAG,GAAG,KAAK;SACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACT,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAChB,CAAC,CAAC,qBAAqB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE;QACzD,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAC5B;SACA,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,OAAO,GAAG,cAAc,CAAC;AAClC,CAAC"}

package/dist/gate/run.d.ts

@@ -0,0 +1,42 @@
+/**
+ * The key gate process: plans from the sources, writes each role's env file
+ * (sentinels), starts mitmdump with one listener per keyed role, hands the map
+ * to the addon over fd 3 and audits each swap or refusal it reports on fd 4.
+ * Real values live in this process and the addon only.
+ */
+import { type ChildProcess } from "node:child_process";
+import { type SecretAudit } from "../audit.js";
+import { type GateConfig, type GatePlan } from "./plan.js";
+export interface GateEvent {
+    t: "use" | "deny";
+    role: string | null;
+    host: string;
+    path: string;
+    /** The key's name; none for an unknown sentinel. */
+    name?: string | null;
+    /** The role the key belongs to (differs from `role` on a refusal). */
+    key_role?: string | null;
+    why?: string;
+}
+export declare function loadGateConfig(path: string): Promise<GateConfig>;
+export declare function readSources(paths: string[]): Promise<Map<string, string>>;
+/** `<dir>/<role>.env` per role, 0600. */
+export declare function writeRoleFiles(dir: string, plan: GatePlan): Promise<string[]>;
+/** The audit line for one addon event. No value, no query. */
+export declare function auditLine(e: GateEvent, plan: GatePlan): Parameters<SecretAudit["record"]>[0];
+export interface RunningGate {
+    child: ChildProcess;
+    plan: GatePlan;
+    /** Resolves with the child's exit code. */
+    done: Promise<number>;
+    stop(): void;
+}
+export interface GateOptions {
+    /** Defaults to the config's Keychain item. */
+    gateKey?: Buffer;
+    audit?: SecretAudit;
+    /** A refused sentinel: a canary. Default: one stderr line. */
+    onDeny?: (e: GateEvent) => void;
+}
+/** Writes the role files and the CA bundle, starts mitmdump; returns once it runs. */
+export declare function gate(config: GateConfig, o?: GateOptions): Promise<RunningGate>;

package/dist/gate/run.js

@@ -0,0 +1,170 @@
+/**
+ * The key gate process: plans from the sources, writes each role's env file
+ * (sentinels), starts mitmdump with one listener per keyed role, hands the map
+ * to the addon over fd 3 and audits each swap or refusal it reports on fd 4.
+ * Real values live in this process and the addon only.
+ */
+import { spawn } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { chmod, mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { connect } from "node:net";
+import { join } from "node:path";
+import { createInterface } from "node:readline";
+import { fileAudit } from "../audit.js";
+import { keychainKey } from "../cipher.js";
+import { parseDotenv, toDotenv } from "../env-store.js";
+import { allowHostsRegex, gateConfigSchema, layer, planGate, } from "./plan.js";
+/** Shipped beside dist: `<package>/gate/addon.py`. */
+const ADDON = new URL("../../gate/addon.py", import.meta.url).pathname;
+const CA_CERT = "mitmproxy-ca-cert.pem";
+/** macOS's roots; Python and curl read `SSL_CERT_FILE` as the whole store, so the bundle adds the gate CA to them. */
+const SYSTEM_ROOTS = "/etc/ssl/cert.pem";
+async function writePrivate(path, text) {
+    const tmp = `${path}.${process.pid}.tmp`;
+    await writeFile(tmp, text, { mode: 0o600 });
+    await rename(tmp, path);
+}
+export async function loadGateConfig(path) {
+    return gateConfigSchema.parse(JSON.parse(await readFile(path, "utf8")));
+}
+export async function readSources(paths) {
+    const read = (p) => (existsSync(p) ? readFileSync(p, "utf8") : null);
+    return layer(await Promise.all(paths.map(async (p) => {
+        if (!existsSync(p))
+            throw new Error(`gate source ${p} is missing`);
+        return parseDotenv(await readFile(p, "utf8"), read);
+    })));
+}
+/** `<dir>/<role>.env` per role, 0600. */
+export async function writeRoleFiles(dir, plan) {
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+    await chmod(dir, 0o700);
+    const out = [];
+    for (const [role, entries] of plan.files) {
+        const path = join(dir, `${role}.env`);
+        await writePrivate(path, toDotenv(entries));
+        out.push(path);
+    }
+    return out;
+}
+/** The audit line for one addon event. No value, no query. */
+export function auditLine(e, plan) {
+    const name = e.name ?? "unknown";
+    const k = [...plan.keys.values()].find((x) => x.name === name && x.role === e.key_role);
+    return {
+        at: new Date().toISOString(),
+        credential: name,
+        field: "secret",
+        site: k?.site ?? e.host,
+        url: `https://${e.host}${e.path}`,
+        by: `gate:${e.role ?? "?"}`,
+        allowed: e.t === "use",
+        owner: "wren",
+        ...(k ? { keyId: k.keyId } : {}),
+        ...(e.why ? { reason: e.why } : {}),
+    };
+}
+/** Writes the role files and the CA bundle, starts mitmdump; returns once it runs. */
+export async function gate(config, o = {}) {
+    const { service, account } = config.keychain;
+    const key = o.gateKey ?? keychainKey(account ? { service, account } : { service });
+    const plan = planGate(config, await readSources(config.sources), key);
+    await writeRoleFiles(config.dir, plan);
+    const confdir = join(config.dir, "ca");
+    await mkdir(confdir, { recursive: true, mode: 0o700 });
+    const keyed = Object.entries(config.roles).filter(([role]) => [...plan.keys.values()].some((k) => k.role === role));
+    if (!keyed.length)
+        throw new Error("no role holds a key: nothing to gate");
+    const args = [
+        "-q",
+        ...keyed.flatMap(([, r]) => ["--mode", `upstream:${r.upstream}@127.0.0.1:${r.port}`]),
+        "--set",
+        `confdir=${confdir}`,
+        "--set",
+        `allow_hosts=${allowHostsRegex(plan.hosts)}`,
+        "--set",
+        "termlog_verbosity=warn",
+        "--set",
+        "flow_detail=0",
+        "-s",
+        ADDON,
+    ];
+    const child = spawn(config.mitmdump, args, {
+        stdio: ["ignore", "inherit", "inherit", "pipe", "pipe"],
+    });
+    const map = {
+        ports: Object.fromEntries(keyed.map(([role, r]) => [String(r.port), role])),
+        keys: Object.fromEntries([...plan.keys].map(([s, k]) => [
+            s,
+            { role: k.role, name: k.name, value: k.value, hosts: k.hosts },
+        ])),
+    };
+    child.stdio[3].end(JSON.stringify(map));
+    const audit = o.audit ?? fileAudit(config.audit);
+    const onDeny = o.onDeny ??
+        ((e) => console.error(`credvault gate: ALERT ${e.name ?? "unknown sentinel"} refused on ${e.host}${e.path} (role ${e.role}): ${e.why}`));
+    createInterface({ input: child.stdio[4] }).on("line", (line) => {
+        let e;
+        try {
+            e = JSON.parse(line);
+        }
+        catch {
+            return;
+        }
+        if (e.t === "deny")
+            onDeny(e);
+        void audit
+            .record(auditLine(e, plan))
+            .catch((err) => console.error(`credvault gate: audit failed: ${err.message}`));
+    });
+    const done = new Promise((resolve) => child.on("exit", (code) => resolve(code ?? 1)));
+    await waitFor(() => existsSync(join(confdir, CA_CERT)), done, "the gate CA");
+    await writeBundle(config.dir, confdir);
+    for (const [role, r] of keyed)
+        await waitPort(r.port, done, `role ${role}`);
+    return { child, plan, done, stop: () => child.kill("SIGTERM") };
+}
+/** `<dir>/ca.pem` (the gate CA, for `NODE_EXTRA_CA_CERTS`) and `<dir>/ca-bundle.pem` (system roots + it). */
+async function writeBundle(dir, confdir) {
+    const ca = await readFile(join(confdir, CA_CERT), "utf8");
+    const roots = existsSync(SYSTEM_ROOTS) ? await readFile(SYSTEM_ROOTS, "utf8") : "";
+    await writeFile(join(dir, "ca.pem"), ca, { mode: 0o644 });
+    await writeFile(join(dir, "ca-bundle.pem"), `${roots.trimEnd()}\n${ca}`, { mode: 0o644 });
+}
+async function waitFor(ok, died, what) {
+    let dead = false;
+    void died.then(() => {
+        dead = true;
+    });
+    for (let i = 0; i < 300; i++) {
+        if (ok())
+            return;
+        if (dead)
+            throw new Error(`mitmdump exited before ${what} was ready`);
+        await new Promise((r) => setTimeout(r, 100));
+    }
+    throw new Error(`${what} not ready after 30 s`);
+}
+async function waitPort(port, died, what) {
+    let dead = false;
+    void died.then(() => {
+        dead = true;
+    });
+    const probe = () => new Promise((resolve) => {
+        const s = connect(port, "127.0.0.1");
+        s.once("connect", () => {
+            s.destroy();
+            resolve(true);
+        });
+        s.once("error", () => resolve(false));
+    });
+    for (let i = 0; i < 300; i++) {
+        if (await probe())
+            return;
+        if (dead)
+            throw new Error(`mitmdump exited before ${what} listened`);
+        await new Promise((r) => setTimeout(r, 100));
+    }
+    throw new Error(`${what}: port ${port} not listening after 30 s`);
+}
+//# sourceMappingURL=run.js.map

package/dist/gate/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/gate/run.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAqB,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,SAAS,EAAoB,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,eAAe,EAGf,gBAAgB,EAChB,KAAK,EACL,QAAQ,GACT,MAAM,WAAW,CAAC;AAEnB,sDAAsD;AACtD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;AACvE,MAAM,OAAO,GAAG,uBAAuB,CAAC;AACxC,sHAAsH;AACtH,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAczC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,IAAY;IACpD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACzC,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5C,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY;IAC/C,OAAO,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAe;IAC/C,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7E,OAAO,KAAK,CACV,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACpB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QACnE,OAAO,WAAW,CAAC,MAAM,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC,CACH,CACF,CAAC;AACJ,CAAC;AAED,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW,EAAE,IAAc;IAC9D,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;QACtC,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,SAAS,CAAC,CAAY,EAAE,IAAc;IACpD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,SAAS,CAAC;IACjC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC;IACxF,OAAO;QACL,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,UAAU,EAAE,IAAI;QAChB,KAAK,EAAE,QAAQ;QACf,IAAI,EAAE,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,IAAI;QACvB,GAAG,EAAE,WAAW,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE;QACjC,EAAE,EAAE,QAAQ,CAAC,CAAC,IAAI,IAAI,GAAG,EAAE;QAC3B,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK;QACtB,KAAK,EAAE,MAAM;QACb,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAkBD,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,MAAkB,EAAE,IAAiB,EAAE;IAChE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC7C,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;IACtE,MAAM,cAAc,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACvC,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEvD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAC3D,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CACrD,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG;QACX,IAAI;QACJ,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,QAAQ,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACrF,OAAO;QACP,WAAW,OAAO,EAAE;QACpB,OAAO;QACP,eAAe,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QAC5C,OAAO;QACP,wBAAwB;QACxB,OAAO;QACP,eAAe;QACf,IAAI;QACJ,KAAK;KACN,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE;QACzC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC;KACxD,CAAC,CAAC;IACH,MAAM,GAAG,GAAG;QACV,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC3E,IAAI,EAAE,MAAM,CAAC,WAAW,CACtB,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;YAC7B,CAAC;YACD,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;SAC/D,CAAC,CACH;KACF,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,CAAC,CAAc,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAEtD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,MAAM,GACV,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,CAAY,EAAE,EAAE,CAChB,OAAO,CAAC,KAAK,CACX,yBAAyB,CAAC,CAAC,IAAI,IAAI,kBAAkB,eAAe,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,EAAE,CACjH,CAAC,CAAC;IACP,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAa,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QACzE,IAAI,CAAY,CAAC;QACjB,IAAI,CAAC;YACH,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;YAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAC9B,KAAK,KAAK;aACP,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;aAC1B,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,iCAAkC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9F,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;IAC7E,MAAM,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK;QAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IAC5E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,6GAA6G;AAC7G,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,OAAe;IACrD,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,EAAiB,EAAE,IAAqB,EAAE,IAAY;IAC3E,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;QAClB,IAAI,GAAG,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,IAAI,EAAE,EAAE;YAAE,OAAO;QACjB,IAAI,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,YAAY,CAAC,CAAC;QACtE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,IAAqB,EAAE,IAAY;IACvE,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;QAClB,IAAI,GAAG,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,GAAG,EAAE,CACjB,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;QAC/B,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACrC,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;YACrB,CAAC,CAAC,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IACL,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,IAAI,MAAM,KAAK,EAAE;YAAE,OAAO;QAC1B,IAAI,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,WAAW,CAAC,CAAC;QACrE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,UAAU,IAAI,2BAA2B,CAAC,CAAC;AACpE,CAAC"}

package/dist/index.d.ts

@@ -4,6 +4,8 @@ export { type Chained, type ChainedFile, chainedFile, rowHash, type Verification
 export { aesGcmCipher, type Cipher, isSealed, type KeychainItem, keychainKey, plainCipher, trustKeychainKey, } from "./cipher.js";
 export { CREDENTIAL_ENV_FIELDS, type Credential, type CredentialEnvStore, type CredentialInput, type CredentialStore, credentialEnv, credentialEnvName, credentialSchema, type EnvNaming, envCredentials, fileCredentials, layeredCredentials, memoryCredentials, type PushOptions, pullCredentials, pushCredentials, ROLE_NAME, type SeenVersions, type SharedCredentialStore, type SyncOptions, syncedCredentials, versionsFile, } from "./credentials.js";
 export { ENV_KEY, type EnvEntry, type EnvListing, type EnvStore, envFileStore, expiring, memoryEnvStore, memoryUnshared, type PutOptions, parseDotenv, REMOVED, type SyncedEnvStore, ssmEnvStore, syncedEnvStore, toDotenv, toExports, type Unshared, unsharedFile, upsertDotenv, WouldReplace, } from "./env-store.js";
+export { allowHostsRegex, type GateConfig, type GateKey, type GatePlan, gateConfigSchema, layer, planGate, SENTINEL, sentinel, VENDOR_HOSTS, } from "./gate/plan.js";
+export { auditLine, type GateEvent, type GateOptions, gate, loadGateConfig, type RunningGate, readSources, writeRoleFiles, } from "./gate/run.js";
 export { type CredentialHistory, type CredentialVersion, changedFields, memoryCredentialHistory, ssmCredentialHistory, } from "./history.js";
 export { type ApiKey, type ApiKeyInput, apiKeySchema, applyProjection, envKeys, inRing, isProjectedName, KEY_ACCOUNT, KEY_SITE, type KeyInfo, type KeyStore, type KeysForOptions, keyAddress, keyId, keyInfo, keyRowName, keysFor, keysFromEnv, keyUses, liveAt, memoryKeys, movePurposes, type ProjectionChange, type ProjectionOptions, parseKeyAddress, parseVendorKeyName, projectionDiff, projectKeys, vendorBase, } from "./keys.js";
 export { type AwsCredentials, checkOwner, OWNER_NAME, type OwnerSession, ownerCredentials, ownerPath, ownerSsmClient, } from "./owner.js";

package/dist/index.js

@@ -4,6 +4,8 @@ export { chainedFile, rowHash, verifyChain, } from "./chain.js";
 export { aesGcmCipher, isSealed, keychainKey, plainCipher, trustKeychainKey, } from "./cipher.js";
 export { CREDENTIAL_ENV_FIELDS, credentialEnv, credentialEnvName, credentialSchema, envCredentials, fileCredentials, layeredCredentials, memoryCredentials, pullCredentials, pushCredentials, ROLE_NAME, syncedCredentials, versionsFile, } from "./credentials.js";
 export { ENV_KEY, envFileStore, expiring, memoryEnvStore, memoryUnshared, parseDotenv, REMOVED, ssmEnvStore, syncedEnvStore, toDotenv, toExports, unsharedFile, upsertDotenv, WouldReplace, } from "./env-store.js";
+export { allowHostsRegex, gateConfigSchema, layer, planGate, SENTINEL, sentinel, VENDOR_HOSTS, } from "./gate/plan.js";
+export { auditLine, gate, loadGateConfig, readSources, writeRoleFiles, } from "./gate/run.js";
 export { changedFields, memoryCredentialHistory, ssmCredentialHistory, } from "./history.js";
 export { apiKeySchema, applyProjection, envKeys, inRing, isProjectedName, KEY_ACCOUNT, KEY_SITE, keyAddress, keyId, keyInfo, keyRowName, keysFor, keysFromEnv, keyUses, liveAt, memoryKeys, movePurposes, parseKeyAddress, parseVendorKeyName, projectionDiff, projectKeys, vendorBase, } from "./keys.js";
 export { checkOwner, OWNER_NAME, ownerCredentials, ownerPath, ownerSsmClient, } from "./owner.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAoC,MAAM,YAAY,CAAC;AACtF,OAAO,EAEL,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,QAAQ,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EAGL,WAAW,EACX,OAAO,EAEP,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,YAAY,EAEZ,QAAQ,EAER,WAAW,EACX,WAAW,EACX,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,EAKrB,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAEhB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EAEjB,eAAe,EACf,eAAe,EACf,SAAS,EAIT,iBAAiB,EACjB,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,OAAO,EAIP,YAAY,EACZ,QAAQ,EACR,cAAc,EACd,cAAc,EAEd,WAAW,EACX,OAAO,EAEP,WAAW,EACX,cAAc,EACd,QAAQ,EACR,SAAS,EAET,YAAY,EACZ,YAAY,EACZ,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,aAAa,EACb,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAGL,YAAY,EACZ,eAAe,EACf,OAAO,EACP,MAAM,EACN,eAAe,EACf,WAAW,EACX,QAAQ,EAIR,UAAU,EACV,KAAK,EACL,OAAO,EACP,UAAU,EACV,OAAO,EACP,WAAW,EACX,OAAO,EACP,MAAM,EACN,UAAU,EACV,YAAY,EAGZ,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,WAAW,EACX,UAAU,GACX,MAAM,WAAW,CAAC;AACnB,OAAO,EAEL,UAAU,EACV,UAAU,EAEV,gBAAgB,EAChB,SAAS,EACT,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EACL,UAAU,EACV,aAAa,EAGb,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EACL,YAAY,EACZ,cAAc,EACd,YAAY,EAIZ,IAAI,EACJ,eAAe,GAChB,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAoC,MAAM,YAAY,CAAC;AACtF,OAAO,EAEL,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,QAAQ,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EAGL,WAAW,EACX,OAAO,EAEP,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,YAAY,EAEZ,QAAQ,EAER,WAAW,EACX,WAAW,EACX,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,EAKrB,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAEhB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EAEjB,eAAe,EACf,eAAe,EACf,SAAS,EAIT,iBAAiB,EACjB,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,OAAO,EAIP,YAAY,EACZ,QAAQ,EACR,cAAc,EACd,cAAc,EAEd,WAAW,EACX,OAAO,EAEP,WAAW,EACX,cAAc,EACd,QAAQ,EACR,SAAS,EAET,YAAY,EACZ,YAAY,EACZ,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,eAAe,EAIf,gBAAgB,EAChB,KAAK,EACL,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,SAAS,EAGT,IAAI,EACJ,cAAc,EAEd,WAAW,EACX,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAGL,aAAa,EACb,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAGL,YAAY,EACZ,eAAe,EACf,OAAO,EACP,MAAM,EACN,eAAe,EACf,WAAW,EACX,QAAQ,EAIR,UAAU,EACV,KAAK,EACL,OAAO,EACP,UAAU,EACV,OAAO,EACP,WAAW,EACX,OAAO,EACP,MAAM,EACN,UAAU,EACV,YAAY,EAGZ,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,WAAW,EACX,UAAU,GACX,MAAM,WAAW,CAAC;AACnB,OAAO,EAEL,UAAU,EACV,UAAU,EAEV,gBAAgB,EAChB,SAAS,EACT,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EACL,UAAU,EACV,aAAa,EAGb,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EACL,YAAY,EACZ,cAAc,EACd,YAAY,EAIZ,IAAI,EACJ,eAAe,GAChB,MAAM,WAAW,CAAC"}

package/gate/addon.py

@@ -0,0 +1,85 @@
+# credvault key gate: mitmproxy addon. Swaps a sentinel for its real key on the key's hosts only.
+# fd 3 in: the map (JSON, read once). fd 4 out: one JSON line per sentinel seen. Values never go out.
+import json
+import os
+import re
+
+from mitmproxy import http
+
+SENTINEL = re.compile(r"wsk_[a-z2-7]{28}")
+BODY_MAX = 1 << 20
+
+with os.fdopen(3, "r") as f:
+    _MAP = json.load(f)
+PORTS = {int(p): r for p, r in _MAP["ports"].items()}
+KEYS = _MAP["keys"]  # sentinel -> {role, name, value, hosts}
+_events = os.fdopen(4, "w", buffering=1)
+
+
+def _host_ok(host: str, hosts: list) -> bool:
+    for h in hosts:
+        if h == host or (h.startswith("*.") and host.endswith(h[1:])):
+            return True
+    return False
+
+
+def _emit(**e) -> None:
+    try:
+        _events.write(json.dumps(e) + "\n")
+    except (BrokenPipeError, ValueError):
+        pass
+
+
+def _deny(flow: http.HTTPFlow, why: str) -> None:
+    flow.response = http.Response.make(403, f"credvault gate: {why}\n".encode(), {"content-type": "text/plain"})
+
+
+def request(flow: http.HTTPFlow) -> None:
+    req = flow.request
+    role = PORTS.get(flow.client_conn.sockname[1]) if flow.client_conn.sockname else None
+    host = req.pretty_host.lower()
+    path = req.path.split("?", 1)[0]
+
+    found = set()
+    for _, v in req.headers.items(multi=True):
+        found.update(SENTINEL.findall(v))
+    for _, v in req.query.items(multi=True):
+        found.update(SENTINEL.findall(v))
+    body = None
+    if req.raw_content and len(req.raw_content) <= BODY_MAX:
+        try:
+            body = req.get_text(strict=False)
+        except ValueError:
+            body = None
+        if body:
+            found.update(SENTINEL.findall(body))
+    if not found:
+        return
+
+    for s in found:
+        k = KEYS.get(s)
+        why = None
+        if k is None:
+            why = "unknown sentinel"
+        elif k["role"] != role:
+            why = "key not for this role"
+        elif not _host_ok(host, k["hosts"]):
+            why = "key not for this host"
+        if why:
+            _emit(t="deny", name=(k or {}).get("name"), key_role=(k or {}).get("role"), role=role, host=host, path=path, why=why)
+            _deny(flow, why)
+            return
+
+    for s in found:
+        k = KEYS[s]
+        for name, v in list(req.headers.items(multi=True)):
+            if s in v:
+                req.headers.set_all(name, [x.replace(s, k["value"]) for x in req.headers.get_all(name)])
+        for name in list(req.query.keys()):
+            vals = req.query.get_all(name)
+            if any(s in x for x in vals):
+                req.query.set_all(name, [x.replace(s, k["value"]) for x in vals])
+        if body and s in body:
+            body = body.replace(s, k["value"])
+            req.set_text(body)
+        _emit(t="use", name=k["name"], key_role=k["role"], role=role, host=host, path=path)

package/package.json

@@ -1,12 +1,15 @@
 {
   "name": "credvault",
-  "version": "0.14.1",
+  "version": "0.15.0",
   "license": "PolyForm-Strict-1.0.0",
   "packageManager": "pnpm@9.15.0",
   "description": "Keep the credentials an automation signs in with: sealed at rest, shared through SSM, every use audited, expiries watched.",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
+  "bin": {
+    "credvault": "./dist/cli.js"
+  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -15,6 +18,7 @@
   },
   "files": [
     "dist",
+    "gate",
     "README.md",
     "LICENSE.md"
   ],