open-index/open-npm huggingface dataset:
npm package: @lifeaitools/clauth
Description: Hardware-bound credential vault for the LIFEAI infrastructure stack
Author: Dave Ladouceur
Latest version: 1.5.38

# @lifeaitools/clauth

Hardware-bound credential vault for the LIFEAI stack. Your machine is the second factor. Keys live in Supabase Vault (AES-256). Nothing sensitive ever touches a config file.

---

## Install

```bash
npm install -g @lifeaitools/clauth
```

Then provision your Supabase project:

```bash
clauth install
```

That's it. `clauth install` handles everything:
- Creates all database tables
- Deploys the `auth-vault` Edge Function
- Generates HMAC salt + bootstrap token
- Tests the connection end-to-end
- Installs the Claude skill

At the end it prints a **bootstrap token** — save it for the next step.

---

## After Install — Register Your Machine

```bash
clauth setup
```

Prompts for: machine label, password, bootstrap token (from `clauth install`).

Then verify:
```bash
clauth test      # → PASS
clauth status    # → 12 services, all NO KEY
```

---

## What clauth install asks for

Two things from Supabase:

**1. Project ref** — the last segment of your Supabase project URL:
`https://supabase.com/dashboard/project/` **`your-ref-here`**

**2. Personal Access Token (PAT)**:
`https://supabase.com/dashboard/account/tokens` → Generate new token

> This is **not** your anon key or service_role key — it is your account-level token.

---

## Writing Your First Key

```bash
clauth write key github     # prompts for value
clauth enable github
clauth get github
```

---

## Command Reference

```
clauth install              Provision Supabase + install Claude skill
clauth setup                Register this machine with the vault
clauth status               All services + state
clauth test                 Verify connection

clauth write key <service>  Store a credential
clauth write pw             Change password
clauth enable <svc|all>     Activate service
clauth disable <svc|all>    Suspend service
clauth get <service>        Retrieve a key

clauth add service <n>      Register new service
clauth remove service <n>   Remove service
clauth revoke <svc|all>     Delete key (destructive)
```

## Built-in Services

`github` `supabase-anon` `supabase-service` `supabase-db`
`vercel` `namecheap` `neo4j` `anthropic`
`r2` `r2-bucket` `cloudflare` `rocketreach`

---

## How It Works

```
Machine fingerprint (BIOS UUID + OS install ID)
  + Your clauth password
  → HMAC-SHA256 token + 5-min timestamp window
  → Supabase Edge Function validates
  → Returns AES-256 encrypted key from Vault
```

Nothing stored locally. Password never persisted. Machine hash is one-way only.

---

## Releasing a New Version (maintainers)

```bash
# 1. Bump version in package.json
# 2. Commit and tag
git tag v0.1.1
git push --tags
# GitHub Actions publishes automatically via Trusted Publishing
```

---

> Life before Profits. — LIFEAI / PRT
>
> ☕ [Support this project](https://github.com/sponsors/DaveLadouceur)