@centient/secrets 0.10.0 → 0.11.0

package/dist/compatibility.js

@@ -0,0 +1,419 @@
+/**
+ * The compatibility floor: what an OLD `@centient/secrets` silently does wrong,
+ * published as data so a consumer can grade itself (#214).
+ *
+ * ## Why this exists
+ *
+ * Five consumers pin this package at four disjoint minors (`^0.5.0` … `0.10.0`)
+ * with no negotiation surface between them and the provider. Several releases
+ * closed defects whose only symptom, at the old version, is **silence**: a
+ * denied credential operation that leaves no audit trace, a keychain write that
+ * reports success into a keychain this context's reader cannot see, a malformed
+ * key that stores on one backend and reads as absent on the next. A consumer
+ * running such a version has no way to learn that from the package — the
+ * behaviour looks fine and the logs look clean.
+ *
+ * So the provider publishes the list. {@link COMPATIBILITY_FLOOR} names each
+ * closed gap, the version that closed it, and the symptom it presented before
+ * then; {@link assessCompatibility} turns an installed version into a grade a
+ * `doctor` command can print.
+ *
+ * ## What this is NOT
+ *
+ * **Never a boot-time refusal.** Nothing here runs at import, nothing throws
+ * from a constructor, and no vault path consults it. A package that refuses to
+ * load because the caller is old converts a documentation problem into an
+ * outage. Every function in this module is pure, total, and advisory: malformed
+ * input comes back as a typed `"unknown"` grade carrying the reason (P2, No
+ * Silent Degradation; P10, Honest Uncertainty), never as a throw.
+ *
+ * ## What a consumer does with it
+ *
+ * ```ts
+ * import { assessCompatibility, SECRETS_PACKAGE_VERSION } from "@centient/secrets";
+ *
+ * const assessment = assessCompatibility(SECRETS_PACKAGE_VERSION);
+ * if (assessment.grade !== "ok") {
+ *   for (const gap of assessment.openGaps) {
+ *     report(`${gap.severity}: ${gap.symptom} (fixed in ${gap.closedIn}, ${gap.reference})`);
+ *   }
+ * }
+ * ```
+ *
+ * `SECRETS_PACKAGE_VERSION` is the version of the build the consumer actually
+ * imported, so the assessment describes the code in that tree — not whatever is
+ * latest on the registry. A consumer auditing a *manifest* range instead (`the
+ * pin says ^0.6.0 — what does that admit at worst?`) uses {@link assessPin}.
+ *
+ * Issue: centient-labs/centient-sdk#214 (findings C6-27, C6-29, C6-61).
+ */
+import { compareSemver, formatSemver, tryParseSemver } from "@centient/cli-utils";
+/**
+ * The version of THIS build of `@centient/secrets`.
+ *
+ * Kept in step with `package.json` two ways: `scripts/sync-claudemd-versions.mjs`
+ * rewrites it during `pnpm run version-packages` (the same step that syncs the
+ * CLAUDE.md package table), and `tests/compatibility.test.ts` fails the build if
+ * the two ever disagree. A stale constant here would misgrade every consumer, so
+ * drift is a test failure rather than a silent wrong answer.
+ */
+export const SECRETS_PACKAGE_VERSION = "0.11.0";
+/**
+ * The oldest version {@link COMPATIBILITY_FLOOR} can honestly describe.
+ *
+ * `0.5.0` is the oldest release any current consumer pins, and the oldest one
+ * whose behaviour the table's entries were written against. Below it the table
+ * is not wrong so much as **incomplete** — returning its short list for a 0.4.x
+ * install would understate what is open — so {@link assessCompatibility} grades
+ * such a version `"unsupported"` and says so, rather than quietly reporting the
+ * gaps it happens to know about.
+ *
+ * This is an epistemic limit on the table, not a support policy and not a gate:
+ * an `"unsupported"` grade still returns every gap the table does know about.
+ */
+export const MIN_ASSESSABLE_VERSION = "0.5.0";
+const SEVERITY_RANK = {
+    low: 0,
+    medium: 1,
+    high: 2,
+};
+/**
+ * Every known behavioural gap this package has closed, oldest fix first.
+ *
+ * Ordering is part of the contract (ascending `closedIn`, then `id`) so that
+ * the list a consumer prints reads as an upgrade path rather than an unordered
+ * bag; `tests/compatibility.test.ts` pins both the ordering and that every
+ * `closedIn` parses as a semver.
+ *
+ * Entries are added when a release closes a defect whose pre-fix symptom is
+ * silent. A fix a consumer would notice on its own does not need a row here.
+ */
+const FLOOR_TABLE = [
+    {
+        id: "per-consumer-vault-key",
+        closedIn: "0.8.0",
+        severity: "high",
+        symptom: "Every consumer on the host encrypts its vault with the same `centient-vault`/`vault-key` master key: `KeychainProvider` hardcodes the item and `openVault()` resolves its provider internally, so a consumer cannot name or inject a key of its own.",
+        reference: "centient-labs/centient-sdk#80",
+        adoptionNote: "Additive: pass `openVault({ keyProvider })` or `{ keychain: { service, account } }`. Defaults are unchanged, so an existing vault keeps opening until the consumer opts in — the bump alone does not isolate the key.",
+        finding: "C6-28",
+    },
+    {
+        id: "denied-operation-audit",
+        closedIn: "0.9.0",
+        severity: "high",
+        symptom: "A policy-denied credential operation leaves no audit trace: the `before` hook throws and no `after` event fires, so denied reads, writes, deletes and enumerations are simply absent from the audit trail.",
+        reference: "centient-labs/centient-sdk#120",
+        adoptionNote: "`SecretsEventType` gains four `*_rejected` members. A consumer that exhaustively switches on the event type must handle them; one that only matches the prior types is unaffected.",
+        finding: "C6-29",
+    },
+    {
+        id: "libsecret-fallback-silence",
+        closedIn: "0.9.0",
+        severity: "medium",
+        symptom: "On Linux, the libsecret D-Bus enumeration falls back to `secret-tool search` — which briefly materializes secret values on stdout — inside a bare `catch {}`, so a security-relevant degradation happens with no signal at all.",
+        reference: "centient-labs/centient-sdk#121",
+        finding: "C6-29",
+    },
+    {
+        id: "credential-key-grammar",
+        closedIn: "0.10.0",
+        severity: "high",
+        symptom: "The documented credential-key grammar is enforced nowhere on the shared path, so a key like `Auth_Token` stores successfully on the macOS keychain and env backends and is unreadable on every other one — and the enforcing backends return `null`, which is indistinguishable from `no such credential`.",
+        reference: "centient-labs/centient-sdk#168",
+        adoptionNote: "Breaking behaviour change: `storeCredential`/`getCredential`/`deleteCredential`/`listCredentials` now throw `InvalidCredentialKeyError` for a non-conforming key instead of dispatching it. Audit operator-supplied keys before bumping. `listCredentials(prefix)` is validated against the looser prefix grammar, so `\"soma.anthropic.\"` still works.",
+    },
+    {
+        id: "sessionless-keychain-read",
+        closedIn: "0.10.0",
+        severity: "high",
+        symptom: "On macOS, keychain writes preauthorize no reader (`-T \"\"`) and reads walk the session search list, so a context with no security session — a launchd system-domain daemon, an SSH login — cannot read its own credentials, and a locked login-keychain copy shadows a readable System-keychain one. Every such failure collapses to `null`, reported as `nothing configured`.",
+        reference: "centient-labs/centient-sdk#188",
+        adoptionNote: "Consumers carrying a private fork of this fix should reconcile deliberately rather than bundling it into a routine bump: the two postures can differ. See centient-labs/centient-sdk#214 (C6-31).",
+        finding: "C6-31",
+    },
+    {
+        id: "sessionless-write-reachability",
+        closedIn: "0.10.0",
+        severity: "medium",
+        symptom: "A sessionless keychain write that falls back to the default keychain for want of privileges is reported as `true` by the boolean accessors, even though this context's reader cannot see it there — a write recorded as a success the reader will never experience.",
+        reference: "centient-labs/centient-sdk#188",
+        adoptionNote: "Behaviour change on an unchanged signature: from 0.10.0 the boolean means `landed where this context's reader looks`, so a sessionless fallback write now returns `false` where it used to return `true`. Code that branches on `storeCredential`'s boolean should be tested against the new meaning before bumping, or read the discriminated `writeKeychainCredential()` result, which carries the destination and a value-free promotion command.",
+        finding: "C6-61",
+    },
+];
+/**
+ * The published floor — deeply frozen at module initialization (every field on
+ * a {@link CompatibilityGap} is a primitive, so freezing each entry plus the
+ * array is a complete freeze). `assessCompatibility()` defaults to this same
+ * object, so a runtime mutation — a JS consumer, a test helper, a cast past
+ * the `readonly` type — would silently change every later assessment in the
+ * process. Frozen, the mutation throws at the mutation site instead
+ * (mb:f/7e54ba; the same no-silent-degradation stance as the rest of this
+ * module).
+ */
+export const COMPATIBILITY_FLOOR = Object.freeze(FLOOR_TABLE.map((gap) => Object.freeze({ ...gap })));
+/**
+ * The one place caller input is narrowed to a usable string.
+ *
+ * Every exported function here is documented as total, and a JS caller — or a
+ * `JSON.parse`d manifest, or an `any` at a module boundary — can hand any of
+ * them `null`, a number, or an object regardless of what the TypeScript
+ * signature says. Rather than trusting each downstream parser to guard for
+ * itself (`tryParseSemver` does today; that is an implementation detail of
+ * another package, not a contract this module may rest its never-throws
+ * promise on), both entry points funnel through this guard, so the two paths
+ * cannot drift apart the way they had (`[mb:f/f8ecdf]`).
+ *
+ * Returns the trimmed string, or `null` for a non-string and for a string that
+ * is empty or whitespace-only — inputs no grammar below could accept anyway.
+ */
+function asInputString(value) {
+    if (typeof value !== "string")
+        return null;
+    const trimmed = value.trim();
+    return trimmed === "" ? null : trimmed;
+}
+/** `null`/`array`/`number`/… — `typeof` with the two cases it gets wrong fixed. */
+function typeNameOf(value) {
+    if (value === null)
+        return "null";
+    if (Array.isArray(value))
+        return "array";
+    return typeof value;
+}
+/**
+ * Render any value as a string without ever throwing.
+ *
+ * `String(value)` is not total: an object with a null prototype, or one whose
+ * `toString`/`Symbol.toPrimitive` throws, throws from the conversion itself —
+ * which would turn *reporting* a bad input into exactly the exception this
+ * module promises never to raise.
+ */
+function stringifySafely(value) {
+    if (value === null)
+        return "null";
+    if (value === undefined)
+        return "undefined";
+    try {
+        return String(value);
+    }
+    catch {
+        return `[unstringifiable ${typeof value}]`;
+    }
+}
+/** The input as the `installedVersion` echo field, whose declared type is `string`. */
+function echoInput(value) {
+    return typeof value === "string" ? value : stringifySafely(value);
+}
+/** The input as it appears in a `reason`: quoted when a string, named when not. */
+function describeInput(value) {
+    if (typeof value === "string")
+        return `'${value}'`;
+    if (value === null || value === undefined)
+        return stringifySafely(value);
+    return `a ${typeNameOf(value)} (${stringifySafely(value)})`;
+}
+/**
+ * Grade an installed version against the compatibility floor.
+ *
+ * Pure and total: it reads no environment, touches no keychain, and **never
+ * throws** — a version string it cannot parse comes back as
+ * `grade: "unknown"` naming the problem. Totality is enforced here rather than
+ * assumed of the parser: input is narrowed by this module's own guard, so a JS
+ * caller handing it `null`, `undefined`, a number or an object gets the same
+ * typed `"unknown"` result as a misspelt version, never an exception. Call it
+ * from a `doctor`, a startup log line, or a CI check; do not call it from a
+ * code path that would refuse to run on the answer.
+ *
+ * @param installedVersion - the version actually installed in the consumer's
+ *   tree. Import {@link SECRETS_PACKAGE_VERSION} for that; a leading `v` and
+ *   surrounding whitespace are tolerated.
+ * @param floor - the gap table to grade against. Defaults to
+ *   {@link COMPATIBILITY_FLOOR}; injectable so a test can grade a fixture table
+ *   without pinning itself to the shipped one.
+ */
+export function assessCompatibility(installedVersion, floor = COMPATIBILITY_FLOOR) {
+    const base = {
+        // Echoed through the guard so the declared `string` type of this field is
+        // true at runtime too, for a caller that got here holding a non-string.
+        installedVersion: echoInput(installedVersion),
+        currentVersion: SECRETS_PACKAGE_VERSION,
+        minAssessableVersion: MIN_ASSESSABLE_VERSION,
+    };
+    const candidate = asInputString(installedVersion);
+    const installed = candidate === null ? null : tryParseSemver(candidate);
+    if (installed === null) {
+        const reason = `${describeInput(installedVersion)} is not a parseable semantic version`;
+        return {
+            ...base,
+            grade: "unknown",
+            openGaps: [],
+            highestSeverity: null,
+            reason,
+            summary: `@centient/secrets compatibility not assessed: ${reason}`,
+        };
+    }
+    // A gap with an unparseable `closedIn` cannot be positioned against the
+    // installed version. Reporting it as closed would understate the risk, so it
+    // is reported as OPEN: over-reporting is recoverable, silence is not.
+    const openGaps = floor.filter((gap) => {
+        const closedIn = tryParseSemver(gap.closedIn);
+        return closedIn === null || compareSemver(installed, closedIn) < 0;
+    });
+    const highestSeverity = openGaps.reduce((worst, gap) => worst === null || SEVERITY_RANK[gap.severity] > SEVERITY_RANK[worst] ? gap.severity : worst, null);
+    const minAssessable = tryParseSemver(MIN_ASSESSABLE_VERSION);
+    const belowFloor = minAssessable !== null && compareSemver(installed, minAssessable) < 0;
+    if (belowFloor) {
+        const reason = `${base.installedVersion} is below ${MIN_ASSESSABLE_VERSION}, the oldest version this table describes; ` +
+            `the ${openGaps.length} gap(s) listed are what is known, not necessarily all that is open`;
+        return {
+            ...base,
+            grade: "unsupported",
+            openGaps,
+            highestSeverity,
+            reason,
+            summary: `@centient/secrets ${base.installedVersion} is older than this table covers (below ${MIN_ASSESSABLE_VERSION}); upgrade to ${SECRETS_PACKAGE_VERSION}`,
+        };
+    }
+    if (openGaps.length === 0) {
+        return {
+            ...base,
+            grade: "ok",
+            openGaps,
+            highestSeverity: null,
+            summary: `@centient/secrets ${base.installedVersion} has no known open compatibility gaps`,
+        };
+    }
+    const worstFix = openGaps[openGaps.length - 1].closedIn;
+    return {
+        ...base,
+        grade: "degraded",
+        openGaps,
+        highestSeverity,
+        summary: `@centient/secrets ${base.installedVersion} has ${openGaps.length} known open gap(s) (highest severity: ${highestSeverity}); all are closed by ${worstFix}`,
+    };
+}
+/**
+ * The complete grammar {@link lowestVersionInRange} resolves, anchored.
+ *
+ * Anchored on purpose. The previous implementation asked only whether the
+ * string *started with* `^`, `~` or `>=` and then handed everything after the
+ * prefix to the parser, so a composite range like `>=0.6.0 <0.8.0` was rejected
+ * only as a side effect of its tail failing to parse. Any parser lenience —
+ * ignored build metadata, a tolerated trailing token — would silently reduce a
+ * two-sided range to its lower bound and grade a version the pin does not pin
+ * (`[mb:f/a6210f]`). Matching the WHOLE range means an unsupported form is
+ * rejected by the grammar, never by luck.
+ *
+ * Accepted, and nothing else:
+ *
+ * | Form | Example |
+ * |---|---|
+ * | caret | `^0.6.0` |
+ * | tilde | `~0.9.1` |
+ * | inclusive lower bound | `>=0.8.0` |
+ * | exact | `0.10.0` |
+ *
+ * The version component is a full `major.minor.patch`, optionally with a
+ * conventional leading `v` and a `-prerelease` suffix (kept, not rounded off —
+ * see below). Horizontal whitespace is allowed after the operator and around
+ * the whole range, and nowhere else.
+ *
+ * Rejected, each as `null`: composite ranges (`>=0.6.0 <0.8.0`), `||` unions,
+ * hyphen ranges (`1.0.0 - 2.0.0`), wildcards (`*`, `""`), x-ranges (`1.x`,
+ * `1.2.x`), partial versions (`1.2`), upper bounds and exclusive lower bounds
+ * (`<0.9.0`, `>0.9.0`), protocol pins (`workspace:*`, `npm:…`, `file:…`, a git
+ * URL), build metadata (`^1.2.3+build` — it is *discarded* by the parser rather
+ * than interpreted, which is exactly the ignored-suffix case), and anything
+ * carrying a trailing token of any kind.
+ */
+const SUPPORTED_RANGE = /^(\^|~|>=)?[ \t]*(v?\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$/;
+/** One line naming the whole accepted grammar, for a `reason` a consumer reads. */
+const RANGE_GRAMMAR_HELP = "expected exactly '^x.y.z', '~x.y.z', '>=x.y.z' or 'x.y.z' " +
+    "(a leading 'v' and a '-prerelease' suffix are allowed; composite ranges, '||' unions, " +
+    "hyphen ranges, wildcards, x-ranges, protocol pins and build metadata are not)";
+/**
+ * The single strict resolver behind {@link lowestVersionInRange} and
+ * {@link assessPin} — the former discards the reason, the latter grades on it.
+ *
+ * Two independent checks, both of which must pass: {@link SUPPORTED_RANGE}
+ * validates the *shape* of the entire trimmed range, and `tryParseSemver`
+ * validates the *contents* of the captured version (per-identifier pre-release
+ * rules live there, and stay there). Neither is asked to stand in for the other.
+ */
+function resolveRange(range) {
+    const candidate = asInputString(range);
+    if (candidate === null) {
+        return {
+            ok: false,
+            reason: `${describeInput(range)} is not a range form this helper resolves (${RANGE_GRAMMAR_HELP})`,
+        };
+    }
+    const match = SUPPORTED_RANGE.exec(candidate);
+    if (match === null) {
+        return {
+            ok: false,
+            reason: `'${candidate}' is not a range form this helper resolves (${RANGE_GRAMMAR_HELP})`,
+        };
+    }
+    const parsed = tryParseSemver(match[2]);
+    if (parsed === null) {
+        return {
+            ok: false,
+            reason: `'${candidate}' has a version component that is not a parseable semantic version (${RANGE_GRAMMAR_HELP})`,
+        };
+    }
+    // Re-serialized rather than returned verbatim, so a leading `v` or stray
+    // whitespace is normalized away — but the pre-release suffix is KEPT.
+    // Dropping it would round `^1.0.0-rc.1` up to `1.0.0` and credit the consumer
+    // for a release it is not running.
+    return { ok: true, version: formatSemver(parsed) };
+}
+/**
+ * The lowest version a dependency range admits, or `null` when the range form
+ * is one this helper does not understand.
+ *
+ * Deliberately narrow: it recognises the forms that actually appear in the
+ * consumers' manifests — `^x.y.z`, `~x.y.z`, `>=x.y.z` and a bare `x.y.z` — and
+ * returns `null` for everything else rather than guessing. A guess here would
+ * grade the wrong version and report a clean bill of health for a pin nobody
+ * checked.
+ *
+ * The accepted grammar is matched whole and enumerated on
+ * {@link SUPPORTED_RANGE}; nothing outside it is partially interpreted. Total:
+ * a non-string, an empty string, and every unsupported form all return `null`.
+ */
+export function lowestVersionInRange(range) {
+    const resolved = resolveRange(range);
+    return resolved.ok ? resolved.version : null;
+}
+/**
+ * Grade a manifest **pin** by its worst admissible version.
+ *
+ * `assessCompatibility` answers "what is open in the build I imported"; this
+ * answers "what could be open in any build this pin admits". A `^0.6.0` pin can
+ * resolve to any 0.6.x, so the version worth grading is its base — which is also
+ * the one a lockfile that has never been refreshed is most likely holding.
+ *
+ * Returns `grade: "unknown"` carrying the reason for a range form
+ * {@link lowestVersionInRange} does not recognise — including a non-string a JS
+ * caller slipped past the signature. Never throws.
+ */
+export function assessPin(pin, floor = COMPATIBILITY_FLOOR) {
+    const resolved = resolveRange(pin);
+    if (!resolved.ok) {
+        return {
+            grade: "unknown",
+            installedVersion: echoInput(pin),
+            currentVersion: SECRETS_PACKAGE_VERSION,
+            minAssessableVersion: MIN_ASSESSABLE_VERSION,
+            openGaps: [],
+            highestSeverity: null,
+            reason: resolved.reason,
+            summary: `@centient/secrets compatibility not assessed: ${resolved.reason}`,
+        };
+    }
+    return assessCompatibility(resolved.version, floor);
+}
+//# sourceMappingURL=compatibility.js.map

package/dist/compatibility.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compatibility.js","sourceRoot":"","sources":["../src/compatibility.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAElF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,QAAQ,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAK9C,MAAM,aAAa,GAA0C;IAC3D,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;CACR,CAAC;AA+BF;;;;;;;;;;GAUG;AACH,MAAM,WAAW,GAAgC;IAC/C;QACE,EAAE,EAAE,wBAAwB;QAC5B,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,MAAM;QAChB,OAAO,EACL,sPAAsP;QACxP,SAAS,EAAE,+BAA+B;QAC1C,YAAY,EACV,uNAAuN;QACzN,OAAO,EAAE,OAAO;KACjB;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,MAAM;QAChB,OAAO,EACL,4MAA4M;QAC9M,SAAS,EAAE,gCAAgC;QAC3C,YAAY,EACV,oLAAoL;QACtL,OAAO,EAAE,OAAO;KACjB;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EACL,iOAAiO;QACnO,SAAS,EAAE,gCAAgC;QAC3C,OAAO,EAAE,OAAO;KACjB;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,MAAM;QAChB,OAAO,EACL,4SAA4S;QAC9S,SAAS,EAAE,gCAAgC;QAC3C,YAAY,EACV,0VAA0V;KAC7V;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,MAAM;QAChB,OAAO,EACL,iXAAiX;QACnX,SAAS,EAAE,gCAAgC;QAC3C,YAAY,EACV,mMAAmM;QACrM,OAAO,EAAE,OAAO;KACjB;IACD;QACE,EAAE,EAAE,gCAAgC;QACpC,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EACL,qQAAqQ;QACvQ,SAAS,EAAE,gCAAgC;QAC3C,YAAY,EACV,sbAAsb;QACxb,OAAO,EAAE,OAAO;KACjB;CACF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAgC,MAAM,CAAC,MAAM,CAC3E,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CACpD,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AACzC,CAAC;AAED,mFAAmF;AACnF,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACzC,OAAO,OAAO,KAAK,CAAC;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAC5C,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,oBAAoB,OAAO,KAAK,GAAG,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAED,mFAAmF;AACnF,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,KAAK,GAAG,CAAC;IACnD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;IACzE,OAAO,KAAK,UAAU,CAAC,KAAK,CAAC,KAAK,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC;AAC9D,CAAC;AAwCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,mBAAmB,CACjC,gBAAwB,EACxB,QAAqC,mBAAmB;IAExD,MAAM,IAAI,GAAG;QACX,0EAA0E;QAC1E,wEAAwE;QACxE,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,CAAC;QAC7C,cAAc,EAAE,uBAAuB;QACvC,oBAAoB,EAAE,sBAAsB;KACpC,CAAC;IAEX,MAAM,SAAS,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IACxE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,GAAG,aAAa,CAAC,gBAAgB,CAAC,sCAAsC,CAAC;QACxF,OAAO;YACL,GAAG,IAAI;YACP,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,EAAE;YACZ,eAAe,EAAE,IAAI;YACrB,MAAM;YACN,OAAO,EAAE,iDAAiD,MAAM,EAAE;SACnE,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,6EAA6E;IAC7E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACpC,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9C,OAAO,QAAQ,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CACrC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACb,KAAK,KAAK,IAAI,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAC7F,IAAI,CACL,CAAC;IAEF,MAAM,aAAa,GAAG,cAAc,CAAC,sBAAsB,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,aAAa,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC;IAEzF,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,MAAM,GACV,GAAG,IAAI,CAAC,gBAAgB,aAAa,sBAAsB,6CAA6C;YACxG,OAAO,QAAQ,CAAC,MAAM,oEAAoE,CAAC;QAC7F,OAAO;YACL,GAAG,IAAI;YACP,KAAK,EAAE,aAAa;YACpB,QAAQ;YACR,eAAe;YACf,MAAM;YACN,OAAO,EAAE,qBAAqB,IAAI,CAAC,gBAAgB,2CAA2C,sBAAsB,iBAAiB,uBAAuB,EAAE;SAC/J,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,GAAG,IAAI;YACP,KAAK,EAAE,IAAI;YACX,QAAQ;YACR,eAAe,EAAE,IAAI;YACrB,OAAO,EAAE,qBAAqB,IAAI,CAAC,gBAAgB,uCAAuC;SAC3F,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,QAAQ,CAAC;IACzD,OAAO;QACL,GAAG,IAAI;QACP,KAAK,EAAE,UAAU;QACjB,QAAQ;QACR,eAAe;QACf,OAAO,EAAE,qBAAqB,IAAI,CAAC,gBAAgB,QAAQ,QAAQ,CAAC,MAAM,yCAAyC,eAAe,wBAAwB,QAAQ,EAAE;KACrK,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,eAAe,GAAG,yDAAyD,CAAC;AAElF,mFAAmF;AACnF,MAAM,kBAAkB,GACtB,4DAA4D;IAC5D,wFAAwF;IACxF,+EAA+E,CAAC;AAOlF;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,8CAA8C,kBAAkB,GAAG;SACnG,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,IAAI,SAAS,+CAA+C,kBAAkB,GAAG;SAC1F,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,IAAI,SAAS,uEAAuE,kBAAkB,GAAG;SAClH,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,sEAAsE;IACtE,8EAA8E;IAC9E,mCAAmC;IACnC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CACvB,GAAW,EACX,QAAqC,mBAAmB;IAExD,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,KAAK,EAAE,SAAS;YAChB,gBAAgB,EAAE,SAAS,CAAC,GAAG,CAAC;YAChC,cAAc,EAAE,uBAAuB;YACvC,oBAAoB,EAAE,sBAAsB;YAC5C,QAAQ,EAAE,EAAE;YACZ,eAAe,EAAE,IAAI;YACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,iDAAiD,QAAQ,CAAC,MAAM,EAAE;SAC5E,CAAC;IACJ,CAAC;IACD,OAAO,mBAAmB,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACtD,CAAC"}

package/dist/index.d.ts

@@ -1,12 +1,18 @@
 export { encrypt, decrypt, encryptObject, decryptObject } from "./crypto/vault-common.js";
 export { ALGORITHM, IV_LENGTH, AUTH_TAG_LENGTH, KEY_LENGTH } from "./crypto/vault-common.js";
 export { storeCredential, getCredential, deleteCredential, listCredentials, getActiveVaultType, isSessionValid, KeychainVault, AUTH_KEYCHAIN_SERVICE } from "./vault/vault.js";
-export type { VaultBackend, VaultType, StoredCredentialMeta } from "./vault/types.js";
+export type { SecretsProvider, VaultBackend, VaultType, StoredCredentialMeta } from "./vault/types.js";
+export { EnvVault, ENV_VAULT_PREFIX, credentialKeyToEnvName, } from "./vault/vault-env.js";
+export type { EnvVaultOptions } from "./vault/vault-env.js";
+export { createSecretsClient } from "./client.js";
+export type { SecretsClient, CreateSecretsClientOptions } from "./client.js";
 export type { SecretState, SecretStateKind } from "./secret-state.js";
 export { probeBackendState, probeVaultBackendState } from "./vault/vault.js";
 export type { BackendStateProbe } from "./vault/vault.js";
 export { probeKeyProviderState, probeKeyProvider } from "./key-providers/probe.js";
 export type { KeyStateProbe } from "./key-providers/probe.js";
+export { SECRETS_PACKAGE_VERSION, MIN_ASSESSABLE_VERSION, COMPATIBILITY_FLOOR, assessCompatibility, assessPin, lowestVersionInRange, } from "./compatibility.js";
+export type { CompatibilityGap, CompatibilityGrade, CompatibilityAssessment, GapSeverity, } from "./compatibility.js";
 export { isTTY, canUnicode, isHeadless, canLaunchBrowser, isCIEnvironment, isDockerContainer, isSSHSession } from "./platform/platform.js";
 export { isAgentEnvironment } from "./platform/agent-detect.js";
 export { detectSessionContext, isSessionlessContext, SESSION_CONTEXT_OVERRIDE_ENV } from "./platform/session-context.js";
@@ -16,6 +22,8 @@ export type { KeychainDeps, KeychainRunResult, KeychainReadResult, KeychainWrite
 export { getEnvironmentManager, EnvironmentManager } from "./environment/EnvironmentManager.js";
 export { runSecrets } from "./cli/secrets-cli.js";
 export type { SecretsOptions } from "./cli/secrets-cli.js";
+export { AUTH_MESSAGES } from "./cli/messages.js";
+export type { AuthMessages } from "./cli/messages.js";
 export { getKeyFromKeychain, storeKeyInKeychain, storeStringInKeychain, getStringFromKeychain, deleteFromKeychain } from "./crypto/vault-common.js";
 export type { KeyProvider, KeyProviderError, KeyProviderType, OnePasswordConfig, OnePasswordBackendConfig, SecretsBackendType, SecretsConfig, CentientConfig } from "./key-providers/types.js";
 export { KeychainProvider, DEFAULT_KEYCHAIN_SERVICE, DEFAULT_KEYCHAIN_ACCOUNT, } from "./key-providers/keychain-provider.js";
@@ -31,9 +39,15 @@ export { resolveKeyProvider, getProviderByType, loadConfig, saveSecretsConfig }
 export type { ResolveKeyProviderOptions } from "./key-providers/resolve.js";
 export { isValidKey, isValidKeyPrefix, assertValidKey, assertValidKeyPrefix, } from "./vault/vault-utils.js";
 export type { KeyOperation } from "./vault/vault-utils.js";
-export { setSecretsPolicies, getActivePolicies, auditTrail, rejectedEventType } from "./vault/policy.js";
-export type { SecretsPolicy, SecretsEvent, SecretsEventType, SecretsOperation, AuditTrailOptions } from "./vault/policy.js";
-export { openVault, rekeyVault, VAULT_SCHEMA_VERSION, VAULT_AAD_PREFIX, DEFAULT_VAULT_PATH, DEFAULT_SIDECAR_PATH } from "./vault/session-vault.js";
+export { setSecretsPolicies, getActivePolicies, rejectedEventType } from "./vault/policy.js";
+export type { SecretsPolicy, SecretsEvent, SecretsEventType, SecretsOperation, SecretsOperationContext, SecretsCaller } from "./vault/policy.js";
+export { auditTrail } from "./policies/audit-trail.js";
+export type { AuditEventChain, AuditTrailOptions } from "./policies/audit-trail.js";
+export { OCSF_SCHEMA_VERSION, OCSF_IAM_CATEGORY_UID, OCSF_ENTITY_MANAGEMENT_CLASS_UID, toCredentialAuditEvent, } from "./audit/ocsf.js";
+export type { CredentialAuditEvent, CredentialAuditMetadata, CredentialAuditUnmapped, OcsfAttestation, OcsfFingerprint, OcsfPreviousEvent, OcsfProjectionOptions, } from "./audit/ocsf.js";
+export { AuditChainError, canonicalizeAuditEvent, createHmacAuditChain, verifyHmacAuditChain, } from "./audit/hmac-chain.js";
+export type { AuditChainCheckpoint, AuditChainErrorCode, AuditChainKey, AuditChainVerificationFailure, AuditChainVerificationFailureCode, AuditChainVerificationResult, ChainedCredentialAuditEvent, CreateHmacAuditChainOptions, HmacAuditChain, VerifyAuditChainOptions, } from "./audit/hmac-chain.js";
+export { createVault, openVault, rekeyVault, VAULT_SCHEMA_VERSION, VAULT_AAD_PREFIX, DEFAULT_VAULT_PATH, DEFAULT_SIDECAR_PATH } from "./vault/session-vault.js";
 export { VaultError, VaultUnlockError, VaultDecryptError, VaultRollbackError, VaultClosedError, VaultLockError, VaultRestoreError, InvalidCredentialKeyError, } from "./vault/session-vault.js";
-export type { SessionVault, OpenVaultOptions, CoherenceStrategy, RekeyVaultOptions, RekeyVaultResult, } from "./vault/session-vault.js";
+export type { SessionVault, CreateVaultOptions, CreateVaultResult, OpenVaultOptions, CoherenceStrategy, RekeyVaultOptions, RekeyVaultResult, } from "./vault/session-vault.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAG7F,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC/K,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAOtF,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,YAAY,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACnF,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAG9D,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3I,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAKhE,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AACzH,YAAY,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAMxF,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,sBAAsB,EACtB,4BAA4B,EAC5B,wBAAwB,EACxB,uBAAuB,EACvB,6BAA6B,EAC7B,8BAA8B,EAC9B,wBAAwB,EACxB,uBAAuB,EAIvB,4BAA4B,EAC5B,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,EACpB,8BAA8B,EAC9B,kBAAkB,EAClB,sBAAsB,EACtB,UAAU,EACV,oBAAoB,EACpB,aAAa,EACb,YAAY,GACb,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAGhG,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG3D,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGpJ,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/L,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACzI,YAAY,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACtG,YAAY,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,6BAA6B,EAC7B,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,EAC3B,mBAAmB,EACnB,8BAA8B,GAC/B,MAAM,wCAAwC,CAAC;AAChD,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAClH,YAAY,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAI5E,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,cAAc,EACd,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAG3D,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACzG,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAM5H,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACnJ,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAG7F,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC/K,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACvG,OAAO,EACL,QAAQ,EACR,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,YAAY,EAAE,aAAa,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAO7E,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,YAAY,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACnF,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAO9D,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,SAAS,EACT,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB,EACvB,WAAW,GACZ,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3I,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAKhE,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AACzH,YAAY,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAMxF,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,sBAAsB,EACtB,4BAA4B,EAC5B,wBAAwB,EACxB,uBAAuB,EACvB,6BAA6B,EAC7B,8BAA8B,EAC9B,wBAAwB,EACxB,uBAAuB,EAIvB,4BAA4B,EAC5B,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,EACpB,8BAA8B,EAC9B,kBAAkB,EAClB,sBAAsB,EACtB,UAAU,EACV,oBAAoB,EACpB,aAAa,EACb,YAAY,GACb,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAGhG,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAI3D,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGtD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGpJ,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/L,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACzI,YAAY,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACtG,YAAY,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,6BAA6B,EAC7B,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,EAC3B,mBAAmB,EACnB,8BAA8B,GAC/B,MAAM,wCAAwC,CAAC;AAChD,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAClH,YAAY,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAI5E,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,cAAc,EACd,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAG3D,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC7F,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACjJ,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,gCAAgC,EAChC,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,EACb,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,EAC5B,2BAA2B,EAC3B,2BAA2B,EAC3B,cAAc,EACd,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChK,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC"}

package/dist/index.js

@@ -3,8 +3,16 @@ export { encrypt, decrypt, encryptObject, decryptObject } from "./crypto/vault-c
 export { ALGORITHM, IV_LENGTH, AUTH_TAG_LENGTH, KEY_LENGTH } from "./crypto/vault-common.js";
 // Credential vault
 export { storeCredential, getCredential, deleteCredential, listCredentials, getActiveVaultType, isSessionValid, KeychainVault, AUTH_KEYCHAIN_SERVICE } from "./vault/vault.js";
+export { EnvVault, ENV_VAULT_PREFIX, credentialKeyToEnvName, } from "./vault/vault-env.js";
+export { createSecretsClient } from "./client.js";
 export { probeBackendState, probeVaultBackendState } from "./vault/vault.js";
 export { probeKeyProviderState, probeKeyProvider } from "./key-providers/probe.js";
+// Compatibility floor (#214) — the provider-published list of behavioural gaps
+// an OLD version of this package silently has, so a consumer's `doctor` can
+// grade its own installed version. Pure, total, advisory: nothing here runs at
+// import, nothing throws, and no vault path consults it. A graded floor, never
+// a boot-time refusal.
+export { SECRETS_PACKAGE_VERSION, MIN_ASSESSABLE_VERSION, COMPATIBILITY_FLOOR, assessCompatibility, assessPin, lowestVersionInRange, } from "./compatibility.js";
 // Platform detection
 export { isTTY, canUnicode, isHeadless, canLaunchBrowser, isCIEnvironment, isDockerContainer, isSSHSession } from "./platform/platform.js";
 export { isAgentEnvironment } from "./platform/agent-detect.js";
@@ -25,6 +33,9 @@ probeKeychainCredentialState, probeKeychainEntry, probeSystemKeychainEntry, prob
 export { getEnvironmentManager, EnvironmentManager } from "./environment/EnvironmentManager.js";
 // CLI
 export { runSecrets } from "./cli/secrets-cli.js";
+// Auth CLI message catalog — public so a consuming CLI imports it instead of
+// forking a copy that drifts (#217 C6-34). `./cli/messages.ts` states its scope.
+export { AUTH_MESSAGES } from "./cli/messages.js";
 // Key storage helpers (legacy — prefer key-providers for vault key access)
 export { getKeyFromKeychain, storeKeyInKeychain, storeStringInKeychain, getStringFromKeychain, deleteFromKeychain } from "./crypto/vault-common.js";
 export { KeychainProvider, DEFAULT_KEYCHAIN_SERVICE, DEFAULT_KEYCHAIN_ACCOUNT, } from "./key-providers/keychain-provider.js";
@@ -37,11 +48,14 @@ export { resolveKeyProvider, getProviderByType, loadConfig, saveSecretsConfig }
 // `InvalidCredentialKeyError` is re-exported from the VaultError block below.
 export { isValidKey, isValidKeyPrefix, assertValidKey, assertValidKeyPrefix, } from "./vault/vault-utils.js";
 // Policy
-export { setSecretsPolicies, getActivePolicies, auditTrail, rejectedEventType } from "./vault/policy.js";
+export { setSecretsPolicies, getActivePolicies, rejectedEventType } from "./vault/policy.js";
+export { auditTrail } from "./policies/audit-trail.js";
+export { OCSF_SCHEMA_VERSION, OCSF_IAM_CATEGORY_UID, OCSF_ENTITY_MANAGEMENT_CLASS_UID, toCredentialAuditEvent, } from "./audit/ocsf.js";
+export { AuditChainError, canonicalizeAuditEvent, createHmacAuditChain, verifyHmacAuditChain, } from "./audit/hmac-chain.js";
 // Session-backed vault (envelope encryption, single unlock per session)
 // Recommended for long-running processes (daemons) holding N credentials;
 // supersedes per-item `getCredential` calls for those consumers. See
 // packages/secrets/docs/session-vault.md and issue #40 for the threat model.
-export { openVault, rekeyVault, VAULT_SCHEMA_VERSION, VAULT_AAD_PREFIX, DEFAULT_VAULT_PATH, DEFAULT_SIDECAR_PATH } from "./vault/session-vault.js";
+export { createVault, openVault, rekeyVault, VAULT_SCHEMA_VERSION, VAULT_AAD_PREFIX, DEFAULT_VAULT_PATH, DEFAULT_SIDECAR_PATH } from "./vault/session-vault.js";
 export { VaultError, VaultUnlockError, VaultDecryptError, VaultRollbackError, VaultClosedError, VaultLockError, VaultRestoreError, InvalidCredentialKeyError, } from "./vault/session-vault.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE7F,mBAAmB;AACnB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAS/K,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE7E,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAGnF,qBAAqB;AACrB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3I,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,2EAA2E;AAC3E,4EAA4E;AAC5E,4EAA4E;AAC5E,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAGzH,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,0CAA0C;AAC1C,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,sBAAsB,EACtB,4BAA4B,EAC5B,wBAAwB,EACxB,uBAAuB,EACvB,6BAA6B,EAC7B,8BAA8B,EAC9B,wBAAwB,EACxB,uBAAuB;AACvB,2EAA2E;AAC3E,6EAA6E;AAC7E,4BAA4B;AAC5B,4BAA4B,EAC5B,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,EACpB,8BAA8B,EAC9B,kBAAkB,EAClB,sBAAsB,EACtB,UAAU,EACV,oBAAoB,EACpB,aAAa,EACb,YAAY,GACb,MAAM,6BAA6B,CAAC;AAUrC,yBAAyB;AACzB,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEhG,MAAM;AACN,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGlD,2EAA2E;AAC3E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAIpJ,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEzI,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEtG,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,6BAA6B,EAC7B,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,EAC3B,mBAAmB,EACnB,8BAA8B,GAC/B,MAAM,wCAAwC,CAAC;AAOhD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAGlH,gFAAgF;AAChF,8EAA8E;AAC9E,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,cAAc,EACd,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAGhC,SAAS;AACT,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAGzG,wEAAwE;AACxE,0EAA0E;AAC1E,qEAAqE;AACrE,6EAA6E;AAC7E,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACnJ,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE7F,mBAAmB;AACnB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAE/K,OAAO,EACL,QAAQ,EACR,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AASlD,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE7E,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAGnF,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,uBAAuB;AACvB,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,SAAS,EACT,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAQ5B,qBAAqB;AACrB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3I,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,2EAA2E;AAC3E,4EAA4E;AAC5E,4EAA4E;AAC5E,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAGzH,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,0CAA0C;AAC1C,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,sBAAsB,EACtB,4BAA4B,EAC5B,wBAAwB,EACxB,uBAAuB,EACvB,6BAA6B,EAC7B,8BAA8B,EAC9B,wBAAwB,EACxB,uBAAuB;AACvB,2EAA2E;AAC3E,6EAA6E;AAC7E,4BAA4B;AAC5B,4BAA4B,EAC5B,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,EACpB,8BAA8B,EAC9B,kBAAkB,EAClB,sBAAsB,EACtB,UAAU,EACV,oBAAoB,EACpB,aAAa,EACb,YAAY,GACb,MAAM,6BAA6B,CAAC;AAUrC,yBAAyB;AACzB,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEhG,MAAM;AACN,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGlD,6EAA6E;AAC7E,iFAAiF;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGlD,2EAA2E;AAC3E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAIpJ,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEzI,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEtG,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,6BAA6B,EAC7B,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,EAC3B,mBAAmB,EACnB,8BAA8B,GAC/B,MAAM,wCAAwC,CAAC;AAOhD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAGlH,gFAAgF;AAChF,8EAA8E;AAC9E,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,cAAc,EACd,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAGhC,SAAS;AACT,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE7F,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAEvD,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,gCAAgC,EAChC,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AAUzB,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAc/B,wEAAwE;AACxE,0EAA0E;AAC1E,qEAAqE;AACrE,6EAA6E;AAC7E,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChK,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC"}

package/dist/policies/audit-trail.d.ts

@@ -0,0 +1,25 @@
+import type { CredentialAuditEvent } from "../audit/ocsf.js";
+import type { AuditSink } from "../sinks/types.js";
+import type { SecretsPolicy } from "../vault/policy.js";
+/** Structural seam implemented by `createHmacAuditChain()`. */
+export interface AuditEventChain {
+    append(event: CredentialAuditEvent): CredentialAuditEvent;
+}
+export interface AuditTrailOptions {
+    /** Defaults to the application-owned global OpenTelemetry tracer. */
+    readonly sink?: AuditSink;
+    /** Successful and missing reads are included unless explicitly disabled. */
+    readonly includeReads?: boolean;
+    /** Optional synchronous integrity chain applied before the record reaches a sink. */
+    readonly chain?: AuditEventChain;
+    /** Actor used when the operation did not carry an explicit caller. */
+    readonly defaultActor?: string;
+    /** Injectable record UID seam. */
+    readonly uid?: () => string;
+}
+/**
+ * Map value-free policy outcomes to OCSF, optionally chain them, then emit to
+ * one synchronous sink boundary. Rejected and failed reads are never filtered.
+ */
+export declare function auditTrail(options?: AuditTrailOptions): SecretsPolicy;
+//# sourceMappingURL=audit-trail.d.ts.map

package/dist/policies/audit-trail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-trail.d.ts","sourceRoot":"","sources":["../../src/policies/audit-trail.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAG7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAgB,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEtE,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,KAAK,EAAE,oBAAoB,GAAG,oBAAoB,CAAC;CAC3D;AAED,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,qFAAqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;IACjC,sEAAsE;IACtE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,kCAAkC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,GAAE,iBAAsB,GAAG,aAAa,CA2BzE"}

package/dist/policies/audit-trail.js

@@ -0,0 +1,31 @@
+import { toCredentialAuditEvent } from "../audit/ocsf.js";
+import { otelAuditSink } from "../sinks/otel.js";
+/**
+ * Map value-free policy outcomes to OCSF, optionally chain them, then emit to
+ * one synchronous sink boundary. Rejected and failed reads are never filtered.
+ */
+export function auditTrail(options = {}) {
+    const includeReads = options.includeReads ?? true;
+    const sink = options.sink ?? otelAuditSink();
+    const chain = options.chain;
+    const appendToChain = chain?.append.bind(chain);
+    const defaultActor = options.defaultActor;
+    const uid = options.uid;
+    return {
+        name: "auditTrail",
+        observesPolicyRejections: true,
+        after(event) {
+            if (!includeReads &&
+                (event.type === "credential_read" ||
+                    event.type === "credential_read_missing")) {
+                return;
+            }
+            const projected = toCredentialAuditEvent(event, {
+                ...(defaultActor !== undefined ? { defaultActor } : {}),
+                ...(uid !== undefined ? { uid } : {}),
+            });
+            sink(appendToChain?.(projected) ?? projected);
+        },
+    };
+}
+//# sourceMappingURL=audit-trail.js.map

package/dist/policies/audit-trail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-trail.js","sourceRoot":"","sources":["../../src/policies/audit-trail.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAsBjD;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,UAA6B,EAAE;IACxD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,aAAa,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,aAAa,GAAG,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAExB,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,wBAAwB,EAAE,IAAI;QAC9B,KAAK,CAAC,KAAmB;YACvB,IACE,CAAC,YAAY;gBACb,CAAC,KAAK,CAAC,IAAI,KAAK,iBAAiB;oBAC/B,KAAK,CAAC,IAAI,KAAK,yBAAyB,CAAC,EAC3C,CAAC;gBACD,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,sBAAsB,CAAC,KAAK,EAAE;gBAC9C,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtC,CAAC,CAAC;YACH,IAAI,CAAC,aAAa,EAAE,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/sinks/index.d.ts

@@ -0,0 +1,9 @@
+export { jsonlAuditSink } from "./jsonl.js";
+export type { JsonlAuditSinkOptions } from "./jsonl.js";
+export { credentialAuditSpanAttributes, otelAuditSink, OtelAuditSinkDegradedError, } from "./otel.js";
+export type { OtelAuditSinkOptions } from "./otel.js";
+export { syslogAuditSink } from "./syslog.js";
+export type { SyslogAuditSender, SyslogAuditSinkOptions, } from "./syslog.js";
+export { AuditSinkOverflowError } from "./types.js";
+export type { AuditSink, AuditSinkErrorHandler, AuditSinkHealth, } from "./types.js";
+//# sourceMappingURL=index.d.ts.map