vaultkeeper 0.5.0 → 0.5.2

package/dist/index.d.cts

@@ -650,7 +650,7 @@ declare class VaultKeeper {
     /** Run doctor checks without full initialization. */
     static doctor(): Promise<PreflightResult>;
     /**
-     * Store a secret and return a JWE token that encapsulates it.
+     * Retrieve a secret from the backend and return a JWE token that encapsulates it.
      *
      * @param secretName - Identifier for the secret
      * @param options - Setup options
@@ -793,4 +793,31 @@ declare class VaultKeeper {
     setDevelopmentMode(executablePath: string, enabled: boolean): Promise<void>;
 }
 
-export { AuthorizationDeniedError, type BackendConfig, type BackendFactory, BackendLockedError, BackendRegistry, type BackendSetupFactory, BackendUnavailableError, CapabilityToken, DeviceNotPresentError, type ExecRequest, type ExecResult, type FetchRequest, FilesystemError, IdentityMismatchError, InvalidAlgorithmError, KeyRevokedError, KeyRotatedError, type KeyStatus, type ListableBackend, PluginNotFoundError, type PreflightCheck, type PreflightCheckStatus, type PreflightResult, RotationInProgressError, type SecretAccessor, type SecretBackend, SecretNotFoundError, type SetupChoice, SetupError, type SetupOptions, type SetupQuestion, type SetupResult, type SignRequest, type SignResult, TokenExpiredError, TokenRevokedError, type TrustTier, UsageLimitExceededError, type VaultConfig, VaultError, VaultKeeper, type VaultKeeperOptions, type VaultResponse, type VerifyRequest, isListableBackend };
+/**
+ * Platform detection utilities.
+ */
+/**
+ * The OS platform identifier used for platform-specific behavior.
+ * @public
+ */
+type Platform = 'darwin' | 'win32' | 'linux';
+
+/**
+ * Doctor runner: orchestrates platform-appropriate checks and aggregates results.
+ */
+
+/**
+ * Options for running the doctor.
+ * @public
+ */
+interface RunDoctorOptions {
+    /** Override the platform detection (useful for testing). */
+    platform?: Platform;
+}
+/**
+ * Run all platform-appropriate preflight checks and aggregate the results.
+ * @public
+ */
+declare function runDoctor(options?: RunDoctorOptions): Promise<PreflightResult>;
+
+export { AuthorizationDeniedError, type BackendConfig, type BackendFactory, BackendLockedError, BackendRegistry, type BackendSetupFactory, BackendUnavailableError, CapabilityToken, DeviceNotPresentError, type ExecRequest, type ExecResult, type FetchRequest, FilesystemError, IdentityMismatchError, InvalidAlgorithmError, KeyRevokedError, KeyRotatedError, type KeyStatus, type ListableBackend, type Platform, PluginNotFoundError, type PreflightCheck, type PreflightCheckStatus, type PreflightResult, RotationInProgressError, type RunDoctorOptions, type SecretAccessor, type SecretBackend, SecretNotFoundError, type SetupChoice, SetupError, type SetupOptions, type SetupQuestion, type SetupResult, type SignRequest, type SignResult, TokenExpiredError, TokenRevokedError, type TrustTier, UsageLimitExceededError, type VaultConfig, VaultError, VaultKeeper, type VaultKeeperOptions, type VaultResponse, type VerifyRequest, isListableBackend, runDoctor };

package/dist/index.d.ts

@@ -650,7 +650,7 @@ declare class VaultKeeper {
     /** Run doctor checks without full initialization. */
     static doctor(): Promise<PreflightResult>;
     /**
-     * Store a secret and return a JWE token that encapsulates it.
+     * Retrieve a secret from the backend and return a JWE token that encapsulates it.
      *
      * @param secretName - Identifier for the secret
      * @param options - Setup options
@@ -793,4 +793,31 @@ declare class VaultKeeper {
     setDevelopmentMode(executablePath: string, enabled: boolean): Promise<void>;
 }
 
-export { AuthorizationDeniedError, type BackendConfig, type BackendFactory, BackendLockedError, BackendRegistry, type BackendSetupFactory, BackendUnavailableError, CapabilityToken, DeviceNotPresentError, type ExecRequest, type ExecResult, type FetchRequest, FilesystemError, IdentityMismatchError, InvalidAlgorithmError, KeyRevokedError, KeyRotatedError, type KeyStatus, type ListableBackend, PluginNotFoundError, type PreflightCheck, type PreflightCheckStatus, type PreflightResult, RotationInProgressError, type SecretAccessor, type SecretBackend, SecretNotFoundError, type SetupChoice, SetupError, type SetupOptions, type SetupQuestion, type SetupResult, type SignRequest, type SignResult, TokenExpiredError, TokenRevokedError, type TrustTier, UsageLimitExceededError, type VaultConfig, VaultError, VaultKeeper, type VaultKeeperOptions, type VaultResponse, type VerifyRequest, isListableBackend };
+/**
+ * Platform detection utilities.
+ */
+/**
+ * The OS platform identifier used for platform-specific behavior.
+ * @public
+ */
+type Platform = 'darwin' | 'win32' | 'linux';
+
+/**
+ * Doctor runner: orchestrates platform-appropriate checks and aggregates results.
+ */
+
+/**
+ * Options for running the doctor.
+ * @public
+ */
+interface RunDoctorOptions {
+    /** Override the platform detection (useful for testing). */
+    platform?: Platform;
+}
+/**
+ * Run all platform-appropriate preflight checks and aggregate the results.
+ * @public
+ */
+declare function runDoctor(options?: RunDoctorOptions): Promise<PreflightResult>;
+
+export { AuthorizationDeniedError, type BackendConfig, type BackendFactory, BackendLockedError, BackendRegistry, type BackendSetupFactory, BackendUnavailableError, CapabilityToken, DeviceNotPresentError, type ExecRequest, type ExecResult, type FetchRequest, FilesystemError, IdentityMismatchError, InvalidAlgorithmError, KeyRevokedError, KeyRotatedError, type KeyStatus, type ListableBackend, type Platform, PluginNotFoundError, type PreflightCheck, type PreflightCheckStatus, type PreflightResult, RotationInProgressError, type RunDoctorOptions, type SecretAccessor, type SecretBackend, SecretNotFoundError, type SetupChoice, SetupError, type SetupOptions, type SetupQuestion, type SetupResult, type SignRequest, type SignResult, TokenExpiredError, TokenRevokedError, type TrustTier, UsageLimitExceededError, type VaultConfig, VaultError, VaultKeeper, type VaultKeeperOptions, type VaultResponse, type VerifyRequest, isListableBackend, runDoctor };

package/dist/index.js

@@ -1592,7 +1592,13 @@ function validateConfig(config) {
   if (typeof config.defaults.ttlMinutes !== "number" || config.defaults.ttlMinutes <= 0) {
     throw new Error("Config defaults.ttlMinutes must be a positive number");
   }
-  const tier = config.defaults.trustTier;
+  let tier = config.defaults.trustTier;
+  if (typeof tier === "string") {
+    const parsed = Number(tier);
+    if (!Number.isNaN(parsed)) {
+      tier = parsed;
+    }
+  }
   if (tier !== 1 && tier !== 2 && tier !== 3) {
     throw new Error("Config defaults.trustTier must be 1, 2, or 3");
   }
@@ -1994,7 +2000,6 @@ var SecretAccessorTarget = class {
 };
 function createSecretAccessor(secretValue) {
   let consumed = false;
-  const revokeHolder = { fn: void 0 };
   function readImpl(callback) {
     if (consumed) {
       throw new Error("SecretAccessor has already been consumed \u2014 call getSecret() again to obtain a new accessor");
@@ -2005,7 +2010,6 @@ function createSecretAccessor(secretValue) {
       callback(buf);
     } finally {
       buf.fill(0);
-      revokeHolder.fn?.();
     }
   }
   function inspectImpl() {
@@ -2063,9 +2067,7 @@ function createSecretAccessor(secretValue) {
       return ["read", INSPECT_CUSTOM];
     }
   };
-  const { proxy, revoke } = Proxy.revocable(target, handler);
-  revokeHolder.fn = revoke;
-  return proxy;
+  return new Proxy(target, handler);
 }
 
 // src/access/sign-util.ts
@@ -2248,7 +2250,17 @@ function currentPlatform() {
 
 // src/doctor/runner.ts
 async function runDoctor(options) {
-  const platform = currentPlatform();
+  let platform;
+  try {
+    platform = options?.platform ?? currentPlatform();
+  } catch {
+    return {
+      checks: [],
+      ready: false,
+      warnings: [],
+      nextSteps: ["Unsupported platform. vaultkeeper supports macOS, Linux, and Windows."]
+    };
+  }
   const entries = buildCheckList(platform);
   const resolved = await Promise.all(
     entries.map(async ({ check, required }) => {
@@ -2301,6 +2313,7 @@ function buildCheckList(platform) {
 
 // src/vault.ts
 var usageCounts = /* @__PURE__ */ new Map();
+var USAGE_MAP_MAX_SIZE = 1e4;
 var VaultKeeper = class _VaultKeeper {
   #config;
   #keyManager;
@@ -2337,7 +2350,7 @@ var VaultKeeper = class _VaultKeeper {
     return runDoctor();
   }
   /**
-   * Store a secret and return a JWE token that encapsulates it.
+   * Retrieve a secret from the backend and return a JWE token that encapsulates it.
    *
    * @param secretName - Identifier for the secret
    * @param options - Setup options
@@ -2396,12 +2409,16 @@ var VaultKeeper = class _VaultKeeper {
     const jti = claims.jti;
     const currentCount = usageCounts.get(jti) ?? 0;
     validateClaims(claims, currentCount);
-    const newCount = currentCount + 1;
-    if (claims.use !== null && newCount >= claims.use) {
-      usageCounts.delete(jti);
-      blockToken(jti);
-    } else {
+    if (claims.use !== null) {
+      const newCount = currentCount + 1;
       usageCounts.set(jti, newCount);
+      if (usageCounts.size > USAGE_MAP_MAX_SIZE) {
+        const oldest = usageCounts.keys().next().value;
+        if (oldest !== void 0) {
+          usageCounts.delete(oldest);
+          blockToken(oldest);
+        }
+      }
     }
     const token = createCapabilityToken(claims);
     const response = { keyStatus };
@@ -2636,6 +2653,6 @@ var VaultKeeper = class _VaultKeeper {
   }
 };
 
-export { AuthorizationDeniedError, BackendLockedError, BackendRegistry, BackendUnavailableError, CapabilityToken, DeviceNotPresentError, FilesystemError, IdentityMismatchError, InvalidAlgorithmError, KeyRevokedError, KeyRotatedError, PluginNotFoundError, RotationInProgressError, SecretNotFoundError, SetupError, TokenExpiredError, TokenRevokedError, UsageLimitExceededError, VaultError, VaultKeeper, isListableBackend };
+export { AuthorizationDeniedError, BackendLockedError, BackendRegistry, BackendUnavailableError, CapabilityToken, DeviceNotPresentError, FilesystemError, IdentityMismatchError, InvalidAlgorithmError, KeyRevokedError, KeyRotatedError, PluginNotFoundError, RotationInProgressError, SecretNotFoundError, SetupError, TokenExpiredError, TokenRevokedError, UsageLimitExceededError, VaultError, VaultKeeper, isListableBackend, runDoctor };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map