ragevault 0.2.3

package/dist/store/vaultfile.d.ts

@@ -0,0 +1,64 @@
+/**
+ * The on-disk (or over-the-wire) vault format.
+ *
+ * A vault file is a small JSON envelope:
+ *
+ *   {
+ *     "magic": "ragevault", "format": 1,
+ *     "kdf": { "algo": "scrypt", "N": 65536, "r": 8, "p": 1, "keyLen": 32 },
+ *     "salt": "<base64>",            // for deriving the KEK from the password
+ *     "wrappedKey": { iv, tag, ct }, // the DEK, encrypted under the KEK
+ *     "payload": { iv, tag, ct }     // the whole VaultData, encrypted under the DEK
+ *   }
+ *
+ * Only the KDF salt/params and two ciphertexts ever touch disk. The header is
+ * enough to *attempt* an unlock, and AES-GCM's auth tag makes a wrong password
+ * fail cleanly rather than silently corrupting data.
+ *
+ * Part of RageVault.
+ * Crafted by SoyRage Agency — https://soyrage.es/
+ * MIT licensed (see LICENSE).
+ */
+import { type KdfParams, type Sealed } from "../crypto/cipher.js";
+import type { VaultData } from "../model.js";
+export declare const MAGIC = "ragevault";
+export declare const FORMAT = 1;
+export interface VaultFile {
+    magic: string;
+    format: number;
+    kdf: KdfParams;
+    salt: string;
+    wrappedKey: Sealed;
+    payload: Sealed;
+}
+/** An unlocked, in-memory handle: the decrypted data plus the live keys. */
+export interface OpenVault {
+    data: VaultData;
+    /** The Data-Encryption-Key held only in memory while unlocked. */
+    dek: Buffer;
+    /** The current wrapped DEK, so a normal save needs no password. */
+    wrappedKey: Sealed;
+    kdf: KdfParams;
+    salt: Buffer;
+}
+/** Create a brand-new encrypted vault from a master password. */
+export declare function createVault(data: VaultData, password: string, kdf?: KdfParams): OpenVault;
+/** Attempt to unlock a vault file. Throws "wrong password" on failure. */
+export declare function unlockVault(file: VaultFile, password: string): OpenVault;
+/** Serialize the current data to a VaultFile (re-encrypts the payload; fast). */
+export declare function toFile(vault: OpenVault): VaultFile;
+/** Change the master password: re-wrap the DEK under a new KEK (fast). */
+export declare function rewrapForPassword(vault: OpenVault, newPassword: string, kdf?: KdfParams): void;
+/** Read + parse a vault file from disk. */
+export declare function readVaultFile(path: string): VaultFile;
+/**
+ * Write a vault file to disk atomically and owner-readable only (0600).
+ *
+ * A password vault is the single copy of irreplaceable data, so we never write
+ * over the live file in place — a crash, full disk or power loss mid-write would
+ * truncate it beyond recovery. Instead: write a sibling temp file, fsync it,
+ * then rename over the target (an atomic replace on the same filesystem).
+ */
+export declare function writeVaultFile(path: string, file: VaultFile): void;
+/** Encrypt the current state and persist it atomically (see writeVaultFile). */
+export declare function saveVault(path: string, vault: OpenVault): void;

package/dist/store/vaultfile.js

@@ -0,0 +1,110 @@
+/**
+ * The on-disk (or over-the-wire) vault format.
+ *
+ * A vault file is a small JSON envelope:
+ *
+ *   {
+ *     "magic": "ragevault", "format": 1,
+ *     "kdf": { "algo": "scrypt", "N": 65536, "r": 8, "p": 1, "keyLen": 32 },
+ *     "salt": "<base64>",            // for deriving the KEK from the password
+ *     "wrappedKey": { iv, tag, ct }, // the DEK, encrypted under the KEK
+ *     "payload": { iv, tag, ct }     // the whole VaultData, encrypted under the DEK
+ *   }
+ *
+ * Only the KDF salt/params and two ciphertexts ever touch disk. The header is
+ * enough to *attempt* an unlock, and AES-GCM's auth tag makes a wrong password
+ * fail cleanly rather than silently corrupting data.
+ *
+ * Part of RageVault.
+ * Crafted by SoyRage Agency — https://soyrage.es/
+ * MIT licensed (see LICENSE).
+ */
+import { chmodSync, closeSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, writeSync } from "node:fs";
+import { dirname } from "node:path";
+import { DEFAULT_KDF, deriveKek, newKey, newSalt, open, seal, unwrapKey, wipe, wrapKey, } from "../crypto/cipher.js";
+export const MAGIC = "ragevault";
+export const FORMAT = 1;
+/** Create a brand-new encrypted vault from a master password. */
+export function createVault(data, password, kdf = DEFAULT_KDF) {
+    const salt = newSalt();
+    const kek = deriveKek(password, salt, kdf);
+    const dek = newKey();
+    const wrappedKey = wrapKey(dek, kek);
+    wipe(kek);
+    return { data, dek, wrappedKey, kdf, salt };
+}
+/** Attempt to unlock a vault file. Throws "wrong password" on failure. */
+export function unlockVault(file, password) {
+    if (file.magic !== MAGIC)
+        throw new Error("Not a RageVault file.");
+    if (file.format !== FORMAT)
+        throw new Error(`Unsupported vault format (${file.format}).`);
+    const salt = Buffer.from(file.salt, "base64");
+    const kek = deriveKek(password, salt, file.kdf);
+    let dek;
+    try {
+        dek = unwrapKey(file.wrappedKey, kek);
+    }
+    catch {
+        wipe(kek);
+        throw new Error("Wrong master password (or the vault file is corrupt).");
+    }
+    wipe(kek);
+    const data = JSON.parse(open(file.payload, dek, "ragevault:payload").toString("utf8"));
+    return { data, dek, wrappedKey: file.wrappedKey, kdf: file.kdf, salt };
+}
+/** Serialize the current data to a VaultFile (re-encrypts the payload; fast). */
+export function toFile(vault) {
+    return {
+        magic: MAGIC,
+        format: FORMAT,
+        kdf: vault.kdf,
+        salt: vault.salt.toString("base64"),
+        wrappedKey: vault.wrappedKey,
+        payload: seal(JSON.stringify(vault.data), vault.dek, "ragevault:payload"),
+    };
+}
+/** Change the master password: re-wrap the DEK under a new KEK (fast). */
+export function rewrapForPassword(vault, newPassword, kdf = DEFAULT_KDF) {
+    const salt = newSalt();
+    const kek = deriveKek(newPassword, salt, kdf);
+    vault.wrappedKey = wrapKey(vault.dek, kek);
+    wipe(kek);
+    vault.kdf = kdf;
+    vault.salt = salt;
+}
+/** Read + parse a vault file from disk. */
+export function readVaultFile(path) {
+    return JSON.parse(readFileSync(path, "utf8"));
+}
+/**
+ * Write a vault file to disk atomically and owner-readable only (0600).
+ *
+ * A password vault is the single copy of irreplaceable data, so we never write
+ * over the live file in place — a crash, full disk or power loss mid-write would
+ * truncate it beyond recovery. Instead: write a sibling temp file, fsync it,
+ * then rename over the target (an atomic replace on the same filesystem).
+ */
+export function writeVaultFile(path, file) {
+    mkdirSync(dirname(path), { recursive: true });
+    const tmp = `${path}.tmp-${process.pid}`;
+    const data = `${JSON.stringify(file, null, 2)}\n`;
+    const fd = openSync(tmp, "w", 0o600);
+    try {
+        writeSync(fd, data, null, "utf8");
+        fsyncSync(fd); // flush to the platter before we swap it in
+    }
+    finally {
+        closeSync(fd);
+    }
+    try {
+        chmodSync(tmp, 0o600);
+    }
+    catch { /* Windows / unsupported fs */ }
+    renameSync(tmp, path); // atomic replace
+}
+/** Encrypt the current state and persist it atomically (see writeVaultFile). */
+export function saveVault(path, vault) {
+    writeVaultFile(path, toFile(vault));
+}
+//# sourceMappingURL=vaultfile.js.map

package/dist/store/vaultfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vaultfile.js","sourceRoot":"","sources":["../../src/store/vaultfile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,WAAW,EACX,SAAS,EACT,MAAM,EACN,OAAO,EACP,IAAI,EACJ,IAAI,EACJ,SAAS,EACT,IAAI,EACJ,OAAO,GAGR,MAAM,qBAAqB,CAAC;AAG7B,MAAM,CAAC,MAAM,KAAK,GAAG,WAAW,CAAC;AACjC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC;AAsBxB,iEAAiE;AACjE,MAAM,UAAU,WAAW,CAAC,IAAe,EAAE,QAAgB,EAAE,MAAiB,WAAW;IACzF,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CAAC,IAAe,EAAE,QAAgB;IAC3D,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACnE,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAc,CAAC;IACpG,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;AACzE,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,MAAM,CAAC,KAAgB;IACrC,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,MAAM;QACd,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACnC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,mBAAmB,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,iBAAiB,CAAC,KAAgB,EAAE,WAAmB,EAAE,MAAiB,WAAW;IACnG,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC9C,KAAK,CAAC,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC;IAChB,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;AACpB,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAc,CAAC;AAC7D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,IAAe;IAC1D,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IAClD,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAClC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,4CAA4C;IAC7D,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,8BAA8B,CAAC,CAAC;IACvE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,iBAAiB;AAC1C,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,KAAgB;IACtD,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACtC,CAAC"}

package/dist/store/vaultfile.test.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Vault-file tests — create, unlock, save, change-password, tamper.
+ * Part of RageVault. Crafted by SoyRage Agency — https://soyrage.es/
+ */
+export {};

package/dist/store/vaultfile.test.js

@@ -0,0 +1,45 @@
+/**
+ * Vault-file tests — create, unlock, save, change-password, tamper.
+ * Part of RageVault. Crafted by SoyRage Agency — https://soyrage.es/
+ */
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { emptyVault, newId } from "../model.js";
+import { createVault, rewrapForPassword, toFile, unlockVault } from "./vaultfile.js";
+const FAST = { algo: "scrypt", N: 1 << 10, r: 8, p: 1, keyLen: 32 };
+const NOW = "2026-07-31T00:00:00.000Z";
+function seedVault() {
+    const data = emptyVault("Personal", "SoyRage", NOW);
+    data.items.push({
+        id: newId(), title: "GitHub", username: "soyrage", password: "s3cr3t-p@ss",
+        url: "https://github.com", tags: ["dev"], favorite: true, createdAt: NOW, updatedAt: NOW, history: [],
+    });
+    return createVault(data, "master-pw", FAST);
+}
+test("create → toFile → unlock recovers the same data", () => {
+    const v = seedVault();
+    const file = toFile(v);
+    const reopened = unlockVault(file, "master-pw");
+    assert.equal(reopened.data.items[0].password, "s3cr3t-p@ss");
+    assert.equal(reopened.data.users[0].role, "owner");
+});
+test("wrong master password is rejected", () => {
+    const file = toFile(seedVault());
+    assert.throws(() => unlockVault(file, "not-the-password"), /Wrong master password/);
+});
+test("changing the password re-wraps the DEK without losing data", () => {
+    const v = seedVault();
+    rewrapForPassword(v, "new-master-pw", FAST);
+    const file = toFile(v);
+    assert.throws(() => unlockVault(file, "master-pw"), "old password no longer works");
+    const reopened = unlockVault(file, "new-master-pw");
+    assert.equal(reopened.data.items[0].title, "GitHub");
+});
+test("a tampered payload fails to open", () => {
+    const file = toFile(seedVault());
+    const bytes = Buffer.from(file.payload.ct, "base64");
+    bytes[10] ^= 0x01;
+    file.payload.ct = bytes.toString("base64");
+    assert.throws(() => unlockVault(file, "master-pw"));
+});
+//# sourceMappingURL=vaultfile.test.js.map

package/dist/store/vaultfile.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vaultfile.test.js","sourceRoot":"","sources":["../../src/store/vaultfile.test.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGrF,MAAM,IAAI,GAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAC/E,MAAM,GAAG,GAAG,0BAA0B,CAAC;AAEvC,SAAS,SAAS;IAChB,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QACd,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa;QAC1E,GAAG,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;KACtG,CAAC,CAAC;IACH,OAAO,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,IAAI,CAAC,iDAAiD,EAAE,GAAG,EAAE;IAC3D,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;IACtB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAChD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAC7D,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mCAAmC,EAAE,GAAG,EAAE;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,kBAAkB,CAAC,EAAE,uBAAuB,CAAC,CAAC;AACtF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4DAA4D,EAAE,GAAG,EAAE;IACtE,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;IACtB,iBAAiB,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,8BAA8B,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACpD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AACvD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACrD,KAAK,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;IAClB,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;AACtD,CAAC,CAAC,CAAC"}

package/dist/totp.d.ts

@@ -0,0 +1,26 @@
+/**
+ * TOTP (RFC 6238) — turn a stored 2FA secret into the live 6-digit code.
+ *
+ * Standard HMAC-based one-time passwords: base32-decode the secret, HMAC it with
+ * a time counter, and dynamically truncate to N digits. Uses only node:crypto.
+ *
+ * Part of RageVault.
+ * Crafted by SoyRage Agency — https://soyrage.es/
+ * MIT licensed (see LICENSE).
+ */
+/** Decode an RFC 4648 base32 string (padding & spaces tolerated). */
+export declare function base32Decode(input: string): Buffer;
+export interface TotpOptions {
+    digits: number;
+    period: number;
+    algorithm: "sha1" | "sha256" | "sha512";
+}
+/** The current TOTP code, plus seconds until it rolls over. Accepts either a
+ *  bare base32 secret or a full otpauth:// URI (its digits/period/algorithm are
+ *  honoured; an explicit `opts` argument still wins over the URI's values). */
+export declare function totp(secret: string, opts?: Partial<TotpOptions>, nowMs?: number): {
+    code: string;
+    remaining: number;
+};
+/** Accept a raw base32 secret or an otpauth:// URI and return the base32 secret. */
+export declare function extractTotpSecret(input: string): string;

package/dist/totp.js

@@ -0,0 +1,88 @@
+/**
+ * TOTP (RFC 6238) — turn a stored 2FA secret into the live 6-digit code.
+ *
+ * Standard HMAC-based one-time passwords: base32-decode the secret, HMAC it with
+ * a time counter, and dynamically truncate to N digits. Uses only node:crypto.
+ *
+ * Part of RageVault.
+ * Crafted by SoyRage Agency — https://soyrage.es/
+ * MIT licensed (see LICENSE).
+ */
+import { createHmac } from "node:crypto";
+const B32 = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+/** Decode an RFC 4648 base32 string (padding & spaces tolerated). */
+export function base32Decode(input) {
+    const clean = input.toUpperCase().replace(/=+$/, "").replace(/\s+/g, "");
+    let bits = 0, value = 0;
+    const out = [];
+    for (const ch of clean) {
+        const idx = B32.indexOf(ch);
+        if (idx === -1)
+            throw new Error("Invalid base32 in TOTP secret.");
+        value = (value << 5) | idx;
+        bits += 5;
+        if (bits >= 8) {
+            bits -= 8;
+            out.push((value >>> bits) & 0xff);
+        }
+    }
+    return Buffer.from(out);
+}
+const DEFAULTS = { digits: 6, period: 30, algorithm: "sha1" };
+/** Pull the secret + digits/period/algorithm out of an otpauth:// URI. */
+function parseOtpauth(uri) {
+    try {
+        const p = new URL(uri).searchParams;
+        const opts = {};
+        const digits = Number(p.get("digits"));
+        if (Number.isInteger(digits) && digits >= 6 && digits <= 10)
+            opts.digits = digits;
+        const period = Number(p.get("period"));
+        if (Number.isInteger(period) && period > 0)
+            opts.period = period;
+        const alg = (p.get("algorithm") ?? "").toLowerCase();
+        if (alg === "sha1" || alg === "sha256" || alg === "sha512")
+            opts.algorithm = alg;
+        return { secret: p.get("secret") ?? "", opts };
+    }
+    catch {
+        return { secret: "", opts: {} };
+    }
+}
+/** The current TOTP code, plus seconds until it rolls over. Accepts either a
+ *  bare base32 secret or a full otpauth:// URI (its digits/period/algorithm are
+ *  honoured; an explicit `opts` argument still wins over the URI's values). */
+export function totp(secret, opts = {}, nowMs = Date.now()) {
+    let base32 = secret.trim();
+    let uriOpts = {};
+    if (base32.toLowerCase().startsWith("otpauth://")) {
+        const parsed = parseOtpauth(base32);
+        base32 = parsed.secret;
+        uriOpts = parsed.opts;
+    }
+    const o = { ...DEFAULTS, ...uriOpts, ...opts };
+    const key = base32Decode(base32);
+    const counter = Math.floor(nowMs / 1000 / o.period);
+    const buf = Buffer.alloc(8);
+    buf.writeBigUInt64BE(BigInt(counter));
+    const hmac = createHmac(o.algorithm, key).update(buf).digest();
+    const offset = hmac[hmac.length - 1] & 0x0f;
+    const bin = ((hmac[offset] & 0x7f) << 24) | (hmac[offset + 1] << 16) | (hmac[offset + 2] << 8) | hmac[offset + 3];
+    const code = (bin % 10 ** o.digits).toString().padStart(o.digits, "0");
+    const remaining = o.period - Math.floor((nowMs / 1000) % o.period);
+    return { code, remaining };
+}
+/** Accept a raw base32 secret or an otpauth:// URI and return the base32 secret. */
+export function extractTotpSecret(input) {
+    const s = input.trim();
+    if (s.toLowerCase().startsWith("otpauth://")) {
+        try {
+            return new URL(s).searchParams.get("secret") ?? "";
+        }
+        catch {
+            return "";
+        }
+    }
+    return s;
+}
+//# sourceMappingURL=totp.js.map

package/dist/totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.js","sourceRoot":"","sources":["../src/totp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,GAAG,GAAG,kCAAkC,CAAC;AAE/C,qEAAqE;AACrE,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzE,IAAI,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;IACxB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAClE,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC;QAC3B,IAAI,IAAI,CAAC,CAAC;QACV,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YAAC,IAAI,IAAI,CAAC,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QAAC,CAAC;IAClE,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAQD,MAAM,QAAQ,GAAgB,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAE3E,0EAA0E;AAC1E,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;QACpC,MAAM,IAAI,GAAyB,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,MAAM,IAAI,EAAE;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAClF,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACjE,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACrD,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,QAAQ;YAAE,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;QACjF,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAAC,CAAC;AAC9C,CAAC;AAED;;+EAE+E;AAC/E,MAAM,UAAU,IAAI,CAAC,MAAc,EAAE,OAA6B,EAAE,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;IACtF,IAAI,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,GAAyB,EAAE,CAAC;IACvC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACvB,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;IACxB,CAAC;IACD,MAAM,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAEpD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5B,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;IAE/D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;IAC5C,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAClH,MAAM,IAAI,GAAG,CAAC,GAAG,GAAG,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACnE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC7B,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC;YAAC,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,EAAE,CAAC;QAAC,CAAC;IAClF,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/totp.test.d.ts

@@ -0,0 +1,5 @@
+/**
+ * TOTP tests against the RFC 6238 published test vectors.
+ * Part of RageVault. Crafted by SoyRage Agency — https://soyrage.es/
+ */
+export {};

package/dist/totp.test.js

@@ -0,0 +1,41 @@
+/**
+ * TOTP tests against the RFC 6238 published test vectors.
+ * Part of RageVault. Crafted by SoyRage Agency — https://soyrage.es/
+ */
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { base32Decode, extractTotpSecret, totp } from "./totp.js";
+// RFC 6238 uses the ASCII seed "12345678901234567890"; as base32 that is:
+const SEED_B32 = "GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ";
+test("base32 decodes to the RFC seed", () => {
+    assert.equal(base32Decode(SEED_B32).toString("ascii"), "12345678901234567890");
+});
+test("TOTP matches RFC 6238 SHA-1 vectors", () => {
+    // (unix time, expected 8-digit code) from RFC 6238 Appendix B.
+    const cases = [
+        [59, "94287082"],
+        [1111111109, "07081804"],
+        [1111111111, "14050471"],
+        [1234567890, "89005924"],
+        [2000000000, "69279037"],
+    ];
+    for (const [t, expected] of cases) {
+        const { code } = totp(SEED_B32, { digits: 8, period: 30, algorithm: "sha1" }, t * 1000);
+        assert.equal(code, expected, `t=${t}`);
+    }
+});
+test("extractTotpSecret unwraps an otpauth URI", () => {
+    assert.equal(extractTotpSecret("otpauth://totp/Example:me?secret=JBSWY3DPEHPK3PXP&issuer=Example"), "JBSWY3DPEHPK3PXP");
+    assert.equal(extractTotpSecret("JBSWY3DPEHPK3PXP"), "JBSWY3DPEHPK3PXP");
+});
+test("totp() honours digits/period/algorithm from an otpauth:// URI", () => {
+    // An otpauth URI carrying non-default params must produce the same code as
+    // passing those params explicitly — the params must not be silently dropped.
+    const uri = `otpauth://totp/Example:me?secret=${SEED_B32}&digits=8&period=30&algorithm=SHA1`;
+    const t = 1111111109;
+    assert.equal(totp(uri, {}, t * 1000).code, "07081804");
+    assert.equal(totp(uri, {}, t * 1000).code, totp(SEED_B32, { digits: 8, period: 30 }, t * 1000).code);
+    // A bare secret still defaults to 6 digits.
+    assert.equal(totp(SEED_B32, {}, 59 * 1000).code.length, 6);
+});
+//# sourceMappingURL=totp.test.js.map

package/dist/totp.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.test.js","sourceRoot":"","sources":["../src/totp.test.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAElE,0EAA0E;AAC1E,MAAM,QAAQ,GAAG,kCAAkC,CAAC;AAEpD,IAAI,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC1C,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,sBAAsB,CAAC,CAAC;AACjF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qCAAqC,EAAE,GAAG,EAAE;IAC/C,+DAA+D;IAC/D,MAAM,KAAK,GAA4B;QACrC,CAAC,EAAE,EAAE,UAAU,CAAC;QAChB,CAAC,UAAU,EAAE,UAAU,CAAC;QACxB,CAAC,UAAU,EAAE,UAAU,CAAC;QACxB,CAAC,UAAU,EAAE,UAAU,CAAC;QACxB,CAAC,UAAU,EAAE,UAAU,CAAC;KACzB,CAAC;IACF,KAAK,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC;QAClC,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACxF,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACpD,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,kEAAkE,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACxH,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,CAAC;AAC1E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+DAA+D,EAAE,GAAG,EAAE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,GAAG,GAAG,oCAAoC,QAAQ,oCAAoC,CAAC;IAC7F,MAAM,CAAC,GAAG,UAAU,CAAC;IACrB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACvD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;IACrG,4CAA4C;IAC5C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC,CAAC,CAAC"}

package/dist/tui/ansi.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Minimal ANSI helpers for the terminal UI — colours, cursor control, and
+ * width-aware string helpers. Dependency-free by design.
+ *
+ * Part of RageVault.
+ * Crafted by SoyRage Agency — https://soyrage.es/
+ * MIT licensed (see LICENSE).
+ */
+export declare const color: {
+    bold: (s: string) => string;
+    dim: (s: string) => string;
+    gray: (s: string) => string;
+    red: (s: string) => string;
+    green: (s: string) => string;
+    yellow: (s: string) => string;
+    brightBlue: (s: string) => string;
+    /** SoyRage accent (256-colour blue). */
+    accent: (s: string) => string;
+    bgAccent: (s: string) => string;
+};
+export declare const ctl: {
+    enterAlt: string;
+    exitAlt: string;
+    hideCursor: string;
+    showCursor: string;
+    clear: string;
+    home: string;
+    clearLine: string;
+    clearBelow: string;
+};
+export declare const visLen: (s: string) => number;
+export declare function truncate(s: string, max: number): string;
+export declare function padEnd(s: string, width: number): string;
+export declare function padStart(s: string, width: number): string;

package/dist/tui/ansi.js

@@ -0,0 +1,52 @@
+/**
+ * Minimal ANSI helpers for the terminal UI — colours, cursor control, and
+ * width-aware string helpers. Dependency-free by design.
+ *
+ * Part of RageVault.
+ * Crafted by SoyRage Agency — https://soyrage.es/
+ * MIT licensed (see LICENSE).
+ */
+const E = "\x1b[";
+const sgr = (n) => (s) => `${E}${n}m${s}${E}0m`;
+export const color = {
+    bold: sgr(1), dim: sgr(2), gray: sgr(90),
+    red: sgr(31), green: sgr(32), yellow: sgr(33), brightBlue: sgr(94),
+    /** SoyRage accent (256-colour blue). */
+    accent: (s) => `${E}38;5;39m${s}${E}0m`,
+    bgAccent: (s) => `${E}48;5;24m${s}${E}0m`,
+};
+export const ctl = {
+    enterAlt: `${E}?1049h`, exitAlt: `${E}?1049l`,
+    hideCursor: `${E}?25l`, showCursor: `${E}?25h`,
+    clear: `${E}2J`, home: `${E}H`, clearLine: `${E}K`, clearBelow: `${E}J`,
+};
+const ANSI = /\x1b\[[0-9;]*m/g;
+export const visLen = (s) => s.replace(ANSI, "").length;
+export function truncate(s, max) {
+    if (visLen(s) <= max)
+        return s;
+    let out = "", n = 0, i = 0;
+    while (i < s.length && n < max - 1) {
+        if (s[i] === "\x1b") {
+            const m = s.slice(i).match(/^\x1b\[[0-9;]*m/);
+            if (m) {
+                out += m[0];
+                i += m[0].length;
+                continue;
+            }
+        }
+        out += s[i];
+        n++;
+        i++;
+    }
+    return out + "…";
+}
+export function padEnd(s, width) {
+    const pad = width - visLen(s);
+    return pad > 0 ? s + " ".repeat(pad) : truncate(s, width);
+}
+export function padStart(s, width) {
+    const pad = width - visLen(s);
+    return pad > 0 ? " ".repeat(pad) + s : s;
+}
+//# sourceMappingURL=ansi.js.map

package/dist/tui/ansi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ansi.js","sourceRoot":"","sources":["../../src/tui/ansi.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,CAAC,GAAG,OAAO,CAAC;AAClB,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;AAEhE,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;IACxC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC;IAClE,wCAAwC;IACxC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI;IAC/C,QAAQ,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI;CAClD,CAAC;AAEF,MAAM,CAAC,MAAM,GAAG,GAAG;IACjB,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ;IAC7C,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM;IAC9C,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,GAAG;CACxE,CAAC;AAEF,MAAM,IAAI,GAAG,iBAAiB,CAAC;AAC/B,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;AAExE,MAAM,UAAU,QAAQ,CAAC,CAAS,EAAE,GAAW;IAC7C,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG;QAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,GAAG,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAAC,IAAI,CAAC,EAAE,CAAC;gBAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAC,SAAS;YAAC,CAAC;QAAC,CAAC;QAC3H,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC,EAAE,CAAC;QAAC,CAAC,EAAE,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,GAAG,GAAG,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,CAAS,EAAE,KAAa;IAC7C,MAAM,GAAG,GAAG,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,CAAS,EAAE,KAAa;IAC/C,MAAM,GAAG,GAAG,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC"}

package/dist/tui/app.d.ts

@@ -0,0 +1,83 @@
+/**
+ * RageVault terminal UI — a menu-driven, searchable vault browser.
+ *
+ * No shortcuts to memorise: you move with the arrow keys, **type to search**, and
+ * press Enter to open a **menu** of actions. Secrets stay blurred until you pick
+ * "Reveal". Passwords live in a folder tree (branches), each item shows an icon,
+ * and there's a built-in generator and one-key copy. Auto-locks after idle.
+ *
+ * Part of RageVault.
+ * Crafted by SoyRage Agency — https://soyrage.es/
+ * MIT licensed (see LICENSE).
+ */
+export declare class VaultTui {
+    private readonly path;
+    private readonly out;
+    private readonly inp;
+    private mode;
+    private vault;
+    private pwBuffer;
+    private unlockError;
+    private search;
+    private sel;
+    private expanded;
+    private revealed;
+    private menu;
+    private prompt;
+    private overlay;
+    private status;
+    private lastActivity;
+    private timer;
+    private clearTimer;
+    /** Breach-check cache: password → count (-2 checking, -1 unknown/offline). */
+    private breach;
+    private breachTimer;
+    private readonly onData;
+    constructor(path: string, out?: NodeJS.WriteStream & {
+        fd: 1;
+    }, inp?: NodeJS.ReadStream & {
+        fd: 0;
+    });
+    start(): void;
+    private quit;
+    private lock;
+    private save;
+    private onKey;
+    private onUnlockKey;
+    private tryUnlock;
+    private onPromptKey;
+    private onMenuKey;
+    private onBrowseKey;
+    private move;
+    private activate;
+    private openMainMenu;
+    private openItemMenu;
+    private openMoveMenu;
+    private confirmDelete;
+    private currentFolderId;
+    private newItem;
+    private newFolder;
+    private rename;
+    private regenerate;
+    private generate;
+    private flash;
+    private copy;
+    private isRisky;
+    private breachStatus;
+    /** Debounced HIBP check for the selected item (k-anonymity — only a hash prefix leaves). */
+    private scheduleBreach;
+    private matches;
+    private rows;
+    private cols;
+    private rows_;
+    private render;
+    private unlockLines;
+    private mainLines;
+    private rowText;
+    /** The live detail pane for whatever is selected. */
+    private detailRows;
+    private itemIcon;
+    private menuText;
+    private promptText;
+    private overlayBox;
+}