langmart-gateway-type3 3.0.0

package/dist/key-vault.js

@@ -0,0 +1,365 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeyVault = void 0;
+const debug_utils_1 = require("./debug-utils");
+/**
+ * KeyVault - Automatic API Key Detection and Redaction
+ *
+ * This module automatically detects API keys in user prompts, replaces them with
+ * random placeholders before sending to LLMs, and restores real values in responses.
+ *
+ * Prevents accidental exposure of sensitive API keys to LLM providers.
+ */
+const crypto = __importStar(require("crypto"));
+class KeyVault {
+    constructor() {
+        this.keyMappings = new Map();
+        // API key detection patterns for major LLM providers
+        // More flexible patterns to catch keys even if length varies slightly
+        this.KEY_PATTERNS = [
+            {
+                name: 'openai-project',
+                pattern: /\bsk-proj-[A-Za-z0-9_-]{40,200}\b/g,
+                prefix: 'sk-proj-',
+                minLength: 48,
+                maxLength: 208
+            },
+            {
+                name: 'anthropic',
+                pattern: /\bsk-ant-api\d+-[A-Za-z0-9_-]{20,100}\b/g,
+                prefix: 'sk-ant-api',
+                minLength: 30,
+                maxLength: 120
+            },
+            {
+                name: 'google-gemini',
+                pattern: /\bAIza[A-Za-z0-9_\\-]{30,50}\b/g,
+                prefix: 'AIza',
+                minLength: 34,
+                maxLength: 54
+            },
+            {
+                name: 'groq',
+                pattern: /\bgsk_[A-Za-z0-9]{40,60}\b/g,
+                prefix: 'gsk_',
+                minLength: 44,
+                maxLength: 64
+            },
+            {
+                name: 'deepseek',
+                pattern: /\bsk-[A-Za-z0-9]{40,60}\b/g,
+                prefix: 'sk-',
+                minLength: 43,
+                maxLength: 63
+            },
+            {
+                name: 'openai-legacy',
+                pattern: /\bsk-[A-Za-z0-9]{40,60}\b/g,
+                prefix: 'sk-',
+                minLength: 43,
+                maxLength: 63
+            }
+        ];
+    }
+    /**
+     * Generate a random key with the same format as the original
+     */
+    generateRandomKey(provider, originalKey) {
+        const pattern = this.KEY_PATTERNS.find(p => p.name === provider);
+        if (!pattern) {
+            throw new Error(`Unknown provider: ${provider}`);
+        }
+        const keyLength = originalKey.length - pattern.prefix.length;
+        const randomChars = crypto.randomBytes(Math.ceil(keyLength / 2))
+            .toString('hex')
+            .substring(0, keyLength);
+        return pattern.prefix + randomChars;
+    }
+    /**
+     * Detect and redact API keys in text
+     * Returns both redacted text and list of detected keys
+     */
+    redactKeys(text) {
+        let redactedText = text;
+        let detectedCount = 0;
+        for (const pattern of this.KEY_PATTERNS) {
+            const matches = text.matchAll(pattern.pattern);
+            for (const match of matches) {
+                const realKey = match[0];
+                // Check if we've already seen this key
+                let mapping = Array.from(this.keyMappings.values())
+                    .find(m => m.real === realKey);
+                if (!mapping) {
+                    // Generate new random key with same format
+                    const redactedKey = this.generateRandomKey(pattern.name, realKey);
+                    const now = new Date();
+                    mapping = {
+                        redacted: redactedKey,
+                        real: realKey,
+                        provider: pattern.name,
+                        detectedAt: now,
+                        lastUsed: now,
+                        useCount: 0
+                    };
+                    // Store both directions for fast lookup
+                    this.keyMappings.set(redactedKey, mapping);
+                    detectedCount++;
+                    (0, debug_utils_1.debugLog)(`[KeyVault] 🔐 Detected ${pattern.name} API key, redacted to: ${redactedKey.substring(0, 15)}...`);
+                }
+                // Replace real key with redacted version
+                redactedText = redactedText.replace(realKey, mapping.redacted);
+            }
+        }
+        return { redactedText, detectedCount };
+    }
+    /**
+     * Restore real API keys in text (for LLM responses and tool calls)
+     */
+    restoreKeys(text) {
+        let restoredText = text;
+        let restoredCount = 0;
+        // Check all stored redacted keys
+        for (const [redactedKey, mapping] of this.keyMappings.entries()) {
+            if (text.includes(redactedKey)) {
+                restoredText = restoredText.replace(new RegExp(redactedKey, 'g'), mapping.real);
+                restoredCount++;
+                // Update usage tracking
+                mapping.lastUsed = new Date();
+                mapping.useCount++;
+                (0, debug_utils_1.debugLog)(`[KeyVault] 🔓 Restored ${mapping.provider} API key from: ${redactedKey.substring(0, 15)}...`);
+            }
+        }
+        return { restoredText, restoredCount };
+    }
+    /**
+     * Check if text contains any API keys (real or redacted)
+     */
+    containsKeys(text) {
+        // Check for real keys
+        for (const pattern of this.KEY_PATTERNS) {
+            if (pattern.pattern.test(text)) {
+                return true;
+            }
+        }
+        // Check for redacted keys
+        for (const redactedKey of this.keyMappings.keys()) {
+            if (text.includes(redactedKey)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    /**
+     * Get statistics about redacted keys
+     */
+    getStats() {
+        const byProvider = {};
+        let oldestDate = null;
+        let newestDate = null;
+        let oldestMapping = null;
+        let newestMapping = null;
+        let totalAge = 0;
+        for (const mapping of this.keyMappings.values()) {
+            byProvider[mapping.provider] = (byProvider[mapping.provider] || 0) + 1;
+            if (!oldestDate || mapping.detectedAt < oldestDate) {
+                oldestDate = mapping.detectedAt;
+                oldestMapping = mapping;
+            }
+            if (!newestDate || mapping.detectedAt > newestDate) {
+                newestDate = mapping.detectedAt;
+                newestMapping = mapping;
+            }
+            totalAge += Date.now() - mapping.detectedAt.getTime();
+        }
+        const count = this.keyMappings.size;
+        const averageAge = count > 0 ? totalAge / count / 1000 / 60 : 0; // Convert to minutes
+        return {
+            totalKeys: count,
+            byProvider,
+            oldestKey: oldestMapping ? {
+                provider: oldestMapping.provider,
+                ageMinutes: (Date.now() - oldestMapping.detectedAt.getTime()) / 1000 / 60
+            } : undefined,
+            newestKey: newestMapping ? {
+                provider: newestMapping.provider,
+                ageMinutes: (Date.now() - newestMapping.detectedAt.getTime()) / 1000 / 60
+            } : undefined,
+            averageAge
+        };
+    }
+    /**
+     * Get keys older than specified age in minutes
+     */
+    getOldKeys(maxAgeMinutes) {
+        const now = Date.now();
+        const maxAgeMs = maxAgeMinutes * 60 * 1000;
+        const oldKeys = [];
+        for (const mapping of this.keyMappings.values()) {
+            const age = now - mapping.detectedAt.getTime();
+            if (age > maxAgeMs) {
+                oldKeys.push({
+                    provider: mapping.provider,
+                    ageMinutes: age / 1000 / 60,
+                    lastUsedMinutes: (now - mapping.lastUsed.getTime()) / 1000 / 60,
+                    useCount: mapping.useCount
+                });
+            }
+        }
+        return oldKeys;
+    }
+    /**
+     * Clean up keys older than specified age in minutes
+     * Returns number of keys removed
+     */
+    cleanupOldKeys(maxAgeMinutes) {
+        const now = Date.now();
+        const maxAgeMs = maxAgeMinutes * 60 * 1000;
+        const keysToRemove = [];
+        for (const [redactedKey, mapping] of this.keyMappings.entries()) {
+            const age = now - mapping.detectedAt.getTime();
+            if (age > maxAgeMs) {
+                keysToRemove.push(redactedKey);
+            }
+        }
+        for (const key of keysToRemove) {
+            this.keyMappings.delete(key);
+        }
+        if (keysToRemove.length > 0) {
+            (0, debug_utils_1.debugLog)(`[KeyVault] 🧹 Cleaned up ${keysToRemove.length} key(s) older than ${maxAgeMinutes} minutes`);
+        }
+        return keysToRemove.length;
+    }
+    /**
+     * Clean up keys not used for specified time in minutes
+     * Returns number of keys removed
+     */
+    cleanupUnusedKeys(unusedMinutes) {
+        const now = Date.now();
+        const unusedMs = unusedMinutes * 60 * 1000;
+        const keysToRemove = [];
+        for (const [redactedKey, mapping] of this.keyMappings.entries()) {
+            const timeSinceLastUse = now - mapping.lastUsed.getTime();
+            if (timeSinceLastUse > unusedMs && mapping.useCount === 0) {
+                keysToRemove.push(redactedKey);
+            }
+        }
+        for (const key of keysToRemove) {
+            this.keyMappings.delete(key);
+        }
+        if (keysToRemove.length > 0) {
+            (0, debug_utils_1.debugLog)(`[KeyVault] 🧹 Cleaned up ${keysToRemove.length} unused key(s) (not used for ${unusedMinutes} minutes)`);
+        }
+        return keysToRemove.length;
+    }
+    /**
+     * Get age of a specific redacted key in minutes
+     */
+    getKeyAge(redactedKey) {
+        const mapping = this.keyMappings.get(redactedKey);
+        if (!mapping)
+            return null;
+        return (Date.now() - mapping.detectedAt.getTime()) / 1000 / 60;
+    }
+    /**
+     * Get detailed info about all stored keys
+     */
+    getAllKeysInfo() {
+        const now = Date.now();
+        const keysInfo = [];
+        for (const mapping of this.keyMappings.values()) {
+            keysInfo.push({
+                provider: mapping.provider,
+                redactedPrefix: mapping.redacted.substring(0, 15) + '...',
+                ageMinutes: (now - mapping.detectedAt.getTime()) / 1000 / 60,
+                lastUsedMinutes: (now - mapping.lastUsed.getTime()) / 1000 / 60,
+                useCount: mapping.useCount
+            });
+        }
+        return keysInfo.sort((a, b) => b.ageMinutes - a.ageMinutes); // Sort by age, oldest first
+    }
+    /**
+     * Get comprehensive statistics for UI display
+     */
+    getStatistics() {
+        const now = Date.now();
+        const keys = [];
+        for (const mapping of this.keyMappings.values()) {
+            keys.push({
+                provider: mapping.provider,
+                redactedPrefix: mapping.redacted.substring(0, 15) + '...',
+                detectedAt: mapping.detectedAt,
+                age: Math.round((now - mapping.detectedAt.getTime()) / 1000 / 60), // Minutes
+                useCount: mapping.useCount
+            });
+        }
+        return {
+            totalKeys: this.keyMappings.size,
+            keys: keys.sort((a, b) => b.age - a.age) // Sort by age, oldest first
+        };
+    }
+    /**
+     * Clear all stored key mappings (use when starting new chat session)
+     */
+    clear() {
+        const count = this.keyMappings.size;
+        this.keyMappings.clear();
+        if (count > 0) {
+            (0, debug_utils_1.debugLog)(`[KeyVault] 🗑️  Cleared ${count} key mappings`);
+        }
+    }
+    /**
+     * Process a chat message before sending to LLM
+     */
+    processOutgoingMessage(message) {
+        const { redactedText, detectedCount } = this.redactKeys(message);
+        if (detectedCount > 0) {
+            (0, debug_utils_1.debugLog)(`[KeyVault] 📤 Outgoing message: Redacted ${detectedCount} API key(s)`);
+        }
+        return redactedText;
+    }
+    /**
+     * Process a response from LLM before showing to user
+     */
+    processIncomingMessage(message) {
+        const { restoredText, restoredCount } = this.restoreKeys(message);
+        if (restoredCount > 0) {
+            (0, debug_utils_1.debugLog)(`[KeyVault] 📥 Incoming message: Restored ${restoredCount} API key(s)`);
+        }
+        return restoredText;
+    }
+}
+exports.KeyVault = KeyVault;
+//# sourceMappingURL=key-vault.js.map

package/dist/key-vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-vault.js","sourceRoot":"","sources":["../key-vault.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,+CAAyC;AACzC;;;;;;;GAOG;AAEH,+CAAiC;AAWjC,MAAa,QAAQ;IAArB;QACY,gBAAW,GAA4B,IAAI,GAAG,EAAE,CAAC;QAEzD,qDAAqD;QACrD,sEAAsE;QACrD,iBAAY,GAAG;YAC5B;gBACI,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,oCAAoC;gBAC7C,MAAM,EAAE,UAAU;gBAClB,SAAS,EAAE,EAAE;gBACb,SAAS,EAAE,GAAG;aACjB;YACD;gBACI,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,0CAA0C;gBACnD,MAAM,EAAE,YAAY;gBACpB,SAAS,EAAE,EAAE;gBACb,SAAS,EAAE,GAAG;aACjB;YACD;gBACI,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,iCAAiC;gBAC1C,MAAM,EAAE,MAAM;gBACd,SAAS,EAAE,EAAE;gBACb,SAAS,EAAE,EAAE;aAChB;YACD;gBACI,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,6BAA6B;gBACtC,MAAM,EAAE,MAAM;gBACd,SAAS,EAAE,EAAE;gBACb,SAAS,EAAE,EAAE;aAChB;YACD;gBACI,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,4BAA4B;gBACrC,MAAM,EAAE,KAAK;gBACb,SAAS,EAAE,EAAE;gBACb,SAAS,EAAE,EAAE;aAChB;YACD;gBACI,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,4BAA4B;gBACrC,MAAM,EAAE,KAAK;gBACb,SAAS,EAAE,EAAE;gBACb,SAAS,EAAE,EAAE;aAChB;SACJ,CAAC;IA4VN,CAAC;IA1VG;;OAEG;IACK,iBAAiB,CAAC,QAAgB,EAAE,WAAmB;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACjE,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7D,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;aAC3D,QAAQ,CAAC,KAAK,CAAC;aACf,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAE7B,OAAO,OAAO,CAAC,MAAM,GAAG,WAAW,CAAC;IACxC,CAAC;IAED;;;OAGG;IACI,UAAU,CAAC,IAAY;QAC1B,IAAI,YAAY,GAAG,IAAI,CAAC;QACxB,IAAI,aAAa,GAAG,CAAC,CAAC;QAEtB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAE/C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAEzB,uCAAuC;gBACvC,IAAI,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;qBAC9C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;gBAEnC,IAAI,CAAC,OAAO,EAAE,CAAC;oBACX,2CAA2C;oBAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;oBAElE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,OAAO,GAAG;wBACN,QAAQ,EAAE,WAAW;wBACrB,IAAI,EAAE,OAAO;wBACb,QAAQ,EAAE,OAAO,CAAC,IAAI;wBACtB,UAAU,EAAE,GAAG;wBACf,QAAQ,EAAE,GAAG;wBACb,QAAQ,EAAE,CAAC;qBACd,CAAC;oBAEF,wCAAwC;oBACxC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;oBAC3C,aAAa,EAAE,CAAC;oBAEhB,IAAA,sBAAQ,EAAC,0BAA0B,OAAO,CAAC,IAAI,0BAA0B,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;gBAChH,CAAC;gBAED,yCAAyC;gBACzC,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YACnE,CAAC;QACL,CAAC;QAED,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;IAC3C,CAAC;IAED;;OAEG;IACI,WAAW,CAAC,IAAY;QAC3B,IAAI,YAAY,GAAG,IAAI,CAAC;QACxB,IAAI,aAAa,GAAG,CAAC,CAAC;QAEtB,iCAAiC;QACjC,KAAK,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9D,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7B,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;gBAChF,aAAa,EAAE,CAAC;gBAEhB,wBAAwB;gBACxB,OAAO,CAAC,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC;gBAC9B,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAEnB,IAAA,sBAAQ,EAAC,0BAA0B,OAAO,CAAC,QAAQ,kBAAkB,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;YAC5G,CAAC;QACL,CAAC;QAED,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;IAC3C,CAAC;IAED;;OAEG;IACI,YAAY,CAAC,IAAY;QAC5B,sBAAsB;QACtB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtC,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC;YAChB,CAAC;QACL,CAAC;QAED,0BAA0B;QAC1B,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;YAChD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC;YAChB,CAAC;QACL,CAAC;QAED,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;OAEG;IACI,QAAQ;QAOX,MAAM,UAAU,GAA2B,EAAE,CAAC;QAC9C,IAAI,UAAU,GAAgB,IAAI,CAAC;QACnC,IAAI,UAAU,GAAgB,IAAI,CAAC;QACnC,IAAI,aAAa,GAAsB,IAAI,CAAC;QAC5C,IAAI,aAAa,GAAsB,IAAI,CAAC;QAC5C,IAAI,QAAQ,GAAG,CAAC,CAAC;QAEjB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9C,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAEvE,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,GAAG,UAAU,EAAE,CAAC;gBACjD,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;gBAChC,aAAa,GAAG,OAAO,CAAC;YAC5B,CAAC;YAED,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,GAAG,UAAU,EAAE,CAAC;gBACjD,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;gBAChC,aAAa,GAAG,OAAO,CAAC;YAC5B,CAAC;YAED,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAC1D,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QACpC,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB;QAEtF,OAAO;YACH,SAAS,EAAE,KAAK;YAChB,UAAU;YACV,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;gBACvB,QAAQ,EAAE,aAAa,CAAC,QAAQ;gBAChC,UAAU,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,EAAE;aAC5E,CAAC,CAAC,CAAC,SAAS;YACb,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;gBACvB,QAAQ,EAAE,aAAa,CAAC,QAAQ;gBAChC,UAAU,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,EAAE;aAC5E,CAAC,CAAC,CAAC,SAAS;YACb,UAAU;SACb,CAAC;IACN,CAAC;IAED;;OAEG;IACI,UAAU,CAAC,aAAqB;QAMnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC;QAC3C,MAAM,OAAO,GAAe,EAAE,CAAC;QAE/B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9C,MAAM,GAAG,GAAG,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YAC/C,IAAI,GAAG,GAAG,QAAQ,EAAE,CAAC;gBACjB,OAAO,CAAC,IAAI,CAAC;oBACT,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,UAAU,EAAE,GAAG,GAAG,IAAI,GAAG,EAAE;oBAC3B,eAAe,EAAE,CAAC,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,EAAE;oBAC/D,QAAQ,EAAE,OAAO,CAAC,QAAQ;iBAC7B,CAAC,CAAC;YACP,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;OAGG;IACI,cAAc,CAAC,aAAqB;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC;QAC3C,MAAM,YAAY,GAAa,EAAE,CAAC;QAElC,KAAK,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9D,MAAM,GAAG,GAAG,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YAC/C,IAAI,GAAG,GAAG,QAAQ,EAAE,CAAC;gBACjB,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACnC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC7B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAA,sBAAQ,EAAC,4BAA4B,YAAY,CAAC,MAAM,sBAAsB,aAAa,UAAU,CAAC,CAAC;QAC3G,CAAC;QAED,OAAO,YAAY,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACI,iBAAiB,CAAC,aAAqB;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC;QAC3C,MAAM,YAAY,GAAa,EAAE,CAAC;QAElC,KAAK,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9D,MAAM,gBAAgB,GAAG,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC1D,IAAI,gBAAgB,GAAG,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACxD,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACnC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC7B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAA,sBAAQ,EAAC,4BAA4B,YAAY,CAAC,MAAM,gCAAgC,aAAa,WAAW,CAAC,CAAC;QACtH,CAAC;QAED,OAAO,YAAY,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED;;OAEG;IACI,SAAS,CAAC,WAAmB;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;IACnE,CAAC;IAED;;OAEG;IACI,cAAc;QAOjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAe,EAAE,CAAC;QAEhC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;gBACzD,UAAU,EAAE,CAAC,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,EAAE;gBAC5D,eAAe,EAAE,CAAC,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,EAAE;gBAC/D,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC7B,CAAC,CAAC;QACP,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,4BAA4B;IAC7F,CAAC;IAED;;OAEG;IACI,aAAa;QAUhB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAe,EAAE,CAAC;QAE5B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9C,IAAI,CAAC,IAAI,CAAC;gBACN,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;gBACzD,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC,EAAE,UAAU;gBAC7E,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC7B,CAAC,CAAC;QACP,CAAC;QAED,OAAO;YACH,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI;YAChC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,4BAA4B;SACxE,CAAC;IACN,CAAC;IAED;;OAEG;IACI,KAAK;QACR,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QACpC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACZ,IAAA,sBAAQ,EAAC,2BAA2B,KAAK,eAAe,CAAC,CAAC;QAC9D,CAAC;IACL,CAAC;IAED;;OAEG;IACI,sBAAsB,CAAC,OAAe;QACzC,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAEjE,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YACpB,IAAA,sBAAQ,EAAC,4CAA4C,aAAa,aAAa,CAAC,CAAC;QACrF,CAAC;QAED,OAAO,YAAY,CAAC;IACxB,CAAC;IAED;;OAEG;IACI,sBAAsB,CAAC,OAAe;QACzC,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAElE,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YACpB,IAAA,sBAAQ,EAAC,4CAA4C,aAAa,aAAa,CAAC,CAAC;QACrF,CAAC;QAED,OAAO,YAAY,CAAC;IACxB,CAAC;CACJ;AA5YD,4BA4YC"}

package/dist/local-vault.d.ts

@@ -0,0 +1,195 @@
+/**
+ * Local Vault for Gateway Type 3
+ *
+ * TWO-PART ARCHITECTURE:
+ *
+ * Part 1: Clear Text Configuration (.vault/config.json)
+ * - Human-readable JSON
+ * - Maps provider names to connection_id UUIDs
+ * - Editable by users
+ * - NOT encrypted
+ *
+ * Part 2: Encrypted Keystore (.vault/keystore.enc)
+ * - AES-256-GCM encrypted credentials
+ * - Base64-encoded for readability
+ * - Header with DO NOT EDIT warnings
+ * - Maps connection_id to API keys
+ *
+ * Key Features:
+ * - Separation of configuration and secrets
+ * - Clear warnings against manual keystore edits
+ * - User-friendly configuration editing
+ * - Secure credential storage
+ */
+export declare class LocalVault {
+    private static instances;
+    private vaultDir;
+    private configPath;
+    private keystorePath;
+    private masterKey;
+    private cache;
+    private config;
+    private algorithm;
+    private userId?;
+    constructor(config: {
+        vaultPath?: string;
+        masterPassword?: string;
+        userId?: string;
+    });
+    /**
+     * Get singleton instance for a specific user
+     * Uses ~/.langmart/users/<userId> as vault directory for user-specific storage
+     *
+     * @param userId - User ID (optional for backward compatibility)
+     */
+    static getInstance(userId?: string): LocalVault;
+    /**
+     * Reset singleton instance (for testing)
+     */
+    static resetInstance(userId?: string): void;
+    /**
+     * Reset all singleton instances (for testing)
+     */
+    static resetAllInstances(): void;
+    /**
+     * Get the user ID associated with this vault
+     */
+    getUserId(): string | undefined;
+    /**
+     * Get the vault directory path
+     */
+    getVaultPath(): string;
+    /**
+     * Check if legacy vault exists (data in ~/.langmart/ instead of ~/.langmart/users/<userId>/)
+     */
+    static hasLegacyVault(): boolean;
+    /**
+     * Migrate legacy vault data to user-specific vault
+     * Call this after validating the API key to get the user ID
+     *
+     * @param userId - User ID to migrate data to
+     * @returns true if migration was successful, false if no legacy data found
+     */
+    static migrateLegacyVault(userId: string): Promise<boolean>;
+    /**
+     * Store API key for an access point
+     * @param accessPointId - UUID of the access point
+     * @param apiKey - Provider API key
+     * @param provider - Optional provider name for config mapping
+     * @param description - Optional description for config
+     */
+    setCredential(accessPointId: string, apiKey: string, provider?: string, description?: string): Promise<void>;
+    /**
+     * Get API key for an access point
+     * @param accessPointId - UUID of the access point
+     */
+    getCredential(accessPointId: string): string | undefined;
+    /**
+     * Check if access point has credential
+     * @param accessPointId - UUID of the access point
+     */
+    hasCredential(accessPointId: string): boolean;
+    /**
+     * List all access point IDs with credentials
+     */
+    listAccessPoints(): string[];
+    /**
+     * Remove credential for an access point
+     * @param accessPointId - UUID of the access point
+     */
+    removeCredential(accessPointId: string): Promise<void>;
+    /**
+     * Clear all credentials
+     */
+    clearAll(): Promise<void>;
+    /**
+     * Store gateway authentication API key
+     * Special key stored with reserved ID '__gateway_auth__'
+     */
+    setAuthKey(apiKey: string): Promise<void>;
+    /**
+     * Get gateway authentication API key
+     */
+    getAuthKey(): string | undefined;
+    /**
+     * Check if gateway authentication key is stored
+     */
+    hasAuthKey(): boolean;
+    /**
+     * Remove gateway authentication key (logout)
+     */
+    removeAuthKey(): Promise<void>;
+    /**
+     * Load clear text configuration
+     */
+    private loadConfig;
+    /**
+     * Save clear text configuration
+     */
+    private saveConfig;
+    /**
+     * Load encrypted keystore
+     */
+    private loadKeystore;
+    /**
+     * Save encrypted keystore with header warnings
+     */
+    private saveKeystore;
+    /**
+     * Encrypt data using AES-256-GCM
+     */
+    private encrypt;
+    /**
+     * Decrypt data using AES-256-GCM
+     */
+    private decrypt;
+    /**
+     * Initialize vault with credentials from environment variables
+     * NOTE: This is for backward compatibility only
+     * In production, use connection_id as key, not provider names
+     * Example: vault.setCredential('uuid-of-connection', 'sk-...')
+     */
+    initializeFromEnvironment(): Promise<void>;
+    /**
+     * Export credentials (for backup - USE WITH CAUTION)
+     * Returns map of connection_id -> apiKey
+     */
+    export(): {
+        [accessPointId: string]: string;
+    };
+    /**
+     * Import credentials (for restore)
+     * @param credentials - Map of connection_id -> apiKey
+     */
+    import(credentials: {
+        [accessPointId: string]: string;
+    }): Promise<void>;
+}
+/**
+ * Usage Example (PRODUCTION):
+ *
+ * const vault = new LocalVault({
+ *     vaultPath: './.vault',
+ *     masterPassword: 'my-secure-password'
+ * });
+ *
+ * // Store credential using connection_id (from database) with provider mapping
+ * await vault.setCredential(
+ *     '12345678-1234-1234-1234-123456789abc',  // connection_id
+ *     'sk-...',                                  // API key
+ *     'groq',                                    // provider name (optional, for config)
+ *     'Groq production endpoint'                 // description (optional)
+ * );
+ *
+ * // Retrieve credential using connection_id
+ * const apiKey = vault.getCredential('12345678-1234-1234-1234-123456789abc');
+ *
+ * // Check available access points
+ * const accessPoints = vault.listAccessPoints();
+ * debugLog('Stored credentials for:', accessPoints);
+ *
+ * // Files created:
+ * // .vault/config.json - Clear text, editable, maps provider names to UUIDs
+ * // .vault/keystore.enc - Encrypted, base64-encoded, with DO NOT EDIT warnings
+ */ 
+//# sourceMappingURL=local-vault.d.ts.map

package/dist/local-vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-vault.d.ts","sourceRoot":"","sources":["../local-vault.ts"],"names":[],"mappings":"AA8BA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,UAAU;IACnB,OAAO,CAAC,MAAM,CAAC,SAAS,CAAsC;IAE9D,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,KAAK,CAAkC;IAC/C,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,SAAS,CAAiB;IAClC,OAAO,CAAC,MAAM,CAAC,CAAS;gBAEZ,MAAM,EAAE;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,CAAC,EAAE,MAAM,CAAC;KACnB;IAkDD;;;;;OAKG;WACW,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,UAAU;IA6BtD;;OAEG;WACW,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IAKlD;;OAEG;WACW,iBAAiB,IAAI,IAAI;IAIvC;;OAEG;IACI,SAAS,IAAI,MAAM,GAAG,SAAS;IAItC;;OAEG;IACI,YAAY,IAAI,MAAM;IAI7B;;OAEG;WACW,cAAc,IAAI,OAAO;IASvC;;;;;;OAMG;WACiB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAsExE;;;;;;OAMG;IACU,aAAa,CACtB,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,EACjB,WAAW,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC;IAoBhB;;;OAGG;IACI,aAAa,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI/D;;;OAGG;IACI,aAAa,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO;IAIpD;;OAEG;IACI,gBAAgB,IAAI,MAAM,EAAE;IAInC;;;OAGG;IACU,gBAAgB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBnE;;OAEG;IACU,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAQtC;;;OAGG;IACU,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBtD;;OAEG;IACI,UAAU,IAAI,MAAM,GAAG,SAAS;IAIvC;;OAEG;IACI,UAAU,IAAI,OAAO;IAI5B;;OAEG;IACU,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAM3C;;OAEG;IACH,OAAO,CAAC,UAAU;IAiBlB;;OAEG;YACW,UAAU;IAWxB;;OAEG;IACH,OAAO,CAAC,YAAY;IAkCpB;;OAEG;YACW,YAAY;IAuD1B;;OAEG;IACH,OAAO,CAAC,OAAO;IAaf;;OAEG;IACH,OAAO,CAAC,OAAO;IAcf;;;;;OAKG;IACU,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC;IAsBvD;;;OAGG;IACI,MAAM,IAAI;QAAE,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE;IAKpD;;;OAGG;IACU,MAAM,CAAC,WAAW,EAAE;QAAE,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAOvF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG"}