titan-vault-node 2.0.0 → 2.1.0

package/README.md

@@ -1,8 +1,13 @@
-# 🛡️ Titan Vault (Node.js SDK) — Modo Paranoia & Zero-Trust
+# Titan Vault (Node.js SDK)
 
-> **SDK de seguridad Zero-Trust, Criptografía E2E, Envenenamiento de `process.env` y Protección de Memoria RAM.**
+Cliente de la bóveda local. Pide `GET /secret/data/{path}` con una llave RSA-2048 efímera, descifra la respuesta híbrida (RSA-OAEP-SHA256 + AES-256-CFB) y reparte cada campo:
 
-`titan-vault-node` resuelve la vulnerabilidad fundamental de Node.js: **la exposición de secretos en texto plano en la memoria RAM (Heap Dumps) y `process.env`.**
+- `JWT_SECRET` y el resto de llaves quedan como `crypto.KeyObject`. El SDK no guarda otra copia en string. `getRaw()` sí crea un string, y el JSON descifrado vive en el heap hasta que V8 lo recolecta.
+- `DB_PASSWORD` y las demás contraseñas de base de datos se entregan solo cuando Sequelize o `pg` piden la conexión.
+- `DATABASE_URL`, `REDIS_URL`, `PORT` y el resto se leen con `TitanVault.config.get`. No entran en `process.env`, salvo `NODE_ENV`, `PORT`, `HOST`, `FRONTEND_PORT` y `BACKEND_PORT`.
+- `VAULT_EMERGENCY_RECOVERY_TOKEN` no se puede leer. Si el payload trae el cebo, esa lectura llama a `GET /sys/recovery` con el valor que inyectó la bóveda.
+
+Si la bóveda no responde, o devuelve el secreto en claro después de recibir `x-vault-public-key`, `armParanoiaMode` lanza `VaultConnectionError` y el proceso no debe seguir. El token se lee de `vaultToken`, `VAULT_TOKEN` o `VAULT_APP_TOKEN`.
 
 ---
 
@@ -14,17 +19,13 @@
 
 ---
 
-## 🛡️ La Solución: Modo Paranoia (Los 4 Pilares)
-
-`titan-vault-node` implementa una arquitectura de grado militar:
+## Qué hace el modo paranoia
 
-1. **Patrón Bootstrap (Arranque Seguro):** Pausa el arranque del runtime para negociar llaves efímeras (RSA-2048 + AES-256-CFB) y proteger la memoria antes de evaluar el código de negocio.
-2. **Envenenamiento de `process.env`:** Borra los secretos del entorno global y coloca un `Proxy` reactivo. Si alguien o una librería de terceros intenta hacer `process.env.JWT_SECRET`, la ejecución se interrumpe con `ParanoiaBlockedError`. Además, las variables secretas no son enumerables (no aparecen en `Object.keys()` ni `console.log(process.env)`).
-3. **Criptografía Nativa C++ (`KeyObject`):** Las llaves simétricas (JWT, cookies, AES) se cargan directamente como instancias nativas `crypto.KeyObject` de C++, invisibles a búsquedas de strings en el heap de V8.
-4. **Inyección JIT en Bases de Datos:** 
-   - **Sequelize:** Gancho `beforeConnect` para inyectar contraseñas microsegundos antes del handshake, y `afterConnect` para nulificar (`password = null`) de inmediato.
-   - **node-postgres (`pg`):** Función asíncrona de contraseña bajo demanda (`async () => password`).
-5. **CaaS / Transit Engine:** Criptografía como Servicio. Permite firmar tokens o cifrar datos directamente en el servidor Titan Vault sin mantener ninguna llave en memoria.
+1. **Arranque.** `bootstrap` espera a `armParanoiaMode`. Si esa llamada lanza, no importa el servidor.
+2. **`process.env`.** Un proxy lanza `ParanoiaBlockedError` al leer o escribir un secreto, y lo oculta de `Object.keys` y `console.log(process.env)`.
+3. **`KeyObject`.** `TitanVault.secrets.get('JWT_SECRET')` sirve para `jsonwebtoken` y `crypto`. La búsqueda de strings en el heap de V8 todavía puede encontrar el valor que produjo `JSON.parse` hasta que el recolector lo suelte.
+4. **Base de datos.** `hookSequelize` pone la contraseña en `beforeConnect` y la quita del config en `afterConnect`. `getPgPasswordProvider` la devuelve en cada conexión. El driver conserva el string que necesita el handshake.
+5. **Transit.** `encrypt`, `decrypt`, `sign` y `verify` llaman a `/transit/*` en la bóveda. La llave no sale del servidor.
 
 ---
 
@@ -39,7 +40,7 @@ Crea un archivo de arranque que cargue el SDK antes de importar el servidor:
 import { TitanVault } from 'titan-vault-node';
 
 async function main() {
-  // 1. Arma el Modo Paranoia y asegura la memoria
+  // Lanza VaultConnectionError si la bóveda no responde.
   await TitanVault.armParanoiaMode({
     vaultUrl: process.env.VAULT_URL || 'http://127.0.0.1:8200',
     vaultToken: process.env.VAULT_APP_TOKEN,
@@ -63,7 +64,6 @@ Compatible de forma nativa con `jsonwebtoken`, `jose` y el módulo `crypto` de N
 import jwt from 'jsonwebtoken';
 import { TitanVault } from 'titan-vault-node';
 
-// Obtiene el KeyObject de C++ (Invisible en volcados de RAM)
 const jwtKey = TitanVault.secrets.get('JWT_SECRET');
 
 // Firmar
@@ -137,16 +137,21 @@ const isValid = await TitanVault.transit.verify('mi-firma-jwt', 'payload.a.firma
 
 ---
 
-### 5. Parámetros de Configuración No Sensibles
+### 5. Configuración
+
+`DATABASE_URL` y `REDIS_URL` salen de aquí. No son contraseñas y no se copian a `process.env`.
 
 ```typescript
+const databaseUrl = TitanVault.config.get('DATABASE_URL');
 const port = TitanVault.config.get('PORT', '3000');
 const host = TitanVault.config.get('HOST', '0.0.0.0');
 ```
 
 ---
 
-### 6. Verificación de Hardening en Contenedores
+### 6. Reporte de runtime
+
+`verifyRuntimeHardening()` dice si el proceso es root, si `NODE_ENV` es `production`, si el límite blando de core dumps es 0 (`/proc/self/limits`) y si el modo paranoia llegó a armarse. No cambia esos límites.
 
 ```typescript
 TitanVault.verifyRuntimeHardening();
@@ -154,6 +159,10 @@ TitanVault.verifyRuntimeHardening();
 
 ---
 
-## 🍯 Tripwires y Honeytokens
+## Honeytoken
+
+En la bóveda, la trampa está apagada hasta definir `TITAN_INJECT_HONEYTOKEN=1` y `TITAN_HONEYTOKEN_VALUE`. El campo por defecto es `VAULT_EMERGENCY_RECOVERY_TOKEN` (`TITAN_HONEYTOKEN_FIELD` lo cambia en los dos lados).
+
+Leer `process.env.VAULT_EMERGENCY_RECOVERY_TOKEN` lanza `ParanoiaBlockedError`. Si el payload traía el cebo, el SDK llama a `GET /sys/recovery` con ese valor en `x-vault-token`. La bóveda sella cuando el header coincide. Sin cebo en el payload, la lectura se bloquea y la bóveda sigue abierta.
 
-Si un atacante inspecciona `process.env` e intenta leer la variable trampa `VAULT_EMERGENCY_RECOVERY_TOKEN`, Titan Vault detona inmediatamente una alerta de intrusión hacia el servidor central y sella la bóveda.
+`TitanVault.flushTripwire()` espera a que esa petición termine.

package/dist/core/classify.d.ts

@@ -0,0 +1,9 @@
+import { VaultOptions } from '../types';
+/** Same default field the vault injects (`TITAN_HONEYTOKEN_FIELD`). */
+export declare const HONEYTOKEN_FIELD = "VAULT_EMERGENCY_RECOVERY_TOKEN";
+export type SecretClass = 'honeytoken' | 'crypto' | 'database' | 'config';
+/**
+ * Classification shared with the vault.
+ * `DATABASE_URL` is configuration the app reads. Only password fields go to the JIT store.
+ */
+export declare function classifyKey(key: string, tag: string | undefined, options?: VaultOptions): SecretClass;

package/dist/core/classify.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HONEYTOKEN_FIELD = void 0;
+exports.classifyKey = classifyKey;
+/** Same default field the vault injects (`TITAN_HONEYTOKEN_FIELD`). */
+exports.HONEYTOKEN_FIELD = 'VAULT_EMERGENCY_RECOVERY_TOKEN';
+// Keep in sync with titan_vault/core.py `_classify_key`.
+const DB_PASSWORD_RE = /(DB_PASS|POSTGRES_PASS|MYSQL_PASS|DB_PASSWORD|POSTGRES_PASSWORD|MYSQL_PASSWORD)/i;
+const CRYPTO_RE = /(JWT|SECRET|KEY|PRIVATE|TOKEN|SALT)/i;
+/**
+ * Classification shared with the vault.
+ * `DATABASE_URL` is configuration the app reads. Only password fields go to the JIT store.
+ */
+function classifyKey(key, tag, options = {}) {
+    const honeyField = options.honeytokenField || exports.HONEYTOKEN_FIELD;
+    if (tag === 'honeytoken' || key === honeyField)
+        return 'honeytoken';
+    if ((options.cryptoKeys || []).includes(key) || tag === 'crypto')
+        return 'crypto';
+    if ((options.dbKeys || []).includes(key) || tag === 'database' || DB_PASSWORD_RE.test(key)) {
+        return 'database';
+    }
+    if (CRYPTO_RE.test(key))
+        return 'crypto';
+    return 'config';
+}

package/dist/core/crypto-store.d.ts

@@ -1,20 +1,16 @@
 import crypto from 'crypto';
 export declare class CryptoStore {
     private keyObjects;
-    private rawFallback;
     /**
-     * Securely store a secret key by converting it to a native C++ KeyObject
-     * and immediately zeroing out the JavaScript buffer.
+     * Store the secret as a KeyObject and drop the temporary byte buffer.
+     * The original JavaScript string from JSON.parse is immutable and stays
+     * until V8 collects it. This store does not keep a second copy.
      */
     register(name: string, rawSecret: string): void;
-    /**
-     * Retrieves the native C++ KeyObject.
-     * This object is invisible to JavaScript heap string inspection and safe from RAM dumps.
-     */
     get(name: string): crypto.KeyObject;
     /**
-     * Retrieves the raw string representation.
-     * WARNING: Accessing secrets as raw strings reintroduces them to the V8 Heap.
+     * Materialize the secret as a string. That string lives on the V8 heap
+     * until it is collected. Prefer `get()` when the library accepts a KeyObject.
      */
     getRaw(name: string): string;
     has(name: string): boolean;

package/dist/core/crypto-store.js

@@ -7,49 +7,30 @@ exports.CryptoStore = void 0;
 const crypto_1 = __importDefault(require("crypto"));
 class CryptoStore {
     keyObjects = new Map();
-    rawFallback = new Map();
     /**
-     * Securely store a secret key by converting it to a native C++ KeyObject
-     * and immediately zeroing out the JavaScript buffer.
+     * Store the secret as a KeyObject and drop the temporary byte buffer.
+     * The original JavaScript string from JSON.parse is immutable and stays
+     * until V8 collects it. This store does not keep a second copy.
      */
     register(name, rawSecret) {
         if (!rawSecret)
             return;
-        // Allocate buffer for the raw secret
         const buffer = Buffer.from(rawSecret, 'utf-8');
         try {
-            // Check if it's PEM formatted private key
             if (rawSecret.includes('-----BEGIN PRIVATE KEY-----') || rawSecret.includes('-----BEGIN RSA PRIVATE KEY-----')) {
-                const privKey = crypto_1.default.createPrivateKey({
-                    key: rawSecret,
-                    format: 'pem',
-                });
-                this.keyObjects.set(name, privKey);
+                this.keyObjects.set(name, crypto_1.default.createPrivateKey({ key: rawSecret, format: 'pem' }));
             }
             else if (rawSecret.includes('-----BEGIN PUBLIC KEY-----')) {
-                const pubKey = crypto_1.default.createPublicKey({
-                    key: rawSecret,
-                    format: 'pem',
-                });
-                this.keyObjects.set(name, pubKey);
+                this.keyObjects.set(name, crypto_1.default.createPublicKey({ key: rawSecret, format: 'pem' }));
             }
             else {
-                // Symmetric secret key (HMAC, AES, JWT, cookies)
-                const secretKey = crypto_1.default.createSecretKey(buffer);
-                this.keyObjects.set(name, secretKey);
+                this.keyObjects.set(name, crypto_1.default.createSecretKey(buffer));
             }
         }
         finally {
-            // ZERO OUT BUFFER IN MEMORY immediately to prevent RAM heap dump recovery
             buffer.fill(0);
         }
-        // Keep an internal raw fallback for libraries that strictly require raw strings (e.g. legacy argon2)
-        this.rawFallback.set(name, rawSecret);
     }
-    /**
-     * Retrieves the native C++ KeyObject.
-     * This object is invisible to JavaScript heap string inspection and safe from RAM dumps.
-     */
     get(name) {
         const key = this.keyObjects.get(name);
         if (!key) {
@@ -58,17 +39,23 @@ class CryptoStore {
         return key;
     }
     /**
-     * Retrieves the raw string representation.
-     * WARNING: Accessing secrets as raw strings reintroduces them to the V8 Heap.
+     * Materialize the secret as a string. That string lives on the V8 heap
+     * until it is collected. Prefer `get()` when the library accepts a KeyObject.
      */
     getRaw(name) {
-        const raw = this.rawFallback.get(name);
-        if (!raw) {
-            throw new Error(`[Titan Vault] Llave '${name}' no encontrada.`);
+        const key = this.get(name);
+        console.warn(`⚠️ [Titan Vault] '${name}' se materializó como texto. ` +
+            `Ese string queda en el heap de V8 hasta que el recolector lo libere. ` +
+            `Usa get() cuando la librería acepte un KeyObject.`);
+        if (key.type === 'secret') {
+            const exported = key.export();
+            return Buffer.isBuffer(exported) ? exported.toString('utf8') : Buffer.from(exported).toString('utf8');
         }
-        console.warn(`⚠️ [Titan Vault - Seguridad] Se accedió a la llave '${name}' como texto plano. ` +
-            `Esto expone el secreto en el Heap de V8. Considera usar 'get("${name}")' devolviendo KeyObject.`);
-        return raw;
+        const exported = key.export({
+            type: key.type === 'private' ? 'pkcs8' : 'spki',
+            format: 'pem',
+        });
+        return typeof exported === 'string' ? exported : exported.toString('utf8');
     }
     has(name) {
         return this.keyObjects.has(name);

package/dist/core/database-hooks.d.ts

@@ -3,17 +3,15 @@ export declare class DatabaseHooks {
     register(key: string, value: string): void;
     getJitCredential(key: string): string;
     /**
-     * Hook for Sequelize ORM.
-     * Injects the database password micro-seconds before connection handshake,
-     * and immediately wipes it (sets config.password = null) after connection succeeds,
-     * minimizing RAM heap exposure.
+     * Inject the password on `beforeConnect` and clear `config.password` after.
+     * The driver still receives a JavaScript string for the handshake.
      */
     hookSequelize(sequelize: any, options?: {
         credentialKey?: string;
     }): void;
     /**
-     * Generates an async password provider for node-postgres (pg.Pool).
-     * pg.Pool supports `password: async () => string` dynamically per socket connection.
+     * Password function for `pg.Pool`. node-postgres calls it per connection.
      */
     getPgPasswordProvider(keyName?: string): () => Promise<string>;
+    private materialize;
 }

package/dist/core/database-hooks.js

@@ -4,22 +4,19 @@ exports.DatabaseHooks = void 0;
 class DatabaseHooks {
     credentials = new Map();
     register(key, value) {
-        if (key && value) {
-            this.credentials.set(key, value);
-        }
+        if (!key || !value)
+            return;
+        const existing = this.credentials.get(key);
+        if (existing)
+            existing.fill(0);
+        this.credentials.set(key, Buffer.from(value, 'utf8'));
     }
     getJitCredential(key) {
-        const cred = this.credentials.get(key);
-        if (!cred) {
-            throw new Error(`[Titan Vault - JIT DB] Credencial '${key}' no encontrada en el almacén JIT.`);
-        }
-        return cred;
+        return this.materialize(key);
     }
     /**
-     * Hook for Sequelize ORM.
-     * Injects the database password micro-seconds before connection handshake,
-     * and immediately wipes it (sets config.password = null) after connection succeeds,
-     * minimizing RAM heap exposure.
+     * Inject the password on `beforeConnect` and clear `config.password` after.
+     * The driver still receives a JavaScript string for the handshake.
      */
     hookSequelize(sequelize, options = {}) {
         const credKey = options.credentialKey || 'DB_PASSWORD';
@@ -27,43 +24,28 @@ class DatabaseHooks {
             console.warn('⚠️ [Titan Vault] La instancia provista no parece ser un objeto Sequelize válido.');
             return;
         }
-        // 1. Before connection handshake: Inject credential JIT
         sequelize.addHook('beforeConnect', async (config) => {
-            try {
-                const password = this.credentials.get(credKey) || this.credentials.get('DATABASE_URL');
-                if (password) {
-                    config.password = password;
-                }
-            }
-            catch (err) {
-                console.error('🚨 [Titan Vault] Error inyectando contraseña JIT en Sequelize:', err);
-            }
+            config.password = this.materialize(credKey);
         });
-        // 2. After connection handshake: Nullify immediately to force Garbage Collection
         sequelize.addHook('afterConnect', async (_connection, config) => {
-            try {
-                if (config && 'password' in config) {
-                    config.password = null;
-                }
-            }
-            catch (err) {
-                // ignore
+            if (config && 'password' in config) {
+                config.password = null;
             }
         });
-        console.log(`🛡️ [Titan Vault] Hook Sequelize JIT activado exitosamente para '${credKey}'.`);
+        console.log(`🛡️ [Titan Vault] Hook Sequelize JIT activado para '${credKey}'.`);
     }
     /**
-     * Generates an async password provider for node-postgres (pg.Pool).
-     * pg.Pool supports `password: async () => string` dynamically per socket connection.
+     * Password function for `pg.Pool`. node-postgres calls it per connection.
      */
     getPgPasswordProvider(keyName = 'DB_PASSWORD') {
-        return async () => {
-            const password = this.credentials.get(keyName) || this.credentials.get('DATABASE_URL');
-            if (!password) {
-                throw new Error(`[Titan Vault - JIT pg] Credencial de BD '${keyName}' no disponible.`);
-            }
-            return password;
-        };
+        return async () => this.materialize(keyName);
+    }
+    materialize(key) {
+        const buf = this.credentials.get(key);
+        if (!buf) {
+            throw new Error(`[Titan Vault - JIT DB] Credencial '${key}' no encontrada en el almacén JIT.`);
+        }
+        return buf.toString('utf8');
     }
 }
 exports.DatabaseHooks = DatabaseHooks;

package/dist/core/hardening.d.ts

@@ -1,2 +1,2 @@
 import { HardeningReport } from '../types';
-export declare function verifyRuntimeHardening(): HardeningReport;
+export declare function verifyRuntimeHardening(paranoiaArmed: boolean): HardeningReport;

package/dist/core/hardening.js

@@ -1,7 +1,26 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.verifyRuntimeHardening = verifyRuntimeHardening;
-function verifyRuntimeHardening() {
+const fs_1 = __importDefault(require("fs"));
+function readCoreDumpSoftLimit() {
+    try {
+        const text = fs_1.default.readFileSync('/proc/self/limits', 'utf8');
+        const line = text.split('\n').find((entry) => entry.toLowerCase().startsWith('max core file size'));
+        if (!line)
+            return null;
+        const cols = line.split(/\s{2,}/).map((part) => part.trim());
+        if (!cols[1])
+            return null;
+        return cols[1] === '0';
+    }
+    catch {
+        return null;
+    }
+}
+function verifyRuntimeHardening(paranoiaArmed) {
     const recommendations = [];
     const nodeEnv = process.env.NODE_ENV || 'development';
     let runningAsRoot = false;
@@ -11,20 +30,30 @@ function verifyRuntimeHardening() {
         }
     }
     catch {
-        // Windows or restricted environment
+        // Windows or a restricted environment.
     }
+    const coreDumpsDisabled = readCoreDumpSoftLimit();
     if (runningAsRoot) {
-        recommendations.push('⚠️ El proceso corre como root (UID 0). En producción, corre como un usuario no privilegiado (ej. USER node).');
+        recommendations.push('El proceso corre como root (UID 0). En producción usa un usuario sin privilegios.');
     }
     if (nodeEnv !== 'production') {
-        recommendations.push('ℹ️ NODE_ENV no es "production". Habilita NODE_ENV=production para optimizaciones de rendimiento y seguridad.');
+        recommendations.push('NODE_ENV no es "production".');
+    }
+    if (coreDumpsDisabled === null) {
+        recommendations.push('No se pudo leer el límite de core dumps. En Linux revisa /proc/self/limits (Max core file size).');
+    }
+    else if (!coreDumpsDisabled) {
+        recommendations.push('Los core dumps están permitidos. Un ulimit -c 0 evita que un volcado escriba la memoria a disco.');
+    }
+    if (!paranoiaArmed) {
+        recommendations.push('El modo paranoia no está armado. Los secretos no pasaron por el proxy de process.env.');
     }
-    recommendations.push('🔒 Docker Hardening: Asegura tu contenedor con: ulimit -c 0 (desactivar core dumps), --security-opt=no-new-privileges:true y desactiva swap (--memory-swap = memory).');
-    const isHardened = !runningAsRoot && nodeEnv === 'production';
-    console.log('\n🛡️ [Titan Vault] Reporte de Hardening en Runtime:');
+    const isHardened = !runningAsRoot && nodeEnv === 'production' && coreDumpsDisabled === true && paranoiaArmed;
+    console.log('\n🛡️ [Titan Vault] Reporte de hardening:');
     console.log(`  - Entorno: ${nodeEnv}`);
-    console.log(`  - Usuario Root: ${runningAsRoot ? '⚠️ SÍ (No recomendado)' : '✅ NO (Seguro)'}`);
-    console.log(`  - Protección Heap V8: ✅ Paranoia Mode Activo`);
+    console.log(`  - Usuario root: ${runningAsRoot ? 'sí' : 'no'}`);
+    console.log(`  - Core dumps desactivados: ${coreDumpsDisabled === null ? 'desconocido' : coreDumpsDisabled ? 'sí' : 'no'}`);
+    console.log(`  - Modo paranoia armado: ${paranoiaArmed ? 'sí' : 'no'}`);
     for (const rec of recommendations) {
         console.log(`    ${rec}`);
     }
@@ -32,8 +61,10 @@ function verifyRuntimeHardening() {
     return {
         isHardened,
         nodeEnv,
-        coreDumpsDisabled: true,
+        coreDumpsDisabled: coreDumpsDisabled === true,
+        coreDumpLimitKnown: coreDumpsDisabled !== null,
         runningAsRoot,
+        paranoiaArmed,
         recommendations,
     };
 }

package/dist/core/poison.js

@@ -50,22 +50,22 @@ function poisonProcessEnv(secretKeys, honeytokenKey, onHoneytokenDetonated) {
             return Reflect.get(target, prop, receiver);
         },
         set(target, prop, value, receiver) {
-            if (typeof prop === 'string' && poisonedSet.has(prop)) {
+            if (typeof prop === 'string' && (prop === honeyKey || poisonedSet.has(prop))) {
                 throw new ParanoiaBlockedError(prop, `No se permite mutar 'process.env.${prop}' en Modo Paranoia.`);
             }
             return Reflect.set(target, prop, value, receiver);
         },
         has(target, prop) {
-            if (typeof prop === 'string' && poisonedSet.has(prop)) {
+            if (typeof prop === 'string' && (prop === honeyKey || poisonedSet.has(prop))) {
                 return false;
             }
             return Reflect.has(target, prop);
         },
         ownKeys(target) {
-            return Reflect.ownKeys(target).filter(k => typeof k !== 'string' || !poisonedSet.has(k));
+            return Reflect.ownKeys(target).filter((k) => typeof k !== 'string' || (k !== honeyKey && !poisonedSet.has(k)));
         },
         getOwnPropertyDescriptor(target, prop) {
-            if (typeof prop === 'string' && poisonedSet.has(prop)) {
+            if (typeof prop === 'string' && (prop === honeyKey || poisonedSet.has(prop))) {
                 return undefined;
             }
             return Reflect.getOwnPropertyDescriptor(target, prop);

package/dist/index.d.ts

@@ -8,6 +8,10 @@ export * from './core/crypto-store';
 export * from './core/database-hooks';
 export * from './core/transit-client';
 export * from './core/hardening';
+export * from './core/classify';
+export declare class VaultConnectionError extends Error {
+    constructor(message: string);
+}
 export declare class TitanVault {
     private static instance;
     static readonly secrets: CryptoStore;
@@ -16,6 +20,8 @@ export declare class TitanVault {
     private static vaultUrl;
     private static vaultToken?;
     private static isArmed;
+    private static baitValues;
+    private static tripwireInflight;
     static readonly transit: TransitClient;
     static readonly config: {
         get(key: string, defaultValue?: string): string;
@@ -23,24 +29,19 @@ export declare class TitanVault {
         getAll(): Record<string, string>;
     };
     /**
-     * Arm Paranoia Mode (Zero-RAM Leak Protection):
-     * 1. Fetches secrets with E2E Ephemeral RSA-2048 hybrid encryption.
-     * 2. Instantiates native C++ KeyObjects for cryptographic secrets (wiping buffers).
-     * 3. Isolates database passwords into JIT hooks.
-     * 4. Envenoms process.env for all secret keys, throwing on unauthorized reads.
-     * 5. Arms Honeytoken Tripwire alarms.
+     * Fetch the app path with an ephemeral RSA-2048 key, decrypt the hybrid
+     * payload, and block secret reads on process.env.
+     * Throws if the token is missing or the vault does not return ciphertext.
      */
     static armParanoiaMode(options?: VaultOptions): Promise<void>;
-    /**
-     * The 10-line Bootstrap Runner:
-     * Initializes Paranoia Mode asynchronously, and once memory is hardened,
-     * dynamically executes the app server import.
-     */
+    /** Resolves when the in-flight honeytoken alert has finished or failed. */
+    static flushTripwire(): Promise<void>;
     static bootstrap(serverFn: () => Promise<any>, options?: VaultOptions): Promise<void>;
     static verifyRuntimeHardening(): HardeningReport;
 }
 /**
- * Backward-compatible helper for drop-in replacement
+ * Classic mode (`paranoiaMode: false`) copies string values into process.env.
+ * The default calls armParanoiaMode and throws if the vault is unreachable.
  */
 export declare function initVault(options?: VaultOptions): Promise<void>;
 export default TitanVault;

package/dist/index.js

@@ -17,7 +17,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TitanVault = void 0;
+exports.TitanVault = exports.VaultConnectionError = void 0;
 exports.initVault = initVault;
 const dotenv_1 = __importDefault(require("dotenv"));
 const crypto_1 = __importDefault(require("crypto"));
@@ -26,12 +26,55 @@ const crypto_store_1 = require("./core/crypto-store");
 const database_hooks_1 = require("./core/database-hooks");
 const transit_client_1 = require("./core/transit-client");
 const hardening_1 = require("./core/hardening");
+const classify_1 = require("./core/classify");
 __exportStar(require("./types"), exports);
 __exportStar(require("./core/poison"), exports);
 __exportStar(require("./core/crypto-store"), exports);
 __exportStar(require("./core/database-hooks"), exports);
 __exportStar(require("./core/transit-client"), exports);
 __exportStar(require("./core/hardening"), exports);
+__exportStar(require("./core/classify"), exports);
+class VaultConnectionError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'VaultConnectionError';
+        Object.setPrototypeOf(this, VaultConnectionError.prototype);
+    }
+}
+exports.VaultConnectionError = VaultConnectionError;
+function resolveToken(explicit) {
+    return explicit || process.env.VAULT_TOKEN || process.env.VAULT_APP_TOKEN;
+}
+function resolveUrl(explicit) {
+    return explicit || process.env.VAULT_URL || 'http://127.0.0.1:8200';
+}
+function decryptHybrid(privateKey, payloadB64) {
+    const buffer = Buffer.from(payloadB64, 'base64');
+    const modulusLength = privateKey.asymmetricKeyDetails?.modulusLength;
+    if (!modulusLength) {
+        throw new VaultConnectionError('No se pudo leer el tamaño de la llave RSA efímera.');
+    }
+    const keyBytes = modulusLength / 8;
+    if (buffer.length < keyBytes + 16) {
+        throw new VaultConnectionError('El payload cifrado es más corto que una respuesta RSA-OAEP + AES-256-CFB.');
+    }
+    const encAesKey = buffer.subarray(0, keyBytes);
+    const iv = buffer.subarray(keyBytes, keyBytes + 16);
+    const ciphertext = buffer.subarray(keyBytes + 16);
+    const aesKey = crypto_1.default.privateDecrypt({
+        key: privateKey,
+        padding: crypto_1.default.constants.RSA_PKCS1_OAEP_PADDING,
+        oaepHash: 'sha256',
+    }, encAesKey);
+    try {
+        const decipher = crypto_1.default.createDecipheriv('aes-256-cfb', aesKey, iv);
+        const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+        return decrypted.toString('utf8');
+    }
+    finally {
+        aesKey.fill(0);
+    }
+}
 class TitanVault {
     static instance;
     static secrets = new crypto_store_1.CryptoStore();
@@ -40,12 +83,26 @@ class TitanVault {
     static vaultUrl = 'http://127.0.0.1:8200';
     static vaultToken;
     static isArmed = false;
+    static baitValues = new Map();
+    static tripwireInflight = Promise.resolve();
     static transit = new transit_client_1.TransitClient(() => TitanVault.vaultUrl, () => TitanVault.vaultToken);
     static config = {
         get(key, defaultValue) {
-            const val = TitanVault.rawConfig.get(key) || process.env[key];
-            if (val !== undefined)
-                return val;
+            if (TitanVault.rawConfig.has(key)) {
+                return TitanVault.rawConfig.get(key);
+            }
+            let envVal;
+            try {
+                envVal = process.env[key];
+            }
+            catch (err) {
+                if (err instanceof Error && err.name === 'ParanoiaBlockedError') {
+                    throw new Error(`[Titan Vault] '${key}' es un secreto. Usa TitanVault.secrets, TitanVault.databases o el campo de configuración correspondiente.`);
+                }
+                throw err;
+            }
+            if (envVal !== undefined)
+                return envVal;
             if (defaultValue !== undefined)
                 return defaultValue;
             throw new Error(`[Titan Vault] Configuración '${key}' no encontrada.`);
@@ -62,126 +119,95 @@ class TitanVault {
         }
     };
     /**
-     * Arm Paranoia Mode (Zero-RAM Leak Protection):
-     * 1. Fetches secrets with E2E Ephemeral RSA-2048 hybrid encryption.
-     * 2. Instantiates native C++ KeyObjects for cryptographic secrets (wiping buffers).
-     * 3. Isolates database passwords into JIT hooks.
-     * 4. Envenoms process.env for all secret keys, throwing on unauthorized reads.
-     * 5. Arms Honeytoken Tripwire alarms.
+     * Fetch the app path with an ephemeral RSA-2048 key, decrypt the hybrid
+     * payload, and block secret reads on process.env.
+     * Throws if the token is missing or the vault does not return ciphertext.
      */
     static async armParanoiaMode(options = {}) {
         if (this.isArmed) {
-            console.log('🛡️ [Titan Vault] Modo Paranoia ya está armado.');
+            console.log('🛡️ [Titan Vault] Modo paranoia ya está armado.');
             return;
         }
         dotenv_1.default.config();
-        this.vaultUrl = options.vaultUrl || process.env.VAULT_URL || 'http://127.0.0.1:8200';
-        this.vaultToken = options.vaultToken || process.env.VAULT_TOKEN;
-        const SECRET_PATH = options.path || 'backend_env';
-        const MAX_RETRIES = options.maxRetries || 5;
-        const RETRY_DELAY = options.retryDelayMs || 5000;
+        this.vaultUrl = resolveUrl(options.vaultUrl);
+        this.vaultToken = resolveToken(options.vaultToken);
+        const secretPath = options.path || 'backend_env';
+        const maxRetries = options.maxRetries ?? 5;
+        const retryDelay = options.retryDelayMs ?? 5000;
+        const honeyField = options.honeytokenField || classify_1.HONEYTOKEN_FIELD;
         if (!this.vaultToken) {
-            console.warn('⚠️ [Titan Vault] No se encontró VAULT_TOKEN. Modo Paranoia operando con variables locales.');
-            return;
+            throw new VaultConnectionError('Falta el token. Pasa vaultToken o define VAULT_TOKEN / VAULT_APP_TOKEN. El proceso no arranca sin la bóveda.');
         }
-        console.log(`\n🛡️ [Titan Vault - Modo Paranoia] Conectando a ${this.vaultUrl}...`);
-        // Ephemeral RSA keypair for E2E zero-trust transit
+        console.log(`\n🛡️ [Titan Vault] Conectando a ${this.vaultUrl}...`);
         const { publicKey, privateKey } = crypto_1.default.generateKeyPairSync('rsa', {
             modulusLength: 2048,
-            publicKeyEncoding: { type: 'spki', format: 'pem' },
-            privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
         });
-        const pubBase64 = Buffer.from(publicKey).toString('base64');
-        let attempt = 0;
-        let rawSecrets = {};
-        while (attempt < MAX_RETRIES) {
-            attempt++;
+        const pubPem = publicKey.export({ type: 'spki', format: 'pem' });
+        const pubBase64 = Buffer.from(pubPem).toString('base64');
+        let rawSecrets = null;
+        let lastError = 'sin respuesta';
+        for (let attempt = 1; attempt <= maxRetries; attempt++) {
             try {
-                const res = await fetch(`${this.vaultUrl}/secret/data/${SECRET_PATH}`, {
+                const res = await fetch(`${this.vaultUrl}/secret/data/${secretPath}`, {
                     headers: {
                         'x-vault-token': this.vaultToken,
                         'x-vault-public-key': pubBase64,
                     },
                 });
-                if (res.ok) {
-                    const json = await res.json();
-                    let finalSecretStr = '';
-                    if (json.data && json.data.is_encrypted) {
-                        console.log('🔐 [Titan Vault] Descifrando payload E2E híbrido (RSA-OAEP-2048 + AES-256-CFB)...');
-                        const buffer = Buffer.from(json.data.value, 'base64');
-                        const encAesKey = buffer.subarray(0, 256);
-                        const iv = buffer.subarray(256, 256 + 16);
-                        const ciphertext = buffer.subarray(256 + 16);
-                        const aesKey = crypto_1.default.privateDecrypt({
-                            key: privateKey,
-                            padding: crypto_1.default.constants.RSA_PKCS1_OAEP_PADDING,
-                            oaepHash: 'sha256',
-                        }, encAesKey);
-                        const decipher = crypto_1.default.createDecipheriv('aes-256-cfb', aesKey, iv);
-                        let decrypted = decipher.update(ciphertext, undefined, 'utf8');
-                        decrypted += decipher.final('utf8');
-                        finalSecretStr = decrypted;
-                    }
-                    else {
-                        finalSecretStr = json.data?.value || '';
-                    }
-                    rawSecrets = JSON.parse(finalSecretStr);
-                    break; // Success!
+                if (!res.ok) {
+                    lastError = `HTTP ${res.status}: ${await res.text()}`;
+                    console.warn(`[Titan Vault] ${lastError}. Reintento ${attempt}/${maxRetries}.`);
                 }
                 else {
-                    const errText = await res.text();
-                    console.warn(`[Titan Vault] Vault sellado o token inválido (HTTP ${res.status}): ${errText}. Reintentando en ${RETRY_DELAY / 1000}s...`);
+                    const json = await res.json();
+                    if (!json.data?.is_encrypted || typeof json.data.value !== 'string') {
+                        throw new VaultConnectionError('La bóveda devolvió el secreto en claro después de recibir x-vault-public-key.');
+                    }
+                    console.log('🔐 [Titan Vault] Descifrando payload híbrido (RSA-OAEP-SHA256 + AES-256-CFB)...');
+                    rawSecrets = JSON.parse(decryptHybrid(privateKey, json.data.value));
+                    break;
                 }
             }
             catch (err) {
-                console.warn(`❌ [Titan Vault] Error de conexión (${err.message}). Reintentando en ${RETRY_DELAY / 1000}s...`);
+                if (err instanceof VaultConnectionError)
+                    throw err;
+                lastError = err?.message || String(err);
+                console.warn(`❌ [Titan Vault] ${lastError}. Reintento ${attempt}/${maxRetries}.`);
             }
-            if (attempt < MAX_RETRIES) {
-                await new Promise((resolve) => setTimeout(resolve, RETRY_DELAY));
+            if (attempt < maxRetries) {
+                await new Promise((resolve) => setTimeout(resolve, retryDelay));
             }
         }
-        if (Object.keys(rawSecrets).length === 0) {
-            console.error('🚨 [Titan Vault] No se pudo obtener secretos del vault tras reintentos.');
-            return;
+        if (!rawSecrets) {
+            throw new VaultConnectionError(`No se pudieron leer los secretos de '${secretPath}' en ${this.vaultUrl}. ${lastError}`);
         }
-        // Unpack classification or run auto-classification
         const classification = rawSecrets['__titan_classification__'] || {};
         delete rawSecrets['__titan_classification__'];
-        const cryptoKeyList = options.cryptoKeys || [];
-        const dbKeyList = options.dbKeys || [];
         const allowedEnvList = new Set(options.allowedEnvKeys || ['NODE_ENV', 'PORT', 'HOST', 'FRONTEND_PORT', 'BACKEND_PORT']);
         const poisonedKeys = [];
+        this.baitValues = new Map();
         let cryptoCount = 0;
         let dbCount = 0;
         let configCount = 0;
         for (const [key, value] of Object.entries(rawSecrets)) {
             if (typeof value !== 'string')
                 continue;
-            const tag = classification[key];
-            const isCrypto = cryptoKeyList.includes(key) ||
-                tag === 'crypto' ||
-                (!dbKeyList.includes(key) && /(JWT|SECRET|KEY|PRIVATE|TOKEN|SALT)/i.test(key));
-            const isDb = dbKeyList.includes(key) ||
-                tag === 'database' ||
-                /(DB_PASS|DATABASE_URL|POSTGRES_PASS|MYSQL_PASS|DB_PASSWORD)/i.test(key);
-            const isHoney = tag === 'honeytoken' || key === 'VAULT_EMERGENCY_RECOVERY_TOKEN';
-            if (isHoney) {
+            const kind = (0, classify_1.classifyKey)(key, classification[key], options);
+            if (kind === 'honeytoken') {
+                this.baitValues.set(key, value);
                 poisonedKeys.push(key);
             }
-            else if (isCrypto) {
-                // Securely store in C++ KeyObject store & poison process.env
+            else if (kind === 'crypto') {
                 this.secrets.register(key, value);
                 poisonedKeys.push(key);
                 cryptoCount++;
             }
-            else if (isDb) {
-                // Securely store in JIT DB store & poison process.env
+            else if (kind === 'database') {
                 this.databases.register(key, value);
                 poisonedKeys.push(key);
                 dbCount++;
             }
             else {
-                // General configuration
                 this.rawConfig.set(key, value);
                 if (allowedEnvList.has(key)) {
                     process.env[key] = value;
@@ -189,79 +215,78 @@ class TitanVault {
                 configCount++;
             }
         }
-        // Detonate honeytoken callback if someone accesses it
+        if (!poisonedKeys.includes(honeyField)) {
+            poisonedKeys.push(honeyField);
+        }
         const onDetonate = (tokenKey) => {
-            console.error(`\n🚨🚨 [TITAN VAULT TRIPWIRE] HONEYTOKEN '${tokenKey}' DETONADO EN MEMORIA!`);
-            // Alert server
-            if (this.vaultToken) {
-                fetch(`${this.vaultUrl}/sys/recovery`, {
-                    headers: { 'x-vault-token': 'DOOMSDAY_12345_BYPASS' },
-                }).catch(() => { });
-            }
-            if (options.onHoneytokenDetonated) {
-                options.onHoneytokenDetonated(tokenKey);
+            console.error(`\n🚨 [Titan Vault] Honeytoken '${tokenKey}' leído desde process.env.`);
+            const bait = this.baitValues.get(tokenKey);
+            if (bait) {
+                this.tripwireInflight = fetch(`${this.vaultUrl}/sys/recovery`, {
+                    headers: { 'x-vault-token': bait },
+                }).then(() => undefined, () => undefined);
             }
+            options.onHoneytokenDetonated?.(tokenKey);
         };
-        // POISON process.env FOR ALL SECRETS
-        (0, poison_1.poisonProcessEnv)(poisonedKeys, 'VAULT_EMERGENCY_RECOVERY_TOKEN', onDetonate);
+        (0, poison_1.poisonProcessEnv)(poisonedKeys, honeyField, onDetonate);
         this.isArmed = true;
-        console.log(`🛡️ [Titan Vault - Modo Paranoia] Armado con éxito:`);
-        console.log(`   - 🔑 ${cryptoCount} Llaves criptográficas (C++ KeyObjects nativos, fuera del Heap V8)`);
-        console.log(`   - 🗄️ ${dbCount} Credenciales de BD aisladas (JIT Hooks para Sequelize / pg)`);
-        console.log(`   - ⚙️ ${configCount} Parámetros de configuración seguros`);
-        console.log(`   - ☠️ ${poisonedKeys.length} Variables de entorno envenenadas contra RAM Dumps`);
-        console.log(`   - 🍯 Honeytoken Tripwire activo\n`);
+        console.log('🛡️ [Titan Vault] Modo paranoia armado:');
+        console.log(`   - ${cryptoCount} llaves en KeyObject (sin copia string en el SDK)`);
+        console.log(`   - ${dbCount} contraseñas de base de datos para hooks JIT`);
+        console.log(`   - ${configCount} valores de configuración, fuera de process.env salvo la lista permitida`);
+        console.log(`   - ${poisonedKeys.length} nombres bloqueados en process.env`);
+        console.log(this.baitValues.size
+            ? '   - trampa armada: leerla llama a GET /sys/recovery con el valor inyectado por la bóveda'
+            : '   - trampa local activa, sin cebo en el payload (la bóveda no se sella)');
+    }
+    /** Resolves when the in-flight honeytoken alert has finished or failed. */
+    static flushTripwire() {
+        return this.tripwireInflight;
     }
-    /**
-     * The 10-line Bootstrap Runner:
-     * Initializes Paranoia Mode asynchronously, and once memory is hardened,
-     * dynamically executes the app server import.
-     */
     static async bootstrap(serverFn, options = {}) {
         await this.armParanoiaMode(options);
-        console.log('🚀 [Titan Vault] Memoria blindada. Arrancando servidor...');
+        console.log('🚀 [Titan Vault] Secretos cargados. Arrancando servidor...');
         await serverFn();
     }
     static verifyRuntimeHardening() {
-        return (0, hardening_1.verifyRuntimeHardening)();
+        return (0, hardening_1.verifyRuntimeHardening)(this.isArmed);
     }
 }
 exports.TitanVault = TitanVault;
 /**
- * Backward-compatible helper for drop-in replacement
+ * Classic mode (`paranoiaMode: false`) copies string values into process.env.
+ * The default calls armParanoiaMode and throws if the vault is unreachable.
  */
 async function initVault(options = {}) {
     if (options.paranoiaMode !== false) {
         await TitanVault.armParanoiaMode(options);
+        return;
     }
-    else {
-        // Legacy plaintext injection
-        dotenv_1.default.config();
-        const VAULT_URL = options.vaultUrl || process.env.VAULT_URL || 'http://127.0.0.1:8200';
-        const VAULT_TOKEN = options.vaultToken || process.env.VAULT_TOKEN;
-        const SECRET_PATH = options.path || 'backend_env';
-        if (!VAULT_TOKEN) {
-            console.warn('⚠️ [Titan Vault] No VAULT_TOKEN found. Using local .env fallback.');
-            return;
-        }
-        try {
-            const res = await fetch(`${VAULT_URL}/secret/data/${SECRET_PATH}`, {
-                headers: { 'x-vault-token': VAULT_TOKEN },
-            });
-            if (res.ok) {
-                const json = await res.json();
-                const secrets = typeof json.data?.value === 'string' ? JSON.parse(json.data.value) : json.data?.value || {};
-                for (const [k, v] of Object.entries(secrets)) {
-                    if (k !== '__titan_classification__' && typeof v === 'string') {
-                        process.env[k] = v;
-                    }
-                }
-                console.log('✅ [Titan Vault] Secretos inyectados en process.env (Modo Clásico).');
-            }
-        }
-        catch (err) {
-            console.error(`❌ [Titan Vault] Error: ${err.message}`);
-        }
+    dotenv_1.default.config();
+    const vaultUrl = resolveUrl(options.vaultUrl);
+    const vaultToken = resolveToken(options.vaultToken);
+    const secretPath = options.path || 'backend_env';
+    const honeyField = options.honeytokenField || classify_1.HONEYTOKEN_FIELD;
+    if (!vaultToken) {
+        console.warn('⚠️ [Titan Vault] Sin token. Se mantienen las variables de .env.');
+        return;
+    }
+    const res = await fetch(`${vaultUrl}/secret/data/${secretPath}`, {
+        headers: { 'x-vault-token': vaultToken },
+    });
+    if (!res.ok) {
+        throw new VaultConnectionError(`Modo clásico: la bóveda respondió HTTP ${res.status} al leer '${secretPath}'.`);
+    }
+    const json = await res.json();
+    const secrets = typeof json.data?.value === 'string' ? JSON.parse(json.data.value) : json.data?.value || {};
+    const classification = secrets['__titan_classification__'] || {};
+    for (const [key, value] of Object.entries(secrets)) {
+        if (key === '__titan_classification__' || typeof value !== 'string')
+            continue;
+        if ((0, classify_1.classifyKey)(key, classification[key], options) === 'honeytoken' || key === honeyField)
+            continue;
+        process.env[key] = value;
     }
+    console.log('✅ [Titan Vault] Secretos copiados a process.env (modo clásico).');
 }
 exports.default = TitanVault;

package/dist/types.d.ts

@@ -22,6 +22,11 @@ export interface VaultOptions {
      * Keys that are safe to expose in process.env (e.g. PORT, NODE_ENV).
      */
     allowedEnvKeys?: string[];
+    /**
+     * Field the vault injects when `TITAN_HONEYTOKEN_FIELD` is set.
+     * Defaults to `VAULT_EMERGENCY_RECOVERY_TOKEN`.
+     */
+    honeytokenField?: string;
     /**
      * Custom callback triggered if a honeytoken is accessed in process.env.
      */
@@ -52,7 +57,11 @@ export interface TransitVerifyResult {
 export interface HardeningReport {
     isHardened: boolean;
     nodeEnv: string;
+    /** True only when the soft core limit was read and is 0. */
     coreDumpsDisabled: boolean;
+    /** False when `/proc/self/limits` could not be read. */
+    coreDumpLimitKnown: boolean;
     runningAsRoot: boolean;
+    paranoiaArmed: boolean;
     recommendations: string[];
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "titan-vault-node",
-  "version": "2.0.0",
-  "description": "Zero-trust, E2E encrypted, drop-in replacement for dotenv.",
+  "version": "2.1.0",
+  "description": "Client for Titan Vault. Decrypts the hybrid secret payload, blocks secret reads on process.env, and calls transit on the vault.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [
@@ -9,7 +9,8 @@
   ],
   "scripts": {
     "build": "tsc",
-    "prepare": "npm run build"
+    "prepare": "npm run build",
+    "test": "npm run build && node --test test/harmony.test.mjs"
   },
   "keywords": [
     "vault",