kavrix 0.1.2 → 0.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/README.md +37 -23
  2. package/dist/bin.js +12466 -3545
  3. package/dist/index.d.ts +1 -1
  4. package/dist/index.js +1 -1
  5. package/dist/kavrix.cdx.json +8 -8
  6. package/package.json +2 -2
package/README.md CHANGED
@@ -1,11 +1,13 @@
1
1
  # kavrix
2
2
 
3
- A local, zero-knowledge credential vault backed directly by MongoDB. Kavrix
4
- encrypts values before storage; it does not require or start a Kavrix server.
3
+ A local, zero-knowledge credential vault that stores multiple independently
4
+ encrypted vaults in a protected local database file or MongoDB. Kavrix encrypts
5
+ private labels and values before storage; it does not require a Kavrix server.
5
6
 
6
7
  ## Install
7
8
 
8
- Requires Node.js `>=24.12.0 <25` or `>=25.1.0` and a reachable MongoDB deployment.
9
+ Requires Node.js `>=24.12.0 <25` or `>=25.1.0`. MongoDB is optional; database
10
+ writes require a transaction-capable replica set or sharded topology.
9
11
 
10
12
  ```sh
11
13
  npm install --global kavrix
@@ -16,12 +18,13 @@ kavrix --help
16
18
  ## Quick start
17
19
 
18
20
  ```sh
19
- kavrix db ping
20
- kavrix init
21
- kavrix put github/token
22
- kavrix list
23
- kavrix view
24
- kavrix get github/token --reveal
21
+ kavrix db profile add work --datastore file \
22
+ --data-file ./work.kavrix --key-file ./work.kavrix.key
23
+ kavrix db profile use work
24
+ kavrix db init --profile work
25
+ kavrix db vault create --profile work
26
+ kavrix put github/token --profile work --vault <vault-id>
27
+ kavrix get github/token --profile work --vault <vault-id>
25
28
  ```
26
29
 
27
30
  Commands prompt for sensitive input. Do not place secrets or MongoDB credentials
@@ -30,8 +33,13 @@ the exact protected-input options available in this version.
30
33
 
31
34
  ## Main command groups
32
35
 
36
+ - `db profile`: manage protected non-secret datastore routes.
37
+ - `db init`, `db status`: initialize or authenticate a multi-vault database.
38
+ - `db vault`: create, list, inspect, or rename independently encrypted vaults.
39
+ - `db recovery`: manage database-root recovery kits.
40
+ - `migrate database`: explicitly copy a legacy version 2 vault into a database.
33
41
  - `db ping`: test direct MongoDB connectivity.
34
- - `init`: create a vault and passphrase-protected portable key file.
42
+ - `init`, `vault`, `key`, `recovery`, `doctor`: version 2 compatibility commands.
35
43
  - `put`, `get`, `list`, `view`, `search`, `stats`: manage encrypted values.
36
44
  - `has`, `rename`, `remove`: inspect or change records without accidental reveal.
37
45
  - `vault list`, `vault status`: select and inspect vaults.
@@ -44,22 +52,28 @@ commands never display credential values.
44
52
 
45
53
  ## Security boundary
46
54
 
47
- Vault payloads use XChaCha20-Poly1305 authenticated encryption. Protected key and
48
- recovery files use Argon2id-derived keys and XChaCha20-Poly1305. Ciphertext is
49
- bound to vault identity, schema/key version, revision, and security metadata.
50
- MongoDB stores ciphertext plus visible operational metadata; it never receives
51
- the portable key, recovery key, passphrase, root key, or decrypted value.
55
+ Vault payloads and the private database catalog use XChaCha20-Poly1305
56
+ authenticated encryption. Protected key and recovery files use Argon2id-derived
57
+ keys and XChaCha20-Poly1305; HKDF-SHA-256 separates database, catalog, anchor,
58
+ and vault wrapping purposes. Ciphertext is bound to exact database/vault identity,
59
+ purpose, versions, revision, and metadata digest. Kavrix does not claim
60
+ permanently unbreakable encryption.
52
61
 
53
- A protected local revision anchor detects older database snapshots and
54
- same-revision metadata forks. Normal unlock fails closed if the anchor is
55
- missing or inconsistent. `doctor health --accept-current` is an explicit trust
56
- decision, not an automatic recovery shortcut.
62
+ A DRK-authenticated local revision anchor detects database rollback,
63
+ same-revision forks, and inconsistent catalog/vault heads. Normal database
64
+ unlock fails closed if that anchor is missing or inconsistent.
57
65
 
58
- Remote MongoDB URIs must explicitly enable validated TLS. Kavrix rejects insecure
59
- TLS options. It cannot protect an already-unlocked machine from local
66
+ MongoDB stores two collections of ciphertext plus visible opaque routing
67
+ metadata; it never receives passphrases, DRKs, VRKs, labels, or decrypted values.
68
+ Remote URIs must explicitly enable validated TLS. Kavrix cannot protect an unlocked machine from local
60
69
  administrators, same-user malware, keyloggers, terminal capture, or process-memory
61
- inspection. Losing all valid key files and recovery kits makes the vault
62
- unrecoverable by design.
70
+ inspection. For local sharing, create a fresh share key with `kavrix db key create`
71
+ and transfer it with its exact matching encrypted database snapshot. Deliver the
72
+ passphrase separately; the pair grants access to all vaults. User identities,
73
+ grants, roles, revocation, ownership
74
+ transfer, environments, groups, structured items, and typed fields are not yet
75
+ implemented. Losing all valid owner keys and database recovery kits makes the
76
+ database unrecoverable by design.
63
77
 
64
78
  ## Documentation and support
65
79