ragevault 0.2.3

package/dist/branding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"branding.js","sourceRoot":"","sources":["../src/branding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,wCAAwC;AACxC,MAAM,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;IACjC,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,gBAAgB;IACxB,GAAG,EAAE,qBAAqB;IAC1B,MAAM,EAAE,+CAA+C;IACvD,OAAO,EAAE,uDAAuD;IAChE,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;IACnC,KAAK,EAAE,SAAS;IAChB,GAAG,EAAE,SAAS;IACd,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,SAAS;IAChB,KAAK,EAAE,SAAS;IAChB,GAAG,EAAE,SAAS;CACf,CAAC,CAAC;AAEH,gDAAgD;AAChD,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;CASrC,CAAC;AAEF,gDAAgD;AAChD,MAAM,UAAU,YAAY;IAC1B,OAAO;QACL,YAAY;QACZ,KAAK,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE;QACtC,0BAA0B,KAAK,CAAC,MAAM,MAAM,KAAK,CAAC,GAAG,EAAE;QACvD,+CAA+C;QAC/C,0BAA0B,KAAK,CAAC,MAAM,EAAE;QACxC,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/crypto/cipher.d.ts

@@ -0,0 +1,74 @@
+/**
+ * The cryptographic core — deliberately small, standard, and auditable.
+ *
+ * RageVault never invents crypto. Everything here is a thin, well-labelled layer
+ * over Node's built-in primitives (no native or third-party crypto deps):
+ *
+ *   • Key derivation:  scrypt (memory-hard) turns the master password + a random
+ *     per-vault salt into a 256-bit Key-Encryption-Key (KEK). Parameters live in
+ *     the vault header so they can be raised over time.
+ *   • Key hierarchy:   a random 256-bit Data-Encryption-Key (DEK) actually
+ *     encrypts your secrets; it is *wrapped* (encrypted) by the KEK. Changing the
+ *     master password only re-wraps the DEK — it never re-encrypts every item.
+ *   • Encryption:      AES-256-GCM (authenticated) with a fresh random 96-bit IV
+ *     per operation. The GCM auth tag is what makes a wrong password or a tampered
+ *     file *fail loudly* instead of returning garbage.
+ *
+ * The server (when self-hosted) only ever stores ciphertext, the wrapped DEK and
+ * the KDF salt/params. Without the master password there is nothing to read.
+ *
+ * Part of RageVault.
+ * Crafted by SoyRage Agency — https://soyrage.es/
+ * MIT licensed (see LICENSE).
+ */
+/** Tunable scrypt parameters, stored per-vault so they can be upgraded. */
+export interface KdfParams {
+    algo: "scrypt";
+    /** CPU/memory cost — a power of two. 2^16 ≈ 64 MB per hash. */
+    N: number;
+    r: number;
+    p: number;
+    keyLen: number;
+}
+/** OWASP-aligned defaults tuned for an interactive unlock (~sub-second). */
+export declare const DEFAULT_KDF: KdfParams;
+/** An authenticated ciphertext blob. All fields are base64. */
+export interface Sealed {
+    /** 96-bit random nonce. */
+    iv: string;
+    /** 128-bit GCM authentication tag. */
+    tag: string;
+    /** The ciphertext. */
+    ct: string;
+}
+/** A fresh random salt for the KDF (128-bit). */
+export declare function newSalt(): Buffer;
+/** A fresh random Data-Encryption-Key (256-bit). */
+export declare function newKey(): Buffer;
+/**
+ * Derive the 256-bit Key-Encryption-Key from the master password and salt.
+ * scrypt is memory-hard, so it resists GPU/ASIC brute-forcing far better than a
+ * plain hash. `maxmem` is raised to fit the chosen N.
+ */
+export declare function deriveKek(password: string, salt: Buffer, params?: KdfParams): Buffer;
+/**
+ * Encrypt (`seal`) a plaintext with a 256-bit key using AES-256-GCM.
+ * `aad` (additional authenticated data) binds the ciphertext to a context — e.g.
+ * an item id — so blobs can't be swapped between records undetected.
+ */
+export declare function seal(plaintext: string | Buffer, key: Buffer, aad?: string): Sealed;
+/**
+ * Decrypt (`open`) a sealed blob. Throws if the key is wrong, the `aad` differs,
+ * or the ciphertext was tampered with — GCM verifies integrity for us.
+ */
+export declare function open(sealed: Sealed, key: Buffer, aad?: string): Buffer;
+/** Convenience: open a sealed blob and return UTF-8 text. */
+export declare function openText(sealed: Sealed, key: Buffer, aad?: string): string;
+/** Wrap (encrypt) the DEK with the KEK. */
+export declare function wrapKey(dek: Buffer, kek: Buffer): Sealed;
+/** Unwrap the DEK with the KEK. Throws on a wrong master password. */
+export declare function unwrapKey(wrapped: Sealed, kek: Buffer): Buffer;
+/** Constant-time buffer comparison (for tokens / verifiers). */
+export declare function safeEqual(a: Buffer, b: Buffer): boolean;
+/** Best-effort wipe of a key buffer once we're done with it. */
+export declare function wipe(buf: Buffer): void;

package/dist/crypto/cipher.js

@@ -0,0 +1,95 @@
+/**
+ * The cryptographic core — deliberately small, standard, and auditable.
+ *
+ * RageVault never invents crypto. Everything here is a thin, well-labelled layer
+ * over Node's built-in primitives (no native or third-party crypto deps):
+ *
+ *   • Key derivation:  scrypt (memory-hard) turns the master password + a random
+ *     per-vault salt into a 256-bit Key-Encryption-Key (KEK). Parameters live in
+ *     the vault header so they can be raised over time.
+ *   • Key hierarchy:   a random 256-bit Data-Encryption-Key (DEK) actually
+ *     encrypts your secrets; it is *wrapped* (encrypted) by the KEK. Changing the
+ *     master password only re-wraps the DEK — it never re-encrypts every item.
+ *   • Encryption:      AES-256-GCM (authenticated) with a fresh random 96-bit IV
+ *     per operation. The GCM auth tag is what makes a wrong password or a tampered
+ *     file *fail loudly* instead of returning garbage.
+ *
+ * The server (when self-hosted) only ever stores ciphertext, the wrapped DEK and
+ * the KDF salt/params. Without the master password there is nothing to read.
+ *
+ * Part of RageVault.
+ * Crafted by SoyRage Agency — https://soyrage.es/
+ * MIT licensed (see LICENSE).
+ */
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
+/** OWASP-aligned defaults tuned for an interactive unlock (~sub-second). */
+export const DEFAULT_KDF = { algo: "scrypt", N: 1 << 16, r: 8, p: 1, keyLen: 32 };
+const IV_LEN = 12; // 96-bit nonce, the GCM standard
+/** A fresh random salt for the KDF (128-bit). */
+export function newSalt() {
+    return randomBytes(16);
+}
+/** A fresh random Data-Encryption-Key (256-bit). */
+export function newKey() {
+    return randomBytes(32);
+}
+/**
+ * Derive the 256-bit Key-Encryption-Key from the master password and salt.
+ * scrypt is memory-hard, so it resists GPU/ASIC brute-forcing far better than a
+ * plain hash. `maxmem` is raised to fit the chosen N.
+ */
+export function deriveKek(password, salt, params = DEFAULT_KDF) {
+    const maxmem = 256 * params.N * params.r; // headroom over scrypt's 128*N*r footprint
+    return scryptSync(password.normalize("NFKC"), salt, params.keyLen, {
+        N: params.N,
+        r: params.r,
+        p: params.p,
+        maxmem,
+    });
+}
+/**
+ * Encrypt (`seal`) a plaintext with a 256-bit key using AES-256-GCM.
+ * `aad` (additional authenticated data) binds the ciphertext to a context — e.g.
+ * an item id — so blobs can't be swapped between records undetected.
+ */
+export function seal(plaintext, key, aad) {
+    const iv = randomBytes(IV_LEN);
+    const cipher = createCipheriv("aes-256-gcm", key, iv);
+    if (aad)
+        cipher.setAAD(Buffer.from(aad, "utf8"));
+    const data = typeof plaintext === "string" ? Buffer.from(plaintext, "utf8") : plaintext;
+    const ct = Buffer.concat([cipher.update(data), cipher.final()]);
+    return { iv: iv.toString("base64"), tag: cipher.getAuthTag().toString("base64"), ct: ct.toString("base64") };
+}
+/**
+ * Decrypt (`open`) a sealed blob. Throws if the key is wrong, the `aad` differs,
+ * or the ciphertext was tampered with — GCM verifies integrity for us.
+ */
+export function open(sealed, key, aad) {
+    const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(sealed.iv, "base64"));
+    if (aad)
+        decipher.setAAD(Buffer.from(aad, "utf8"));
+    decipher.setAuthTag(Buffer.from(sealed.tag, "base64"));
+    return Buffer.concat([decipher.update(Buffer.from(sealed.ct, "base64")), decipher.final()]);
+}
+/** Convenience: open a sealed blob and return UTF-8 text. */
+export function openText(sealed, key, aad) {
+    return open(sealed, key, aad).toString("utf8");
+}
+/** Wrap (encrypt) the DEK with the KEK. */
+export function wrapKey(dek, kek) {
+    return seal(dek, kek, "ragevault:dek");
+}
+/** Unwrap the DEK with the KEK. Throws on a wrong master password. */
+export function unwrapKey(wrapped, kek) {
+    return open(wrapped, kek, "ragevault:dek");
+}
+/** Constant-time buffer comparison (for tokens / verifiers). */
+export function safeEqual(a, b) {
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+/** Best-effort wipe of a key buffer once we're done with it. */
+export function wipe(buf) {
+    buf.fill(0);
+}
+//# sourceMappingURL=cipher.js.map

package/dist/crypto/cipher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cipher.js","sourceRoot":"","sources":["../../src/crypto/cipher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAYzG,4EAA4E;AAC5E,MAAM,CAAC,MAAM,WAAW,GAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAY7F,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,iCAAiC;AAEpD,iDAAiD;AACjD,MAAM,UAAU,OAAO;IACrB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,MAAM;IACpB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,IAAY,EAAE,SAAoB,WAAW;IACvF,MAAM,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,2CAA2C;IACrF,OAAO,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE;QACjE,CAAC,EAAE,MAAM,CAAC,CAAC;QACX,CAAC,EAAE,MAAM,CAAC,CAAC;QACX,CAAC,EAAE,MAAM,CAAC,CAAC;QACX,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,IAAI,CAAC,SAA0B,EAAE,GAAW,EAAE,GAAY;IACxE,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,GAAG;QAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAChE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC/G,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,IAAI,CAAC,MAAc,EAAE,GAAW,EAAE,GAAY;IAC5D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;IACxF,IAAI,GAAG;QAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,GAAW,EAAE,GAAY;IAChE,OAAO,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACjD,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,OAAO,CAAC,GAAW,EAAE,GAAW;IAC9C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;AACzC,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,GAAW;IACpD,OAAO,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;AAC7C,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,SAAS,CAAC,CAAS,EAAE,CAAS;IAC5C,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,IAAI,CAAC,GAAW;IAC9B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACd,CAAC"}

package/dist/crypto/cipher.test.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Crypto core tests — the security guarantees, made executable.
+ * Run with: npm test   (node --test)
+ *
+ * Part of RageVault. Crafted by SoyRage Agency — https://soyrage.es/
+ */
+export {};

package/dist/crypto/cipher.test.js

@@ -0,0 +1,50 @@
+/**
+ * Crypto core tests — the security guarantees, made executable.
+ * Run with: npm test   (node --test)
+ *
+ * Part of RageVault. Crafted by SoyRage Agency — https://soyrage.es/
+ */
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { deriveKek, newKey, newSalt, open, openText, seal, unwrapKey, wrapKey } from "./cipher.js";
+// Fast params for tests — production uses N=2^16.
+const FAST = { algo: "scrypt", N: 1 << 10, r: 8, p: 1, keyLen: 32 };
+test("seal → open round-trips arbitrary data", () => {
+    const key = newKey();
+    const s = seal("hunter2 · 🔐 · ünïcode", key);
+    assert.equal(openText(s, key), "hunter2 · 🔐 · ünïcode");
+});
+test("open with the wrong key throws (GCM auth)", () => {
+    const s = seal("secret", newKey());
+    assert.throws(() => open(s, newKey()));
+});
+test("tampering with the ciphertext is detected", () => {
+    const key = newKey();
+    const s = seal("secret", key);
+    const bytes = Buffer.from(s.ct, "base64");
+    bytes[0] ^= 0xff;
+    assert.throws(() => open({ ...s, ct: bytes.toString("base64") }, key));
+});
+test("AAD mismatch is rejected", () => {
+    const key = newKey();
+    const s = seal("secret", key, "item:1");
+    assert.throws(() => open(s, key, "item:2"));
+});
+test("deriveKek is deterministic for the same password+salt, and salt-sensitive", () => {
+    const salt = newSalt();
+    const a = deriveKek("correct horse", salt, FAST);
+    const b = deriveKek("correct horse", salt, FAST);
+    const c = deriveKek("correct horse", newSalt(), FAST);
+    assert.ok(a.equals(b), "same inputs → same key");
+    assert.ok(!a.equals(c), "different salt → different key");
+});
+test("DEK wrap/unwrap round-trips; wrong password fails", () => {
+    const salt = newSalt();
+    const dek = newKey();
+    const kek = deriveKek("master", salt, FAST);
+    const wrapped = wrapKey(dek, kek);
+    assert.ok(unwrapKey(wrapped, kek).equals(dek), "correct KEK recovers the DEK");
+    const wrongKek = deriveKek("wrong", salt, FAST);
+    assert.throws(() => unwrapKey(wrapped, wrongKek), "wrong password cannot unwrap");
+});
+//# sourceMappingURL=cipher.test.js.map

package/dist/crypto/cipher.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cipher.test.js","sourceRoot":"","sources":["../../src/crypto/cipher.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAkB,MAAM,aAAa,CAAC;AAEnH,kDAAkD;AAClD,MAAM,IAAI,GAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAE/E,IAAI,CAAC,wCAAwC,EAAE,GAAG,EAAE;IAClD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,GAAG,IAAI,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IAC9C,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,wBAAwB,CAAC,CAAC;AAC3D,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2CAA2C,EAAE,GAAG,EAAE;IACrD,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACnC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AACzC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2CAA2C,EAAE,GAAG,EAAE;IACrD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC1C,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACjB,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;AACzE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACpC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC9C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2EAA2E,EAAE,GAAG,EAAE;IACrF,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,CAAC,GAAG,SAAS,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACjD,MAAM,CAAC,GAAG,SAAS,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACjD,MAAM,CAAC,GAAG,SAAS,CAAC,eAAe,EAAE,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;IACtD,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;IACjD,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,gCAAgC,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mDAAmD,EAAE,GAAG,EAAE;IAC7D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,8BAA8B,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,8BAA8B,CAAC,CAAC;AACpF,CAAC,CAAC,CAAC"}

package/dist/generator.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Password & passphrase generator — the "Password Pusher"-style toolbox.
+ *
+ * Uses the CSPRNG (`randomInt`) for unbiased selection, offers random-character,
+ * pronounceable and diceware-style passphrase modes, and ships a fast entropy
+ * estimator so the UI can show a real strength read (not a vibes-based meter).
+ *
+ * Part of RageVault.
+ * Crafted by SoyRage Agency — https://soyrage.es/
+ * MIT licensed (see LICENSE).
+ */
+export interface GenOptions {
+    length: number;
+    lower: boolean;
+    upper: boolean;
+    digits: boolean;
+    symbols: boolean;
+    /** Drop visually ambiguous characters. */
+    avoidAmbiguous: boolean;
+}
+export declare const DEFAULT_GEN: GenOptions;
+/** A random-character password honouring the selected sets. */
+export declare function generatePassword(opts?: Partial<GenOptions>): string;
+/** A pronounceable password (alternating CV syllables) with a digit + symbol. */
+export declare function generatePronounceable(syllables?: number): string;
+/**
+ * A diceware-style passphrase. A compact word list is embedded so it works
+ * offline / inside the standalone binary; swap in the full EFF list for max
+ * entropy if you ship it as an asset.
+ */
+export declare function generatePassphrase(words?: number, separator?: string, capitalize?: boolean): string;
+/** Rough entropy in bits + a human label. Not a substitute for zxcvbn, but honest. */
+export declare function estimateStrength(pw: string): {
+    bits: number;
+    label: string;
+};

package/dist/generator.js

@@ -0,0 +1,114 @@
+/**
+ * Password & passphrase generator — the "Password Pusher"-style toolbox.
+ *
+ * Uses the CSPRNG (`randomInt`) for unbiased selection, offers random-character,
+ * pronounceable and diceware-style passphrase modes, and ships a fast entropy
+ * estimator so the UI can show a real strength read (not a vibes-based meter).
+ *
+ * Part of RageVault.
+ * Crafted by SoyRage Agency — https://soyrage.es/
+ * MIT licensed (see LICENSE).
+ */
+import { randomInt } from "node:crypto";
+const LOWER = "abcdefghijkmnpqrstuvwxyz"; // no l, o (look-alikes)
+const UPPER = "ABCDEFGHJKLMNPQRSTUVWXYZ"; // no I, O
+const DIGITS = "23456789"; // no 0, 1
+const SYMBOLS = "!@#$%^&*()-_=+[]{};:,.?";
+export const DEFAULT_GEN = {
+    length: 20,
+    lower: true,
+    upper: true,
+    digits: true,
+    symbols: true,
+    avoidAmbiguous: true,
+};
+/** Pick one random element (uniform, CSPRNG-backed). */
+function pick(arr) {
+    return arr[randomInt(arr.length)];
+}
+/** A random-character password honouring the selected sets. */
+export function generatePassword(opts = {}) {
+    const o = { ...DEFAULT_GEN, ...opts };
+    const pools = [];
+    if (o.lower)
+        pools.push(o.avoidAmbiguous ? LOWER : "abcdefghijklmnopqrstuvwxyz");
+    if (o.upper)
+        pools.push(o.avoidAmbiguous ? UPPER : "ABCDEFGHIJKLMNOPQRSTUVWXYZ");
+    if (o.digits)
+        pools.push(o.avoidAmbiguous ? DIGITS : "0123456789");
+    if (o.symbols)
+        pools.push(SYMBOLS);
+    if (pools.length === 0)
+        pools.push(LOWER);
+    const all = pools.join("");
+    const chars = [];
+    // Guarantee at least one from each selected pool, then fill the rest.
+    for (const pool of pools)
+        chars.push(pick(pool));
+    while (chars.length < o.length)
+        chars.push(pick(all));
+    // Fisher–Yates shuffle so the guaranteed chars aren't always at the front.
+    for (let i = chars.length - 1; i > 0; i--) {
+        const j = randomInt(i + 1);
+        [chars[i], chars[j]] = [chars[j], chars[i]];
+    }
+    return chars.slice(0, o.length).join("");
+}
+const CONSONANTS = "bcdfghjkmnprstvwz";
+const VOWELS = "aeiou";
+/** A pronounceable password (alternating CV syllables) with a digit + symbol. */
+export function generatePronounceable(syllables = 5) {
+    let out = "";
+    for (let i = 0; i < syllables; i++) {
+        let c = pick(CONSONANTS);
+        if (i === 0)
+            c = c.toUpperCase();
+        out += c + pick(VOWELS);
+    }
+    return `${out}${pick(DIGITS)}${pick("!@#$%&*")}`;
+}
+/**
+ * A diceware-style passphrase. A compact word list is embedded so it works
+ * offline / inside the standalone binary; swap in the full EFF list for max
+ * entropy if you ship it as an asset.
+ */
+export function generatePassphrase(words = 5, separator = "-", capitalize = true) {
+    const list = WORDS;
+    const out = [];
+    for (let i = 0; i < words; i++) {
+        let w = list[randomInt(list.length)];
+        if (capitalize)
+            w = w[0].toUpperCase() + w.slice(1);
+        out.push(w);
+    }
+    // Sprinkle a number so it satisfies "needs a digit" policies.
+    return out.join(separator) + separator + String(randomInt(10, 100));
+}
+/** Rough entropy in bits + a human label. Not a substitute for zxcvbn, but honest. */
+export function estimateStrength(pw) {
+    let pool = 0;
+    if (/[a-z]/.test(pw))
+        pool += 26;
+    if (/[A-Z]/.test(pw))
+        pool += 26;
+    if (/[0-9]/.test(pw))
+        pool += 10;
+    if (/[^a-zA-Z0-9]/.test(pw))
+        pool += 30;
+    const bits = pw.length * (pool ? Math.log2(pool) : 0);
+    const label = bits < 40 ? "weak" : bits < 60 ? "fair" : bits < 80 ? "strong" : "excellent";
+    return { bits: Math.round(bits), label };
+}
+// A small, curated word list (kept short here; replace with the EFF long list
+// as a bundled asset for ~12.9 bits/word). These are common, easy-to-type words.
+const WORDS = [
+    "amber", "anchor", "apple", "arrow", "atlas", "aurora", "basil", "beacon", "birch", "bloom",
+    "bronze", "cabin", "canyon", "cedar", "cinder", "cobalt", "comet", "coral", "cove", "crane",
+    "delta", "dune", "ember", "falcon", "fern", "flint", "forest", "garnet", "glade", "granite",
+    "harbor", "hazel", "heron", "indigo", "ivory", "jade", "kite", "lagoon", "lantern", "linen",
+    "lotus", "maple", "marble", "meadow", "mint", "north", "oak", "ocean", "onyx", "opal",
+    "orbit", "pebble", "pine", "prairie", "quartz", "quill", "raven", "reef", "ripple", "river",
+    "rowan", "saffron", "sage", "sequoia", "silver", "slate", "solstice", "spruce", "storm", "summit",
+    "tide", "timber", "topaz", "trail", "tulip", "umber", "valley", "velvet", "willow", "zephyr",
+];
+//# sourceMappingURL=generator.js.map

package/dist/generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generator.js","sourceRoot":"","sources":["../src/generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,KAAK,GAAG,0BAA0B,CAAC,CAAC,wBAAwB;AAClE,MAAM,KAAK,GAAG,0BAA0B,CAAC,CAAC,UAAU;AACpD,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,UAAU;AACrC,MAAM,OAAO,GAAG,yBAAyB,CAAC;AAY1C,MAAM,CAAC,MAAM,WAAW,GAAe;IACrC,MAAM,EAAE,EAAE;IACV,KAAK,EAAE,IAAI;IACX,KAAK,EAAE,IAAI;IACX,MAAM,EAAE,IAAI;IACZ,OAAO,EAAE,IAAI;IACb,cAAc,EAAE,IAAI;CACrB,CAAC;AAEF,wDAAwD;AACxD,SAAS,IAAI,CAAI,GAAiB;IAChC,OAAO,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAe,CAAC;AAClD,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,gBAAgB,CAAC,OAA4B,EAAE;IAC7D,MAAM,CAAC,GAAG,EAAE,GAAG,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC;IACtC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC;IACjF,IAAI,CAAC,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC;IACjF,IAAI,CAAC,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACnE,IAAI,CAAC,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAE1C,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,sEAAsE;IACtE,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAW,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAW,CAAC,CAAC;IAChE,2EAA2E;IAC3E,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,GAAG,mBAAmB,CAAC;AACvC,MAAM,MAAM,GAAG,OAAO,CAAC;AAEvB,iFAAiF;AACjF,MAAM,UAAU,qBAAqB,CAAC,SAAS,GAAG,CAAC;IACjD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAW,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC;YAAE,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QACjC,GAAG,IAAI,CAAC,GAAI,IAAI,CAAC,MAAM,CAAY,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAW,GAAG,IAAI,CAAC,SAAS,CAAW,EAAE,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAK,GAAG,CAAC,EAAE,SAAS,GAAG,GAAG,EAAE,UAAU,GAAG,IAAI;IAC9E,MAAM,IAAI,GAAG,KAAK,CAAC;IACnB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACrC,IAAI,UAAU;YAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,8DAA8D;IAC9D,OAAO,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,gBAAgB,CAAC,EAAU;IACzC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,IAAI,IAAI,EAAE,CAAC;IACjC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,IAAI,IAAI,EAAE,CAAC;IACjC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,IAAI,IAAI,EAAE,CAAC;IACjC,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,IAAI,IAAI,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;IAC3F,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED,8EAA8E;AAC9E,iFAAiF;AACjF,MAAM,KAAK,GAAG;IACZ,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO;IAC3F,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO;IAC3F,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS;IAC3F,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO;IAC3F,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM;IACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO;IAC3F,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ;IACjG,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ;CAC7F,CAAC"}

package/dist/model.d.ts

@@ -0,0 +1,96 @@
+/**
+ * The RageVault data model.
+ *
+ * Everything here is what lives *inside* the encrypted payload — the server and
+ * the on-disk file only ever see the sealed form. The shapes are deliberately
+ * plain JSON so the vault is portable and easy to export.
+ *
+ * Part of RageVault.
+ * Crafted by SoyRage Agency — https://soyrage.es/
+ * MIT licensed (see LICENSE).
+ */
+/** Role hierarchy for internal / team use. Higher roles subsume lower ones. */
+export type Role = "owner" | "admin" | "member" | "viewer";
+/** What each role may do — enforced by the app layer (see canDo). */
+export declare const ROLE_RANK: Record<Role, number>;
+export type Capability = "vault.manage" | "item.create" | "item.update" | "item.delete" | "item.reveal" | "item.read";
+/** True if `role` is allowed to perform `cap`. */
+export declare function canDo(role: Role, cap: Capability): boolean;
+/** A person who can unlock/use the vault (RBAC at the app layer). */
+export interface User {
+    id: string;
+    name: string;
+    role: Role;
+    createdAt: string;
+    /** Optional: a per-user unlock is on the roadmap; owner-managed for now. */
+    disabled?: boolean;
+}
+/** A top-level grouping (e.g. "Work", "Personal", "Infrastructure"). */
+export interface Category {
+    id: string;
+    name: string;
+    /** A hint colour from the SoyRage palette or any hex. */
+    color?: string;
+    icon?: string;
+}
+/** A nested container within (or across) categories — a "branch" of the tree. */
+export interface Folder {
+    id: string;
+    name: string;
+    parentId?: string;
+    categoryId?: string;
+    /** A custom glyph/emoji, or a colour hex — shown in the tree. */
+    icon?: string;
+    color?: string;
+}
+/** An extra, user-defined field — the flexible way to model cards, SSH keys,
+ *  API tokens, identities, etc. Secret fields are blurred like the password. */
+export interface CustomField {
+    label: string;
+    value: string;
+    /** Blur this value by default (card CVV, SSH private key, API token…). */
+    secret: boolean;
+}
+/** A secret record. Secret fields are plaintext only in memory after unlock. */
+export interface Item {
+    id: string;
+    title: string;
+    categoryId?: string;
+    folderId?: string;
+    username?: string;
+    password?: string;
+    url?: string;
+    notes?: string;
+    /** TOTP secret (base32) for 2FA code generation. */
+    totp?: string;
+    /** Arbitrary extra fields (cards, SSH keys, tokens, secure notes…). */
+    fields?: CustomField[];
+    /** A custom glyph/emoji (or leave blank to derive an initial from the title). */
+    icon?: string;
+    tags: string[];
+    favorite: boolean;
+    createdAt: string;
+    updatedAt: string;
+    /** Previous passwords, newest first, for recovery/rotation audit. */
+    history: Array<{
+        password: string;
+        changedAt: string;
+    }>;
+}
+/** The decrypted vault contents. */
+export interface VaultData {
+    meta: {
+        name: string;
+        createdAt: string;
+    };
+    users: User[];
+    categories: Category[];
+    folders: Folder[];
+    items: Item[];
+    /** Soft-deleted items, recoverable until the trash is emptied. */
+    trash: Item[];
+}
+/** A short, url-safe id. */
+export declare function newId(): string;
+/** An empty vault owned by the given user name. */
+export declare function emptyVault(name: string, ownerName: string, now: string): VaultData;

package/dist/model.js

@@ -0,0 +1,43 @@
+/**
+ * The RageVault data model.
+ *
+ * Everything here is what lives *inside* the encrypted payload — the server and
+ * the on-disk file only ever see the sealed form. The shapes are deliberately
+ * plain JSON so the vault is portable and easy to export.
+ *
+ * Part of RageVault.
+ * Crafted by SoyRage Agency — https://soyrage.es/
+ * MIT licensed (see LICENSE).
+ */
+import { randomBytes } from "node:crypto";
+/** What each role may do — enforced by the app layer (see canDo). */
+export const ROLE_RANK = { owner: 3, admin: 2, member: 1, viewer: 0 };
+const CAP_MIN_RANK = {
+    "vault.manage": ROLE_RANK.owner,
+    "item.delete": ROLE_RANK.admin,
+    "item.create": ROLE_RANK.member,
+    "item.update": ROLE_RANK.member,
+    "item.reveal": ROLE_RANK.member, // a viewer sees metadata only, never secrets
+    "item.read": ROLE_RANK.viewer,
+};
+/** True if `role` is allowed to perform `cap`. */
+export function canDo(role, cap) {
+    return ROLE_RANK[role] >= CAP_MIN_RANK[cap];
+}
+/** A short, url-safe id. */
+export function newId() {
+    // 12 bytes of base64url — collision-resistant enough for local ids.
+    return randomBytes(12).toString("base64url");
+}
+/** An empty vault owned by the given user name. */
+export function emptyVault(name, ownerName, now) {
+    return {
+        meta: { name, createdAt: now },
+        users: [{ id: newId(), name: ownerName, role: "owner", createdAt: now }],
+        categories: [],
+        folders: [],
+        items: [],
+        trash: [],
+    };
+}
+//# sourceMappingURL=model.js.map

package/dist/model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../src/model.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAK1C,qEAAqE;AACrE,MAAM,CAAC,MAAM,SAAS,GAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AAU5F,MAAM,YAAY,GAA+B;IAC/C,cAAc,EAAE,SAAS,CAAC,KAAK;IAC/B,aAAa,EAAE,SAAS,CAAC,KAAK;IAC9B,aAAa,EAAE,SAAS,CAAC,MAAM;IAC/B,aAAa,EAAE,SAAS,CAAC,MAAM;IAC/B,aAAa,EAAE,SAAS,CAAC,MAAM,EAAE,6CAA6C;IAC9E,WAAW,EAAE,SAAS,CAAC,MAAM;CAC9B,CAAC;AAEF,kDAAkD;AAClD,MAAM,UAAU,KAAK,CAAC,IAAU,EAAE,GAAe;IAC/C,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC;AA4ED,4BAA4B;AAC5B,MAAM,UAAU,KAAK;IACnB,oEAAoE;IACpE,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,SAAiB,EAAE,GAAW;IACrE,OAAO;QACL,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE;QAC9B,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QACxE,UAAU,EAAE,EAAE;QACd,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,EAAE;QACT,KAAK,EAAE,EAAE;KACV,CAAC;AACJ,CAAC"}

package/dist/porters.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Import / export — get your secrets in and out.
+ *
+ * Import understands the common CSV shapes (generic, Bitwarden, Chrome/Firefox,
+ * KeePass) by sniffing the header row. Export writes a portable JSON or CSV —
+ * necessarily *plaintext*, so callers must warn loudly and clean up after.
+ *
+ * Part of RageVault.
+ * Crafted by SoyRage Agency — https://soyrage.es/
+ * MIT licensed (see LICENSE).
+ */
+import { type Item, type VaultData } from "./model.js";
+/** A minimal, correct CSV parser (RFC 4180-ish: quotes, escaped quotes, CRLF). */
+export declare function parseCsv(text: string): string[][];
+/** Import items from CSV text. Returns the parsed items + how columns mapped. */
+export declare function importCsv(text: string): {
+    items: Item[];
+    mapped: Record<string, string>;
+};
+/** Import a Bitwarden JSON export (`{ items:[{ login:{...} }], folders:[...] }`). */
+export declare function importBitwardenJson(j: Record<string, unknown>): Item[];
+/** Import a Proton Pass JSON export (`{ vaults: { id: { items:[{ data:{...} }] } } }`). */
+export declare function importProtonPassJson(j: Record<string, unknown>): Item[];
+/**
+ * Auto-detect the export format and import: Bitwarden / Proton Pass JSON, a prior
+ * RageVault JSON, or CSV (1Password / Chrome / KeePass / generic).
+ */
+export declare function importAny(content: string, _filename?: string): {
+    items: Item[];
+    source: string;
+};
+/** Export the vault to portable (PLAINTEXT) JSON. */
+export declare function exportJson(data: VaultData): string;
+/** Export items to (PLAINTEXT) CSV in the generic shape most tools import. */
+export declare function exportCsv(data: VaultData): string;