secretless-ai 0.3.1 → 0.5.0

package/dist/backends/env.d.ts

@@ -0,0 +1,11 @@
+import type { SecretBackend, BackendHealth } from './types';
+/**
+ * Environment variable backend — resolves secrets from process.env.
+ * The simplest backend. Zero dependencies. Always available.
+ */
+export declare class EnvBackend implements SecretBackend {
+    readonly name = "env";
+    resolve(path: string): Promise<Record<string, string>>;
+    healthCheck(): Promise<BackendHealth>;
+}
+//# sourceMappingURL=env.d.ts.map

package/dist/backends/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/backends/env.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE5D;;;GAGG;AACH,qBAAa,UAAW,YAAW,aAAa;IAC9C,QAAQ,CAAC,IAAI,SAAS;IAEhB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAYtD,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC;CAG5C"}

package/dist/backends/env.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EnvBackend = void 0;
+/**
+ * Environment variable backend — resolves secrets from process.env.
+ * The simplest backend. Zero dependencies. Always available.
+ */
+class EnvBackend {
+    constructor() {
+        this.name = 'env';
+    }
+    async resolve(path) {
+        // Path format: "ENV_VAR_NAME" or "prefix/ENV_VAR_NAME"
+        const varName = path.includes('/') ? path.split('/').pop() : path;
+        const value = process.env[varName];
+        if (value === undefined) {
+            return {};
+        }
+        return { [varName]: value };
+    }
+    async healthCheck() {
+        return { healthy: true, latencyMs: 0, message: 'Environment variables always available' };
+    }
+}
+exports.EnvBackend = EnvBackend;
+//# sourceMappingURL=env.js.map

package/dist/backends/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/backends/env.ts"],"names":[],"mappings":";;;AAEA;;;GAGG;AACH,MAAa,UAAU;IAAvB;QACW,SAAI,GAAG,KAAK,CAAC;IAiBxB,CAAC;IAfC,KAAK,CAAC,OAAO,CAAC,IAAY;QACxB,uDAAuD;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACnE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAEnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,WAAW;QACf,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;IAC5F,CAAC;CACF;AAlBD,gCAkBC"}

package/dist/backends/local.d.ts

@@ -0,0 +1,18 @@
+import type { SecretBackend, BackendHealth } from './types';
+/**
+ * Local encrypted store backend — resolves secrets from a local AES-256-GCM encrypted file.
+ * Used for development/local setups. Zero network dependencies.
+ */
+export declare class LocalBackend implements SecretBackend {
+    readonly name = "local";
+    private readonly storeDir;
+    private readonly encryptionKey;
+    constructor(config?: Record<string, unknown>);
+    resolve(secretPath: string): Promise<Record<string, string>>;
+    healthCheck(): Promise<BackendHealth>;
+    /** Store a secret locally */
+    store(key: string, value: string): Promise<void>;
+    private encrypt;
+    private decrypt;
+}
+//# sourceMappingURL=local.d.ts.map

package/dist/backends/local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../../src/backends/local.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAU5D;;;GAGG;AACH,qBAAa,YAAa,YAAW,aAAa;IAChD,QAAQ,CAAC,IAAI,WAAW;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;gBAE3B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAStC,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAsB5D,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC;IAW3C,6BAA6B;IACvB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgCtD,OAAO,CAAC,OAAO;IASf,OAAO,CAAC,OAAO;CAQhB"}

package/dist/backends/local.js

@@ -0,0 +1,133 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalBackend = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const crypto = __importStar(require("crypto"));
+const STORE_FILE = 'secrets.enc';
+const META_FILE = 'secrets.meta.json';
+/**
+ * Local encrypted store backend — resolves secrets from a local AES-256-GCM encrypted file.
+ * Used for development/local setups. Zero network dependencies.
+ */
+class LocalBackend {
+    constructor(config) {
+        this.name = 'local';
+        const home = process.env.HOME ?? process.env.USERPROFILE ?? '/tmp';
+        this.storeDir = config?.storeDir ?? path.join(home, '.secretless-ai', 'store');
+        // Derive key from machine-specific data (not perfect, but better than plaintext)
+        const keyMaterial = config?.key ?? `${home}-secretless-${process.env.USER ?? 'default'}`;
+        this.encryptionKey = crypto.createHash('sha256').update(keyMaterial).digest();
+    }
+    async resolve(secretPath) {
+        const storePath = path.join(this.storeDir, STORE_FILE);
+        if (!fs.existsSync(storePath))
+            return {};
+        try {
+            const encrypted = fs.readFileSync(storePath);
+            const decrypted = this.decrypt(encrypted);
+            const store = JSON.parse(decrypted);
+            // Path can be a key name or a glob pattern
+            const results = {};
+            for (const [key, value] of Object.entries(store)) {
+                if (key === secretPath || key.startsWith(secretPath + '/')) {
+                    results[key] = value;
+                }
+            }
+            return results;
+        }
+        catch {
+            return {};
+        }
+    }
+    async healthCheck() {
+        const start = Date.now();
+        const storePath = path.join(this.storeDir, STORE_FILE);
+        const exists = fs.existsSync(storePath);
+        return {
+            healthy: exists,
+            latencyMs: Date.now() - start,
+            message: exists ? 'Local store available' : 'No local store found',
+        };
+    }
+    /** Store a secret locally */
+    async store(key, value) {
+        fs.mkdirSync(this.storeDir, { recursive: true, mode: 0o700 });
+        const storePath = path.join(this.storeDir, STORE_FILE);
+        let store = {};
+        if (fs.existsSync(storePath)) {
+            try {
+                const encrypted = fs.readFileSync(storePath);
+                store = JSON.parse(this.decrypt(encrypted));
+            }
+            catch {
+                // Corrupted store — start fresh
+            }
+        }
+        store[key] = value;
+        const encrypted = this.encrypt(JSON.stringify(store));
+        fs.writeFileSync(storePath, encrypted, { mode: 0o600 });
+        // Update metadata
+        const metaPath = path.join(this.storeDir, META_FILE);
+        let meta = { version: '1', entries: {} };
+        try {
+            if (fs.existsSync(metaPath)) {
+                meta = JSON.parse(fs.readFileSync(metaPath, 'utf-8'));
+            }
+        }
+        catch { /* ignore */ }
+        meta.entries[key] = { createdAt: new Date().toISOString() };
+        fs.writeFileSync(metaPath, JSON.stringify(meta, null, 2), { mode: 0o600 });
+    }
+    encrypt(plaintext) {
+        const iv = crypto.randomBytes(16);
+        const cipher = crypto.createCipheriv('aes-256-gcm', this.encryptionKey, iv);
+        const encrypted = Buffer.concat([cipher.update(plaintext, 'utf-8'), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        // Format: [iv(16)][tag(16)][ciphertext]
+        return Buffer.concat([iv, tag, encrypted]);
+    }
+    decrypt(data) {
+        const iv = data.subarray(0, 16);
+        const tag = data.subarray(16, 32);
+        const ciphertext = data.subarray(32);
+        const decipher = crypto.createDecipheriv('aes-256-gcm', this.encryptionKey, iv);
+        decipher.setAuthTag(tag);
+        return decipher.update(ciphertext) + decipher.final('utf-8');
+    }
+}
+exports.LocalBackend = LocalBackend;
+//# sourceMappingURL=local.js.map

package/dist/backends/local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.js","sourceRoot":"","sources":["../../src/backends/local.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAC7B,+CAAiC;AAGjC,MAAM,UAAU,GAAG,aAAa,CAAC;AACjC,MAAM,SAAS,GAAG,mBAAmB,CAAC;AAOtC;;;GAGG;AACH,MAAa,YAAY;IAKvB,YAAY,MAAgC;QAJnC,SAAI,GAAG,OAAO,CAAC;QAKtB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,MAAM,CAAC;QACnE,IAAI,CAAC,QAAQ,GAAI,MAAM,EAAE,QAAmB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAE3F,iFAAiF;QACjF,MAAM,WAAW,GAAI,MAAM,EAAE,GAAc,IAAI,GAAG,IAAI,eAAe,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC;QACrG,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,UAAkB;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC;QAEzC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAEpC,2CAA2C;YAC3C,MAAM,OAAO,GAA2B,EAAE,CAAC;YAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,GAAG,GAAG,CAAC,EAAE,CAAC;oBAC3D,OAAO,CAAC,GAAG,CAAC,GAAG,KAAe,CAAC;gBACjC,CAAC;YACH,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxC,OAAO;YACL,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC7B,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,sBAAsB;SACnE,CAAC;IACJ,CAAC;IAED,6BAA6B;IAC7B,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,KAAa;QACpC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAE9D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACvD,IAAI,KAAK,GAA2B,EAAE,CAAC;QAEvC,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;gBAC7C,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;QACH,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACtD,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAExD,kBAAkB;QAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACrD,IAAI,IAAI,GAAc,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAExB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAC5D,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;IAEO,OAAO,CAAC,SAAiB;QAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAC5E,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACrF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAChC,wCAAwC;QACxC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;IAC7C,CAAC;IAEO,OAAO,CAAC,IAAY;QAC1B,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAClC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAChF,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;CACF;AAjGD,oCAiGC"}

package/dist/backends/types.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Pluggable secret backend interface.
+ * Each backend resolves secrets from a different source.
+ * Zero mandatory deps — backend SDKs are optional peer dependencies.
+ */
+export interface SecretBackend {
+    /** Backend name (e.g., "vault", "aws-sm", "env") */
+    readonly name: string;
+    /** Resolve one or more secrets by path/name. Returns key-value pairs. */
+    resolve(path: string): Promise<Record<string, string>>;
+    /** Check if the backend is available and authenticated */
+    healthCheck(): Promise<BackendHealth>;
+}
+export interface BackendHealth {
+    healthy: boolean;
+    latencyMs: number;
+    message?: string;
+}
+/** Backend configuration from secretless config file */
+export interface BackendConfig {
+    /** Backend type */
+    type: BackendType;
+    /** Backend-specific config */
+    config?: Record<string, unknown>;
+    /** Priority (lower = preferred, default: 100) */
+    priority?: number;
+    /** Path prefix this backend handles (e.g., "vault/", "aws/") */
+    prefix?: string;
+}
+export type BackendType = 'env' | 'local' | 'vault' | 'aws-sm' | '1password';
+/** Access audit entry */
+export interface AccessAuditEntry {
+    timestamp: string;
+    backend: string;
+    path: string;
+    action: 'resolve' | 'healthCheck' | 'migrate';
+    success: boolean;
+    latencyMs: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/backends/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/backends/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,yEAAyE;IACzE,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEvD,0DAA0D;IAC1D,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wDAAwD;AACxD,MAAM,WAAW,aAAa;IAC5B,mBAAmB;IACnB,IAAI,EAAE,WAAW,CAAC;IAClB,8BAA8B;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE7E,yBAAyB;AACzB,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,aAAa,GAAG,SAAS,CAAC;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/dist/backends/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/backends/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/backends/types.ts"],"names":[],"mappings":""}

package/dist/backends/vault.d.ts

@@ -0,0 +1,28 @@
+import type { SecretBackend, BackendHealth } from './types';
+/**
+ * HashiCorp Vault / OpenBao backend — AppRole auth, KV v2.
+ * Zero mandatory dependencies. Uses raw HTTP.
+ *
+ * Config:
+ *   addr: Vault address (default: VAULT_ADDR env or http://127.0.0.1:8200)
+ *   token: Vault token (default: VAULT_TOKEN env)
+ *   roleId: AppRole role ID (alternative to token)
+ *   secretId: AppRole secret ID
+ *   namespace: Vault namespace (enterprise)
+ *   mountPath: KV v2 mount path (default: "secret")
+ */
+export declare class VaultBackend implements SecretBackend {
+    readonly name = "vault";
+    private readonly addr;
+    private readonly mountPath;
+    private readonly namespace;
+    private token;
+    private readonly roleId?;
+    private readonly secretId?;
+    constructor(config?: Record<string, unknown>);
+    resolve(secretPath: string): Promise<Record<string, string>>;
+    healthCheck(): Promise<BackendHealth>;
+    private ensureAuthenticated;
+    private request;
+}
+//# sourceMappingURL=vault.d.ts.map

package/dist/backends/vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../src/backends/vault.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE5D;;;;;;;;;;;GAWG;AACH,qBAAa,YAAa,YAAW,aAAa;IAChD,QAAQ,CAAC,IAAI,WAAW;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAS;gBAEvB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAStC,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAwB5D,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC;YAmB7B,mBAAmB;IAejC,OAAO,CAAC,OAAO;CAyChB"}

package/dist/backends/vault.js

@@ -0,0 +1,157 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VaultBackend = void 0;
+const https = __importStar(require("https"));
+const http = __importStar(require("http"));
+/**
+ * HashiCorp Vault / OpenBao backend — AppRole auth, KV v2.
+ * Zero mandatory dependencies. Uses raw HTTP.
+ *
+ * Config:
+ *   addr: Vault address (default: VAULT_ADDR env or http://127.0.0.1:8200)
+ *   token: Vault token (default: VAULT_TOKEN env)
+ *   roleId: AppRole role ID (alternative to token)
+ *   secretId: AppRole secret ID
+ *   namespace: Vault namespace (enterprise)
+ *   mountPath: KV v2 mount path (default: "secret")
+ */
+class VaultBackend {
+    constructor(config) {
+        this.name = 'vault';
+        this.addr = config?.addr ?? process.env.VAULT_ADDR ?? 'http://127.0.0.1:8200';
+        this.token = config?.token ?? process.env.VAULT_TOKEN ?? '';
+        this.mountPath = config?.mountPath ?? 'secret';
+        this.namespace = config?.namespace ?? process.env.VAULT_NAMESPACE ?? '';
+        this.roleId = config?.roleId;
+        this.secretId = config?.secretId;
+    }
+    async resolve(secretPath) {
+        await this.ensureAuthenticated();
+        // KV v2 read: GET /v1/{mount}/data/{path}
+        const apiPath = `/v1/${this.mountPath}/data/${secretPath}`;
+        try {
+            const response = await this.request('GET', apiPath);
+            const data = JSON.parse(response);
+            if (data?.data?.data) {
+                // KV v2 wraps data in data.data
+                const result = {};
+                for (const [key, value] of Object.entries(data.data.data)) {
+                    result[key] = String(value);
+                }
+                return result;
+            }
+            return {};
+        }
+        catch {
+            return {};
+        }
+    }
+    async healthCheck() {
+        const start = Date.now();
+        try {
+            const response = await this.request('GET', '/v1/sys/health');
+            const data = JSON.parse(response);
+            return {
+                healthy: data.sealed === false,
+                latencyMs: Date.now() - start,
+                message: data.sealed ? 'Vault is sealed' : `Vault ${data.version} (${data.cluster_name ?? 'standalone'})`,
+            };
+        }
+        catch (err) {
+            return {
+                healthy: false,
+                latencyMs: Date.now() - start,
+                message: `Cannot reach Vault at ${this.addr}: ${err instanceof Error ? err.message : String(err)}`,
+            };
+        }
+    }
+    async ensureAuthenticated() {
+        if (this.token)
+            return;
+        // Try AppRole auth
+        if (this.roleId && this.secretId) {
+            const body = JSON.stringify({ role_id: this.roleId, secret_id: this.secretId });
+            const response = await this.request('POST', '/v1/auth/approle/login', body);
+            const data = JSON.parse(response);
+            this.token = data?.auth?.client_token ?? '';
+            return;
+        }
+        throw new Error('No Vault authentication configured. Set VAULT_TOKEN or provide roleId/secretId.');
+    }
+    request(method, apiPath, body) {
+        return new Promise((resolve, reject) => {
+            const url = new URL(apiPath, this.addr);
+            const isHttps = url.protocol === 'https:';
+            const mod = isHttps ? https : http;
+            const headers = {};
+            if (this.token)
+                headers['X-Vault-Token'] = this.token;
+            if (this.namespace)
+                headers['X-Vault-Namespace'] = this.namespace;
+            if (body) {
+                headers['Content-Type'] = 'application/json';
+                headers['Content-Length'] = String(Buffer.byteLength(body));
+            }
+            const options = {
+                hostname: url.hostname,
+                port: url.port || (isHttps ? 443 : 8200),
+                path: url.pathname,
+                method,
+                headers,
+                timeout: 10000,
+            };
+            const req = mod.request(options, (res) => {
+                let data = '';
+                res.on('data', (chunk) => { data += chunk; });
+                res.on('end', () => {
+                    if (res.statusCode && res.statusCode >= 400) {
+                        reject(new Error(`Vault ${res.statusCode}: ${data.slice(0, 200)}`));
+                    }
+                    else {
+                        resolve(data);
+                    }
+                });
+            });
+            req.on('error', reject);
+            req.on('timeout', () => { req.destroy(); reject(new Error('Vault request timeout')); });
+            if (body)
+                req.write(body);
+            req.end();
+        });
+    }
+}
+exports.VaultBackend = VaultBackend;
+//# sourceMappingURL=vault.js.map

package/dist/backends/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../src/backends/vault.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,6CAA+B;AAC/B,2CAA6B;AAG7B;;;;;;;;;;;GAWG;AACH,MAAa,YAAY;IASvB,YAAY,MAAgC;QARnC,SAAI,GAAG,OAAO,CAAC;QAStB,IAAI,CAAC,IAAI,GAAI,MAAM,EAAE,IAAe,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,uBAAuB,CAAC;QAC1F,IAAI,CAAC,KAAK,GAAI,MAAM,EAAE,KAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;QACxE,IAAI,CAAC,SAAS,GAAI,MAAM,EAAE,SAAoB,IAAI,QAAQ,CAAC;QAC3D,IAAI,CAAC,SAAS,GAAI,MAAM,EAAE,SAAoB,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;QACpF,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,MAAgB,CAAC;QACvC,IAAI,CAAC,QAAQ,GAAG,MAAM,EAAE,QAAkB,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,UAAkB;QAC9B,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAEjC,0CAA0C;QAC1C,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,SAAS,SAAS,UAAU,EAAE,CAAC;QAE3D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAElC,IAAI,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;gBACrB,gCAAgC;gBAChC,MAAM,MAAM,GAA2B,EAAE,CAAC;gBAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC9B,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;YAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAClC,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,MAAM,KAAK,KAAK;gBAC9B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC7B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,YAAY,IAAI,YAAY,GAAG;aAC1G,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC7B,OAAO,EAAE,yBAAyB,IAAI,CAAC,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aACnG,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,mBAAmB;QAC/B,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QAEvB,mBAAmB;QACnB,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAChF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,wBAAwB,EAAE,IAAI,CAAC,CAAC;YAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC;YAC5C,OAAO;QACT,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrG,CAAC;IAEO,OAAO,CAAC,MAAc,EAAE,OAAe,EAAE,IAAa;QAC5D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;YAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YAEnC,MAAM,OAAO,GAA2B,EAAE,CAAC;YAC3C,IAAI,IAAI,CAAC,KAAK;gBAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;YACtD,IAAI,IAAI,CAAC,SAAS;gBAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;YAClE,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;gBAC7C,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,CAAC;YAED,MAAM,OAAO,GAAG;gBACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;gBACxC,IAAI,EAAE,GAAG,CAAC,QAAQ;gBAClB,MAAM;gBACN,OAAO;gBACP,OAAO,EAAE,KAAK;aACf,CAAC;YAEF,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACvC,IAAI,IAAI,GAAG,EAAE,CAAC;gBACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACjB,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;wBAC5C,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;oBACtE,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,IAAI,CAAC,CAAC;oBAChB,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACxB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxF,IAAI,IAAI;gBAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1B,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AArHD,oCAqHC"}

package/dist/cli.d.ts

@@ -6,6 +6,9 @@
  *   npx secretless-ai init     — Set up protections for detected AI tools
  *   npx secretless-ai scan     — Scan for hardcoded secrets
  *   npx secretless-ai status   — Show current protection status
+ *   npx secretless-ai verify   — Verify keys are usable but hidden from AI
+ *   npx secretless-ai clean    — Scan and redact credentials in transcripts
+ *   npx secretless-ai watch    — Monitor transcripts in real-time
  */
 export {};
 //# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA;;;;;;;GAOG"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;GAUG"}