daemora 1.0.0-alpha.0

package/dist/cli/commands/vault.js

@@ -0,0 +1,167 @@
+/**
+ * `daemora vault <action>` — secret management from terminal.
+ *
+ *   vault status                         show unlocked + key hints
+ *   vault unlock [--passphrase <p>]      unlock with passphrase (reads stdin if omitted)
+ *   vault lock                           relock
+ *   vault list                           list known keys (no values)
+ *   vault set <KEY> [--value <v>]        write a key (value from stdin or flag)
+ *   vault get <KEY>                      print hint (last 4 chars) — never full value
+ *   vault delete <KEY>                   remove a key
+ *
+ * Vault values are NEVER printed in full. `get` returns a 4-char hint.
+ */
+import { readFileSync } from "node:fs";
+import { createInterface } from "node:readline/promises";
+import { stdin, stdout } from "node:process";
+import { ConfigManager } from "../../config/ConfigManager.js";
+import { secrets as secretsSchema } from "../../config/schema.js";
+async function readPassphraseInteractive(prompt) {
+    if (!stdin.isTTY) {
+        // Piped: read full stdin
+        return readFileSync(0, "utf-8").trim();
+    }
+    const rl = createInterface({ input: stdin, output: stdout });
+    const answer = await rl.question(prompt);
+    rl.close();
+    return answer.trim();
+}
+function flag(args, name) {
+    const idx = args.indexOf(`--${name}`);
+    if (idx < 0 || idx + 1 >= args.length)
+        return undefined;
+    return args[idx + 1];
+}
+export async function vaultCommand(args) {
+    const action = args[0];
+    if (!action || action === "help" || action === "--help") {
+        printHelp();
+        return;
+    }
+    const cfg = ConfigManager.open();
+    try {
+        switch (action) {
+            case "status": {
+                console.log(JSON.stringify({
+                    exists: cfg.vault.exists(),
+                    unlocked: cfg.vault.isUnlocked(),
+                    keys: cfg.vault.isUnlocked() ? cfg.vault.keys() : [],
+                }, null, 2));
+                return;
+            }
+            case "unlock": {
+                const pass = flag(args, "passphrase")
+                    ?? process.env["VAULT_PASSPHRASE"]
+                    ?? await readPassphraseInteractive("Passphrase: ");
+                if (!pass) {
+                    console.error("passphrase required");
+                    process.exit(2);
+                }
+                cfg.vault.unlock(pass);
+                console.log("unlocked");
+                return;
+            }
+            case "lock": {
+                cfg.vault.lock();
+                console.log("locked");
+                return;
+            }
+            case "list": {
+                if (!cfg.vault.isUnlocked()) {
+                    console.error("vault is locked — run `vault unlock` first");
+                    process.exit(3);
+                }
+                const keys = cfg.vault.keys();
+                for (const k of keys) {
+                    const hint = cfg.vault.get(k)?.hint() ?? "(set)";
+                    console.log(`${k}  ${hint}`);
+                }
+                return;
+            }
+            case "set": {
+                const key = args[1];
+                if (!key) {
+                    console.error("missing KEY");
+                    process.exit(2);
+                }
+                if (!(key in secretsSchema)) {
+                    console.error(`unknown secret key: ${key}`);
+                    console.error(`known: ${Object.keys(secretsSchema).join(", ")}`);
+                    process.exit(2);
+                }
+                if (!cfg.vault.isUnlocked()) {
+                    console.error("vault is locked — run `vault unlock` first");
+                    process.exit(3);
+                }
+                const value = flag(args, "value") ?? await readPassphraseInteractive(`Value for ${key}: `);
+                if (!value) {
+                    console.error("value required");
+                    process.exit(2);
+                }
+                const def = secretsSchema[key];
+                if (def.pattern && !def.pattern.test(value)) {
+                    console.error(`${key} doesn't match expected format ${def.pattern}`);
+                    process.exit(2);
+                }
+                cfg.vault.set(key, value);
+                console.log(`set ${key}: ${cfg.vault.get(key)?.hint()}`);
+                return;
+            }
+            case "get": {
+                const key = args[1];
+                if (!key) {
+                    console.error("missing KEY");
+                    process.exit(2);
+                }
+                if (!cfg.vault.isUnlocked()) {
+                    console.error("vault is locked");
+                    process.exit(3);
+                }
+                const s = cfg.vault.get(key);
+                if (!s) {
+                    console.error(`no such key: ${key}`);
+                    process.exit(4);
+                }
+                console.log(s.hint());
+                return;
+            }
+            case "delete":
+            case "rm": {
+                const key = args[1];
+                if (!key) {
+                    console.error("missing KEY");
+                    process.exit(2);
+                }
+                if (!cfg.vault.isUnlocked()) {
+                    console.error("vault is locked");
+                    process.exit(3);
+                }
+                const removed = cfg.vault.delete(key);
+                console.log(removed ? `removed ${key}` : `key not present: ${key}`);
+                return;
+            }
+            default:
+                console.error(`unknown vault action: ${action}`);
+                printHelp();
+                process.exit(2);
+        }
+    }
+    finally {
+        cfg.close();
+    }
+}
+function printHelp() {
+    console.log(`daemora vault <action>
+
+Actions:
+  status                            Show unlocked state + key hints
+  unlock [--passphrase <p>]         Unlock the vault (reads stdin if no flag)
+  lock                              Re-lock the vault
+  list                              List known keys (no values)
+  set <KEY> [--value <v>]           Store a secret (prompts if no flag)
+  get <KEY>                         Print 4-char hint (never full value)
+  delete <KEY>                      Remove a secret
+
+Values are never printed in full — only a 4-char hint.`);
+}
+//# sourceMappingURL=vault.js.map

package/dist/cli/commands/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../../src/cli/commands/vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,OAAO,IAAI,aAAa,EAAkB,MAAM,wBAAwB,CAAC;AAElF,KAAK,UAAU,yBAAyB,CAAC,MAAc;IACrD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,yBAAyB;QACzB,OAAO,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzC,EAAE,CAAC,KAAK,EAAE,CAAC;IACX,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,IAAI,CAAC,IAAuB,EAAE,IAAY;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACtC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACxD,OAAO,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAuB;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxD,SAAS,EAAE,CAAC;QACZ,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;oBACzB,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE;oBAC1B,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE;oBAChC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;iBACrD,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBACb,OAAO;YACT,CAAC;YAED,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;uBAChC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;uBAC/B,MAAM,yBAAyB,CAAC,cAAc,CAAC,CAAC;gBACrD,IAAI,CAAC,IAAI,EAAE,CAAC;oBAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC;gBACrE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACvB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;YAED,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBACjB,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACtB,OAAO;YACT,CAAC;YAED,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;oBAAC,OAAO,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAC9G,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;oBACrB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC;oBACjD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC/B,CAAC;gBACD,OAAO;YACT,CAAC;YAED,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACpB,IAAI,CAAC,GAAG,EAAE,CAAC;oBAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAC5D,IAAI,CAAC,CAAC,GAAG,IAAI,aAAa,CAAC,EAAE,CAAC;oBAC5B,OAAO,CAAC,KAAK,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;oBAC5C,OAAO,CAAC,KAAK,CAAC,UAAU,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;oBAAC,OAAO,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAC9G,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,yBAAyB,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;gBAC3F,IAAI,CAAC,KAAK,EAAE,CAAC;oBAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC;gBACjE,MAAM,GAAG,GAAG,aAAa,CAAC,GAAgB,CAAC,CAAC;gBAC5C,IAAI,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC5C,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,kCAAkC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;oBACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBACD,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAC1B,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,KAAK,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;gBACzD,OAAO;YACT,CAAC;YAED,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACpB,IAAI,CAAC,GAAG,EAAE,CAAC;oBAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAC5D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;oBAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC;gBACnF,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC7B,IAAI,CAAC,CAAC,EAAE,CAAC;oBAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,GAAG,EAAE,CAAC,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAClE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACtB,OAAO;YACT,CAAC;YAED,KAAK,QAAQ,CAAC;YACd,KAAK,IAAI,CAAC,CAAC,CAAC;gBACV,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACpB,IAAI,CAAC,GAAG,EAAE,CAAC;oBAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAC5D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;oBAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC;gBACnF,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACtC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC,CAAC,oBAAoB,GAAG,EAAE,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YAED;gBACE,OAAO,CAAC,KAAK,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAC;gBACjD,SAAS,EAAE,CAAC;gBACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,KAAK,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;uDAWyC,CAAC,CAAC;AACzD,CAAC"}

package/dist/cli/index.d.ts

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+/**
+ * Daemora CLI entry. Routes subcommands; each command lives in
+ * its own file under cli/commands/.
+ *
+ * Usage: tsx src/cli/index.ts <command>
+ *   start      run the HTTP server
+ *   setup      first-run wizard (interactive in TTY, prints URL otherwise)
+ *   doctor     diagnose config + connectivity
+ *   version    print package version
+ */
+import "./loadEnv.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG;AAOH,OAAO,cAAc,CAAC"}

package/dist/cli/index.js

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+/**
+ * Daemora CLI entry. Routes subcommands; each command lives in
+ * its own file under cli/commands/.
+ *
+ * Usage: tsx src/cli/index.ts <command>
+ *   start      run the HTTP server
+ *   setup      first-run wizard (interactive in TTY, prints URL otherwise)
+ *   doctor     diagnose config + connectivity
+ *   version    print package version
+ */
+// MUST be the very first import. Side-effect-only — populates
+// process.env from .env before any downstream module reads top-level
+// env constants (e.g. ModelRouter's DAEMORA_VERTEX_SA_KEY_PATH). ESM
+// guarantees this module is fully evaluated before the next import is
+// processed.
+import "./loadEnv.js";
+import { readFileSync } from "node:fs";
+import { configCommand } from "./commands/config.js";
+import { daemonCommand } from "./commands/daemon.js";
+import { doctorCommand } from "./commands/doctor.js";
+import { setupCommand } from "./commands/setup.js";
+import { startCommand } from "./commands/start.js";
+import { vaultCommand } from "./commands/vault.js";
+async function main() {
+    const [, , cmd] = process.argv;
+    switch (cmd) {
+        case undefined:
+        case "help":
+        case "--help":
+        case "-h":
+            printHelp();
+            return;
+        case "version":
+        case "--version":
+        case "-v": {
+            const pkg = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf-8"));
+            console.log(`daemora v${pkg.version}`);
+            return;
+        }
+        case "start":
+            await startCommand();
+            return;
+        case "setup":
+            await setupCommand();
+            return;
+        case "daemon":
+            await daemonCommand(process.argv.slice(3));
+            return;
+        case "doctor":
+            await doctorCommand();
+            return;
+        case "vault":
+            await vaultCommand(process.argv.slice(3));
+            return;
+        case "config":
+            await configCommand(process.argv.slice(3));
+            return;
+        case "voice-worker":
+        case "voice": {
+            // LiveKit voice agent worker — runs as separate process
+            // Uses dynamic import so LiveKit deps are only loaded when needed
+            await import("../voice/VoiceAgent.js");
+            return;
+        }
+        default:
+            console.error(`Unknown command: ${cmd}`);
+            printHelp();
+            process.exit(2);
+    }
+}
+function printHelp() {
+    console.log(`Daemora
+
+Commands:
+  start          Run the HTTP server (auto-opens setup URL if not configured)
+  setup          First-run interactive setup (vault + provider + model)
+  daemon <cmd>   Manage the OS background service
+                   install | uninstall | start | stop | restart | status
+                   Optional: --passphrase <value>
+  doctor         Self-diagnose (providers, vault, db, skills, mcp, memory)
+  vault <cmd>    Secret management (status | unlock | lock | list | set | get | delete)
+  config <cmd>   Settings management (list | get | set | unset)
+  voice-worker   Run the LiveKit voice agent worker (STT → Daemora → TTS)
+  version        Print version
+  help           Show this help
+`);
+}
+main().catch((e) => {
+    console.error(e instanceof Error ? e.stack : e);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG;AAEH,8DAA8D;AAC9D,qEAAqE;AACrE,qEAAqE;AACrE,sEAAsE;AACtE,aAAa;AACb,OAAO,cAAc,CAAC;AAEtB,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,EAAE,AAAD,EAAG,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAC/B,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,SAAS,CAAC;QACf,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI;YACP,SAAS,EAAE,CAAC;YACZ,OAAO;QACT,KAAK,SAAS,CAAC;QACf,KAAK,WAAW,CAAC;QACjB,KAAK,IAAI,CAAC,CAAC,CAAC;YACV,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,YAAY,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAC/C,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QACD,KAAK,OAAO;YACV,MAAM,YAAY,EAAE,CAAC;YACrB,OAAO;QACT,KAAK,OAAO;YACV,MAAM,YAAY,EAAE,CAAC;YACrB,OAAO;QACT,KAAK,QAAQ;YACX,MAAM,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,OAAO;QACT,KAAK,QAAQ;YACX,MAAM,aAAa,EAAE,CAAC;YACtB,OAAO;QACT,KAAK,OAAO;YACV,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1C,OAAO;QACT,KAAK,QAAQ;YACX,MAAM,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,OAAO;QACT,KAAK,cAAc,CAAC;QACpB,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,wDAAwD;YACxD,kEAAkE;YAClE,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QACD;YACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,EAAE,CAAC,CAAC;YACzC,SAAS,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;CAcb,CAAC,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;IACjB,OAAO,CAAC,KAAK,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/cli/loadEnv.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Side-effect-only module that loads `.env` from the current working
+ * directory before any other module is evaluated. Imported FIRST from
+ * src/cli/index.ts so ESM's import-order guarantee makes process.env
+ * fully populated by the time downstream modules read top-level env
+ * constants (e.g. ModelRouter's VERTEX_SA_KEY_PATH).
+ *
+ * Uses Node's built-in process.loadEnvFile (Node ≥ 20.6) — no dotenv
+ * dependency. Failure is non-fatal: if the file is missing or
+ * unreadable, callers are expected to function without env (or fall
+ * back to the UI Settings page for configuration).
+ */
+export {};
+//# sourceMappingURL=loadEnv.d.ts.map

package/dist/cli/loadEnv.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loadEnv.d.ts","sourceRoot":"","sources":["../../src/cli/loadEnv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}

package/dist/cli/loadEnv.js

@@ -0,0 +1,18 @@
+/**
+ * Side-effect-only module that loads `.env` from the current working
+ * directory before any other module is evaluated. Imported FIRST from
+ * src/cli/index.ts so ESM's import-order guarantee makes process.env
+ * fully populated by the time downstream modules read top-level env
+ * constants (e.g. ModelRouter's VERTEX_SA_KEY_PATH).
+ *
+ * Uses Node's built-in process.loadEnvFile (Node ≥ 20.6) — no dotenv
+ * dependency. Failure is non-fatal: if the file is missing or
+ * unreadable, callers are expected to function without env (or fall
+ * back to the UI Settings page for configuration).
+ */
+try {
+    process.loadEnvFile(".env");
+}
+catch { /* no .env or unreadable — fine */ }
+export {};
+//# sourceMappingURL=loadEnv.js.map

package/dist/cli/loadEnv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loadEnv.js","sourceRoot":"","sources":["../../src/cli/loadEnv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,IAAI,CAAC;IACH,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC;AAAC,MAAM,CAAC,CAAC,kCAAkC,CAAC,CAAC"}

package/dist/config/ConfigManager.d.ts

@@ -0,0 +1,79 @@
+/**
+ * ConfigManager — single, typed, source-aware accessor for all of
+ * Daemora's configuration. Owns the vault + settings store + boot env.
+ *
+ *   const cfg = ConfigManager.open({ dataDir });
+ *   cfg.vault.unlock(passphrase);
+ *
+ *   cfg.setting("DEFAULT_MODEL");        // typed, falls back to default
+ *   cfg.secret("ANTHROPIC_API_KEY");     // Secret | undefined
+ *   cfg.source("DEFAULT_MODEL");         // "settings" | "default"
+ *
+ *   cfg.on("change", ({ key, source }) => …);  // react to changes
+ */
+import { EventEmitter } from "node:events";
+import Database from "better-sqlite3";
+import { type BootEnv } from "./env.js";
+import { type ConfigSource, type SecretKey, type SettingKey, type SettingValue } from "./schema.js";
+import { Secret } from "./Secret.js";
+import { SecretVault } from "./SecretVault.js";
+import { SettingsStore } from "./SettingsStore.js";
+export interface ConfigChangeEvent {
+    readonly key: string;
+    readonly kind: "secret" | "setting";
+    readonly action: "set" | "delete";
+}
+export declare class ConfigManager extends EventEmitter {
+    readonly vault: SecretVault;
+    readonly settings: SettingsStore;
+    readonly env: BootEnv;
+    private readonly db;
+    /**
+     * Shared SQLite handle. Other subsystems (SessionStore, MemoryStore, …)
+     * reuse this so we keep one file, one WAL context, one close() call —
+     * not N independent connections stepping on each other.
+     */
+    get database(): Database.Database;
+    private constructor();
+    static open(opts?: {
+        dataDir?: string;
+        dbName?: string;
+    }): ConfigManager;
+    /** Strongly-typed setting accessor. */
+    setting<K extends SettingKey>(key: K): SettingValue<K>;
+    /** Get a secret. Returns undefined if vault locked OR key not set. */
+    secret(key: SecretKey): Secret | undefined;
+    /** Where did this value come from? Useful for the UI's "show source" affordance. */
+    source(key: string): ConfigSource;
+    /**
+     * Snapshot of every known field with its current value + source.
+     * Secrets are returned as `Secret` instances (auto-redacted on log).
+     * Use this for /api/config/inspect.
+     */
+    inspect(): readonly InspectedField[];
+    close(): void;
+}
+export type InspectedField = {
+    readonly kind: "setting";
+    readonly key: string;
+    readonly group: string;
+    readonly label: string;
+    readonly description: string;
+    readonly source: ConfigSource;
+    readonly value: unknown;
+    readonly editable: boolean;
+} | {
+    readonly kind: "secret";
+    readonly key: string;
+    readonly group: string;
+    readonly label: string;
+    readonly description: string;
+    readonly source: ConfigSource;
+    readonly isSet: boolean;
+    readonly hint: string | undefined;
+    readonly oauth?: {
+        integration: string;
+        tokenType: string;
+    };
+};
+//# sourceMappingURL=ConfigManager.d.ts.map

package/dist/config/ConfigManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConfigManager.d.ts","sourceRoot":"","sources":["../../src/config/ConfigManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAGtC,OAAO,EAAe,KAAK,OAAO,EAAE,MAAM,UAAU,CAAC;AACrD,OAAO,EAIL,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,YAAY,EAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAInD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,QAAQ,CAAC;CACnC;AAED,qBAAa,aAAc,SAAQ,YAAY;IAC7C,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAoB;IAEvC;;;;OAIG;IACH,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAEhC;IAED,OAAO;IAgBP,MAAM,CAAC,IAAI,CAAC,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,aAAa;IAc5E,uCAAuC;IACvC,OAAO,CAAC,CAAC,SAAS,UAAU,EAAE,GAAG,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC;IAItD,sEAAsE;IACtE,MAAM,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS;IAI1C,oFAAoF;IACpF,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY;IAYjC;;;;OAIG;IACH,OAAO,IAAI,SAAS,cAAc,EAAE;IA4BpC,KAAK,IAAI,IAAI;CAId;AAED,MAAM,MAAM,cAAc,GACtB;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7D,CAAC"}

package/dist/config/ConfigManager.js

@@ -0,0 +1,118 @@
+/**
+ * ConfigManager — single, typed, source-aware accessor for all of
+ * Daemora's configuration. Owns the vault + settings store + boot env.
+ *
+ *   const cfg = ConfigManager.open({ dataDir });
+ *   cfg.vault.unlock(passphrase);
+ *
+ *   cfg.setting("DEFAULT_MODEL");        // typed, falls back to default
+ *   cfg.secret("ANTHROPIC_API_KEY");     // Secret | undefined
+ *   cfg.source("DEFAULT_MODEL");         // "settings" | "default"
+ *
+ *   cfg.on("change", ({ key, source }) => …);  // react to changes
+ */
+import { mkdirSync } from "node:fs";
+import { EventEmitter } from "node:events";
+import { join } from "node:path";
+import Database from "better-sqlite3";
+import { createLogger } from "../util/logger.js";
+import { readBootEnv } from "./env.js";
+import { allFields, isSecret as schemaIsSecret, isSetting as schemaIsSetting, } from "./schema.js";
+import { SecretVault } from "./SecretVault.js";
+import { SettingsStore } from "./SettingsStore.js";
+const log = createLogger("config");
+export class ConfigManager extends EventEmitter {
+    vault;
+    settings;
+    env;
+    db;
+    /**
+     * Shared SQLite handle. Other subsystems (SessionStore, MemoryStore, …)
+     * reuse this so we keep one file, one WAL context, one close() call —
+     * not N independent connections stepping on each other.
+     */
+    get database() {
+        return this.db;
+    }
+    constructor(db, env) {
+        super();
+        this.db = db;
+        this.env = env;
+        this.vault = new SecretVault(db);
+        this.settings = new SettingsStore(db);
+        // Re-emit downstream changes through one channel so consumers don't
+        // need to subscribe to vault + settings separately.
+        this.vault.on("set", (key) => this.emit("change", { key, kind: "secret", action: "set" }));
+        this.vault.on("delete", (key) => this.emit("change", { key, kind: "secret", action: "delete" }));
+        this.settings.on("change", ({ key }) => this.emit("change", { key, kind: "setting", action: "set" }));
+    }
+    static open(opts = {}) {
+        const env = readBootEnv();
+        const dataDir = opts.dataDir ?? env.dataDir;
+        mkdirSync(dataDir, { recursive: true });
+        const dbPath = join(dataDir, opts.dbName ?? "daemora.db");
+        const db = new Database(dbPath);
+        db.pragma("journal_mode = WAL");
+        db.pragma("foreign_keys = ON");
+        log.info({ dbPath }, "config opened");
+        return new ConfigManager(db, env);
+    }
+    /** Strongly-typed setting accessor. */
+    setting(key) {
+        return this.settings.get(key);
+    }
+    /** Get a secret. Returns undefined if vault locked OR key not set. */
+    secret(key) {
+        return this.vault.get(String(key));
+    }
+    /** Where did this value come from? Useful for the UI's "show source" affordance. */
+    source(key) {
+        if (schemaIsSecret(key)) {
+            return this.vault.has(key) ? "vault" : "default";
+        }
+        if (schemaIsSetting(key)) {
+            return this.settings.has(key) ? "settings" : "default";
+        }
+        // Env-only fields
+        if (process.env[key] !== undefined)
+            return "env";
+        return "default";
+    }
+    /**
+     * Snapshot of every known field with its current value + source.
+     * Secrets are returned as `Secret` instances (auto-redacted on log).
+     * Use this for /api/config/inspect.
+     */
+    inspect() {
+        return Array.from(allFields.entries()).map(([key, def]) => {
+            if (def.kind === "setting") {
+                return {
+                    key,
+                    kind: "setting",
+                    group: def.group,
+                    label: def.label,
+                    description: def.description,
+                    source: this.source(key),
+                    value: this.settings.get(key),
+                    editable: def.editable,
+                };
+            }
+            return {
+                key,
+                kind: "secret",
+                group: def.group,
+                label: def.label,
+                description: def.description,
+                source: this.source(key),
+                isSet: this.vault.has(key),
+                hint: this.vault.get(key)?.hint(),
+                ...(def.oauth ? { oauth: def.oauth } : {}),
+            };
+        });
+    }
+    close() {
+        this.vault.lock();
+        this.db.close();
+    }
+}
+//# sourceMappingURL=ConfigManager.js.map

package/dist/config/ConfigManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConfigManager.js","sourceRoot":"","sources":["../../src/config/ConfigManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAEtC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAgB,MAAM,UAAU,CAAC;AACrD,OAAO,EACL,SAAS,EACT,QAAQ,IAAI,cAAc,EAC1B,SAAS,IAAI,eAAe,GAK7B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;AAQnC,MAAM,OAAO,aAAc,SAAQ,YAAY;IACpC,KAAK,CAAc;IACnB,QAAQ,CAAgB;IACxB,GAAG,CAAU;IACL,EAAE,CAAoB;IAEvC;;;;OAIG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IAED,YAAoB,EAAqB,EAAE,GAAY;QACrD,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,KAAK,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,GAAG,IAAI,aAAa,CAAC,EAAE,CAAC,CAAC;QAEtC,oEAAoE;QACpE,oDAAoD;QACpD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAA8B,CAAC,CAAC,CAAC;QAC/H,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAA8B,CAAC,CAAC,CAAC;QACrI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAmB,EAAE,EAAE,CACtD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAA8B,CAAC,CACzF,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,OAA8C,EAAE;QAC1D,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC;QAC5C,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAExC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC,CAAC;QAC1D,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAChC,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC;QAEtC,OAAO,IAAI,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;IAED,uCAAuC;IACvC,OAAO,CAAuB,GAAM;QAClC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,sEAAsE;IACtE,MAAM,CAAC,GAAc;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,oFAAoF;IACpF,MAAM,CAAC,GAAW;QAChB,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACnD,CAAC;QACD,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAiB,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,CAAC;QACD,kBAAkB;QAClB,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACjD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,OAAO;QACL,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE;YACxD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO;oBACL,GAAG;oBACH,IAAI,EAAE,SAAS;oBACf,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,WAAW,EAAE,GAAG,CAAC,WAAW;oBAC5B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;oBACxB,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAiB,CAAC;oBAC3C,QAAQ,EAAE,GAAG,CAAC,QAAQ;iBACvB,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,GAAG;gBACH,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;gBACxB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;gBAC1B,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE;gBACjC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3C,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK;QACH,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;CACF"}

package/dist/config/Secret.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Secret<T> — a branded string that resists accidental logging.
+ *
+ * `toString()`, `toJSON()`, `inspect()` all return "[REDACTED]" so a
+ * stray `console.log(secret)` or `JSON.stringify({ key: secret })`
+ * never leaks the real value. To USE the value, call `.reveal()` —
+ * an explicit, greppable call that's easy to audit.
+ *
+ *   const k = vault.get("ANTHROPIC_API_KEY");        // Secret
+ *   if (k) provider({ apiKey: k.reveal() });          // explicit unwrap
+ *   logger.info({ key: k });                          // prints "[REDACTED]"
+ */
+declare const inspectSym: unique symbol;
+export declare class Secret {
+    #private;
+    private constructor();
+    static of(value: string): Secret;
+    /** Explicit unwrap. Always grep `.reveal()` to find every site that touches a real secret. */
+    reveal(): string;
+    /** Length of the underlying value, useful for "is this set" checks without revealing it. */
+    get length(): number;
+    /** Last 4 chars, prefixed with bullets — useful for UI display ("•••• abc1"). */
+    hint(): string;
+    toString(): string;
+    toJSON(): string;
+    [inspectSym](): string;
+}
+export {};
+//# sourceMappingURL=Secret.d.ts.map

package/dist/config/Secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Secret.d.ts","sourceRoot":"","sources":["../../src/config/Secret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,QAAA,MAAM,UAAU,eAA2C,CAAC;AAE5D,qBAAa,MAAM;;IAGjB,OAAO;IAIP,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAIhC,8FAA8F;IAC9F,MAAM,IAAI,MAAM;IAIhB,4FAA4F;IAC5F,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,iFAAiF;IACjF,IAAI,IAAI,MAAM;IAKd,QAAQ,IAAI,MAAM;IAIlB,MAAM,IAAI,MAAM;IAIhB,CAAC,UAAU,CAAC,IAAI,MAAM;CAGvB"}

package/dist/config/Secret.js

@@ -0,0 +1,47 @@
+/**
+ * Secret<T> — a branded string that resists accidental logging.
+ *
+ * `toString()`, `toJSON()`, `inspect()` all return "[REDACTED]" so a
+ * stray `console.log(secret)` or `JSON.stringify({ key: secret })`
+ * never leaks the real value. To USE the value, call `.reveal()` —
+ * an explicit, greppable call that's easy to audit.
+ *
+ *   const k = vault.get("ANTHROPIC_API_KEY");        // Secret
+ *   if (k) provider({ apiKey: k.reveal() });          // explicit unwrap
+ *   logger.info({ key: k });                          // prints "[REDACTED]"
+ */
+const REDACTED = "[REDACTED]";
+const inspectSym = Symbol.for("nodejs.util.inspect.custom");
+export class Secret {
+    #value;
+    constructor(value) {
+        this.#value = value;
+    }
+    static of(value) {
+        return new Secret(value);
+    }
+    /** Explicit unwrap. Always grep `.reveal()` to find every site that touches a real secret. */
+    reveal() {
+        return this.#value;
+    }
+    /** Length of the underlying value, useful for "is this set" checks without revealing it. */
+    get length() {
+        return this.#value.length;
+    }
+    /** Last 4 chars, prefixed with bullets — useful for UI display ("•••• abc1"). */
+    hint() {
+        if (this.#value.length <= 4)
+            return REDACTED;
+        return `•••• ${this.#value.slice(-4)}`;
+    }
+    toString() {
+        return REDACTED;
+    }
+    toJSON() {
+        return REDACTED;
+    }
+    [inspectSym]() {
+        return REDACTED;
+    }
+}
+//# sourceMappingURL=Secret.js.map

package/dist/config/Secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Secret.js","sourceRoot":"","sources":["../../src/config/Secret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;AAE5D,MAAM,OAAO,MAAM;IACR,MAAM,CAAS;IAExB,YAAoB,KAAa;QAC/B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,MAAM,CAAC,EAAE,CAAC,KAAa;QACrB,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,8FAA8F;IAC9F,MAAM;QACJ,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,4FAA4F;IAC5F,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IAC5B,CAAC;IAED,iFAAiF;IACjF,IAAI;QACF,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC7C,OAAO,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzC,CAAC;IAED,QAAQ;QACN,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM;QACJ,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,CAAC,UAAU,CAAC;QACV,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}