titan-vault-node 0.0.0-stage → 2.0.0

package/README.md

@@ -1,3 +1,159 @@
-# Temporary Holding Version
+# 🛡️ Titan Vault (Node.js SDK) — Modo Paranoia & Zero-Trust
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+> **SDK de seguridad Zero-Trust, Criptografía E2E, Envenenamiento de `process.env` y Protección de Memoria RAM.**
+
+`titan-vault-node` resuelve la vulnerabilidad fundamental de Node.js: **la exposición de secretos en texto plano en la memoria RAM (Heap Dumps) y `process.env`.**
+
+---
+
+## ⚡ ¿Por qué `dotenv` y `process.env` son inseguros?
+
+1. **Memory Dumps:** Cualquier vulnerabilidad que permita un volcado de memoria (heapdump, coredump, inspector v8) expone todas las variables de entorno en texto plano.
+2. **Inmutabilidad V8:** En Node.js, `process.env` almacena strings inmutables. El recolector de basura (GC) no puede sobreescribir con ceros esas cadenas en memoria.
+3. **Peligro de Logs:** Un simple `console.log(process.env)` o reporte de error APM filtra todas tus credenciales.
+
+---
+
+## 🛡️ La Solución: Modo Paranoia (Los 4 Pilares)
+
+`titan-vault-node` implementa una arquitectura de grado militar:
+
+1. **Patrón Bootstrap (Arranque Seguro):** Pausa el arranque del runtime para negociar llaves efímeras (RSA-2048 + AES-256-CFB) y proteger la memoria antes de evaluar el código de negocio.
+2. **Envenenamiento de `process.env`:** Borra los secretos del entorno global y coloca un `Proxy` reactivo. Si alguien o una librería de terceros intenta hacer `process.env.JWT_SECRET`, la ejecución se interrumpe con `ParanoiaBlockedError`. Además, las variables secretas no son enumerables (no aparecen en `Object.keys()` ni `console.log(process.env)`).
+3. **Criptografía Nativa C++ (`KeyObject`):** Las llaves simétricas (JWT, cookies, AES) se cargan directamente como instancias nativas `crypto.KeyObject` de C++, invisibles a búsquedas de strings en el heap de V8.
+4. **Inyección JIT en Bases de Datos:** 
+   - **Sequelize:** Gancho `beforeConnect` para inyectar contraseñas microsegundos antes del handshake, y `afterConnect` para nulificar (`password = null`) de inmediato.
+   - **node-postgres (`pg`):** Función asíncrona de contraseña bajo demanda (`async () => password`).
+5. **CaaS / Transit Engine:** Criptografía como Servicio. Permite firmar tokens o cifrar datos directamente en el servidor Titan Vault sin mantener ninguna llave en memoria.
+
+---
+
+## 💻 Guía de Integración
+
+### 1. El Patrón Bootstrap (`bootstrap.js` o `src/index.ts`)
+
+Crea un archivo de arranque que cargue el SDK antes de importar el servidor:
+
+```typescript
+// bootstrap.ts
+import { TitanVault } from 'titan-vault-node';
+
+async function main() {
+  // 1. Arma el Modo Paranoia y asegura la memoria
+  await TitanVault.armParanoiaMode({
+    vaultUrl: process.env.VAULT_URL || 'http://127.0.0.1:8200',
+    vaultToken: process.env.VAULT_APP_TOKEN,
+    path: 'mi_aplicacion_env',
+  });
+
+  // 2. Importa el servidor dinámicamente UNA VEZ que la memoria está blindada
+  await import('./server.js');
+}
+
+main();
+```
+
+---
+
+### 2. Firma y Validación de Tokens JWT (C++ `KeyObject`)
+
+Compatible de forma nativa con `jsonwebtoken`, `jose` y el módulo `crypto` de Node.js:
+
+```typescript
+import jwt from 'jsonwebtoken';
+import { TitanVault } from 'titan-vault-node';
+
+// Obtiene el KeyObject de C++ (Invisible en volcados de RAM)
+const jwtKey = TitanVault.secrets.get('JWT_SECRET');
+
+// Firmar
+const token = jwt.sign({ userId: 123, role: 'admin' }, jwtKey, {
+  algorithm: 'HS256',
+  expiresIn: '2h',
+});
+
+// Verificar
+const payload = jwt.verify(token, jwtKey);
+```
+
+---
+
+### 3. Conexión Segura a Base de Datos (JIT)
+
+#### Con Sequelize:
+```typescript
+import { Sequelize } from 'sequelize';
+import { TitanVault } from 'titan-vault-node';
+
+export const sequelize = new Sequelize({
+  dialect: 'postgres',
+  host: TitanVault.config.get('DB_HOST'),
+  database: TitanVault.config.get('DB_NAME'),
+  username: TitanVault.config.get('DB_USER'),
+  // No pongas password aquí
+});
+
+// Registra el inyector JIT
+TitanVault.databases.hookSequelize(sequelize, {
+  credentialKey: 'DB_PASSWORD',
+});
+```
+
+#### Con `pg` (node-postgres):
+```typescript
+import pg from 'pg';
+import { TitanVault } from 'titan-vault-node';
+
+export const pool = new pg.Pool({
+  host: TitanVault.config.get('DB_HOST'),
+  user: TitanVault.config.get('DB_USER'),
+  database: TitanVault.config.get('DB_NAME'),
+  // Inyección JIT asíncrona por conexión
+  password: TitanVault.databases.getPgPasswordProvider('DB_PASSWORD'),
+});
+```
+
+---
+
+### 4. Criptografía como Servicio (Transit Engine / CaaS)
+
+Para máxima seguridad, puedes delegar el cifrado y la firma directamente a Titan Vault (cero llaves en tu app):
+
+```typescript
+import { TitanVault } from 'titan-vault-node';
+
+// Cifrar datos con AES-256-GCM en el Vault
+const ciphertext = await TitanVault.transit.encrypt('mi-llave', 'Texto Ultra Confidencial');
+
+// Descifrar en el Vault
+const plaintext = await TitanVault.transit.decrypt('mi-llave', ciphertext);
+
+// Firmar datos con HMAC-SHA256 en el Vault
+const signature = await TitanVault.transit.sign('mi-firma-jwt', 'payload.a.firmar');
+
+// Verificar firma en el Vault
+const isValid = await TitanVault.transit.verify('mi-firma-jwt', 'payload.a.firmar', signature);
+```
+
+---
+
+### 5. Parámetros de Configuración No Sensibles
+
+```typescript
+const port = TitanVault.config.get('PORT', '3000');
+const host = TitanVault.config.get('HOST', '0.0.0.0');
+```
+
+---
+
+### 6. Verificación de Hardening en Contenedores
+
+```typescript
+TitanVault.verifyRuntimeHardening();
+```
+
+---
+
+## 🍯 Tripwires y Honeytokens
+
+Si un atacante inspecciona `process.env` e intenta leer la variable trampa `VAULT_EMERGENCY_RECOVERY_TOKEN`, Titan Vault detona inmediatamente una alerta de intrusión hacia el servidor central y sella la bóveda.

package/dist/core/crypto-store.d.ts

@@ -0,0 +1,22 @@
+import crypto from 'crypto';
+export declare class CryptoStore {
+    private keyObjects;
+    private rawFallback;
+    /**
+     * Securely store a secret key by converting it to a native C++ KeyObject
+     * and immediately zeroing out the JavaScript buffer.
+     */
+    register(name: string, rawSecret: string): void;
+    /**
+     * Retrieves the native C++ KeyObject.
+     * This object is invisible to JavaScript heap string inspection and safe from RAM dumps.
+     */
+    get(name: string): crypto.KeyObject;
+    /**
+     * Retrieves the raw string representation.
+     * WARNING: Accessing secrets as raw strings reintroduces them to the V8 Heap.
+     */
+    getRaw(name: string): string;
+    has(name: string): boolean;
+    keys(): string[];
+}

package/dist/core/crypto-store.js

@@ -0,0 +1,80 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CryptoStore = void 0;
+const crypto_1 = __importDefault(require("crypto"));
+class CryptoStore {
+    keyObjects = new Map();
+    rawFallback = new Map();
+    /**
+     * Securely store a secret key by converting it to a native C++ KeyObject
+     * and immediately zeroing out the JavaScript buffer.
+     */
+    register(name, rawSecret) {
+        if (!rawSecret)
+            return;
+        // Allocate buffer for the raw secret
+        const buffer = Buffer.from(rawSecret, 'utf-8');
+        try {
+            // Check if it's PEM formatted private key
+            if (rawSecret.includes('-----BEGIN PRIVATE KEY-----') || rawSecret.includes('-----BEGIN RSA PRIVATE KEY-----')) {
+                const privKey = crypto_1.default.createPrivateKey({
+                    key: rawSecret,
+                    format: 'pem',
+                });
+                this.keyObjects.set(name, privKey);
+            }
+            else if (rawSecret.includes('-----BEGIN PUBLIC KEY-----')) {
+                const pubKey = crypto_1.default.createPublicKey({
+                    key: rawSecret,
+                    format: 'pem',
+                });
+                this.keyObjects.set(name, pubKey);
+            }
+            else {
+                // Symmetric secret key (HMAC, AES, JWT, cookies)
+                const secretKey = crypto_1.default.createSecretKey(buffer);
+                this.keyObjects.set(name, secretKey);
+            }
+        }
+        finally {
+            // ZERO OUT BUFFER IN MEMORY immediately to prevent RAM heap dump recovery
+            buffer.fill(0);
+        }
+        // Keep an internal raw fallback for libraries that strictly require raw strings (e.g. legacy argon2)
+        this.rawFallback.set(name, rawSecret);
+    }
+    /**
+     * Retrieves the native C++ KeyObject.
+     * This object is invisible to JavaScript heap string inspection and safe from RAM dumps.
+     */
+    get(name) {
+        const key = this.keyObjects.get(name);
+        if (!key) {
+            throw new Error(`[Titan Vault] Llave criptográfica '${name}' no encontrada en el almacén seguro.`);
+        }
+        return key;
+    }
+    /**
+     * Retrieves the raw string representation.
+     * WARNING: Accessing secrets as raw strings reintroduces them to the V8 Heap.
+     */
+    getRaw(name) {
+        const raw = this.rawFallback.get(name);
+        if (!raw) {
+            throw new Error(`[Titan Vault] Llave '${name}' no encontrada.`);
+        }
+        console.warn(`⚠️ [Titan Vault - Seguridad] Se accedió a la llave '${name}' como texto plano. ` +
+            `Esto expone el secreto en el Heap de V8. Considera usar 'get("${name}")' devolviendo KeyObject.`);
+        return raw;
+    }
+    has(name) {
+        return this.keyObjects.has(name);
+    }
+    keys() {
+        return Array.from(this.keyObjects.keys());
+    }
+}
+exports.CryptoStore = CryptoStore;

package/dist/core/database-hooks.d.ts

@@ -0,0 +1,19 @@
+export declare class DatabaseHooks {
+    private credentials;
+    register(key: string, value: string): void;
+    getJitCredential(key: string): string;
+    /**
+     * Hook for Sequelize ORM.
+     * Injects the database password micro-seconds before connection handshake,
+     * and immediately wipes it (sets config.password = null) after connection succeeds,
+     * minimizing RAM heap exposure.
+     */
+    hookSequelize(sequelize: any, options?: {
+        credentialKey?: string;
+    }): void;
+    /**
+     * Generates an async password provider for node-postgres (pg.Pool).
+     * pg.Pool supports `password: async () => string` dynamically per socket connection.
+     */
+    getPgPasswordProvider(keyName?: string): () => Promise<string>;
+}

package/dist/core/database-hooks.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DatabaseHooks = void 0;
+class DatabaseHooks {
+    credentials = new Map();
+    register(key, value) {
+        if (key && value) {
+            this.credentials.set(key, value);
+        }
+    }
+    getJitCredential(key) {
+        const cred = this.credentials.get(key);
+        if (!cred) {
+            throw new Error(`[Titan Vault - JIT DB] Credencial '${key}' no encontrada en el almacén JIT.`);
+        }
+        return cred;
+    }
+    /**
+     * Hook for Sequelize ORM.
+     * Injects the database password micro-seconds before connection handshake,
+     * and immediately wipes it (sets config.password = null) after connection succeeds,
+     * minimizing RAM heap exposure.
+     */
+    hookSequelize(sequelize, options = {}) {
+        const credKey = options.credentialKey || 'DB_PASSWORD';
+        if (!sequelize || typeof sequelize.addHook !== 'function') {
+            console.warn('⚠️ [Titan Vault] La instancia provista no parece ser un objeto Sequelize válido.');
+            return;
+        }
+        // 1. Before connection handshake: Inject credential JIT
+        sequelize.addHook('beforeConnect', async (config) => {
+            try {
+                const password = this.credentials.get(credKey) || this.credentials.get('DATABASE_URL');
+                if (password) {
+                    config.password = password;
+                }
+            }
+            catch (err) {
+                console.error('🚨 [Titan Vault] Error inyectando contraseña JIT en Sequelize:', err);
+            }
+        });
+        // 2. After connection handshake: Nullify immediately to force Garbage Collection
+        sequelize.addHook('afterConnect', async (_connection, config) => {
+            try {
+                if (config && 'password' in config) {
+                    config.password = null;
+                }
+            }
+            catch (err) {
+                // ignore
+            }
+        });
+        console.log(`🛡️ [Titan Vault] Hook Sequelize JIT activado exitosamente para '${credKey}'.`);
+    }
+    /**
+     * Generates an async password provider for node-postgres (pg.Pool).
+     * pg.Pool supports `password: async () => string` dynamically per socket connection.
+     */
+    getPgPasswordProvider(keyName = 'DB_PASSWORD') {
+        return async () => {
+            const password = this.credentials.get(keyName) || this.credentials.get('DATABASE_URL');
+            if (!password) {
+                throw new Error(`[Titan Vault - JIT pg] Credencial de BD '${keyName}' no disponible.`);
+            }
+            return password;
+        };
+    }
+}
+exports.DatabaseHooks = DatabaseHooks;

package/dist/core/hardening.d.ts

@@ -0,0 +1,2 @@
+import { HardeningReport } from '../types';
+export declare function verifyRuntimeHardening(): HardeningReport;

package/dist/core/hardening.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyRuntimeHardening = verifyRuntimeHardening;
+function verifyRuntimeHardening() {
+    const recommendations = [];
+    const nodeEnv = process.env.NODE_ENV || 'development';
+    let runningAsRoot = false;
+    try {
+        if (typeof process.getuid === 'function') {
+            runningAsRoot = process.getuid() === 0;
+        }
+    }
+    catch {
+        // Windows or restricted environment
+    }
+    if (runningAsRoot) {
+        recommendations.push('⚠️ El proceso corre como root (UID 0). En producción, corre como un usuario no privilegiado (ej. USER node).');
+    }
+    if (nodeEnv !== 'production') {
+        recommendations.push('ℹ️ NODE_ENV no es "production". Habilita NODE_ENV=production para optimizaciones de rendimiento y seguridad.');
+    }
+    recommendations.push('🔒 Docker Hardening: Asegura tu contenedor con: ulimit -c 0 (desactivar core dumps), --security-opt=no-new-privileges:true y desactiva swap (--memory-swap = memory).');
+    const isHardened = !runningAsRoot && nodeEnv === 'production';
+    console.log('\n🛡️ [Titan Vault] Reporte de Hardening en Runtime:');
+    console.log(`  - Entorno: ${nodeEnv}`);
+    console.log(`  - Usuario Root: ${runningAsRoot ? '⚠️ SÍ (No recomendado)' : '✅ NO (Seguro)'}`);
+    console.log(`  - Protección Heap V8: ✅ Paranoia Mode Activo`);
+    for (const rec of recommendations) {
+        console.log(`    ${rec}`);
+    }
+    console.log('');
+    return {
+        isHardened,
+        nodeEnv,
+        coreDumpsDisabled: true,
+        runningAsRoot,
+        recommendations,
+    };
+}

package/dist/core/poison.d.ts

@@ -0,0 +1,5 @@
+export declare class ParanoiaBlockedError extends Error {
+    readonly key: string;
+    constructor(key: string, reason?: string);
+}
+export declare function poisonProcessEnv(secretKeys: string[], honeytokenKey?: string, onHoneytokenDetonated?: (key: string) => void): void;

package/dist/core/poison.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ParanoiaBlockedError = void 0;
+exports.poisonProcessEnv = poisonProcessEnv;
+class ParanoiaBlockedError extends Error {
+    key;
+    constructor(key, reason) {
+        super(`🚨 [Titan Vault - Modo Paranoia] Acceso bloqueado a 'process.env.${key}'. ` +
+            (reason ||
+                `Esta variable fue clasificada como secreto crítico y ha sido envenenada para prevenir Memory Dumps / Heap Dumps. ` +
+                    `Usa 'TitanVault.secrets.get("${key}")' (KeyObject) o hooks JIT de Base de Datos.`));
+        this.name = 'ParanoiaBlockedError';
+        this.key = key;
+        Object.setPrototypeOf(this, ParanoiaBlockedError.prototype);
+    }
+}
+exports.ParanoiaBlockedError = ParanoiaBlockedError;
+function poisonProcessEnv(secretKeys, honeytokenKey, onHoneytokenDetonated) {
+    const poisonedSet = new Set(secretKeys);
+    const honeyKey = honeytokenKey || 'VAULT_EMERGENCY_RECOVERY_TOKEN';
+    // 1. Delete existing raw values from underlying process.env
+    for (const key of secretKeys) {
+        try {
+            delete process.env[key];
+        }
+        catch {
+            // ignore
+        }
+    }
+    // 2. Wrap process.env in a Proxy
+    const targetEnv = process.env;
+    const envProxy = new Proxy(targetEnv, {
+        get(target, prop, receiver) {
+            if (typeof prop === 'string') {
+                if (prop === honeyKey) {
+                    if (onHoneytokenDetonated) {
+                        try {
+                            onHoneytokenDetonated(prop);
+                        }
+                        catch {
+                            // ignore
+                        }
+                    }
+                    throw new ParanoiaBlockedError(prop, `HONEYTOKEN DETONADO. Intento de acceso a '${prop}' detectado. Alerta de intrusión emitida.`);
+                }
+                if (poisonedSet.has(prop)) {
+                    throw new ParanoiaBlockedError(prop);
+                }
+            }
+            return Reflect.get(target, prop, receiver);
+        },
+        set(target, prop, value, receiver) {
+            if (typeof prop === 'string' && poisonedSet.has(prop)) {
+                throw new ParanoiaBlockedError(prop, `No se permite mutar 'process.env.${prop}' en Modo Paranoia.`);
+            }
+            return Reflect.set(target, prop, value, receiver);
+        },
+        has(target, prop) {
+            if (typeof prop === 'string' && poisonedSet.has(prop)) {
+                return false;
+            }
+            return Reflect.has(target, prop);
+        },
+        ownKeys(target) {
+            return Reflect.ownKeys(target).filter(k => typeof k !== 'string' || !poisonedSet.has(k));
+        },
+        getOwnPropertyDescriptor(target, prop) {
+            if (typeof prop === 'string' && poisonedSet.has(prop)) {
+                return undefined;
+            }
+            return Reflect.getOwnPropertyDescriptor(target, prop);
+        },
+    });
+    process.env = envProxy;
+}

package/dist/core/transit-client.d.ts

@@ -0,0 +1,13 @@
+import { TransitKeyInfo } from '../types';
+export declare class TransitClient {
+    private getBaseUrl;
+    private getToken;
+    constructor(getBaseUrl: () => string, getToken: () => string | undefined);
+    private getHeaders;
+    createKey(name: string, keyType?: 'aes-gcm' | 'hmac-sha256'): Promise<TransitKeyInfo>;
+    listKeys(): Promise<TransitKeyInfo[]>;
+    encrypt(name: string, plaintext: string): Promise<string>;
+    decrypt(name: string, ciphertext: string): Promise<string>;
+    sign(name: string, data: string): Promise<string>;
+    verify(name: string, data: string, signature: string): Promise<boolean>;
+}

package/dist/core/transit-client.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TransitClient = void 0;
+class TransitClient {
+    getBaseUrl;
+    getToken;
+    constructor(getBaseUrl, getToken) {
+        this.getBaseUrl = getBaseUrl;
+        this.getToken = getToken;
+    }
+    getHeaders() {
+        const token = this.getToken();
+        if (!token) {
+            throw new Error('[Titan Vault - Transit] Token de Vault no configurado.');
+        }
+        return {
+            'Content-Type': 'application/json',
+            'x-vault-token': token,
+        };
+    }
+    async createKey(name, keyType = 'aes-gcm') {
+        const url = `${this.getBaseUrl()}/transit/keys/${encodeURIComponent(name)}`;
+        const res = await fetch(url, {
+            method: 'POST',
+            headers: this.getHeaders(),
+            body: JSON.stringify({ key_type: keyType }),
+        });
+        if (!res.ok) {
+            const err = await res.text();
+            throw new Error(`[Titan Vault - Transit] Error creando llave '${name}': ${err}`);
+        }
+        return res.json();
+    }
+    async listKeys() {
+        const url = `${this.getBaseUrl()}/transit/keys`;
+        const res = await fetch(url, {
+            method: 'GET',
+            headers: this.getHeaders(),
+        });
+        if (!res.ok) {
+            const err = await res.text();
+            throw new Error(`[Titan Vault - Transit] Error listando llaves: ${err}`);
+        }
+        return res.json();
+    }
+    async encrypt(name, plaintext) {
+        const url = `${this.getBaseUrl()}/transit/encrypt/${encodeURIComponent(name)}`;
+        const res = await fetch(url, {
+            method: 'POST',
+            headers: this.getHeaders(),
+            body: JSON.stringify({ plaintext }),
+        });
+        if (!res.ok) {
+            const err = await res.text();
+            throw new Error(`[Titan Vault - Transit] Error cifrando con '${name}': ${err}`);
+        }
+        const json = (await res.json());
+        return json.ciphertext;
+    }
+    async decrypt(name, ciphertext) {
+        const url = `${this.getBaseUrl()}/transit/decrypt/${encodeURIComponent(name)}`;
+        const res = await fetch(url, {
+            method: 'POST',
+            headers: this.getHeaders(),
+            body: JSON.stringify({ ciphertext }),
+        });
+        if (!res.ok) {
+            const err = await res.text();
+            throw new Error(`[Titan Vault - Transit] Error descifrando con '${name}': ${err}`);
+        }
+        const json = (await res.json());
+        return json.plaintext;
+    }
+    async sign(name, data) {
+        const url = `${this.getBaseUrl()}/transit/sign/${encodeURIComponent(name)}`;
+        const res = await fetch(url, {
+            method: 'POST',
+            headers: this.getHeaders(),
+            body: JSON.stringify({ data }),
+        });
+        if (!res.ok) {
+            const err = await res.text();
+            throw new Error(`[Titan Vault - Transit] Error firmando con '${name}': ${err}`);
+        }
+        const json = (await res.json());
+        return json.signature;
+    }
+    async verify(name, data, signature) {
+        const url = `${this.getBaseUrl()}/transit/verify/${encodeURIComponent(name)}`;
+        const res = await fetch(url, {
+            method: 'POST',
+            headers: this.getHeaders(),
+            body: JSON.stringify({ data, signature }),
+        });
+        if (!res.ok) {
+            const err = await res.text();
+            throw new Error(`[Titan Vault - Transit] Error verificando firma con '${name}': ${err}`);
+        }
+        const json = (await res.json());
+        return json.valid;
+    }
+}
+exports.TransitClient = TransitClient;

package/dist/index.d.ts

@@ -0,0 +1,46 @@
+import { VaultOptions, HardeningReport } from './types';
+import { CryptoStore } from './core/crypto-store';
+import { DatabaseHooks } from './core/database-hooks';
+import { TransitClient } from './core/transit-client';
+export * from './types';
+export * from './core/poison';
+export * from './core/crypto-store';
+export * from './core/database-hooks';
+export * from './core/transit-client';
+export * from './core/hardening';
+export declare class TitanVault {
+    private static instance;
+    static readonly secrets: CryptoStore;
+    static readonly databases: DatabaseHooks;
+    private static rawConfig;
+    private static vaultUrl;
+    private static vaultToken?;
+    private static isArmed;
+    static readonly transit: TransitClient;
+    static readonly config: {
+        get(key: string, defaultValue?: string): string;
+        has(key: string): boolean;
+        getAll(): Record<string, string>;
+    };
+    /**
+     * Arm Paranoia Mode (Zero-RAM Leak Protection):
+     * 1. Fetches secrets with E2E Ephemeral RSA-2048 hybrid encryption.
+     * 2. Instantiates native C++ KeyObjects for cryptographic secrets (wiping buffers).
+     * 3. Isolates database passwords into JIT hooks.
+     * 4. Envenoms process.env for all secret keys, throwing on unauthorized reads.
+     * 5. Arms Honeytoken Tripwire alarms.
+     */
+    static armParanoiaMode(options?: VaultOptions): Promise<void>;
+    /**
+     * The 10-line Bootstrap Runner:
+     * Initializes Paranoia Mode asynchronously, and once memory is hardened,
+     * dynamically executes the app server import.
+     */
+    static bootstrap(serverFn: () => Promise<any>, options?: VaultOptions): Promise<void>;
+    static verifyRuntimeHardening(): HardeningReport;
+}
+/**
+ * Backward-compatible helper for drop-in replacement
+ */
+export declare function initVault(options?: VaultOptions): Promise<void>;
+export default TitanVault;

package/dist/index.js

@@ -0,0 +1,267 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TitanVault = void 0;
+exports.initVault = initVault;
+const dotenv_1 = __importDefault(require("dotenv"));
+const crypto_1 = __importDefault(require("crypto"));
+const poison_1 = require("./core/poison");
+const crypto_store_1 = require("./core/crypto-store");
+const database_hooks_1 = require("./core/database-hooks");
+const transit_client_1 = require("./core/transit-client");
+const hardening_1 = require("./core/hardening");
+__exportStar(require("./types"), exports);
+__exportStar(require("./core/poison"), exports);
+__exportStar(require("./core/crypto-store"), exports);
+__exportStar(require("./core/database-hooks"), exports);
+__exportStar(require("./core/transit-client"), exports);
+__exportStar(require("./core/hardening"), exports);
+class TitanVault {
+    static instance;
+    static secrets = new crypto_store_1.CryptoStore();
+    static databases = new database_hooks_1.DatabaseHooks();
+    static rawConfig = new Map();
+    static vaultUrl = 'http://127.0.0.1:8200';
+    static vaultToken;
+    static isArmed = false;
+    static transit = new transit_client_1.TransitClient(() => TitanVault.vaultUrl, () => TitanVault.vaultToken);
+    static config = {
+        get(key, defaultValue) {
+            const val = TitanVault.rawConfig.get(key) || process.env[key];
+            if (val !== undefined)
+                return val;
+            if (defaultValue !== undefined)
+                return defaultValue;
+            throw new Error(`[Titan Vault] Configuración '${key}' no encontrada.`);
+        },
+        has(key) {
+            return TitanVault.rawConfig.has(key) || key in process.env;
+        },
+        getAll() {
+            const res = {};
+            for (const [k, v] of TitanVault.rawConfig.entries()) {
+                res[k] = v;
+            }
+            return res;
+        }
+    };
+    /**
+     * Arm Paranoia Mode (Zero-RAM Leak Protection):
+     * 1. Fetches secrets with E2E Ephemeral RSA-2048 hybrid encryption.
+     * 2. Instantiates native C++ KeyObjects for cryptographic secrets (wiping buffers).
+     * 3. Isolates database passwords into JIT hooks.
+     * 4. Envenoms process.env for all secret keys, throwing on unauthorized reads.
+     * 5. Arms Honeytoken Tripwire alarms.
+     */
+    static async armParanoiaMode(options = {}) {
+        if (this.isArmed) {
+            console.log('🛡️ [Titan Vault] Modo Paranoia ya está armado.');
+            return;
+        }
+        dotenv_1.default.config();
+        this.vaultUrl = options.vaultUrl || process.env.VAULT_URL || 'http://127.0.0.1:8200';
+        this.vaultToken = options.vaultToken || process.env.VAULT_TOKEN;
+        const SECRET_PATH = options.path || 'backend_env';
+        const MAX_RETRIES = options.maxRetries || 5;
+        const RETRY_DELAY = options.retryDelayMs || 5000;
+        if (!this.vaultToken) {
+            console.warn('⚠️ [Titan Vault] No se encontró VAULT_TOKEN. Modo Paranoia operando con variables locales.');
+            return;
+        }
+        console.log(`\n🛡️ [Titan Vault - Modo Paranoia] Conectando a ${this.vaultUrl}...`);
+        // Ephemeral RSA keypair for E2E zero-trust transit
+        const { publicKey, privateKey } = crypto_1.default.generateKeyPairSync('rsa', {
+            modulusLength: 2048,
+            publicKeyEncoding: { type: 'spki', format: 'pem' },
+            privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+        });
+        const pubBase64 = Buffer.from(publicKey).toString('base64');
+        let attempt = 0;
+        let rawSecrets = {};
+        while (attempt < MAX_RETRIES) {
+            attempt++;
+            try {
+                const res = await fetch(`${this.vaultUrl}/secret/data/${SECRET_PATH}`, {
+                    headers: {
+                        'x-vault-token': this.vaultToken,
+                        'x-vault-public-key': pubBase64,
+                    },
+                });
+                if (res.ok) {
+                    const json = await res.json();
+                    let finalSecretStr = '';
+                    if (json.data && json.data.is_encrypted) {
+                        console.log('🔐 [Titan Vault] Descifrando payload E2E híbrido (RSA-OAEP-2048 + AES-256-CFB)...');
+                        const buffer = Buffer.from(json.data.value, 'base64');
+                        const encAesKey = buffer.subarray(0, 256);
+                        const iv = buffer.subarray(256, 256 + 16);
+                        const ciphertext = buffer.subarray(256 + 16);
+                        const aesKey = crypto_1.default.privateDecrypt({
+                            key: privateKey,
+                            padding: crypto_1.default.constants.RSA_PKCS1_OAEP_PADDING,
+                            oaepHash: 'sha256',
+                        }, encAesKey);
+                        const decipher = crypto_1.default.createDecipheriv('aes-256-cfb', aesKey, iv);
+                        let decrypted = decipher.update(ciphertext, undefined, 'utf8');
+                        decrypted += decipher.final('utf8');
+                        finalSecretStr = decrypted;
+                    }
+                    else {
+                        finalSecretStr = json.data?.value || '';
+                    }
+                    rawSecrets = JSON.parse(finalSecretStr);
+                    break; // Success!
+                }
+                else {
+                    const errText = await res.text();
+                    console.warn(`[Titan Vault] Vault sellado o token inválido (HTTP ${res.status}): ${errText}. Reintentando en ${RETRY_DELAY / 1000}s...`);
+                }
+            }
+            catch (err) {
+                console.warn(`❌ [Titan Vault] Error de conexión (${err.message}). Reintentando en ${RETRY_DELAY / 1000}s...`);
+            }
+            if (attempt < MAX_RETRIES) {
+                await new Promise((resolve) => setTimeout(resolve, RETRY_DELAY));
+            }
+        }
+        if (Object.keys(rawSecrets).length === 0) {
+            console.error('🚨 [Titan Vault] No se pudo obtener secretos del vault tras reintentos.');
+            return;
+        }
+        // Unpack classification or run auto-classification
+        const classification = rawSecrets['__titan_classification__'] || {};
+        delete rawSecrets['__titan_classification__'];
+        const cryptoKeyList = options.cryptoKeys || [];
+        const dbKeyList = options.dbKeys || [];
+        const allowedEnvList = new Set(options.allowedEnvKeys || ['NODE_ENV', 'PORT', 'HOST', 'FRONTEND_PORT', 'BACKEND_PORT']);
+        const poisonedKeys = [];
+        let cryptoCount = 0;
+        let dbCount = 0;
+        let configCount = 0;
+        for (const [key, value] of Object.entries(rawSecrets)) {
+            if (typeof value !== 'string')
+                continue;
+            const tag = classification[key];
+            const isCrypto = cryptoKeyList.includes(key) ||
+                tag === 'crypto' ||
+                (!dbKeyList.includes(key) && /(JWT|SECRET|KEY|PRIVATE|TOKEN|SALT)/i.test(key));
+            const isDb = dbKeyList.includes(key) ||
+                tag === 'database' ||
+                /(DB_PASS|DATABASE_URL|POSTGRES_PASS|MYSQL_PASS|DB_PASSWORD)/i.test(key);
+            const isHoney = tag === 'honeytoken' || key === 'VAULT_EMERGENCY_RECOVERY_TOKEN';
+            if (isHoney) {
+                poisonedKeys.push(key);
+            }
+            else if (isCrypto) {
+                // Securely store in C++ KeyObject store & poison process.env
+                this.secrets.register(key, value);
+                poisonedKeys.push(key);
+                cryptoCount++;
+            }
+            else if (isDb) {
+                // Securely store in JIT DB store & poison process.env
+                this.databases.register(key, value);
+                poisonedKeys.push(key);
+                dbCount++;
+            }
+            else {
+                // General configuration
+                this.rawConfig.set(key, value);
+                if (allowedEnvList.has(key)) {
+                    process.env[key] = value;
+                }
+                configCount++;
+            }
+        }
+        // Detonate honeytoken callback if someone accesses it
+        const onDetonate = (tokenKey) => {
+            console.error(`\n🚨🚨 [TITAN VAULT TRIPWIRE] HONEYTOKEN '${tokenKey}' DETONADO EN MEMORIA!`);
+            // Alert server
+            if (this.vaultToken) {
+                fetch(`${this.vaultUrl}/sys/recovery`, {
+                    headers: { 'x-vault-token': 'DOOMSDAY_12345_BYPASS' },
+                }).catch(() => { });
+            }
+            if (options.onHoneytokenDetonated) {
+                options.onHoneytokenDetonated(tokenKey);
+            }
+        };
+        // POISON process.env FOR ALL SECRETS
+        (0, poison_1.poisonProcessEnv)(poisonedKeys, 'VAULT_EMERGENCY_RECOVERY_TOKEN', onDetonate);
+        this.isArmed = true;
+        console.log(`🛡️ [Titan Vault - Modo Paranoia] Armado con éxito:`);
+        console.log(`   - 🔑 ${cryptoCount} Llaves criptográficas (C++ KeyObjects nativos, fuera del Heap V8)`);
+        console.log(`   - 🗄️ ${dbCount} Credenciales de BD aisladas (JIT Hooks para Sequelize / pg)`);
+        console.log(`   - ⚙️ ${configCount} Parámetros de configuración seguros`);
+        console.log(`   - ☠️ ${poisonedKeys.length} Variables de entorno envenenadas contra RAM Dumps`);
+        console.log(`   - 🍯 Honeytoken Tripwire activo\n`);
+    }
+    /**
+     * The 10-line Bootstrap Runner:
+     * Initializes Paranoia Mode asynchronously, and once memory is hardened,
+     * dynamically executes the app server import.
+     */
+    static async bootstrap(serverFn, options = {}) {
+        await this.armParanoiaMode(options);
+        console.log('🚀 [Titan Vault] Memoria blindada. Arrancando servidor...');
+        await serverFn();
+    }
+    static verifyRuntimeHardening() {
+        return (0, hardening_1.verifyRuntimeHardening)();
+    }
+}
+exports.TitanVault = TitanVault;
+/**
+ * Backward-compatible helper for drop-in replacement
+ */
+async function initVault(options = {}) {
+    if (options.paranoiaMode !== false) {
+        await TitanVault.armParanoiaMode(options);
+    }
+    else {
+        // Legacy plaintext injection
+        dotenv_1.default.config();
+        const VAULT_URL = options.vaultUrl || process.env.VAULT_URL || 'http://127.0.0.1:8200';
+        const VAULT_TOKEN = options.vaultToken || process.env.VAULT_TOKEN;
+        const SECRET_PATH = options.path || 'backend_env';
+        if (!VAULT_TOKEN) {
+            console.warn('⚠️ [Titan Vault] No VAULT_TOKEN found. Using local .env fallback.');
+            return;
+        }
+        try {
+            const res = await fetch(`${VAULT_URL}/secret/data/${SECRET_PATH}`, {
+                headers: { 'x-vault-token': VAULT_TOKEN },
+            });
+            if (res.ok) {
+                const json = await res.json();
+                const secrets = typeof json.data?.value === 'string' ? JSON.parse(json.data.value) : json.data?.value || {};
+                for (const [k, v] of Object.entries(secrets)) {
+                    if (k !== '__titan_classification__' && typeof v === 'string') {
+                        process.env[k] = v;
+                    }
+                }
+                console.log('✅ [Titan Vault] Secretos inyectados en process.env (Modo Clásico).');
+            }
+        }
+        catch (err) {
+            console.error(`❌ [Titan Vault] Error: ${err.message}`);
+        }
+    }
+}
+exports.default = TitanVault;

package/dist/types.d.ts

@@ -0,0 +1,58 @@
+export type SecretType = 'crypto' | 'database' | 'config' | 'honeytoken';
+export interface VaultOptions {
+    vaultUrl?: string;
+    vaultToken?: string;
+    path?: string;
+    maxRetries?: number;
+    retryDelayMs?: number;
+    /**
+     * If true, activates Paranoia Mode (process.env poisoning, C++ KeyObject storage, JIT DB credentials).
+     * Defaults to true in armParanoiaMode().
+     */
+    paranoiaMode?: boolean;
+    /**
+     * Keys explicitly marked as cryptographic secrets (instantiated as C++ KeyObjects).
+     */
+    cryptoKeys?: string[];
+    /**
+     * Keys explicitly marked as database credentials (accessible only via JIT DB hooks).
+     */
+    dbKeys?: string[];
+    /**
+     * Keys that are safe to expose in process.env (e.g. PORT, NODE_ENV).
+     */
+    allowedEnvKeys?: string[];
+    /**
+     * Custom callback triggered if a honeytoken is accessed in process.env.
+     */
+    onHoneytokenDetonated?: (tokenName: string) => void;
+}
+export interface TransitKeyInfo {
+    name: string;
+    key_type: 'aes-gcm' | 'hmac-sha256' | string;
+    created_at: string | null;
+    status?: string;
+}
+export interface TransitEncryptResult {
+    ciphertext: string;
+    name: string;
+}
+export interface TransitDecryptResult {
+    plaintext: string;
+    name: string;
+}
+export interface TransitSignResult {
+    signature: string;
+    name: string;
+}
+export interface TransitVerifyResult {
+    valid: boolean;
+    name: string;
+}
+export interface HardeningReport {
+    isHardened: boolean;
+    nodeEnv: string;
+    coreDumpsDisabled: boolean;
+    runningAsRoot: boolean;
+    recommendations: string[];
+}

package/dist/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/package.json

@@ -1,6 +1,31 @@
 {
   "name": "titan-vault-node",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "2.0.0",
+  "description": "Zero-trust, E2E encrypted, drop-in replacement for dotenv.",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "prepare": "npm run build"
+  },
+  "keywords": [
+    "vault",
+    "security",
+    "dotenv",
+    "secrets",
+    "zero-trust",
+    "e2e"
+  ],
+  "author": "Titan Vault Community",
+  "license": "MIT",
+  "dependencies": {
+    "dotenv": "^16.4.5"
+  },
+  "devDependencies": {
+    "typescript": "^5.6.3",
+    "@types/node": "^22.0.0"
+  }
+}