titan-vault-node 0.0.0-stage → 1.0.0

package/README.md

@@ -1,3 +1,66 @@
-# Temporary Holding Version
+# 🛡️ Titan Vault (Node.js SDK)
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+> **Zero-trust, E2E encrypted, drop-in replacement for dotenv.**
+
+Titan Vault is the easiest way to secure your application secrets. Forget about hardcoded `.env` files that get leaked. Titan Vault acts as a highly secure, encrypted environment variable injector that requires **zero friction** to use.
+
+## 🚀 The Problem with `.env`
+If a hacker gets read access to your server (LFI, directory traversal, etc.), they can read your `.env` file and steal all your database passwords and API keys.
+
+## 💡 The Titan Vault Solution
+Titan Vault stores your secrets in a centralized, encrypted server. Your app authenticates using a lightweight AppToken, and the Vault dynamically injects the secrets directly into Node.js memory (`process.env`) using **Hybrid E2E Encryption (RSA-OAEP + AES-CFB)**. If the app stops, the secrets disappear.
+
+### 🔥 Killer Features
+- **Zero-Friction SDK:** Replaces `dotenv` with exactly 2 lines of code.
+- **E2E Encryption out-of-the-box:** Secrets are never sent in plain text over the network.
+- **Honeytokens & Webhooks:** Create fake "Honeytoken" secrets. If a hacker tries to use them, the Vault instantly locks down and sends an alert to your **Telegram/Slack**.
+- **Burn-on-read Tokens:** For maximum paranoia, use one-time wrap tokens that self-destruct after your app boots.
+
+## 📦 Installation
+
+```bash
+npm install titan-vault-node
+```
+
+## 💻 Usage
+
+Replace your standard `dotenv.config()` with `initVault()`.
+
+### 1. Set your App Token
+In your deployment environment (or a local `.env`), just provide your vault's URL and your App Token:
+
+```env
+VAULT_URL=http://localhost:8200
+VAULT_APP_TOKEN=my-super-secret-app-role-token
+```
+
+### 2. Initialize in your code
+
+```typescript
+import { initVault } from 'titan-vault-node';
+
+async function startServer() {
+  // Magically connects to Titan Vault, decrypts the E2E payload, 
+  // and injects everything into process.env!
+  await initVault();
+
+  console.log("My secure DB password is:", process.env.DB_PASSWORD);
+  
+  // Start your Express/NestJS/HTTP server...
+}
+
+startServer();
+```
+
+## 🚨 Telegram Webhook Setup (Server-side)
+Want to be notified if someone touches your Honeytoken? Run your Titan Vault server with Telegram variables:
+
+```bash
+export TELEGRAM_BOT_TOKEN="your_bot_token"
+export TELEGRAM_CHAT_ID="your_chat_id"
+# Start your vault...
+```
+If your Honeytoken is triggered, the Vault seals itself and sends a red alert to your phone instantly.
+
+---
+**Built for the paranoid, designed for the developer.**

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+interface VaultOptions {
+    vaultUrl?: string;
+    vaultToken?: string;
+    path?: string;
+    maxRetries?: number;
+    retryDelayMs?: number;
+}
+export declare function initVault(options?: VaultOptions): Promise<void>;
+export {};

package/dist/index.js

@@ -0,0 +1,84 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.initVault = initVault;
+const dotenv_1 = __importDefault(require("dotenv"));
+const crypto_1 = __importDefault(require("crypto"));
+async function initVault(options = {}) {
+    // Load local .env first to get base configs (like VAULT_URL or VAULT_TOKEN)
+    dotenv_1.default.config();
+    const VAULT_URL = options.vaultUrl || process.env.VAULT_URL || 'http://127.0.0.1:8200';
+    const VAULT_TOKEN = options.vaultToken || process.env.VAULT_TOKEN;
+    const SECRET_PATH = options.path || 'backend_env';
+    const MAX_RETRIES = options.maxRetries || 5;
+    const RETRY_DELAY = options.retryDelayMs || 5000;
+    if (!VAULT_TOKEN) {
+        console.warn("⚠️ [Titan Vault] No VAULT_TOKEN found. Using local .env fallback.");
+        return;
+    }
+    console.log(`\n🔒 [Titan Vault] Conectando a ${VAULT_URL}...`);
+    // E2E Encryption: Generate ephemeral RSA keypair
+    const { publicKey, privateKey } = crypto_1.default.generateKeyPairSync('rsa', {
+        modulusLength: 2048,
+        publicKeyEncoding: { type: 'spki', format: 'pem' },
+        privateKeyEncoding: { type: 'pkcs8', format: 'pem' }
+    });
+    const pubBase64 = Buffer.from(publicKey).toString('base64');
+    let attempt = 0;
+    while (attempt < MAX_RETRIES) {
+        attempt++;
+        try {
+            const res = await fetch(`${VAULT_URL}/secret/data/${SECRET_PATH}`, {
+                headers: {
+                    "x-vault-token": VAULT_TOKEN,
+                    "x-vault-public-key": pubBase64
+                }
+            });
+            if (res.ok) {
+                const json = await res.json();
+                let finalSecretStr = "";
+                if (json.data && json.data.is_encrypted) {
+                    console.log("🔐 [Titan Vault] Descifrando payload E2E híbrido (RSA-OAEP + AES-CFB)...");
+                    const buffer = Buffer.from(json.data.value, 'base64');
+                    const encAesKey = buffer.subarray(0, 256);
+                    const iv = buffer.subarray(256, 256 + 16);
+                    const ciphertext = buffer.subarray(256 + 16);
+                    const aesKey = crypto_1.default.privateDecrypt({
+                        key: privateKey,
+                        padding: crypto_1.default.constants.RSA_PKCS1_OAEP_PADDING,
+                        oaepHash: "sha256"
+                    }, encAesKey);
+                    const decipher = crypto_1.default.createDecipheriv('aes-256-cfb', aesKey, iv);
+                    let decrypted = decipher.update(ciphertext, undefined, 'utf8');
+                    decrypted += decipher.final('utf8');
+                    finalSecretStr = decrypted;
+                }
+                else {
+                    finalSecretStr = json.data.value;
+                }
+                const secrets = JSON.parse(finalSecretStr);
+                // Inject into process.env
+                let injectedCount = 0;
+                for (const [key, value] of Object.entries(secrets)) {
+                    process.env[key] = value;
+                    injectedCount++;
+                }
+                console.log(`✅ [Titan Vault] ${injectedCount} secretos inyectados en memoria (Zero-Trust).`);
+                return; // Success!
+            }
+            else {
+                const errText = await res.text();
+                console.warn(`[Titan Vault] Vault sellado o token inválido (HTTP ${res.status}): ${errText}. Reintentando en ${RETRY_DELAY / 1000}s...`);
+            }
+        }
+        catch (err) {
+            console.warn(`❌ [Titan Vault] Error de conexión (${err.message}). Reintentando en ${RETRY_DELAY / 1000}s...`);
+        }
+        if (attempt < MAX_RETRIES) {
+            await new Promise(resolve => setTimeout(resolve, RETRY_DELAY));
+        }
+    }
+    console.error("🚨 [Titan Vault] No se pudo conectar al vault tras múltiples intentos. Iniciando con secretos locales si existen.");
+}

package/package.json

@@ -1,6 +1,27 @@
 {
   "name": "titan-vault-node",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0",
+  "description": "Zero-trust, E2E encrypted, drop-in replacement for dotenv.",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc"
+  },
+  "keywords": [
+    "vault",
+    "security",
+    "dotenv",
+    "secrets",
+    "zero-trust",
+    "e2e"
+  ],
+  "author": "Titan Vault Community",
+  "license": "MIT",
+  "dependencies": {
+    "dotenv": "^16.4.5"
+  },
+  "devDependencies": {
+    "typescript": "^5.6.3",
+    "@types/node": "^22.0.0"
+  }
+}

package/src/index.ts

@@ -0,0 +1,101 @@
+import dotenv from 'dotenv';
+import crypto from 'crypto';
+
+interface VaultOptions {
+  vaultUrl?: string;
+  vaultToken?: string;
+  path?: string;
+  maxRetries?: number;
+  retryDelayMs?: number;
+}
+
+export async function initVault(options: VaultOptions = {}) {
+  // Load local .env first to get base configs (like VAULT_URL or VAULT_TOKEN)
+  dotenv.config();
+
+  const VAULT_URL = options.vaultUrl || process.env.VAULT_URL || 'http://127.0.0.1:8200';
+  const VAULT_TOKEN = options.vaultToken || process.env.VAULT_TOKEN;
+  const SECRET_PATH = options.path || 'backend_env';
+  const MAX_RETRIES = options.maxRetries || 5;
+  const RETRY_DELAY = options.retryDelayMs || 5000;
+
+  if (!VAULT_TOKEN) {
+    console.warn("⚠️ [Titan Vault] No VAULT_TOKEN found. Using local .env fallback.");
+    return;
+  }
+
+  console.log(`\n🔒 [Titan Vault] Conectando a ${VAULT_URL}...`);
+  
+  // E2E Encryption: Generate ephemeral RSA keypair
+  const { publicKey, privateKey } = crypto.generateKeyPairSync('rsa', {
+    modulusLength: 2048,
+    publicKeyEncoding: { type: 'spki', format: 'pem' },
+    privateKeyEncoding: { type: 'pkcs8', format: 'pem' }
+  });
+  
+  const pubBase64 = Buffer.from(publicKey).toString('base64');
+  let attempt = 0;
+
+  while (attempt < MAX_RETRIES) {
+    attempt++;
+    try {
+      const res = await fetch(`${VAULT_URL}/secret/data/${SECRET_PATH}`, {
+        headers: { 
+          "x-vault-token": VAULT_TOKEN,
+          "x-vault-public-key": pubBase64
+        }
+      });
+      
+      if (res.ok) {
+        const json = await res.json();
+        let finalSecretStr = "";
+        
+        if (json.data && json.data.is_encrypted) {
+          console.log("🔐 [Titan Vault] Descifrando payload E2E híbrido (RSA-OAEP + AES-CFB)...");
+          const buffer = Buffer.from(json.data.value, 'base64');
+          
+          const encAesKey = buffer.subarray(0, 256);
+          const iv = buffer.subarray(256, 256 + 16);
+          const ciphertext = buffer.subarray(256 + 16);
+
+          const aesKey = crypto.privateDecrypt({
+              key: privateKey,
+              padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
+              oaepHash: "sha256"
+          }, encAesKey);
+
+          const decipher = crypto.createDecipheriv('aes-256-cfb', aesKey, iv);
+          let decrypted = decipher.update(ciphertext, undefined, 'utf8');
+          decrypted += decipher.final('utf8');
+          
+          finalSecretStr = decrypted;
+        } else {
+          finalSecretStr = json.data.value;
+        }
+
+        const secrets = JSON.parse(finalSecretStr);
+        
+        // Inject into process.env
+        let injectedCount = 0;
+        for (const [key, value] of Object.entries(secrets)) {
+          process.env[key] = value as string;
+          injectedCount++;
+        }
+        
+        console.log(`✅ [Titan Vault] ${injectedCount} secretos inyectados en memoria (Zero-Trust).`);
+        return; // Success!
+      } else {
+        const errText = await res.text();
+        console.warn(`[Titan Vault] Vault sellado o token inválido (HTTP ${res.status}): ${errText}. Reintentando en ${RETRY_DELAY/1000}s...`);
+      }
+    } catch (err: any) {
+      console.warn(`❌ [Titan Vault] Error de conexión (${err.message}). Reintentando en ${RETRY_DELAY/1000}s...`);
+    }
+    
+    if (attempt < MAX_RETRIES) {
+      await new Promise(resolve => setTimeout(resolve, RETRY_DELAY));
+    }
+  }
+  
+  console.error("🚨 [Titan Vault] No se pudo conectar al vault tras múltiples intentos. Iniciando con secretos locales si existen.");
+}

package/tsconfig.json

@@ -0,0 +1,14 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "CommonJS",
+    "moduleResolution": "node",
+    "declaration": true,
+    "outDir": "./dist",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true
+  },
+  "include": ["src/**/*"]
+}