ragevault 0.2.3

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 SoyRage Agency
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,350 @@
+<div align="center">
+
+<a href="https://soyrage.es/">
+  <img src="./assets/soyrage-banner.svg" alt="SoyRage Agency — Full-Stack Developer × Infrastructure Engineer · soyrage.es" width="100%">
+</a>
+
+<br/>
+
+# 🔐 RageVault
+
+**Your passwords, self-hosted and end-to-end encrypted.**
+A password manager you *fully own* — CLI, a full-screen TUI, a self-hosted web UI
+and a browser extension. **Import your whole vault from Bitwarden / 1Password /
+Proton Pass in one drop**, then get categories & folders, user roles, a serious
+password generator, live 2FA codes, a WireGuard one-command setup — and only
+standard, auditable crypto (`scrypt` + `AES-256-GCM`).
+
+<br/>
+
+[![Release](https://github.com/soyrageagency/ragevault/actions/workflows/release.yml/badge.svg)](https://github.com/soyrageagency/ragevault/actions/workflows/release.yml)
+[![Crypto](https://img.shields.io/badge/crypto-scrypt%20%2B%20AES--256--GCM-3b9ee8)](./docs/ANALYSIS.md)
+[![Platforms](https://img.shields.io/badge/binaries-Windows%20·%20macOS%20·%20Linux-3b9ee8)](https://github.com/soyrageagency/ragevault/releases/latest)
+[![Node](https://img.shields.io/badge/Node-%3E%3D20-3c873a?logo=node.js&logoColor=white)](https://nodejs.org)
+[![License: MIT](https://img.shields.io/badge/License-MIT-green)](./LICENSE)
+
+### Designed, built & maintained by **[SoyRage Agency](https://soyrage.es/)** · **https://soyrage.es/**
+
+**⚡ New here? [Install in 60 seconds](#-install-in-60-seconds--plug--play-no-node-no-npm).**
+
+</div>
+
+---
+
+> ## ⚠️ Use a VPN. Seriously.
+> RageVault is **self-hosted** and meant to live on a **private network** — never
+> exposed to the open Internet. Run the built-in setup to put it behind a
+> WireGuard tunnel in one command:
+> ```bash
+> ragevault wg          # installs & configures WireGuard, prints a client QR
+> ```
+> It's **optional** — for purely local / personal use you don't need it — but if
+> the vault is reachable from another machine, put a tunnel in front of it.
+
+---
+
+## 📸 A look
+
+<div align="center">
+
+### Terminal dashboard — a searchable folder tree with a live detail panel (no shortcuts to learn)
+As you move, the right panel shows the item's URL, strength and a **live breach check** ([Have I Been Pwned](https://haveibeenpwned.com/Passwords), k-anonymity) — weak or leaked passwords are flagged in red with a one-click "regenerate".
+<img src="./assets/screenshots/tui-tree.png" alt="RageVault terminal UI — searchable folder tree with a live detail panel, strength and breach check, by SoyRage Agency" width="90%">
+
+**Type to search, ↑/↓ to move, Enter opens a menu** of actions — reveal, copy, copy 2FA, rename, regenerate, move, delete:
+<img src="./assets/screenshots/tui-vault.png" alt="RageVault terminal UI — per-item action menu, by SoyRage Agency" width="70%">
+
+### Self-hosted web UI — the SoyRage cream/ink/blue line
+A full-screen animated unlock, then your vault. Credential cards with the real **site favicon**, reveal / copy / live 2FA:
+<img src="./assets/screenshots/web-vault.png" alt="RageVault self-hosted web UI — credential cards with reveal / copy / 2FA, by SoyRage Agency" width="90%">
+
+### 🔁 Coming from another manager? One drop and you're in.
+**Export → drop the file → done.** RageVault auto-detects **Bitwarden, 1Password, Proton Pass, LastPass** and any CSV — no manual field mapping, and the file is parsed **locally** (nothing is uploaded):
+<img src="./assets/screenshots/web-import.png" alt="RageVault one-click import from Bitwarden, 1Password, Proton Pass, LastPass or CSV" width="90%">
+
+### Make it yours — themes, a guided tour & in-app settings
+Pick a theme (Cream, **Dark**, Midnight, Forest), change your master password, and a first-run **interactive tour** points out every feature:
+
+<table>
+<tr>
+<td width="50%" valign="top"><b>⚙️ Settings & themes</b><br/><img src="./assets/screenshots/web-settings.png" alt="RageVault settings — themes and change master password" width="100%"></td>
+<td width="50%" valign="top"><b>🧭 First-run guided tour</b><br/><img src="./assets/screenshots/web-tour.png" alt="RageVault interactive spotlight onboarding tour" width="100%"></td>
+</tr>
+<tr>
+<td width="50%" valign="top"><b>🌙 Dark theme</b><br/><img src="./assets/screenshots/web-dark.png" alt="RageVault dark theme vault" width="100%"></td>
+<td width="50%" valign="top"><b>📱 Mobile (responsive PWA)</b><br/><img src="./assets/screenshots/mobile.png" alt="RageVault on mobile — responsive web UI" width="60%"></td>
+</tr>
+</table>
+
+### Browser extension — auto-detects your server on the network
+A cinematic connect screen finds your self-hosted server, then one click copies, autofills or reads a 2FA code:
+
+<table>
+<tr>
+<td width="50%" valign="top"><b>🛰️ Auto-detect & unlock</b><br/><img src="./assets/screenshots/extension-connect.png" alt="RageVault extension auto-detecting the self-hosted server" width="70%"></td>
+<td width="50%" valign="top"><b>🧩 Fill for this site</b><br/><img src="./assets/screenshots/extension.png" alt="RageVault browser extension popup detecting github.com" width="70%"></td>
+</tr>
+</table>
+
+<sub>Unlock screens: <a href="./assets/screenshots/tui-unlock.png">TUI</a> · <a href="./assets/screenshots/web-unlock.png">web</a></sub>
+
+</div>
+
+---
+
+## What it is
+
+A password manager you **fully own**. The vault is a small encrypted file (or,
+soon, a self-hosted server): a KDF salt and two AES-256-GCM ciphertexts. Without
+your master password there is **nothing to read** — not even the titles.
+
+- **End-to-end encrypted** — `scrypt` (memory-hard KDF) derives a key that wraps a
+  random data key; **AES-256-GCM** encrypts everything, authenticated.
+- **Blur by default** — secrets show as `••••••`; you explicitly reveal or copy,
+  so nobody sees every password at a glance.
+- **Categories, folders, tags, favourites, password history.**
+- **Users & roles** — `owner / admin / member / viewer` with capability checks.
+- **Generator** — random, passphrase, or pronounceable, with a real entropy meter.
+- **No exotic dependencies** — the crypto is the Node standard library. Read it.
+
+Full design, threat model and the 30+-feature roadmap: **[docs/ANALYSIS.md](./docs/ANALYSIS.md)**.
+
+## ⬇️ Which download do I want?
+
+RageVault ships in a few shapes — they all open the **same encrypted vault**, so pick one or mix them:
+
+| You want… | Download | Who it's for |
+|---|---|---|
+| **A desktop app** — a window with an icon, no terminal | **Windows:** `RageVault.Setup.<ver>.exe` · **macOS:** `RageVault-<ver>-arm64.dmg` · **Linux:** `RageVault-<ver>.AppImage` | 👉 Most people. Windows installs to Start menu + system tray. |
+| **A self-hosted server / CLI / TUI** on a box you reach over VPN | `ragevault-<os>-x64` (one self-contained file) — or `npx ragevault` if you have Node | Home-labbers. Run `ragevault serve` or the terminal UI. |
+| **Autofill in your browser** | `ragevault-extension.zip` | Anyone — it auto-detects your server and fills logins. |
+| **Your phone** | `ragevault-<ver>.apk` (Android) — or add the web UI to your home screen (PWA) | Android users. Enable "install unknown apps" to sideload. |
+
+## 🖥️ Desktop app (Windows) — double-click and go
+
+Prefer a real app window over the terminal? The **RageVault desktop app** is a normal
+Windows program: install it, launch it from the Start menu, and your vault opens in
+its **own window with the RageVault icon** — no console, no config. It runs the
+encrypted server privately in the background (loopback only) and stores your data in
+your user profile.
+
+<div align="center">
+
+[![Windows app](https://img.shields.io/badge/⬇%20Windows-Installer%20(.exe)-0078D6?logo=windows&logoColor=white&style=for-the-badge)](https://github.com/soyrageagency/ragevault/releases/latest/download/RageVault.Setup.0.2.3.exe)
+[![macOS app](https://img.shields.io/badge/⬇%20macOS-Apple%20Silicon%20(.dmg)-000000?logo=apple&logoColor=white&style=for-the-badge)](https://github.com/soyrageagency/ragevault/releases/latest/download/RageVault-0.2.3-arm64.dmg)
+[![Linux app](https://img.shields.io/badge/⬇%20Linux-AppImage-FCC624?logo=linux&logoColor=black&style=for-the-badge)](https://github.com/soyrageagency/ragevault/releases/latest/download/RageVault-0.2.3.AppImage)
+[![Android app](https://img.shields.io/badge/⬇%20Android-APK-3DDC84?logo=android&logoColor=white&style=for-the-badge)](https://github.com/soyrageagency/ragevault/releases/latest/download/ragevault-v0.2.3.apk)
+
+<sub>Lives in the **system tray**, shows native notifications for updates, and first run walks you through a **“create your vault”** screen + a guided tour. **macOS** (`.dmg`, Apple Silicon) and **Linux** (`.AppImage`) builds are on the [latest release](https://github.com/soyrageagency/ragevault/releases/latest) too (unsigned — right-click → Open on macOS).</sub>
+
+</div>
+
+## ⚡ Or the CLI / server — one self-contained file, no Node, no npm
+
+The command-line + self-hosted-server build is **one file** per device (Windows, macOS, Linux). Ideal for a home-lab box you reach over your VPN, or the terminal/TUI.
+
+### ⬇️ Download for your device
+
+<div align="center">
+
+[![Windows](https://img.shields.io/badge/Download-Windows%20x64-0078D6?logo=windows&logoColor=white&style=for-the-badge)](https://github.com/soyrageagency/ragevault/releases/latest/download/ragevault-windows-x64.exe)
+[![macOS Apple Silicon](https://img.shields.io/badge/Download-macOS%20arm64-000000?logo=apple&logoColor=white&style=for-the-badge)](https://github.com/soyrageagency/ragevault/releases/latest/download/ragevault-macos-arm64)
+[![macOS Intel](https://img.shields.io/badge/Download-macOS%20x64-555555?logo=apple&logoColor=white&style=for-the-badge)](https://github.com/soyrageagency/ragevault/releases/latest/download/ragevault-macos-x64)
+[![Linux](https://img.shields.io/badge/Download-Linux%20x64-FCC624?logo=linux&logoColor=black&style=for-the-badge)](https://github.com/soyrageagency/ragevault/releases/latest/download/ragevault-linux-x64)
+
+<sub>…or see all files & the changelog on the **[latest release](https://github.com/soyrageagency/ragevault/releases/latest)**. macOS/Linux: `chmod +x <file> && ./<file>`.</sub>
+
+</div>
+
+### 🟢 Or one command (auto-downloads + adds to PATH)
+
+<table>
+<tr><td><b>🪟 Windows</b><br/><sub>PowerShell</sub></td><td>
+
+```powershell
+irm https://raw.githubusercontent.com/soyrageagency/ragevault/main/scripts/install.ps1 | iex
+```
+</td></tr>
+<tr><td><b>🍎 macOS · 🐧 Linux</b><br/><sub>Terminal</sub></td><td>
+
+```sh
+curl -fsSL https://raw.githubusercontent.com/soyrageagency/ragevault/main/scripts/install.sh | sh
+```
+</td></tr>
+</table>
+
+### 🟣 Or, if you already have Node
+
+```sh
+npx ragevault            # run it once, no install
+npm i -g ragevault       # or install the command globally
+```
+
+### 🔵 Or download the binary by hand
+
+Grab the file for your device from the [**latest release**](https://github.com/soyrageagency/ragevault/releases/latest), make it runnable, and go:
+
+| Device | File | Run it |
+|---|---|---|
+| Windows 64-bit | `ragevault-windows-x64.exe` | double-click, or `.\ragevault-windows-x64.exe` |
+| macOS (Apple Silicon) | `ragevault-macos-arm64` | `chmod +x ragevault-macos-arm64 && ./ragevault-macos-arm64` |
+| macOS (Intel) | `ragevault-macos-x64` | `chmod +x … && ./ragevault-macos-x64` |
+| Linux 64-bit | `ragevault-linux-x64` | `chmod +x ragevault-linux-x64 && ./ragevault-linux-x64` |
+
+> Re-run the installer any time to update — and RageVault tells you in-app when a new version ships.
+
+## 🚀 First run — a guided 3-step wizard
+
+Just type `ragevault` (or the binary name). It walks you through everything — **no config files, ever**:
+
+```text
+1)  ragevault init      →  names your vault, asks you to set a master password
+                           (twice), and creates the encrypted file. That's it.
+
+2)  ragevault add       →  a friendly prompt: title, username, URL — then offers
+                           to *generate* a strong password for you. Repeat freely.
+
+3)  ragevault tui       →  the full-screen dashboard. Arrow keys to move, r to
+                           reveal, c to copy, t for a 2FA code, l to lock, q to quit.
+```
+
+Prefer a browser? `ragevault serve` opens the web UI at `http://127.0.0.1:8722`, and the [browser extension](./extension) autofills logins. Want it reachable from your phone/laptop safely? `ragevault wg` sets up WireGuard and prints a QR to scan — **optional, and skippable for personal use.**
+
+Your vault lives at `~/.ragevault/vault.ragevault` (override with `RAGEVAULT_HOME`), written owner-readable only. Back it up any time with `ragevault backup`.
+
+## 📱 On your phone (Android & iOS) — install the app
+
+RageVault's web UI is an **installable app (PWA)** — no store, no APK sideloading:
+
+1. On the machine that holds your vault, run `ragevault serve` (ideally behind your VPN — `ragevault wg`).
+2. On your phone's browser, open the server's address (e.g. `http://10.72.0.1:8722` over WireGuard).
+3. **Chrome/Android:** menu → **"Install app"** / "Add to Home screen". **Safari/iOS:** Share → **"Add to Home Screen"**.
+
+It launches full-screen like a native app, with the RageVault icon. Your data stays on **your** server.
+
+> **Prefer a real `.apk`?** Download **`ragevault-<ver>.apk`** from the [latest release](https://github.com/soyrageagency/ragevault/releases/latest) (built on CI) and sideload it — enable "Install unknown apps" for your browser/files app. It's a thin, secure shell that opens your self-hosted vault. Source + signed-build steps: [`mobile/`](./mobile) and **[docs/ANDROID.md](./docs/ANDROID.md)**.
+
+## 🔁 Switch in seconds — import from anywhere
+
+Leaving another manager shouldn't be a chore. RageVault reads the export files the big managers already give you and **detects the format for you** — no column-mapping, no cleanup.
+
+| Coming from | Export you give RageVault |
+|---|---|
+| 🟦 **Bitwarden** | *Tools → Export vault* → **`.json`** |
+| ⬛ **1Password** | export a vault as **`.csv`** |
+| 🟪 **Proton Pass** | *Settings → Export* → **`.json`** |
+| 🟥 **LastPass** | *Advanced → Export* → **`.csv`** |
+| ⬜ **Anything else** | any **`.csv`** with url/username/password columns |
+
+**In the web UI:** unlock → **↓ Import** → drop the file. **On the CLI:**
+
+```bash
+ragevault import bitwarden-export.json     # auto-detects Bitwarden/1Password/Proton/LastPass/CSV
+```
+
+Everything is parsed **on your machine** — the file never leaves it.
+
+## 🧩 Browser extension — install in 3 steps
+
+Detect the current site, copy or **autofill** credentials, grab a **2FA** code, and generate passwords — right from the toolbar.
+
+<div align="center">
+
+[![Download extension](https://img.shields.io/badge/⬇%20Download-Browser%20extension%20(.zip)-3b9ee8?style=for-the-badge)](https://github.com/soyrageagency/ragevault/releases/latest/download/ragevault-extension.zip)
+
+<img src="./assets/screenshots/extension.png" alt="RageVault browser extension popup" width="330">
+
+</div>
+
+1. **Download** `ragevault-extension.zip` (button above) and **unzip** it.
+2. **Chrome / Edge / Brave:** open `chrome://extensions`, turn on **Developer mode**, click **Load unpacked**, pick the unzipped folder. *(Firefox: `about:debugging` → Load Temporary Add-on → pick `manifest.json`.)*
+3. Click the RageVault icon, enter your server address + master password — done.
+
+> Extensions can only be truly one-click from the Chrome Web Store / Firefox AMO (store publishing is on the roadmap). Until then, the unpacked install above takes about 20 seconds.
+
+<details><summary><b>Run from source instead (developers)</b></summary>
+
+```bash
+npm install && npm run build
+node dist/ragevault.js init        # or: npm run dev
+npm test                           # 14 crypto/vault/TOTP tests
+npm run build:release              # cross-build binaries for all 4 devices → build/release/
+```
+</details>
+
+## Security at a glance
+
+| Property | How |
+|---|---|
+| Key derivation | `scrypt`, N=2¹⁶, per-vault random salt (params stored & upgradable) |
+| Encryption | `AES-256-GCM`, random 96-bit IV per record, AAD-bound |
+| Key hierarchy | master → KEK → wraps a random DEK (password change ≠ re-encrypt everything) |
+| Integrity | GCM auth tag — wrong password / tampering **fails loudly** |
+| At rest | only salt + ciphertext on disk; **no plaintext leak** (tested) |
+| Verified | `npm test` — 14 crypto / vault / TOTP tests (round-trip, wrong-pw, tamper, re-wrap, RFC 6238 vectors) |
+
+> RageVault is young (v0.2). The cryptographic core is standard and tested, but
+> please review the code and threat model before trusting it with production
+> secrets — and keep it behind that VPN.
+
+## What's inside (already shipped)
+
+End-to-end encrypted vault · categories · nested folders · tags & favourites ·
+password history · **users & roles** (owner/admin/member/viewer) · blur → reveal →
+copy everywhere · random / passphrase / pronounceable **generator** with an entropy
+meter · **live TOTP 2FA codes** (RFC 6238) · **weak/reused/old health audit** + opt-in
+HIBP breach check · **one-drop import** (auto-detects Bitwarden/1Password/Proton Pass/LastPass/CSV)
++ JSON/CSV export · **encrypted backups** (backup/restore) · atomic crash-safe writes ·
+auto-lock + clipboard auto-clear · **privacy-preserving site favicons** (server-fetched
+& cached) · **custom emoji icons** · **4 themes** (Cream/Dark/Midnight/Forest) ·
+**change master password in-app** · **interactive first-run tour** · **Windows desktop
+app** (Electron) with **system tray + native update / broadcast notifications** ·
+**CLI · TUI · web UI · browser extension** (auto-detects your server) · WireGuard
+bootstrap · one-file standalone install + in-app update & global-announcement channel.
+
+**Roadmap:** per-user cryptographic sharing (X25519) · multi-device sync · expiring
+share links · custom item types & attachments · Android client · audit log. Full
+threat model, crypto design and the 35-item feature map: **[docs/ANALYSIS.md](./docs/ANALYSIS.md)**.
+
+---
+
+## 🤝 Free & open source
+
+RageVault is **100% free** and **MIT licensed** — no paywall, no "pro" tier, no telemetry. Read every line, self‑host it forever, and **contributions are very welcome**: open an issue, suggest a feature, or send a pull request.
+
+**Want to contribute?**
+```bash
+git clone https://github.com/soyrageagency/ragevault && cd ragevault
+npm install && npm run build && npm test     # 14 tests should pass
+npm run dev                                   # hack away
+```
+
+## 💙 Support the project
+
+RageVault is free and MIT licensed. If it protects your logins, you can [support development on PayPal](https://www.paypal.com/paypalme/soyrageagency) — a ⭐ on the repo helps just as much.
+
+---
+
+## 🖋️ Credits & License
+
+<div align="center">
+
+**Designed, built and maintained by [SoyRage Agency](https://soyrage.es/) — https://soyrage.es/**
+
+</div>
+
+Released under the **[MIT License](./LICENSE)** — use it, modify it, self-host it, ship it commercially.
+
+If you build something on top of it, a link back to [soyrage.es](https://soyrage.es/) is appreciated but never required.
+
+> 🛠️ Maintainer? See **[docs/MAINTAINERS.md](./docs/MAINTAINERS.md)** for how to broadcast announcements and ship updates through `updates.json`.
+
+> ⚠️ RageVault is a password manager and still young (v0.2). The cryptographic core is standard and tested, but review the code and the [threat model](./docs/ANALYSIS.md) before trusting it with production secrets — and keep it **behind your VPN**.
+
+<div align="center">
+
+**© 2026 SoyRage Agency — https://soyrage.es/**
+
+Made with ❤ in Valencia, Spain.
+
+</div>

package/dist/assets.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Bundled-asset access — works the same from `dist/` (with Node) or as a
+ * single-file standalone binary (Node SEA, no Node installed).
+ *
+ * When packaged, the web UI assets and the update channel are read from the SEA
+ * blob; otherwise from disk.
+ *
+ * Part of RageVault.
+ * Crafted by SoyRage Agency — https://soyrage.es/
+ * MIT licensed (see LICENSE).
+ */
+export declare function isPackaged(): boolean;
+export declare function readAssetBuffer(key: string, diskPath: string): Buffer;
+export declare function readAssetText(key: string, diskPath: string): string | null;

package/dist/assets.js

@@ -0,0 +1,47 @@
+/**
+ * Bundled-asset access — works the same from `dist/` (with Node) or as a
+ * single-file standalone binary (Node SEA, no Node installed).
+ *
+ * When packaged, the web UI assets and the update channel are read from the SEA
+ * blob; otherwise from disk.
+ *
+ * Part of RageVault.
+ * Crafted by SoyRage Agency — https://soyrage.es/
+ * MIT licensed (see LICENSE).
+ */
+import { readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+let seaMod = null;
+try {
+    const require = createRequire(import.meta.url);
+    seaMod = require("node:sea");
+}
+catch {
+    seaMod = null;
+}
+export function isPackaged() {
+    try {
+        return Boolean(seaMod?.isSea());
+    }
+    catch {
+        return false;
+    }
+}
+export function readAssetBuffer(key, diskPath) {
+    if (seaMod && isPackaged()) {
+        try {
+            return Buffer.from(seaMod.getRawAsset(key));
+        }
+        catch { /* fall through */ }
+    }
+    return readFileSync(diskPath);
+}
+export function readAssetText(key, diskPath) {
+    try {
+        return readAssetBuffer(key, diskPath).toString("utf8");
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=assets.js.map

package/dist/assets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets.js","sourceRoot":"","sources":["../src/assets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAI5C,IAAI,MAAM,GAAkB,IAAI,CAAC;AACjC,IAAI,CAAC;IACH,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,GAAG,OAAO,CAAC,UAAU,CAAW,CAAC;AACzC,CAAC;AAAC,MAAM,CAAC;IACP,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QAAC,OAAO,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,QAAgB;IAC3D,IAAI,MAAM,IAAI,UAAU,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC;YAAC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,QAAgB;IACzD,IAAI,CAAC;QAAC,OAAO,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AACxF,CAAC"}

package/dist/audit.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Password health audit — the "how bad is my hygiene?" report everyone wants.
+ *
+ *   • Weak     — low estimated entropy.
+ *   • Reused   — the same password across two or more items.
+ *   • Old      — not changed in over a year.
+ *   • Breached — optional, opt-in: checked against Have I Been Pwned using
+ *                k-anonymity (only the first 5 chars of the SHA-1 hash ever leave
+ *                the machine; the full password never does).
+ *
+ * Part of RageVault.
+ * Crafted by SoyRage Agency — https://soyrage.es/
+ * MIT licensed (see LICENSE).
+ */
+import type { VaultData } from "./model.js";
+export interface Finding {
+    itemId: string;
+    title: string;
+    issues: string[];
+}
+export interface AuditReport {
+    total: number;
+    weak: number;
+    reused: number;
+    old: number;
+    findings: Finding[];
+}
+/** The offline audit — weak, reused and old passwords. */
+export declare function auditVault(data: VaultData, nowMs?: number): AuditReport;
+/**
+ * Opt-in breach check via HIBP's range API (k-anonymity). Returns how many times
+ * the password appears in known breaches (0 = not found). Never sends the
+ * password — only the 5-char SHA-1 prefix.
+ */
+export declare function breachCount(password: string, timeoutMs?: number): Promise<number>;

package/dist/audit.js

@@ -0,0 +1,79 @@
+/**
+ * Password health audit — the "how bad is my hygiene?" report everyone wants.
+ *
+ *   • Weak     — low estimated entropy.
+ *   • Reused   — the same password across two or more items.
+ *   • Old      — not changed in over a year.
+ *   • Breached — optional, opt-in: checked against Have I Been Pwned using
+ *                k-anonymity (only the first 5 chars of the SHA-1 hash ever leave
+ *                the machine; the full password never does).
+ *
+ * Part of RageVault.
+ * Crafted by SoyRage Agency — https://soyrage.es/
+ * MIT licensed (see LICENSE).
+ */
+import { createHash } from "node:crypto";
+import { estimateStrength } from "./generator.js";
+const YEAR_MS = 365 * 24 * 60 * 60 * 1000;
+/** The offline audit — weak, reused and old passwords. */
+export function auditVault(data, nowMs = Date.now()) {
+    const counts = new Map();
+    for (const i of data.items)
+        if (i.password)
+            counts.set(i.password, (counts.get(i.password) ?? 0) + 1);
+    const findings = [];
+    let weak = 0, reused = 0, old = 0;
+    for (const i of data.items) {
+        if (!i.password)
+            continue;
+        const issues = [];
+        if (estimateStrength(i.password).bits < 50) {
+            issues.push("weak");
+            weak++;
+        }
+        if ((counts.get(i.password) ?? 0) > 1) {
+            issues.push("reused");
+            reused++;
+        }
+        if (nowMs - Date.parse(i.updatedAt || i.createdAt) > YEAR_MS) {
+            issues.push("old");
+            old++;
+        }
+        if (issues.length)
+            findings.push({ itemId: i.id, title: i.title, issues });
+    }
+    return { total: data.items.length, weak, reused, old, findings };
+}
+/**
+ * Opt-in breach check via HIBP's range API (k-anonymity). Returns how many times
+ * the password appears in known breaches (0 = not found). Never sends the
+ * password — only the 5-char SHA-1 prefix.
+ */
+export async function breachCount(password, timeoutMs = 4000) {
+    const sha1 = createHash("sha1").update(password, "utf8").digest("hex").toUpperCase();
+    const prefix = sha1.slice(0, 5), suffix = sha1.slice(5);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const res = await fetch(`https://api.pwnedpasswords.com/range/${prefix}`, {
+            signal: controller.signal,
+            headers: { "Add-Padding": "true", "user-agent": "RageVault" },
+        });
+        if (!res.ok)
+            return -1;
+        const text = await res.text();
+        for (const line of text.split("\n")) {
+            const [suf, count] = line.trim().split(":");
+            if (suf === suffix)
+                return Number(count) || 0;
+        }
+        return 0;
+    }
+    catch {
+        return -1; // unknown (offline / blocked)
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+//# sourceMappingURL=audit.js.map

package/dist/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAiBlD,MAAM,OAAO,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE1C,0DAA0D;AAC1D,MAAM,UAAU,UAAU,CAAC,IAAe,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;IAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,CAAC,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEtG,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,IAAI,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,CAAC,QAAQ;YAAE,SAAS;QAC1B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAAC,IAAI,EAAE,CAAC;QAAC,CAAC;QAC5E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAC,MAAM,EAAE,CAAC;QAAC,CAAC;QAC3E,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC,GAAG,OAAO,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAC,GAAG,EAAE,CAAC;QAAC,CAAC;QAC5F,IAAI,MAAM,CAAC,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,SAAS,GAAG,IAAI;IAClE,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACrF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,wCAAwC,MAAM,EAAE,EAAE;YACxE,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,CAAC,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5C,IAAI,GAAG,KAAK,MAAM;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC,CAAC,CAAC,8BAA8B;IAC3C,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC"}

package/dist/branding.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Branding & identity.
+ *
+ * Single source of truth for the project identity carried by RageVault: the
+ * startup banner and the version string.
+ *
+ * Part of RageVault.
+ * Crafted by SoyRage Agency — https://soyrage.es/
+ * MIT licensed (see LICENSE).
+ */
+/** Identity of the project's author. */
+export declare const BRAND: Readonly<{
+    product: "RageVault";
+    author: "SoyRage Agency";
+    url: "https://soyrage.es/";
+    donate: "https://www.paypal.com/paypalme/soyrageagency";
+    tagline: "Your passwords, self-hosted and end-to-end encrypted.";
+    version: "0.2.3";
+}>;
+/**
+ * The SoyRage minimalist palette, mirrored from the web/panel line:
+ * cream background, ink text, a single blue accent. Used by the web UI's CSS
+ * variables and, in spirit, by the TUI's 256-colour accent.
+ */
+export declare const PALETTE: Readonly<{
+    cream: "#f3f1ea";
+    ink: "#111111";
+    accent: "#3b9ee8";
+    green: "#3a8f5c";
+    amber: "#b8892a";
+    red: "#c8524a";
+}>;
+/** ASCII welcome banner (ANSI Shadow style). */
+export declare const ASCII_BANNER: string;
+/** The full welcome block, banner + credits. */
+export declare function welcomeBlock(): string;

package/dist/branding.js

@@ -0,0 +1,55 @@
+/**
+ * Branding & identity.
+ *
+ * Single source of truth for the project identity carried by RageVault: the
+ * startup banner and the version string.
+ *
+ * Part of RageVault.
+ * Crafted by SoyRage Agency — https://soyrage.es/
+ * MIT licensed (see LICENSE).
+ */
+/** Identity of the project's author. */
+export const BRAND = Object.freeze({
+    product: "RageVault",
+    author: "SoyRage Agency",
+    url: "https://soyrage.es/",
+    donate: "https://www.paypal.com/paypalme/soyrageagency",
+    tagline: "Your passwords, self-hosted and end-to-end encrypted.",
+    version: "0.2.3",
+});
+/**
+ * The SoyRage minimalist palette, mirrored from the web/panel line:
+ * cream background, ink text, a single blue accent. Used by the web UI's CSS
+ * variables and, in spirit, by the TUI's 256-colour accent.
+ */
+export const PALETTE = Object.freeze({
+    cream: "#f3f1ea",
+    ink: "#111111",
+    accent: "#3b9ee8",
+    green: "#3a8f5c",
+    amber: "#b8892a",
+    red: "#c8524a",
+});
+/** ASCII welcome banner (ANSI Shadow style). */
+export const ASCII_BANNER = String.raw `
+ ██████╗  █████╗  ██████╗ ███████╗██╗   ██╗ █████╗ ██╗   ██╗██╗  ████████╗
+ ██╔══██╗██╔══██╗██╔════╝ ██╔════╝██║   ██║██╔══██╗██║   ██║██║  ╚══██╔══╝
+ ██████╔╝███████║██║  ███╗█████╗  ██║   ██║███████║██║   ██║██║     ██║
+ ██╔══██╗██╔══██║██║   ██║██╔══╝  ╚██╗ ██╔╝██╔══██║██║   ██║██║     ██║
+ ██║  ██║██║  ██║╚██████╔╝███████╗ ╚████╔╝ ██║  ██║╚██████╔╝███████╗██║
+ ╚═╝  ╚═╝╚═╝  ╚═╝ ╚═════╝ ╚══════╝  ╚═══╝  ╚═╝  ╚═╝ ╚═════╝ ╚══════╝╚═╝
+             R A G E V A U L T   ·   self-hosted secrets
+        ~ End-to-end encrypted. Behind your VPN. Owned by you. ~
+`;
+/** The full welcome block, banner + credits. */
+export function welcomeBlock() {
+    return [
+        ASCII_BANNER,
+        `  ${BRAND.product} v${BRAND.version}`,
+        `  Crafted with care by ${BRAND.author} — ${BRAND.url}`,
+        "  Free and open source under the MIT License.",
+        `  Support the project: ${BRAND.donate}`,
+        "",
+    ].join("\n");
+}
+//# sourceMappingURL=branding.js.map