crewly 1.5.22 → 1.6.0

package/dist/backend/backend/src/utils/encryption.utils.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Credential Encryption Utilities
+ *
+ * AES-256-GCM encryption with scrypt-derived keys for credential payloads.
+ * Uses a per-install master.key file (mode 0600) as the base key material.
+ *
+ * File format:
+ *   [1 byte: version=1] [12 bytes: IV] [16 bytes: auth tag] [N bytes: ciphertext]
+ *
+ * Threat model:
+ * - Primary defense: file exfiltration via backup / cloud sync / screen capture
+ * - NOT a defense against a compromised local user account or malicious code
+ *   running as the user (both can read master.key and derive the same key)
+ *
+ * @module utils/encryption.utils
+ */
+/**
+ * Clear the derived-key cache. Primarily for tests — production code should
+ * not need this as master.key is assumed stable for the process lifetime.
+ */
+export declare function _resetDerivedKeyCache(): void;
+/**
+ * Ensure a master.key file exists at the given path. If absent, generate
+ * a cryptographically random 32-byte key and write it with mode 0600.
+ *
+ * Idempotent: if the file already exists, does nothing.
+ *
+ * @param masterKeyPath - Absolute path to the master.key file
+ */
+export declare function ensureMasterKey(masterKeyPath: string): Promise<void>;
+/**
+ * Encrypt a UTF-8 string using AES-256-GCM.
+ *
+ * @param plaintext - The string to encrypt (caller typically JSON-serializes first)
+ * @param masterKeyPath - Absolute path to the master.key file
+ * @returns Buffer in the format `[version][iv][tag][ciphertext]`
+ */
+export declare function encrypt(plaintext: string, masterKeyPath: string): Promise<Buffer>;
+/**
+ * Decrypt a buffer produced by `encrypt()`.
+ *
+ * @param encrypted - Buffer in the `[version][iv][tag][ciphertext]` format
+ * @param masterKeyPath - Absolute path to the master.key file
+ * @returns The decrypted UTF-8 string
+ * @throws Error if the buffer is malformed, the version is unsupported,
+ *         or the auth tag does not match (tampering or wrong key)
+ */
+export declare function decrypt(encrypted: Buffer, masterKeyPath: string): Promise<string>;
+/**
+ * Default credentials directory: `~/.crewly/credentials/`.
+ */
+export declare function defaultCredentialsDir(): string;
+/**
+ * Default master.key path: `~/.crewly/credentials/master.key`.
+ */
+export declare function defaultMasterKeyPath(): string;
+//# sourceMappingURL=encryption.utils.d.ts.map

package/dist/backend/backend/src/utils/encryption.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.utils.d.ts","sourceRoot":"","sources":["../../../../../backend/src/utils/encryption.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAmEH;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAU1E;AAED;;;;;;GAMG;AACH,wBAAsB,OAAO,CAC3B,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,OAAO,CAC3B,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CA0BjB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}

package/dist/backend/backend/src/utils/encryption.utils.js

@@ -0,0 +1,162 @@
+/**
+ * Credential Encryption Utilities
+ *
+ * AES-256-GCM encryption with scrypt-derived keys for credential payloads.
+ * Uses a per-install master.key file (mode 0600) as the base key material.
+ *
+ * File format:
+ *   [1 byte: version=1] [12 bytes: IV] [16 bytes: auth tag] [N bytes: ciphertext]
+ *
+ * Threat model:
+ * - Primary defense: file exfiltration via backup / cloud sync / screen capture
+ * - NOT a defense against a compromised local user account or malicious code
+ *   running as the user (both can read master.key and derive the same key)
+ *
+ * @module utils/encryption.utils
+ */
+import { promises as fs } from 'fs';
+import path from 'path';
+import os from 'os';
+import crypto from 'crypto';
+/** File-format version byte — bump if layout changes. */
+const FORMAT_VERSION = 1;
+/** AES-256-GCM uses 12-byte (96-bit) IVs per NIST recommendation. */
+const IV_LENGTH = 12;
+/** AES-GCM produces 16-byte (128-bit) auth tags. */
+const AUTH_TAG_LENGTH = 16;
+/** AES-256 key size. */
+const KEY_LENGTH = 32;
+/** scrypt N (iteration count). 2^15 = 32768. */
+const SCRYPT_N = 32768;
+const SCRYPT_R = 8;
+const SCRYPT_P = 1;
+/**
+ * scrypt memory cap. Default in Node is 32MB which is right at the edge for
+ * our parameters; give explicit headroom so derivation never fails.
+ */
+const SCRYPT_MAX_MEM = 128 * 1024 * 1024;
+/** Fixed salt — changing invalidates all previously encrypted credentials. */
+const SCRYPT_SALT = Buffer.from('crewly-credentials-v1', 'utf8');
+/**
+ * Module-level cache of derived keys, keyed by master.key path. scrypt is
+ * intentionally expensive (~100ms per call), so we run it once per master
+ * key path per process. Concurrent callers share the in-flight promise.
+ */
+const derivedKeyCache = new Map();
+/**
+ * Derive the AES key from the master.key file contents via scrypt. Results
+ * are cached by master-key path for the lifetime of the process.
+ *
+ * @param masterKeyPath - Absolute path to the master.key file
+ * @returns A 32-byte derived key
+ */
+async function deriveKey(masterKeyPath) {
+    const cached = derivedKeyCache.get(masterKeyPath);
+    if (cached)
+        return cached;
+    const promise = deriveKeyUncached(masterKeyPath).catch((err) => {
+        // On failure, remove the rejected promise so the next call retries.
+        derivedKeyCache.delete(masterKeyPath);
+        throw err;
+    });
+    derivedKeyCache.set(masterKeyPath, promise);
+    return promise;
+}
+async function deriveKeyUncached(masterKeyPath) {
+    const masterKey = await fs.readFile(masterKeyPath);
+    return new Promise((resolve, reject) => {
+        crypto.scrypt(masterKey, SCRYPT_SALT, KEY_LENGTH, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P, maxmem: SCRYPT_MAX_MEM }, (err, derivedKey) => (err ? reject(err) : resolve(derivedKey)));
+    });
+}
+/**
+ * Clear the derived-key cache. Primarily for tests — production code should
+ * not need this as master.key is assumed stable for the process lifetime.
+ */
+export function _resetDerivedKeyCache() {
+    derivedKeyCache.clear();
+}
+/**
+ * Ensure a master.key file exists at the given path. If absent, generate
+ * a cryptographically random 32-byte key and write it with mode 0600.
+ *
+ * Idempotent: if the file already exists, does nothing.
+ *
+ * @param masterKeyPath - Absolute path to the master.key file
+ */
+export async function ensureMasterKey(masterKeyPath) {
+    try {
+        await fs.access(masterKeyPath);
+        return;
+    }
+    catch {
+        // File doesn't exist — create it.
+    }
+    await fs.mkdir(path.dirname(masterKeyPath), { recursive: true });
+    const key = crypto.randomBytes(32);
+    await fs.writeFile(masterKeyPath, key, { mode: 0o600 });
+}
+/**
+ * Encrypt a UTF-8 string using AES-256-GCM.
+ *
+ * @param plaintext - The string to encrypt (caller typically JSON-serializes first)
+ * @param masterKeyPath - Absolute path to the master.key file
+ * @returns Buffer in the format `[version][iv][tag][ciphertext]`
+ */
+export async function encrypt(plaintext, masterKeyPath) {
+    const key = await deriveKey(masterKeyPath);
+    const iv = crypto.randomBytes(IV_LENGTH);
+    const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+    const ciphertext = Buffer.concat([
+        cipher.update(plaintext, 'utf8'),
+        cipher.final(),
+    ]);
+    const authTag = cipher.getAuthTag();
+    return Buffer.concat([
+        Buffer.from([FORMAT_VERSION]),
+        iv,
+        authTag,
+        ciphertext,
+    ]);
+}
+/**
+ * Decrypt a buffer produced by `encrypt()`.
+ *
+ * @param encrypted - Buffer in the `[version][iv][tag][ciphertext]` format
+ * @param masterKeyPath - Absolute path to the master.key file
+ * @returns The decrypted UTF-8 string
+ * @throws Error if the buffer is malformed, the version is unsupported,
+ *         or the auth tag does not match (tampering or wrong key)
+ */
+export async function decrypt(encrypted, masterKeyPath) {
+    if (encrypted.length < 1 + IV_LENGTH + AUTH_TAG_LENGTH + 1) {
+        throw new Error('Encrypted buffer is too short to be valid');
+    }
+    const version = encrypted[0];
+    if (version !== FORMAT_VERSION) {
+        throw new Error(`Unsupported encryption format version: ${version}`);
+    }
+    const iv = encrypted.subarray(1, 1 + IV_LENGTH);
+    const authTag = encrypted.subarray(1 + IV_LENGTH, 1 + IV_LENGTH + AUTH_TAG_LENGTH);
+    const ciphertext = encrypted.subarray(1 + IV_LENGTH + AUTH_TAG_LENGTH);
+    const key = await deriveKey(masterKeyPath);
+    const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+    decipher.setAuthTag(authTag);
+    const plaintext = Buffer.concat([
+        decipher.update(ciphertext),
+        decipher.final(),
+    ]);
+    return plaintext.toString('utf8');
+}
+/**
+ * Default credentials directory: `~/.crewly/credentials/`.
+ */
+export function defaultCredentialsDir() {
+    return path.join(os.homedir(), '.crewly', 'credentials');
+}
+/**
+ * Default master.key path: `~/.crewly/credentials/master.key`.
+ */
+export function defaultMasterKeyPath() {
+    return path.join(defaultCredentialsDir(), 'master.key');
+}
+//# sourceMappingURL=encryption.utils.js.map

package/dist/backend/backend/src/utils/encryption.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.utils.js","sourceRoot":"","sources":["../../../../../backend/src/utils/encryption.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,yDAAyD;AACzD,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,qEAAqE;AACrE,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,oDAAoD;AACpD,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,wBAAwB;AACxB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,gDAAgD;AAChD,MAAM,QAAQ,GAAG,KAAK,CAAC;AACvB,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB;;;GAGG;AACH,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AACzC,8EAA8E;AAC9E,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;AAEjE;;;;GAIG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,EAA2B,CAAC;AAE3D;;;;;;GAMG;AACH,KAAK,UAAU,SAAS,CAAC,aAAqB;IAC5C,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAClD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,OAAO,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAC7D,oEAAoE;QACpE,eAAe,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACtC,MAAM,GAAG,CAAC;IACZ,CAAC,CAAC,CAAC;IACH,eAAe,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,aAAqB;IACpD,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,MAAM,CACX,SAAS,EACT,WAAW,EACX,UAAU,EACV,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,EACjE,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAC/D,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,eAAe,CAAC,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,aAAqB;IACzD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC/B,OAAO;IACT,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;IACD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,SAAiB,EACjB,aAAqB;IAErB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAE7D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;QAChC,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEpC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,CAAC;QAC7B,EAAE;QACF,OAAO;QACP,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,SAAiB,EACjB,aAAqB;IAErB,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,GAAG,SAAS,GAAG,eAAe,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,0CAA0C,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAChC,CAAC,GAAG,SAAS,EACb,CAAC,GAAG,SAAS,GAAG,eAAe,CAChC,CAAC;IACF,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC,GAAG,SAAS,GAAG,eAAe,CAAC,CAAC;IAEvE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACjE,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAE7B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;QAC3B,QAAQ,CAAC,KAAK,EAAE;KACjB,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,YAAY,CAAC,CAAC;AAC1D,CAAC"}

package/dist/cli/backend/src/services/credential/credential-store.service.d.ts

@@ -0,0 +1,161 @@
+/**
+ * Credential Store Service
+ *
+ * Manages the workspace-level credential registry and per-credential
+ * encrypted payload files under `~/.crewly/credentials/`.
+ *
+ * The store is split into two surfaces:
+ *
+ * - **Metadata API** (`listCredentials`, `getCredential`, `findCredentialsByProvider`):
+ *   returns `CredentialRegistryEntry` objects containing only non-secret
+ *   information (id, name, provider, scopes, email, timestamps). Safe to
+ *   expose to agent / LLM context and over MCP.
+ *
+ * - **Payload API** (`getPayload`, `setPayload`): decrypts the per-credential
+ *   `.enc` file to return the actual token value(s). **Intended only for
+ *   credential helpers and the skill executor** (which injects values into
+ *   skill subprocess env vars). Callers must never return payload contents
+ *   to agent/LLM context.
+ *
+ * Encrypted file format and threat model: see `utils/encryption.utils.ts`.
+ *
+ * @module services/credential/credential-store.service
+ */
+import { CredentialRegistryEntry, CredentialPayload, GoogleOAuthPayload, CredentialType, CredentialHelperName, CredentialStatus } from '../../types/credential.types.js';
+/**
+ * Arguments for adding an API key credential.
+ */
+export interface AddApiKeyInput {
+    /** User-provided display name (must be unique recommended, not enforced). */
+    name: string;
+    /** Provider identifier (e.g., "gemini", "openai"). */
+    provider: string;
+    /** The actual API key value — never logged or returned to agent. */
+    value: string;
+}
+/**
+ * Arguments for adding an OAuth credential (usually produced by a helper's
+ * capture flow).
+ */
+export interface AddOAuthInput {
+    /** User-provided display name. */
+    name: string;
+    /** Provider identifier (e.g., "google"). */
+    provider: string;
+    /** Which helper manages refresh for this credential. */
+    helper: CredentialHelperName;
+    /** Full OAuth token payload captured from the helper's login flow. */
+    payload: GoogleOAuthPayload;
+}
+/**
+ * Updatable metadata fields on a credential. Other fields are managed
+ * internally (id, type, provider, encFile, createdAt).
+ */
+export interface UpdateCredentialMetadata {
+    name?: string;
+    status?: CredentialStatus;
+    lastUsedAt?: string;
+    expiresAt?: number;
+    scopes?: string[];
+    accountEmail?: string;
+}
+/**
+ * Options for constructing a `CredentialStoreService`. Intended mainly for
+ * tests — production uses the default paths under `~/.crewly/credentials/`.
+ */
+export interface CredentialStoreOptions {
+    /** Override the credentials directory (default: `~/.crewly/credentials`). */
+    dir?: string;
+    /** Override the master.key file path (default: `<dir>/master.key`). */
+    masterKeyPath?: string;
+}
+/**
+ * File-based credential store.
+ */
+export declare class CredentialStoreService {
+    private readonly dir;
+    private readonly registryPath;
+    private readonly masterKeyPath;
+    private initialized;
+    constructor(options?: CredentialStoreOptions);
+    /**
+     * Ensure the credentials directory and master.key exist. Called
+     * automatically by every public method — safe to invoke explicitly
+     * for eager initialization.
+     */
+    init(): Promise<void>;
+    /**
+     * List all credentials' metadata. Does not include secret values.
+     */
+    listCredentials(): Promise<CredentialRegistryEntry[]>;
+    /**
+     * Get a single credential's metadata by id.
+     *
+     * @throws CredentialNotFoundError if no entry with that id exists
+     */
+    getCredential(id: string): Promise<CredentialRegistryEntry>;
+    /**
+     * Find all credentials for a given provider, optionally filtered by type.
+     */
+    findCredentialsByProvider(provider: string, type?: CredentialType): Promise<CredentialRegistryEntry[]>;
+    /**
+     * Add a new API key credential. The value is encrypted on disk and
+     * never exposed back through the metadata API.
+     */
+    addApiKey(input: AddApiKeyInput): Promise<CredentialRegistryEntry>;
+    /**
+     * Add a new OAuth credential. Typically called by a helper's capture
+     * flow after completing an OAuth exchange.
+     */
+    addOAuth(input: AddOAuthInput): Promise<CredentialRegistryEntry>;
+    /**
+     * Update a credential's metadata. Does not touch the encrypted payload.
+     * Use `setPayload` to rewrite the secret material (e.g., after refresh).
+     *
+     * @throws CredentialNotFoundError if no entry with that id exists
+     */
+    updateCredential(id: string, patch: UpdateCredentialMetadata): Promise<CredentialRegistryEntry>;
+    /**
+     * Delete a credential (removes registry entry and encrypted payload).
+     * The registry removal is authoritative — if the `.enc` file is missing
+     * for any reason, that is not an error.
+     *
+     * @throws CredentialNotFoundError if no entry with that id exists
+     */
+    deleteCredential(id: string): Promise<void>;
+    /**
+     * Decrypt and return the credential's payload. **Do not return the
+     * result to agent / LLM contexts** — intended only for helpers
+     * refreshing tokens and the skill executor injecting env vars.
+     *
+     * @throws CredentialNotFoundError if no entry with that id exists
+     */
+    getPayload(id: string): Promise<CredentialPayload>;
+    /**
+     * Encrypt and write a new payload for an existing credential. Used by
+     * helpers after a successful token refresh.
+     *
+     * @throws CredentialNotFoundError if no entry with that id exists
+     */
+    setPayload(id: string, payload: CredentialPayload): Promise<void>;
+    private readRegistry;
+    private writeRegistry;
+    private appendEntry;
+    private encFilePath;
+    private writePayload;
+    private newId;
+}
+/**
+ * Get the process-wide CredentialStoreService singleton.
+ */
+export declare function getCredentialStoreService(): CredentialStoreService;
+/**
+ * Reset the singleton — for tests only.
+ */
+export declare function resetCredentialStoreService(): void;
+/**
+ * Replace the singleton with a specific instance — for tests only.
+ * Allows route/controller tests to point the store at a scratch directory.
+ */
+export declare function _setCredentialStoreForTesting(svc: CredentialStoreService): void;
+//# sourceMappingURL=credential-store.service.d.ts.map

package/dist/cli/backend/src/services/credential/credential-store.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/credential/credential-store.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,OAAO,EAEL,uBAAuB,EACvB,iBAAiB,EAEjB,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAEjB,MAAM,iCAAiC,CAAC;AAgCzC;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,MAAM,EAAE,oBAAoB,CAAC;IAC7B,sEAAsE;IACtE,OAAO,EAAE,kBAAkB,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAMD;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,WAAW,CAAS;gBAEhB,OAAO,CAAC,EAAE,sBAAsB;IAW5C;;;;OAIG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAW3B;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAM3D;;;;OAIG;IACG,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAQjE;;OAEG;IACG,yBAAyB,CAC7B,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAYrC;;;OAGG;IACG,SAAS,CACb,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,uBAAuB,CAAC;IAwBnC;;;OAGG;IACG,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA+BtE;;;;;OAKG;IACG,gBAAgB,CACpB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,uBAAuB,CAAC;IAsBnC;;;;;;OAMG;IACG,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBjD;;;;;;OAMG;IACG,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IASxD;;;;;OAKG;IACG,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;YAUzD,YAAY;YAOZ,aAAa;YAIb,WAAW;IAQzB,OAAO,CAAC,WAAW;YAIL,YAAY;IAW1B,OAAO,CAAC,KAAK;CAGd;AAQD;;GAEG;AACH,wBAAgB,yBAAyB,IAAI,sBAAsB,CAGlE;AAED;;GAEG;AACH,wBAAgB,2BAA2B,IAAI,IAAI,CAElD;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,sBAAsB,GAC1B,IAAI,CAEN"}