Metadata-Version: 2.4
Name: navig-vault
Version: 0.2.0
Summary: NAVIG Vault — a free, standalone, encrypted developer secrets manager (Doppler / 1Password-CLI / Infisical class). Installs without navig; shares one vault.
Author-email: NAVIG Team <opensource@navig.run>
License: Apache-2.0
Project-URL: Homepage, https://navig.run
Project-URL: Documentation, https://github.com/navig-run/core/blob/main/docs/README.md
Keywords: secrets,vault,credentials,secrets-manager,encryption,dotenv,keychain,navig
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: System Administrators
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security :: Cryptography
Classifier: Topic :: Software Development :: Libraries
Classifier: Topic :: Utilities
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: cryptography>=42.0
Provides-Extra: argon2
Requires-Dist: argon2-cffi>=21.0; extra == "argon2"
Provides-Extra: keyring
Requires-Dist: keyring>=24.0; extra == "keyring"
Provides-Extra: validators
Requires-Dist: httpx>=0.27; extra == "validators"
Provides-Extra: web
Requires-Dist: tldextract>=5.0; extra == "web"
Provides-Extra: all
Requires-Dist: argon2-cffi>=21.0; extra == "all"
Requires-Dist: keyring>=24.0; extra == "all"
Requires-Dist: httpx>=0.27; extra == "all"
Requires-Dist: tldextract>=5.0; extra == "all"
Provides-Extra: dev
Requires-Dist: pytest>=7.0; extra == "dev"
Requires-Dist: ruff>=0.4; extra == "dev"
Dynamic: license-file

# navig-vault

> A free, standalone, encrypted **developer secrets manager** — Doppler / 1Password-CLI /
> Infisical / Bitwarden class — that installs **without** navig and shares **one vault**.

**Status: the library layer is real; the engine is still being extracted.**

`0.2.0` ships working code, not a skeleton — the vault's types, `SecretStr`, TOTP, and the
path seam that makes a standalone install read the **same** `~/.navig/vault` navig uses:

```python
from navig_vault import SecretStr, Credential, CredentialType, totp_now, vault_dir

s = SecretStr("hunter2")
print(s)          # masked in reprs, logs and tracebacks
```

These are not a copy. `navig.vault.types` and friends inside navig are now *shims that alias
themselves to this package* (`sys.modules[__name__] = _impl`), so there is exactly **one**
source of truth and the two cannot drift — a guard in navig's suite asserts the module
objects are identical.

Still in navig for now: the encryption engine (crypto, storage, resolver, sessions) and the
commands. So there is deliberately **no `nv` binary yet** — claiming a two-letter global
command for something that does nothing is not a decision to undo later. Use `navig vault
add|get|list` until the engine lands here.

## What it will be

- **Install-without-navig:** `pip install navig-vault` → `navig-vault` (alias `nv`) works on its
  own. Add navig later and they share the same encrypted vault automatically.
- **Runtime injection:** `navig-vault run -- <cmd>` injects real secret values from the encrypted
  vault into a process's environment at runtime (no plaintext `.env` on disk).
- **Secret types:** API keys, logins, cards, passport, TOTP.
- **Frictionless unlock:** OS keychain (macOS Keychain, Windows Credential Manager, Linux Secret
  Service) with a passphrase fallback.
- **Apache-2.0**, own subdomain **vault.navig.run**.

## Layout

```
navig-vault/
  pyproject.toml        # name "navig-vault", scripts: navig-vault + nv
  LICENSE               # Apache-2.0
  README.md
  navig_vault/
    __init__.py         # package metadata
    cli.py              # `navig-vault` / `nv` entrypoint  (stub)
    __main__.py         # `python -m navig_vault`
  tests/
    test_smoke.py
```

## Develop

```bash
cd navig-vault
python -m pip install -e ".[dev]"
navig-vault --help      # or:  nv --help   or:  python -m navig_vault
pytest -q
```

## Relationship to navig

Inside navig it remains `navig vault`. `navig-vault` owns the code; `navig-core` re-exports it,
so the two never fork. See the implementation plan (extract-from-navig-core, share-don't-fork)
in the project's Claude plans (`i-ant-to-make-staged-prism`).
