credvault 0.3.0

package/dist/env-store.js

@@ -0,0 +1,288 @@
+/**
+ * The one place a secret lives across machines: SSM Parameter Store, one
+ * SecureString per name under the app's path (`/myapp/config/NAME`). KMS
+ * at rest, IAM at the door, every read in CloudTrail. Values never enter
+ * argv, logs or errors.
+ */
+import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { DeleteParameterCommand, DescribeParametersCommand, GetParameterCommand, GetParametersByPathCommand, ParameterNotFound, PutParameterCommand, } from "@aws-sdk/client-ssm";
+/** SSM throttles writes at a few a second; a push of thirty keys backs off and goes on rather than dying. */
+async function patient(call, sleep = (ms) => new Promise((r) => setTimeout(r, ms))) {
+    for (let attempt = 0;; attempt++) {
+        try {
+            return await call();
+        }
+        catch (err) {
+            const throttled = err instanceof Error &&
+                (err.name === "ThrottlingException" || /Rate exceeded/i.test(err.message));
+            if (!throttled || attempt >= 8)
+                throw err;
+            await sleep(200 * 2 ** attempt);
+        }
+    }
+}
+export const ENV_KEY = /^[A-Z][A-Z0-9_]*$/;
+/**
+ * Entries that stop working within `withinMs` of `now` (already expired
+ * included), soonest first: what a watcher re-mints.
+ */
+export function expiring(entries, withinMs, now = Date.now()) {
+    return entries
+        .filter((e) => e.expiresAt !== null && Date.parse(e.expiresAt) - now <= withinMs)
+        .sort((a, b) => (a.expiresAt ?? "").localeCompare(b.expiresAt ?? ""));
+}
+/** SSM keeps expiry in the parameter's description, which reads without decrypting. */
+const EXPIRES = "expires ";
+const describe = (o = {}) => o.expiresAt ? `${EXPIRES}${new Date(o.expiresAt).toISOString()}` : "no expiry";
+const expiryOf = (description) => description?.startsWith(EXPIRES) ? description.slice(EXPIRES.length) : null;
+/** SSM under `prefix`: `/prefix/NAME`. The client comes in so tests pass a fake. */
+export function ssmEnvStore(ssm, prefix) {
+    const path = (name) => {
+        if (!ENV_KEY.test(name))
+            throw new Error(`env store: bad name ${name}`);
+        return `${prefix}/${name}`;
+    };
+    const nameOf = (p) => p?.slice(prefix.length + 1) ?? "";
+    const byName = (rows) => rows.sort((a, b) => a.name.localeCompare(b.name));
+    return {
+        async list() {
+            const out = [];
+            let next;
+            do {
+                const r = await patient(() => ssm.send(new DescribeParametersCommand({
+                    ParameterFilters: [{ Key: "Path", Option: "OneLevel", Values: [prefix] }],
+                    NextToken: next,
+                })));
+                for (const p of r.Parameters ?? [])
+                    out.push({
+                        name: nameOf(p.Name),
+                        updatedAt: p.LastModifiedDate?.toISOString() ?? null,
+                        expiresAt: expiryOf(p.Description),
+                    });
+                next = r.NextToken;
+            } while (next);
+            return byName(out);
+        },
+        async all() {
+            const out = [];
+            let next;
+            do {
+                const r = await patient(() => ssm.send(new GetParametersByPathCommand({
+                    Path: prefix,
+                    Recursive: false,
+                    WithDecryption: true,
+                    NextToken: next,
+                })));
+                for (const p of r.Parameters ?? [])
+                    out.push({ name: nameOf(p.Name), value: p.Value ?? "" });
+                next = r.NextToken;
+            } while (next);
+            return byName(out);
+        },
+        async get(name) {
+            try {
+                const r = await ssm.send(new GetParameterCommand({ Name: path(name), WithDecryption: true }));
+                return r.Parameter?.Value ?? null;
+            }
+            catch (err) {
+                if (err instanceof ParameterNotFound)
+                    return null;
+                throw err;
+            }
+        },
+        async put(name, value, o) {
+            if (!value)
+                throw new Error(`env store: ${name} is empty`);
+            await patient(() => ssm.send(new PutParameterCommand({
+                Name: path(name),
+                Value: value,
+                // Always said, so a re-mint without an expiry clears the old one.
+                Description: describe(o),
+                Type: "SecureString",
+                // Past 4 KB (a service-account JSON) SSM needs the advanced tier; this picks it only then.
+                Tier: "Intelligent-Tiering",
+                Overwrite: true,
+            })));
+        },
+        async remove(name) {
+            try {
+                await ssm.send(new DeleteParameterCommand({ Name: path(name) }));
+                return true;
+            }
+            catch (err) {
+                if (err instanceof ParameterNotFound)
+                    return false;
+                throw err;
+            }
+        },
+    };
+}
+export function memoryEnvStore(initial = {}) {
+    const values = { ...initial };
+    const expires = new Map();
+    return {
+        values,
+        list: async () => Object.keys(values)
+            .sort()
+            .map((name) => ({ name, updatedAt: null, expiresAt: expiryOf(expires.get(name)) })),
+        all: async () => Object.entries(values)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([name, value]) => ({ name, value })),
+        get: async (name) => values[name] ?? null,
+        async put(name, value, o) {
+            if (!ENV_KEY.test(name))
+                throw new Error(`env store: bad name ${name}`);
+            values[name] = value;
+            expires.set(name, describe(o));
+        },
+        async remove(name) {
+            const had = name in values;
+            delete values[name];
+            expires.delete(name);
+            return had;
+        },
+    };
+}
+/** The comment above a line that says when its value stops working: `# NAME expires <ISO>`. */
+const EXPIRY_LINE = /^# ([A-Z][A-Z0-9_]*) expires (\S+)$/;
+/**
+ * A local `.env` as a store: 0600, one line per name, other lines untouched.
+ * Expiry is a comment directly above the line, so a person reading the file
+ * sees it too. A put also sets `env[name]`, so this process sees the value.
+ */
+export function envFileStore(path, env = process.env) {
+    const file = path.startsWith("~/") ? `${homedir()}${path.slice(1)}` : path;
+    const text = () => (existsSync(file) ? readFileSync(file, "utf8") : "");
+    const lines = () => {
+        const out = text().split("\n");
+        if (out.at(-1) === "")
+            out.pop();
+        return out;
+    };
+    const write = (out) => {
+        const tmp = `${file}.tmp`;
+        writeFileSync(tmp, out.length ? `${out.join("\n")}\n` : "", { mode: 0o600 });
+        renameSync(tmp, file);
+    };
+    /** The file without `name`'s line and expiry comment; where the line was, or -1. */
+    const without = (name) => {
+        const out = [];
+        let at = -1;
+        for (const l of lines()) {
+            if (EXPIRY_LINE.exec(l)?.[1] === name)
+                continue;
+            if (l.startsWith(`${name}=`)) {
+                at = out.length;
+                continue;
+            }
+            out.push(l);
+        }
+        return { out, at };
+    };
+    return {
+        async list() {
+            const expires = new Map();
+            for (const l of lines()) {
+                const m = EXPIRY_LINE.exec(l);
+                if (m?.[1] && m[2])
+                    expires.set(m[1], m[2]);
+            }
+            return parseDotenv(text()).map(({ name }) => ({
+                name,
+                updatedAt: null,
+                expiresAt: expires.get(name) ?? null,
+            }));
+        },
+        all: async () => parseDotenv(text()),
+        get: async (name) => parseDotenv(text()).find((e) => e.name === name)?.value ?? null,
+        async put(name, value, o) {
+            if (!ENV_KEY.test(name))
+                throw new Error(`env file: bad name ${name}`);
+            if (/[\r\n]/.test(value))
+                throw new Error(`env file: ${name} spans lines`);
+            const { out, at } = without(name);
+            const add = [...(o?.expiresAt ? [`# ${name} ${describe(o)}`] : []), `${name}=${value}`];
+            out.splice(at < 0 ? out.length : at, 0, ...add);
+            write(out);
+            env[name] = value;
+        },
+        async remove(name) {
+            const { out, at } = without(name);
+            if (at < 0)
+                return false;
+            write(out);
+            delete env[name];
+            return true;
+        },
+    };
+}
+/**
+ * `KEY=VALUE` lines → entries. Comments, blanks and quotes as a shell would
+ * read them; a value naming a readable file whose content is JSON (a
+ * service account) is inlined so the store holds the secret, not a path.
+ */
+export function parseDotenv(text, readFile) {
+    const out = [];
+    for (const raw of text.split("\n")) {
+        const line = raw.trim();
+        if (!line || line.startsWith("#") || !line.includes("="))
+            continue;
+        const i = line.indexOf("=");
+        const name = line
+            .slice(0, i)
+            .trim()
+            .replace(/^export\s+/, "");
+        let value = line.slice(i + 1).trim();
+        const q = value[0];
+        if (q === '"' || q === "'") {
+            const end = value.indexOf(q, 1);
+            value = end > 0 ? value.slice(1, end) : value.slice(1);
+        }
+        else
+            value = value.replace(/\s+#.*$/, "");
+        if (!ENV_KEY.test(name) || !value)
+            continue;
+        if (readFile && !value.trimStart().startsWith("{") && /\.json$/.test(value)) {
+            const inlined = readFile(value);
+            if (inlined?.trimStart().startsWith("{"))
+                value = inlined;
+        }
+        out.push({ name, value });
+    }
+    return out;
+}
+/** Entries → `KEY=VALUE` lines. A multi-line value cannot live in one line: `files` takes it and the line names the path. */
+export function toDotenv(entries, files) {
+    return `${entries
+        .map(({ name, value }) => {
+        if (!/[\r\n]/.test(value))
+            return `${name}=${value}`;
+        if (!files)
+            throw new Error(`${name} spans lines; give it a file`);
+        return `${name}=${files(name, value)}`;
+    })
+        .join("\n")}\n`;
+}
+/** Entries → `export KEY='…'` lines for `eval "$(…)"`; single quotes are the one thing escaped. */
+export function toExports(entries) {
+    return `${entries
+        .map(({ name, value }) => `export ${name}='${value.replace(/'/g, `'\\''`)}'`)
+        .join("\n")}\n`;
+}
+/** Upsert `entries` into an env file's text; other lines untouched. */
+export function upsertDotenv(text, entries) {
+    const lines = text.split("\n");
+    if (lines.at(-1) === "")
+        lines.pop();
+    for (const { name, value } of entries) {
+        const line = `${name}=${value}`;
+        const i = lines.findIndex((l) => l.startsWith(`${name}=`));
+        if (i >= 0)
+            lines[i] = line;
+        else
+            lines.push(line);
+    }
+    return `${lines.join("\n")}\n`;
+}
+//# sourceMappingURL=env-store.js.map

package/dist/env-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-store.js","sourceRoot":"","sources":["../src/env-store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,mBAAmB,EACnB,0BAA0B,EAC1B,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,qBAAqB,CAAC;AAE7B,6GAA6G;AAC7G,KAAK,UAAU,OAAO,CACpB,IAAsB,EACtB,QAAQ,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAE7D,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,SAAS,GACb,GAAG,YAAY,KAAK;gBACpB,CAAC,GAAG,CAAC,IAAI,KAAK,qBAAqB,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YAC7E,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI,CAAC;gBAAE,MAAM,GAAG,CAAC;YAC1C,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,OAAO,GAAG,mBAAmB,CAAC;AA+B3C;;;GAGG;AACH,MAAM,UAAU,QAAQ,CACtB,OAA8B,EAC9B,QAAgB,EAChB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,OAAO,OAAO;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,GAAG,IAAI,QAAQ,CAAC;SAChF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,uFAAuF;AACvF,MAAM,OAAO,GAAG,UAAU,CAAC;AAC3B,MAAM,QAAQ,GAAG,CAAC,IAAgB,EAAE,EAAE,EAAE,CACtC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;AACjF,MAAM,QAAQ,GAAG,CAAC,WAA+B,EAAiB,EAAE,CAClE,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAE9E,oFAAoF;AACpF,MAAM,UAAU,WAAW,CAAC,GAAc,EAAE,MAAc;IACxD,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE;QAC5B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;QACxE,OAAO,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;IAC7B,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAG,CAA6B,IAAS,EAAE,EAAE,CACvD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,OAAO;QACL,KAAK,CAAC,IAAI;YACR,MAAM,GAAG,GAAiB,EAAE,CAAC;YAC7B,IAAI,IAAwB,CAAC;YAC7B,GAAG,CAAC;gBACF,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAC3B,GAAG,CAAC,IAAI,CACN,IAAI,yBAAyB,CAAC;oBAC5B,gBAAgB,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;oBACzE,SAAS,EAAE,IAAI;iBAChB,CAAC,CACH,CACF,CAAC;gBACF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE;oBAChC,GAAG,CAAC,IAAI,CAAC;wBACP,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;wBACpB,SAAS,EAAE,CAAC,CAAC,gBAAgB,EAAE,WAAW,EAAE,IAAI,IAAI;wBACpD,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;qBACnC,CAAC,CAAC;gBACL,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC;YACrB,CAAC,QAAQ,IAAI,EAAE;YACf,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QACD,KAAK,CAAC,GAAG;YACP,MAAM,GAAG,GAAe,EAAE,CAAC;YAC3B,IAAI,IAAwB,CAAC;YAC7B,GAAG,CAAC;gBACF,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAC3B,GAAG,CAAC,IAAI,CACN,IAAI,0BAA0B,CAAC;oBAC7B,IAAI,EAAE,MAAM;oBACZ,SAAS,EAAE,KAAK;oBAChB,cAAc,EAAE,IAAI;oBACpB,SAAS,EAAE,IAAI;iBAChB,CAAC,CACH,CACF,CAAC;gBACF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE;oBAChC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC3D,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC;YACrB,CAAC,QAAQ,IAAI,EAAE;YACf,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI;YACZ,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CACtB,IAAI,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CACpE,CAAC;gBACF,OAAO,CAAC,CAAC,SAAS,EAAE,KAAK,IAAI,IAAI,CAAC;YACpC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,iBAAiB;oBAAE,OAAO,IAAI,CAAC;gBAClD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,WAAW,CAAC,CAAC;YAC3D,MAAM,OAAO,CAAC,GAAG,EAAE,CACjB,GAAG,CAAC,IAAI,CACN,IAAI,mBAAmB,CAAC;gBACtB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;gBAChB,KAAK,EAAE,KAAK;gBACZ,kEAAkE;gBAClE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACxB,IAAI,EAAE,cAAc;gBACpB,2FAA2F;gBAC3F,IAAI,EAAE,qBAAqB;gBAC3B,SAAS,EAAE,IAAI;aAChB,CAAC,CACH,CACF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,IAAI;YACf,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBACjE,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,iBAAiB;oBAAE,OAAO,KAAK,CAAC;gBACnD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,UAAkC,EAAE;IAGjE,MAAM,MAAM,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,OAAO;QACL,MAAM;QACN,IAAI,EAAE,KAAK,IAAI,EAAE,CACf,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;aAChB,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;QACvF,GAAG,EAAE,KAAK,IAAI,EAAE,CACd,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;aACnB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI;QACzC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;YACxE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,IAAI;YACf,MAAM,GAAG,GAAG,IAAI,IAAI,MAAM,CAAC;YAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;YACpB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrB,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,MAAM,WAAW,GAAG,qCAAqC,CAAC;AAE1D;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,MAAM,GAAG,GAAG,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,GAAG,CAAC,GAAG,EAAE,CAAC;QACjC,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,GAAa,EAAE,EAAE;QAC9B,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;QAC1B,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC,CAAC;IACF,oFAAoF;IACpF,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QACZ,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;YACxB,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,SAAS;YAChD,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC7B,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IACrB,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,IAAI;YACR,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;YAC1C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;gBACxB,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC9B,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,CAAC;YACD,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC5C,IAAI;gBACJ,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI;aACrC,CAAC,CAAC,CAAC;QACN,CAAC;QACD,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QACpC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI;QACpF,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;YACvE,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,cAAc,CAAC,CAAC;YAC3E,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;YACxF,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC;YAChD,KAAK,CAAC,GAAG,CAAC,CAAC;YACX,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACpB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,IAAI;YACf,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,EAAE,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YACzB,KAAK,CAAC,GAAG,CAAC,CAAC;YACX,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,QAA0C;IAClF,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QACnE,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI;aACd,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACX,IAAI,EAAE;aACN,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC7B,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAChC,KAAK,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzD,CAAC;;YAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,SAAS;QAC5C,IAAI,QAAQ,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5E,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,KAAK,GAAG,OAAO,CAAC;QAC5D,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6HAA6H;AAC7H,MAAM,UAAU,QAAQ,CACtB,OAAmB,EACnB,KAA+C;IAE/C,OAAO,GAAG,OAAO;SACd,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;QACrD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,8BAA8B,CAAC,CAAC;QACnE,OAAO,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;IACzC,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,SAAS,CAAC,OAAmB;IAC3C,OAAO,GAAG,OAAO;SACd,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,UAAU,IAAI,KAAK,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;SAC5E,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAmB;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IACrC,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;;YACvB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+export { fileAudit, memoryAudit, type SecretAudit, type SecretUse } from "./audit.js";
+export { type CanaryOptions, CanaryTripped, canaryCredential, canaryStore, isCanary, } from "./canary.js";
+export { type Chained, type ChainedFile, chainedFile, rowHash, type Verification, verifyChain, } from "./chain.js";
+export { aesGcmCipher, type Cipher, isSealed, type KeychainItem, keychainKey, plainCipher, trustKeychainKey, } from "./cipher.js";
+export { CREDENTIAL_ENV_FIELDS, type Credential, type CredentialEnvStore, type CredentialInput, type CredentialStore, credentialEnv, credentialEnvName, credentialSchema, type EnvNaming, envCredentials, fileCredentials, layeredCredentials, memoryCredentials, mirroredCredentials, pullCredentials, pushCredentials, } from "./credentials.js";
+export { ENV_KEY, type EnvEntry, type EnvListing, type EnvStore, envFileStore, expiring, memoryEnvStore, type PutOptions, parseDotenv, ssmEnvStore, toDotenv, toExports, upsertDotenv, } from "./env-store.js";
+export { newPassword } from "./passwords.js";
+export { envSecrets, memorySecrets, type SecretSource, type TrackingSecrets, trackingSecrets, } from "./secrets.js";
+export { tailJson, tailLines } from "./tail.js";
+export { base32Decode, findTotpSecret, parseOtpauth, type TotpAlgorithm, type TotpOptions, type TotpParams, totp, totpRemainingMs, } from "./totp.js";

package/dist/index.js

@@ -0,0 +1,11 @@
+export { fileAudit, memoryAudit } from "./audit.js";
+export { CanaryTripped, canaryCredential, canaryStore, isCanary, } from "./canary.js";
+export { chainedFile, rowHash, verifyChain, } from "./chain.js";
+export { aesGcmCipher, isSealed, keychainKey, plainCipher, trustKeychainKey, } from "./cipher.js";
+export { CREDENTIAL_ENV_FIELDS, credentialEnv, credentialEnvName, credentialSchema, envCredentials, fileCredentials, layeredCredentials, memoryCredentials, mirroredCredentials, pullCredentials, pushCredentials, } from "./credentials.js";
+export { ENV_KEY, envFileStore, expiring, memoryEnvStore, parseDotenv, ssmEnvStore, toDotenv, toExports, upsertDotenv, } from "./env-store.js";
+export { newPassword } from "./passwords.js";
+export { envSecrets, memorySecrets, trackingSecrets, } from "./secrets.js";
+export { tailJson, tailLines } from "./tail.js";
+export { base32Decode, findTotpSecret, parseOtpauth, totp, totpRemainingMs, } from "./totp.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAoC,MAAM,YAAY,CAAC;AACtF,OAAO,EAEL,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,QAAQ,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EAGL,WAAW,EACX,OAAO,EAEP,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,YAAY,EAEZ,QAAQ,EAER,WAAW,EACX,WAAW,EACX,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,EAKrB,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAEhB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,OAAO,EAIP,YAAY,EACZ,QAAQ,EACR,cAAc,EAEd,WAAW,EACX,WAAW,EACX,QAAQ,EACR,SAAS,EACT,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EACL,UAAU,EACV,aAAa,EAGb,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EACL,YAAY,EACZ,cAAc,EACd,YAAY,EAIZ,IAAI,EACJ,eAAe,GAChB,MAAM,WAAW,CAAC"}

package/dist/passwords.d.ts

@@ -0,0 +1,2 @@
+/** A password no site refuses: 24 chars, at least one of each class, no look-alikes (l/1/O/0). */
+export declare function newPassword(length?: number, pick?: (n: number) => number): string;

package/dist/passwords.js

@@ -0,0 +1,19 @@
+/** Passwords drawn here: nobody picks them, nobody sees them. */
+import { randomInt } from "node:crypto";
+const LOWER = "abcdefghijkmnopqrstuvwxyz";
+const UPPER = "ABCDEFGHJKLMNPQRSTUVWXYZ";
+const DIGIT = "23456789";
+const SYMBOL = "!@#$%^&*-_=+";
+const ALL = LOWER + UPPER + DIGIT + SYMBOL;
+/** A password no site refuses: 24 chars, at least one of each class, no look-alikes (l/1/O/0). */
+export function newPassword(length = 24, pick = randomInt) {
+    const chars = [LOWER, UPPER, DIGIT, SYMBOL].map((set) => set[pick(set.length)] ?? "a");
+    while (chars.length < length)
+        chars.push(ALL[pick(ALL.length)] ?? "a");
+    for (let i = chars.length - 1; i > 0; i--) {
+        const j = pick(i + 1);
+        [chars[i], chars[j]] = [chars[j], chars[i]];
+    }
+    return chars.join("");
+}
+//# sourceMappingURL=passwords.js.map

package/dist/passwords.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwords.js","sourceRoot":"","sources":["../src/passwords.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,KAAK,GAAG,2BAA2B,CAAC;AAC1C,MAAM,KAAK,GAAG,0BAA0B,CAAC;AACzC,MAAM,KAAK,GAAG,UAAU,CAAC;AACzB,MAAM,MAAM,GAAG,cAAc,CAAC;AAC9B,MAAM,GAAG,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;AAE3C,kGAAkG;AAClG,MAAM,UAAU,WAAW,CAAC,MAAM,GAAG,EAAE,EAAE,OAA8B,SAAS;IAC9E,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IACvF,OAAO,KAAK,CAAC,MAAM,GAAG,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IACvE,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAW,EAAE,KAAK,CAAC,CAAC,CAAW,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxB,CAAC"}

package/dist/secrets.d.ts

@@ -0,0 +1,17 @@
+/**
+ * One named value, asked for by key at the moment it is needed (a card
+ * number, an API key), never carried on a plan or in a log. Env is the
+ * default source; the shared store (env-store.ts) is another.
+ */
+export interface SecretSource {
+    get(key: string): Promise<string>;
+}
+/** A key in camelCase (`cardCvv`) → `SECRET_CARD_CVV` in the environment, under the app's prefix. */
+export declare function envSecrets(env?: NodeJS.ProcessEnv, prefix?: string): SecretSource;
+export declare function memorySecrets(values: Record<string, string>): SecretSource;
+/** A secret source that remembers what it handed out, so a caller can tell a secret's value from any other. */
+export interface TrackingSecrets extends SecretSource {
+    /** The key a value was handed out under, or null. */
+    keyOf(value: string): string | null;
+}
+export declare function trackingSecrets(source: SecretSource): TrackingSecrets;

package/dist/secrets.js

@@ -0,0 +1,37 @@
+/** A key in camelCase (`cardCvv`) → `SECRET_CARD_CVV` in the environment, under the app's prefix. */
+export function envSecrets(env = process.env, prefix = "SECRET_") {
+    return {
+        async get(key) {
+            const name = `${prefix}${key
+                .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+                .replace(/[^a-zA-Z0-9]+/g, "_")
+                .toUpperCase()}`;
+            const value = env[name];
+            if (!value)
+                throw new Error(`secret ${key}: set ${name}`);
+            return value;
+        },
+    };
+}
+export function memorySecrets(values) {
+    return {
+        async get(key) {
+            const v = values[key];
+            if (v === undefined)
+                throw new Error(`secret ${key}: not set`);
+            return v;
+        },
+    };
+}
+export function trackingSecrets(source) {
+    const keys = new Map();
+    return {
+        async get(key) {
+            const value = await source.get(key);
+            keys.set(value, key);
+            return value;
+        },
+        keyOf: (value) => keys.get(value) ?? null,
+    };
+}
+//# sourceMappingURL=secrets.js.map

package/dist/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AASA,qGAAqG;AACrG,MAAM,UAAU,UAAU,CAAC,MAAyB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS;IACjF,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,MAAM,IAAI,GAAG,GAAG,MAAM,GAAG,GAAG;iBACzB,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;iBACtC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;iBAC9B,WAAW,EAAE,EAAE,CAAC;YACnB,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;YACxB,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,SAAS,IAAI,EAAE,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAA8B;IAC1D,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,IAAI,CAAC,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,WAAW,CAAC,CAAC;YAC/D,OAAO,CAAC,CAAC;QACX,CAAC;KACF,CAAC;AACJ,CAAC;AAQD,MAAM,UAAU,eAAe,CAAC,MAAoB;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACrB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI;KAC1C,CAAC;AACJ,CAAC"}

package/dist/tail.d.ts

@@ -0,0 +1,4 @@
+/** The last `n` non-empty lines of `path`, oldest first; [] for a missing file. */
+export declare function tailLines(path: string, n: number): Promise<string[]>;
+/** Each of the last `n` lines parsed as JSON; a torn line is skipped. */
+export declare function tailJson<T>(path: string, n: number): Promise<T[]>;

package/dist/tail.js

@@ -0,0 +1,56 @@
+/**
+ * The last lines of an append-only file, read from its end in blocks: a
+ * ledger that grows for months costs the same to consult as a fresh one.
+ */
+import { open } from "node:fs/promises";
+const BLOCK = 64 * 1024;
+/** The last `n` non-empty lines of `path`, oldest first; [] for a missing file. */
+export async function tailLines(path, n) {
+    if (n <= 0)
+        return [];
+    let fh;
+    try {
+        fh = await open(path, "r");
+    }
+    catch {
+        return [];
+    }
+    try {
+        const { size } = await fh.stat();
+        const chunks = [];
+        let pos = size;
+        let newlines = 0;
+        // Stop once the read-back text holds n+1 line breaks: the first partial line is then cut whole.
+        while (pos > 0 && newlines <= n) {
+            const len = Math.min(BLOCK, pos);
+            pos -= len;
+            const buf = Buffer.alloc(len);
+            await fh.read(buf, 0, len, pos);
+            chunks.unshift(buf);
+            for (let i = 0; i < len; i++)
+                if (buf[i] === 10)
+                    newlines++;
+        }
+        // With n+1 line breaks in hand the last n lines are whole; the window's first line may be a
+        // fragment and is the one `slice(-n)` leaves behind.
+        const lines = Buffer.concat(chunks).toString("utf8").split("\n").filter(Boolean);
+        return lines.slice(-n);
+    }
+    finally {
+        await fh.close();
+    }
+}
+/** Each of the last `n` lines parsed as JSON; a torn line is skipped. */
+export async function tailJson(path, n) {
+    const out = [];
+    for (const l of await tailLines(path, n)) {
+        try {
+            out.push(JSON.parse(l));
+        }
+        catch {
+            // a line still being written, or a fragment at the window's start
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=tail.js.map

package/dist/tail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tail.js","sourceRoot":"","sources":["../src/tail.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAExC,MAAM,KAAK,GAAG,EAAE,GAAG,IAAI,CAAC;AAExB,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,CAAS;IACrD,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACtB,IAAI,EAAoC,CAAC;IACzC,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,GAAG,GAAG,IAAI,CAAC;QACf,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,gGAAgG;QAChG,OAAO,GAAG,GAAG,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACjC,GAAG,IAAI,GAAG,CAAC;YACX,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAChC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE;gBAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;oBAAE,QAAQ,EAAE,CAAC;QAC9D,CAAC;QACD,4FAA4F;QAC5F,qDAAqD;QACrD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjF,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAI,IAAY,EAAE,CAAS;IACvD,MAAM,GAAG,GAAQ,EAAE,CAAC;IACpB,KAAK,MAAM,CAAC,IAAI,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAM,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/totp.d.ts

@@ -0,0 +1,24 @@
+export declare function base32Decode(text: string): Buffer;
+export type TotpAlgorithm = "sha1" | "sha256" | "sha512";
+export interface TotpOptions {
+    /** Unix ms; defaults to now. */
+    at?: number;
+    period?: number;
+    digits?: number;
+    algorithm?: TotpAlgorithm;
+}
+/** The code for `secret` (base32) at `at`. */
+export declare function totp(secret: string, opts?: TotpOptions): string;
+/** Milliseconds until the current code rolls over; wait it out when a site rejects a code that is about to expire. */
+export declare function totpRemainingMs(at?: number, period?: number): number;
+export interface TotpParams {
+    secret: string;
+    issuer: string | null;
+    account: string | null;
+    digits: number;
+    period: number;
+    algorithm: TotpAlgorithm;
+}
+export declare function parseOtpauth(uri: string): TotpParams;
+/** The seed in page text or HTML: a URI wins, then a manual-entry key. Null when neither is there. */
+export declare function findTotpSecret(text: string): string | null;

package/dist/totp.js

@@ -0,0 +1,111 @@
+/**
+ * TOTP (RFC 6238) with node:crypto, no dependency: the codes an
+ * authenticator app would show, so a login's second factor is ours to
+ * type. `findTotpSecret` pulls the seed out of an enrollment page (the
+ * otpauth:// link behind the QR, or the "enter this key manually" text).
+ */
+import { createHmac } from "node:crypto";
+const ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+export function base32Decode(text) {
+    const clean = text.toUpperCase().replace(/[\s=-]/g, "");
+    let bits = 0;
+    let value = 0;
+    const out = [];
+    for (const ch of clean) {
+        const idx = ALPHABET.indexOf(ch);
+        if (idx < 0)
+            throw new Error(`base32: bad character ${JSON.stringify(ch)}`);
+        value = (value << 5) | idx;
+        bits += 5;
+        if (bits >= 8) {
+            out.push((value >>> (bits - 8)) & 0xff);
+            bits -= 8;
+        }
+    }
+    return Buffer.from(out);
+}
+/** The code for `secret` (base32) at `at`. */
+export function totp(secret, opts = {}) {
+    const period = opts.period ?? 30;
+    const digits = opts.digits ?? 6;
+    const counter = Math.floor((opts.at ?? Date.now()) / 1000 / period);
+    const msg = Buffer.alloc(8);
+    msg.writeBigUInt64BE(BigInt(counter));
+    const mac = createHmac(opts.algorithm ?? "sha1", base32Decode(secret))
+        .update(msg)
+        .digest();
+    const offset = (mac[mac.length - 1] ?? 0) & 0x0f;
+    const code = (mac.readUInt32BE(offset) & 0x7fffffff) % 10 ** digits;
+    return String(code).padStart(digits, "0");
+}
+/** Milliseconds until the current code rolls over; wait it out when a site rejects a code that is about to expire. */
+export function totpRemainingMs(at = Date.now(), period = 30) {
+    const step = period * 1000;
+    return step - (at % step);
+}
+export function parseOtpauth(uri) {
+    const u = new URL(uri);
+    if (u.protocol !== "otpauth:" || u.host !== "totp")
+        throw new Error("not an otpauth://totp URI");
+    const secret = u.searchParams.get("secret");
+    if (!secret)
+        throw new Error("otpauth URI has no secret");
+    const label = decodeURIComponent(u.pathname.replace(/^\/+/, ""));
+    const [labelIssuer, account] = label.includes(":") ? label.split(":", 2) : [null, label];
+    const algo = (u.searchParams.get("algorithm") ?? "SHA1").toLowerCase();
+    return {
+        secret: secret.replace(/[\s=-]/g, "").toUpperCase(),
+        issuer: u.searchParams.get("issuer") ?? labelIssuer,
+        account: account || null,
+        digits: Number(u.searchParams.get("digits") ?? 6),
+        period: Number(u.searchParams.get("period") ?? 30),
+        algorithm: algo === "sha256" || algo === "sha512" ? algo : "sha1",
+    };
+}
+const OTPAUTH = /otpauth:\/\/totp\/[^\s"'<>]+/i;
+/**
+ * 16+ base32 characters in one case, optionally in spaced or dashed groups
+ * of 4. One case because a page prints its key in one case, and the words
+ * around it ("Make sure Time based") are mixed: they must not join the run.
+ */
+const MANUAL_KEYS = [
+    /\b(?:[a-z2-7]{4}[\s-]?){4,}[a-z2-7]*\b/g,
+    /\b(?:[A-Z2-7]{4}[\s-]?){4,}[A-Z2-7]*\b/g,
+];
+/**
+ * Seed lengths sites hand out, most common first (Google/Cloudflare 32,
+ * GitHub/Microsoft 16, AWS 64). A run is cut to the first of these some
+ * prefix of its groups adds up to, so a 4-letter word after the key
+ * ("then") does not join it. A wrong cut fails the confirm step, nothing worse.
+ */
+const SEED_LENGTHS = [32, 16, 64, 26, 52, 20, 24, 40];
+function manualKey(text) {
+    for (const re of MANUAL_KEYS)
+        for (const m of text.matchAll(re)) {
+            const tokens = m[0].trim().split(/[\s-]+/);
+            const prefixes = tokens.map((_, i) => tokens.slice(0, i + 1).join(""));
+            for (const len of SEED_LENGTHS) {
+                const key = prefixes.find((p) => p.length === len);
+                if (key)
+                    return key.toUpperCase();
+            }
+            const whole = tokens.join("");
+            if (whole.length >= 16 && whole.length % 2 === 0)
+                return whole.toUpperCase();
+        }
+    return null;
+}
+/** The seed in page text or HTML: a URI wins, then a manual-entry key. Null when neither is there. */
+export function findTotpSecret(text) {
+    const uri = text.match(OTPAUTH);
+    if (uri) {
+        try {
+            return parseOtpauth(uri[0].replace(/&amp;/g, "&")).secret;
+        }
+        catch {
+            // fall through to a manual key
+        }
+    }
+    return manualKey(text);
+}
+//# sourceMappingURL=totp.js.map

package/dist/totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.js","sourceRoot":"","sources":["../src/totp.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,QAAQ,GAAG,kCAAkC,CAAC;AAEpD,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,GAAG,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5E,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC;QAC3B,IAAI,IAAI,CAAC,CAAC;QACV,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACxC,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAYD,8CAA8C;AAC9C,MAAM,UAAU,IAAI,CAAC,MAAc,EAAE,OAAoB,EAAE;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5B,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;SACnE,MAAM,CAAC,GAAG,CAAC;SACX,MAAM,EAAE,CAAC;IACZ,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IACjD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC;IACpE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,eAAe,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE;IAC1D,MAAM,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,IAAI,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;AAC5B,CAAC;AAWD,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IACjE,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IACvE,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE;QACnD,MAAM,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,WAAW;QACnD,OAAO,EAAE,OAAO,IAAI,IAAI;QACxB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClD,SAAS,EAAE,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;KAClE,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,GAAG,+BAA+B,CAAC;AAChD;;;;GAIG;AACH,MAAM,WAAW,GAAG;IAClB,yCAAyC;IACzC,yCAAyC;CAC1C,CAAC;AACF;;;;;GAKG;AACH,MAAM,YAAY,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;AAEtD,SAAS,SAAS,CAAC,IAAY;IAC7B,KAAK,MAAM,EAAE,IAAI,WAAW;QAC1B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACvE,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;gBAC/B,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;gBACnD,IAAI,GAAG;oBAAE,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;YACpC,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;QAC/E,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC"}