@centient/secrets 0.10.0 → 0.11.0

package/dist/vault/sidecar.js

@@ -6,13 +6,45 @@
  * sees a lower version triggers rollback detection. Corrupt vs missing is
  * distinguished so callers can report meaningfully (L5).
  */
-import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync, } from "node:fs";
+import { closeSync, existsSync, linkSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
 import { dirname } from "node:path";
 import { randomBytes } from "node:crypto";
 /** File mode for vault and sidecar files (POSIX). */
 export const VAULT_FILE_MODE = 0o600;
 /** Directory mode for the vault/sidecar parent directory (POSIX). */
 export const VAULT_DIR_MODE = 0o700;
+function removeTempOrWarn(path) {
+    try {
+        unlinkSync(path);
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return;
+        const detail = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`[secrets] WARNING: could not remove sidecar temp file ${path}: ${detail}.\n`);
+    }
+}
+/** Write and close a new temp file, cleaning only after exclusive ownership. */
+function writeExclusiveTemp(path, contents) {
+    const fd = openSync(path, "wx", VAULT_FILE_MODE);
+    let closed = false;
+    try {
+        writeFileSync(fd, contents);
+        closeSync(fd);
+        closed = true;
+    }
+    finally {
+        if (!closed) {
+            try {
+                closeSync(fd);
+            }
+            catch {
+                // Preserve the write/first-close failure.
+            }
+            removeTempOrWarn(path);
+        }
+    }
+}
 /**
  * Read sidecar content. Returns null in two distinguishable cases:
  *   - file does not exist (silent — caller drives the missing-sidecar path),
@@ -56,8 +88,45 @@ export function readSidecar(path) {
 export function writeSidecar(path, content) {
     mkdirSync(dirname(path), { recursive: true, mode: VAULT_DIR_MODE });
     const tmpPath = `${path}.${randomBytes(8).toString("hex")}.tmp`;
-    writeFileSync(tmpPath, JSON.stringify(content), { mode: VAULT_FILE_MODE });
-    renameSync(tmpPath, path);
+    let tempCreated = false;
+    let renamed = false;
+    try {
+        writeExclusiveTemp(tmpPath, JSON.stringify(content));
+        tempCreated = true;
+        renameSync(tmpPath, path);
+        renamed = true;
+    }
+    finally {
+        // After a successful rename the temp pathname is no longer ours: another
+        // process could recreate that random name before a redundant unlink. Only
+        // clean a temp that this call created and failed to rename.
+        if (tempCreated && !renamed)
+            removeTempOrWarn(tmpPath);
+    }
+}
+/**
+ * Publish an initial sidecar without ever replacing an existing destination.
+ *
+ * A hard link is the portable Node filesystem primitive that combines an
+ * already-complete temp file with EEXIST-preserving publication. The temp and
+ * destination are in the same directory, so they necessarily share a
+ * filesystem. Existing sidecar updates continue to use {@link writeSidecar}.
+ */
+export function createSidecar(path, content) {
+    mkdirSync(dirname(path), { recursive: true, mode: VAULT_DIR_MODE });
+    const tmpPath = `${path}.${randomBytes(8).toString("hex")}.tmp`;
+    let tempCreated = false;
+    try {
+        writeExclusiveTemp(tmpPath, JSON.stringify(content));
+        tempCreated = true;
+        linkSync(tmpPath, path);
+    }
+    finally {
+        // link(2) leaves the source name in place on success, so it is still this
+        // call's temp and must be removed on both paths.
+        if (tempCreated)
+            removeTempOrWarn(tmpPath);
+    }
 }
 /**
  * Check sidecar file mode; warn on stderr if not 0600.

package/dist/vault/sidecar.js.map

@@ -1 +1 @@
-{"version":3,"file":"sidecar.js","sourceRoot":"","sources":["../../src/vault/sidecar.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,UAAU,EACV,SAAS,EACT,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,qDAAqD;AACrD,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC;AAErC,qEAAqE;AACrE,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC;AAOpC;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mCAAmC,IAAI,uDAAuD,CAC/F,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mCAAmC,IAAI,yDAAyD,CACjG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,CAAC,GAAI,MAA2C,CAAC,kBAAkB,CAAC;QAC1E,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mCAAmC,IAAI,kEAAkE,CAC1G,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,kBAAkB,EAAE,CAAC,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mCAAmC,IAAI,yDAAyD,CACjG,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAuB;IAChE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAChE,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;IAC3E,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,YAAY,GAAG,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC;QACrC,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mCAAmC,IAAI,uBAAuB;gBAC5D,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,kBAAkB;gBACnE,uBAAuB,IAAI,IAAI,CAClC,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;IACzD,CAAC;AACH,CAAC"}
+{"version":3,"file":"sidecar.js","sourceRoot":"","sources":["../../src/vault/sidecar.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,SAAS,EACT,UAAU,EACV,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,qDAAqD;AACrD,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC;AAErC,qEAAqE;AACrE,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC;AAOpC,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO;QAC7D,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yDAAyD,IAAI,KAAK,MAAM,KAAK,CAC9E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,SAAS,kBAAkB,CAAC,IAAY,EAAE,QAAgB;IACxD,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;IACjD,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,aAAa,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC5B,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,SAAS,CAAC,EAAE,CAAC,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;YACD,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mCAAmC,IAAI,uDAAuD,CAC/F,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mCAAmC,IAAI,yDAAyD,CACjG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,CAAC,GAAI,MAA2C,CAAC,kBAAkB,CAAC;QAC1E,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mCAAmC,IAAI,kEAAkE,CAC1G,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,kBAAkB,EAAE,CAAC,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mCAAmC,IAAI,yDAAyD,CACjG,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAuB;IAChE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAChE,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACrD,WAAW,GAAG,IAAI,CAAC;QACnB,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC1B,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;YAAS,CAAC;QACT,yEAAyE;QACzE,0EAA0E;QAC1E,4DAA4D;QAC5D,IAAI,WAAW,IAAI,CAAC,OAAO;YAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,OAAuB;IAEvB,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAChE,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACrD,WAAW,GAAG,IAAI,CAAC;QACnB,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;YAAS,CAAC;QACT,0EAA0E;QAC1E,iDAAiD;QACjD,IAAI,WAAW;YAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,YAAY,GAAG,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC;QACrC,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mCAAmC,IAAI,uBAAuB;gBAC5D,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,kBAAkB;gBACnE,uBAAuB,IAAI,IAAI,CAClC,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;IACzD,CAAC;AACH,CAAC"}

package/dist/vault/types.d.ts

@@ -44,8 +44,9 @@ export interface StoredCredentialMeta {
     refreshToken?: string;
 }
 /**
- * Common interface implemented by all vault backends.
- * Backends must implement store/retrieve/delete/listKeys plus a static detect() method.
+ * Stable credential-value storage SPI implemented by all vault backends.
+ * Backends implement store/retrieve/delete/listKeys; concrete built-in classes
+ * may additionally expose a static `detect()` helper for cascade selection.
  *
  * **Key contract (#168).** `key` must match the grammar in `vault-utils.ts`:
  * 2-64 characters of lowercase alphanumerics with `-` or `.` as separators,
@@ -58,10 +59,15 @@ export interface StoredCredentialMeta {
  * constructible and several interpolate the key into a shell string or an
  * `op://` reference, where the grammar is also the injection guard.
  */
-export interface VaultBackend {
-    store(key: string, value: string): boolean;
-    retrieve(key: string): string | null;
-    delete(key: string): boolean;
+export interface SecretsProvider {
+    /**
+     * Stable provider identifier for audit events. Custom providers may omit it;
+     * clients then report the honest fallback `"unknown"`.
+     */
+    readonly name?: string;
+    store(key: string, value: string): boolean | Promise<boolean>;
+    retrieve(key: string): string | null | Promise<string | null>;
+    delete(key: string): boolean | Promise<boolean>;
     /**
      * Enumerate credential keys stored in this backend.
      *
@@ -71,9 +77,8 @@ export interface VaultBackend {
      *
      * Returns keys in unspecified order; callers must not rely on sort order.
      *
-     * Implementations that cannot enumerate (e.g. an env-var backend without
-     * a naming convention they can filter) should return an empty array
-     * rather than throwing. Transient failures from the underlying store
+     * Implementations whose underlying store cannot enumerate should return an
+     * empty array rather than throwing. Transient failures from the underlying store
      * (keychain access denied, libsecret timeout, filesystem permission
      * error) should throw, so the caller can retry or surface the problem.
      *
@@ -114,4 +119,6 @@ export interface VaultBackend {
      */
     probe?(key: string): SecretState | Promise<SecretState>;
 }
+/** @deprecated Use {@link SecretsProvider}. */
+export type VaultBackend = SecretsProvider;
 //# sourceMappingURL=types.d.ts.map

package/dist/vault/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/vault/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAMtD,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,OAAO,GAAG,eAAe,GAAG,SAAS,CAAC;IAC9C,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAMD,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,sBAAsB;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,MAAM,mBAAmB,GAC3B,eAAe,GACf,eAAe,GACf,eAAe,GACf,SAAS,GACT,SAAS,CAAC;AAEd,qBAAa,eAAgB,SAAQ,KAAK;aAEtB,IAAI,EAAE,mBAAmB;gBAAzB,IAAI,EAAE,mBAAmB,EACzC,OAAO,EAAE,MAAM;CAKlB;AAMD,MAAM,WAAW,aAAa;IAC5B,iCAAiC;IACjC,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,yDAAyD;IACzD,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B,iCAAiC;IACjC,MAAM,IAAI,IAAI,CAAC;CAChB;AAMD,MAAM,MAAM,SAAS,GACjB,UAAU,GACV,SAAS,GACT,WAAW,GACX,KAAK,GACL,KAAK,GACL,WAAW,GACX,eAAe,GACf,SAAS,CAAC;AAEd,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,aAAa,GAAG,SAAS,GAAG,KAAK,CAAC;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3C,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACrC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAE7B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE7C;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,KAAK,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACzD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/vault/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAMtD,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,OAAO,GAAG,eAAe,GAAG,SAAS,CAAC;IAC9C,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAMD,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,sBAAsB;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,MAAM,mBAAmB,GAC3B,eAAe,GACf,eAAe,GACf,eAAe,GACf,SAAS,GACT,SAAS,CAAC;AAEd,qBAAa,eAAgB,SAAQ,KAAK;aAEtB,IAAI,EAAE,mBAAmB;gBAAzB,IAAI,EAAE,mBAAmB,EACzC,OAAO,EAAE,MAAM;CAKlB;AAMD,MAAM,WAAW,aAAa;IAC5B,iCAAiC;IACjC,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,yDAAyD;IACzD,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B,iCAAiC;IACjC,MAAM,IAAI,IAAI,CAAC;CAChB;AAMD,MAAM,MAAM,SAAS,GACjB,UAAU,GACV,SAAS,GACT,WAAW,GACX,KAAK,GACL,KAAK,GACL,WAAW,GACX,eAAe,GACf,SAAS,CAAC;AAEd,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,aAAa,GAAG,SAAS,GAAG,KAAK,CAAC;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC9D,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEhD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE7C;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,KAAK,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACzD;AAED,+CAA+C;AAC/C,MAAM,MAAM,YAAY,GAAG,eAAe,CAAC"}

package/dist/vault/vault-env.d.ts

@@ -1,83 +1,62 @@
 /**
  * Auth Vault — Environment Variable Fallback Backend
  *
- * Last-resort vault backend that reads credentials from environment variables.
- * Reads/writes nothing to disk. Suitable for CI/headless environments where no
- * secure credential store (libsecret, GPG, macOS Keychain) is available.
- *
- * Implements the VaultBackend interface:
- *   store(key, value): boolean  — always returns false (env vars are read-only)
- *   retrieve(key): string|null  — returns ENGRAM_API_KEY for 'auth-token', null otherwise
- *   delete(key): boolean        — always returns true (no-op; nothing to delete)
- *   static detect(): boolean    — always returns true (last-resort fallback)
+ * Last-resort, read-only backend for CI and headless environments where no
+ * secure credential store is available. Every valid logical key has exactly
+ * one shell-safe environment-variable name; no credential values are written
+ * to disk.
  */
 import type { SecretState } from "../secret-state.js";
 import type { VaultBackend } from "./types.js";
+/** Prefix reserved for non-auth-token credential values in {@link EnvVault}. */
+export declare const ENV_VAULT_PREFIX = "CENTIENT_SECRET_";
+/** Injectable process environment for deterministic consumers and tests. */
+export interface EnvVaultOptions {
+    /** Read by reference so later environment changes remain visible. */
+    env?: NodeJS.ProcessEnv;
+    /** Defaults to `process.platform`; injectable for Windows-name tests. */
+    platform?: NodeJS.Platform;
+}
+/**
+ * Return the one environment-variable name assigned to a credential key.
+ *
+ * The historical `auth-token` mapping remains `ENGRAM_API_KEY`. Every other
+ * valid key uses {@link ENV_VAULT_PREFIX} plus the reversible encoding above.
+ *
+ * @throws {InvalidCredentialKeyError} when `key` violates the package-wide
+ * credential-key grammar.
+ */
+export declare function credentialKeyToEnvName(key: string): string;
 /**
  * Environment-variable-only vault backend.
  *
  * This is the last-resort fallback when no OS-level secure credential store is
- * available. It surfaces `ENGRAM_API_KEY` as the `auth-token` credential and
- * rejects all write attempts with a warning on stderr.
+ * available. It is intentionally read-only and offers no encryption or
+ * process-isolation boundary.
  */
 export declare class EnvVault implements VaultBackend {
-    /**
-     * Detection probe — always returns true so that EnvVault is always
-     * available as a last-resort fallback.
-     */
+    readonly name = "env";
+    private readonly env;
+    private readonly platform;
+    constructor(options?: EnvVaultOptions);
+    /** Always available as the cascade's terminal fallback. */
     static detect(): boolean;
-    /**
-     * Attempt to store a credential.
-     *
-     * Environment variables cannot be written from within a process, so this
-     * always fails. A warning is emitted to stderr explaining how to configure
-     * persistent storage.
-     *
-     * @returns false — storage is never performed
-     */
-    store(_key: string, _value: string): boolean;
-    /**
-     * Retrieve a credential from the environment.
-     *
-     * - `'auth-token'`    -> `process.env["ENGRAM_API_KEY"] ?? null`
-     * - `'refresh-token'` -> `null` (refresh tokens are not available in env mode)
-     * - any other key     -> `null`
-     *
-     * @param key - Logical credential key
-     * @returns The credential value, or null if unavailable
-     */
+    /** Validate and look up one credential without trimming or copying it. */
+    private lookup;
+    /** Environment variables cannot be mutated persistently from this process. */
+    store(key: string, _value: string): boolean;
+    /** Return the configured value, or `null` when its canonical slot is absent/empty. */
     retrieve(key: string): string | null;
     /**
-     * Probe one credential's state (#188).
+     * Probe one credential without returning its value.
      *
-     * Environment variables have no lock concept and no ACL: a variable is
-     * either set in this process or it is not, and there is no third state in
-     * which it exists but cannot be read. So this backend answers exactly
-     * `found`/`absent` and never `locked` — inventing one would be as dishonest
-     * as the collapse the probe exists to prevent, in the other direction.
-     *
-     * Value-free: the variable is read only to test it against `null`, and the
-     * value is discarded.
+     * An unset canonical variable is confirmed absent. A defined-but-empty
+     * variable is a visible configuration failure, never a found credential.
      */
     probe(key: string): SecretState;
-    /**
-     * Delete a credential.
-     *
-     * No-op: there is nothing stored in this backend to delete.
-     *
-     * @returns true — always succeeds (nothing to remove)
-     */
-    delete(_key: string): boolean;
-    /**
-     * Enumerate logical keys served by this backend.
-     *
-     * EnvVault only surfaces a single hardcoded mapping (`auth-token` ->
-     * `ENGRAM_API_KEY`), so enumeration returns `["auth-token"]` when the
-     * underlying env var is set, otherwise `[]`.
-     *
-     * There is no user-defined naming convention over `process.env`, so
-     * arbitrary prefixes that don't match `auth-token` always produce `[]`.
-     */
+    /** No-op deletion for the read-only fallback, after contract validation. */
+    delete(key: string): boolean;
+    /** Enumerate defined canonical variable names without reading unrelated values. */
     listKeys(prefix?: string): Promise<string[]>;
 }
 //# sourceMappingURL=vault-env.d.ts.map

package/dist/vault/vault-env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vault-env.d.ts","sourceRoot":"","sources":["../../src/vault/vault-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAM/C;;;;;;GAMG;AACH,qBAAa,QAAS,YAAW,YAAY;IAC3C;;;OAGG;IACH,MAAM,CAAC,MAAM,IAAI,OAAO;IAIxB;;;;;;;;OAQG;IACH,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAK5C;;;;;;;;;OASG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAOpC;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW;IAI/B;;;;;;OAMG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI7B;;;;;;;;;OASG;IACG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAKnD"}
+{"version":3,"file":"vault-env.d.ts","sourceRoot":"","sources":["../../src/vault/vault-env.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAW/C,gFAAgF;AAChF,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC5B;AAwBD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAI1D;AA4BD;;;;;;GAMG;AACH,qBAAa,QAAS,YAAW,YAAY;IAC3C,QAAQ,CAAC,IAAI,SAAS;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAoB;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;gBAE/B,OAAO,GAAE,eAAoB;IAKzC,2DAA2D;IAC3D,MAAM,CAAC,MAAM,IAAI,OAAO;IAIxB,0EAA0E;IAC1E,OAAO,CAAC,MAAM;IASd,8EAA8E;IAC9E,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAM3C,sFAAsF;IACtF,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAKpC;;;;;OAKG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW;IAU/B,4EAA4E;IAC5E,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAK5B,mFAAmF;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CA2BnD"}

package/dist/vault/vault-env.js

@@ -1,105 +1,169 @@
 /**
  * Auth Vault — Environment Variable Fallback Backend
  *
- * Last-resort vault backend that reads credentials from environment variables.
- * Reads/writes nothing to disk. Suitable for CI/headless environments where no
- * secure credential store (libsecret, GPG, macOS Keychain) is available.
- *
- * Implements the VaultBackend interface:
- *   store(key, value): boolean  — always returns false (env vars are read-only)
- *   retrieve(key): string|null  — returns ENGRAM_API_KEY for 'auth-token', null otherwise
- *   delete(key): boolean        — always returns true (no-op; nothing to delete)
- *   static detect(): boolean    — always returns true (last-resort fallback)
+ * Last-resort, read-only backend for CI and headless environments where no
+ * secure credential store is available. Every valid logical key has exactly
+ * one shell-safe environment-variable name; no credential values are written
+ * to disk.
  */
 import { AUTH_MESSAGES } from "../cli/messages.js";
-// =============================================================================
-// EnvVault implementation
-// =============================================================================
+import { assertValidKey, assertValidKeyPrefix, isValidKey, } from "./vault-utils.js";
+const AUTH_TOKEN_KEY = "auth-token";
+const AUTH_TOKEN_ENV_NAME = "ENGRAM_API_KEY";
+/** Prefix reserved for non-auth-token credential values in {@link EnvVault}. */
+export const ENV_VAULT_PREFIX = "CENTIENT_SECRET_";
+/**
+ * Encode a validated key into an uppercase, shell-safe, reversible suffix.
+ *
+ * `_` is forbidden by the credential-key grammar, so the ASCII escapes are
+ * unambiguous even when separators are adjacent: `-` becomes `_2D` and `.`
+ * becomes `_2E`.
+ */
+function encodeCredentialKey(key) {
+    let encoded = "";
+    for (const character of key) {
+        if (character === "-")
+            encoded += "_2D";
+        else if (character === ".")
+            encoded += "_2E";
+        else
+            encoded += character.toUpperCase();
+    }
+    return encoded;
+}
+/**
+ * Return the one environment-variable name assigned to a credential key.
+ *
+ * The historical `auth-token` mapping remains `ENGRAM_API_KEY`. Every other
+ * valid key uses {@link ENV_VAULT_PREFIX} plus the reversible encoding above.
+ *
+ * @throws {InvalidCredentialKeyError} when `key` violates the package-wide
+ * credential-key grammar.
+ */
+export function credentialKeyToEnvName(key) {
+    assertValidKey(key, "read");
+    if (key === AUTH_TOKEN_KEY)
+        return AUTH_TOKEN_ENV_NAME;
+    return `${ENV_VAULT_PREFIX}${encodeCredentialKey(key)}`;
+}
+/** Decode only canonical generic names. Malformed or aliased names are ignored. */
+function envNameToCredentialKey(envName) {
+    if (!envName.startsWith(ENV_VAULT_PREFIX))
+        return null;
+    const encoded = envName.slice(ENV_VAULT_PREFIX.length);
+    let key = "";
+    for (let index = 0; index < encoded.length; index += 1) {
+        const character = encoded[index];
+        if (/^[A-Z0-9]$/.test(character)) {
+            key += character.toLowerCase();
+            continue;
+        }
+        if (character !== "_")
+            return null;
+        const escape = encoded.slice(index + 1, index + 3);
+        if (escape === "2D")
+            key += "-";
+        else if (escape === "2E")
+            key += ".";
+        else
+            return null;
+        index += 2;
+    }
+    if (!isValidKey(key))
+        return null;
+    // This also excludes a generic alias for the legacy auth-token mapping.
+    return credentialKeyToEnvName(key) === envName ? key : null;
+}
 /**
  * Environment-variable-only vault backend.
  *
  * This is the last-resort fallback when no OS-level secure credential store is
- * available. It surfaces `ENGRAM_API_KEY` as the `auth-token` credential and
- * rejects all write attempts with a warning on stderr.
+ * available. It is intentionally read-only and offers no encryption or
+ * process-isolation boundary.
  */
 export class EnvVault {
-    /**
-     * Detection probe — always returns true so that EnvVault is always
-     * available as a last-resort fallback.
-     */
+    name = "env";
+    env;
+    platform;
+    constructor(options = {}) {
+        this.env = options.env ?? process.env;
+        this.platform = options.platform ?? process.platform;
+    }
+    /** Always available as the cascade's terminal fallback. */
     static detect() {
         return true;
     }
-    /**
-     * Attempt to store a credential.
-     *
-     * Environment variables cannot be written from within a process, so this
-     * always fails. A warning is emitted to stderr explaining how to configure
-     * persistent storage.
-     *
-     * @returns false — storage is never performed
-     */
-    store(_key, _value) {
+    /** Validate and look up one credential without trimming or copying it. */
+    lookup(key, operation) {
+        assertValidKey(key, operation);
+        const envName = credentialKeyToEnvName(key);
+        const value = this.env[envName];
+        if (value === undefined)
+            return { kind: "absent", envName };
+        if (value.length === 0)
+            return { kind: "empty", envName };
+        return { kind: "found", envName, value };
+    }
+    /** Environment variables cannot be mutated persistently from this process. */
+    store(key, _value) {
+        assertValidKey(key, "write");
         process.stderr.write(AUTH_MESSAGES.warning.envVaultNoStorage + "\n");
         return false;
     }
-    /**
-     * Retrieve a credential from the environment.
-     *
-     * - `'auth-token'`    -> `process.env["ENGRAM_API_KEY"] ?? null`
-     * - `'refresh-token'` -> `null` (refresh tokens are not available in env mode)
-     * - any other key     -> `null`
-     *
-     * @param key - Logical credential key
-     * @returns The credential value, or null if unavailable
-     */
+    /** Return the configured value, or `null` when its canonical slot is absent/empty. */
     retrieve(key) {
-        if (key === "auth-token") {
-            return process.env["ENGRAM_API_KEY"] ?? null;
-        }
-        return null;
+        const lookup = this.lookup(key, "read");
+        return lookup.kind === "found" ? lookup.value : null;
     }
     /**
-     * Probe one credential's state (#188).
+     * Probe one credential without returning its value.
      *
-     * Environment variables have no lock concept and no ACL: a variable is
-     * either set in this process or it is not, and there is no third state in
-     * which it exists but cannot be read. So this backend answers exactly
-     * `found`/`absent` and never `locked` — inventing one would be as dishonest
-     * as the collapse the probe exists to prevent, in the other direction.
-     *
-     * Value-free: the variable is read only to test it against `null`, and the
-     * value is discarded.
+     * An unset canonical variable is confirmed absent. A defined-but-empty
+     * variable is a visible configuration failure, never a found credential.
      */
     probe(key) {
-        return this.retrieve(key) !== null ? { kind: "found" } : { kind: "absent" };
+        const lookup = this.lookup(key, "read");
+        if (lookup.kind === "found")
+            return { kind: "found" };
+        if (lookup.kind === "absent")
+            return { kind: "absent" };
+        return {
+            kind: "failed",
+            detail: `environment variable "${lookup.envName}" is set but empty`,
+        };
     }
-    /**
-     * Delete a credential.
-     *
-     * No-op: there is nothing stored in this backend to delete.
-     *
-     * @returns true — always succeeds (nothing to remove)
-     */
-    delete(_key) {
+    /** No-op deletion for the read-only fallback, after contract validation. */
+    delete(key) {
+        assertValidKey(key, "delete");
         return true;
     }
-    /**
-     * Enumerate logical keys served by this backend.
-     *
-     * EnvVault only surfaces a single hardcoded mapping (`auth-token` ->
-     * `ENGRAM_API_KEY`), so enumeration returns `["auth-token"]` when the
-     * underlying env var is set, otherwise `[]`.
-     *
-     * There is no user-defined naming convention over `process.env`, so
-     * arbitrary prefixes that don't match `auth-token` always produce `[]`.
-     */
+    /** Enumerate defined canonical variable names without reading unrelated values. */
     async listKeys(prefix) {
-        if (process.env["ENGRAM_API_KEY"] === undefined)
-            return [];
-        if (prefix !== undefined && !"auth-token".startsWith(prefix))
-            return [];
-        return ["auth-token"];
+        if (prefix !== undefined)
+            assertValidKeyPrefix(prefix, "enumerate");
+        const keys = new Set();
+        for (const observedEnvName of Object.keys(this.env)) {
+            // Native Windows environment lookup is case-insensitive but preserves an
+            // existing variable's spelling during enumeration. Normalize only the
+            // comparison name so retrieve() and listKeys() answer for the same store;
+            // POSIX retains exact-case canonical-name enforcement.
+            const envName = this.platform === "win32" ? observedEnvName.toUpperCase() : observedEnvName;
+            if (envName === AUTH_TOKEN_ENV_NAME) {
+                if (this.env[observedEnvName] !== undefined)
+                    keys.add(AUTH_TOKEN_KEY);
+                continue;
+            }
+            if (!envName.startsWith(ENV_VAULT_PREFIX))
+                continue;
+            if (this.env[observedEnvName] === undefined)
+                continue;
+            const key = envNameToCredentialKey(envName);
+            if (key !== null)
+                keys.add(key);
+        }
+        return [...keys]
+            .filter((key) => prefix === undefined || key.startsWith(prefix))
+            .sort();
     }
 }
 //# sourceMappingURL=vault-env.js.map

package/dist/vault/vault-env.js.map

@@ -1 +1 @@
-{"version":3,"file":"vault-env.js","sourceRoot":"","sources":["../../src/vault/vault-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAInD,gFAAgF;AAChF,0BAA0B;AAC1B,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,OAAO,QAAQ;IACnB;;;OAGG;IACH,MAAM,CAAC,MAAM;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,IAAY,EAAE,MAAc;QAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;QACrE,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;OASG;IACH,QAAQ,CAAC,GAAW;QAClB,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YACzB,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC;QAC/C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,GAAW;QACf,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC9E,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,IAAY;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,QAAQ,CAAC,MAAe;QAC5B,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QAC3D,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACxE,OAAO,CAAC,YAAY,CAAC,CAAC;IACxB,CAAC;CACF"}
+{"version":3,"file":"vault-env.js","sourceRoot":"","sources":["../../src/vault/vault-env.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGnD,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,UAAU,GAEX,MAAM,kBAAkB,CAAC;AAE1B,MAAM,cAAc,GAAG,YAAY,CAAC;AACpC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAE7C,gFAAgF;AAChF,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAenD;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,SAAS,IAAI,GAAG,EAAE,CAAC;QAC5B,IAAI,SAAS,KAAK,GAAG;YAAE,OAAO,IAAI,KAAK,CAAC;aACnC,IAAI,SAAS,KAAK,GAAG;YAAE,OAAO,IAAI,KAAK,CAAC;;YACxC,OAAO,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5B,IAAI,GAAG,KAAK,cAAc;QAAE,OAAO,mBAAmB,CAAC;IACvD,OAAO,GAAG,gBAAgB,GAAG,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,mFAAmF;AACnF,SAAS,sBAAsB,CAAC,OAAe;IAC7C,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QAClC,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,GAAG,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAEnC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,IAAI;YAAE,GAAG,IAAI,GAAG,CAAC;aAC3B,IAAI,MAAM,KAAK,IAAI;YAAE,GAAG,IAAI,GAAG,CAAC;;YAChC,OAAO,IAAI,CAAC;QACjB,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,wEAAwE;IACxE,OAAO,sBAAsB,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,QAAQ;IACV,IAAI,GAAG,KAAK,CAAC;IACL,GAAG,CAAoB;IACvB,QAAQ,CAAkB;IAE3C,YAAY,UAA2B,EAAE;QACvC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACtC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACvD,CAAC;IAED,2DAA2D;IAC3D,MAAM,CAAC,MAAM;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0EAA0E;IAClE,MAAM,CAAC,GAAW,EAAE,SAAuB;QACjD,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAC1D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,GAAW,EAAE,MAAc;QAC/B,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;QACrE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,sFAAsF;IACtF,QAAQ,CAAC,GAAW;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACxC,OAAO,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,GAAW;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACtD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACxD,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,yBAAyB,MAAM,CAAC,OAAO,oBAAoB;SACpE,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,MAAM,CAAC,GAAW;QAChB,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mFAAmF;IACnF,KAAK,CAAC,QAAQ,CAAC,MAAe;QAC5B,IAAI,MAAM,KAAK,SAAS;YAAE,oBAAoB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAEpE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,eAAe,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpD,yEAAyE;YACzE,sEAAsE;YACtE,0EAA0E;YAC1E,uDAAuD;YACvD,MAAM,OAAO,GACX,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;YAE9E,IAAI,OAAO,KAAK,mBAAmB,EAAE,CAAC;gBACpC,IAAI,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,SAAS;oBAAE,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBACtE,SAAS;YACX,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC;gBAAE,SAAS;YACpD,IAAI,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,SAAS;gBAAE,SAAS;YAEtD,MAAM,GAAG,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,GAAG,KAAK,IAAI;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QAED,OAAO,CAAC,GAAG,IAAI,CAAC;aACb,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;aAC/D,IAAI,EAAE,CAAC;IACZ,CAAC;CACF"}

package/dist/vault/vault-gpg.d.ts

@@ -18,6 +18,7 @@ import type { VaultBackend } from "./types.js";
  * Use `GpgVault.detect()` before instantiating to verify availability.
  */
 export declare class GpgVault implements VaultBackend {
+    readonly name = "gpg";
     /**
      * Returns true if GPG is installed and at least one public key is available.
      */

package/dist/vault/vault-gpg.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vault-gpg.d.ts","sourceRoot":"","sources":["../../src/vault/vault-gpg.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA4D/C;;;;GAIG;AACH,qBAAa,QAAS,YAAW,YAAY;IAC3C;;OAEG;IACH,MAAM,CAAC,MAAM,IAAI,OAAO;IASxB;;;;OAIG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAuB1C;;;;OAIG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAkBpC;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAmB5B;;;;;;;OAOG;IACG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CA0BnD"}
+{"version":3,"file":"vault-gpg.d.ts","sourceRoot":"","sources":["../../src/vault/vault-gpg.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA4D/C;;;;GAIG;AACH,qBAAa,QAAS,YAAW,YAAY;IAC3C,QAAQ,CAAC,IAAI,SAAS;IAEtB;;OAEG;IACH,MAAM,CAAC,MAAM,IAAI,OAAO;IASxB;;;;OAIG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAuB1C;;;;OAIG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAkBpC;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAmB5B;;;;;;;OAOG;IACG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CA0BnD"}

package/dist/vault/vault-gpg.js

@@ -70,6 +70,7 @@ function getFirstGpgKeyId() {
  * Use `GpgVault.detect()` before instantiating to verify availability.
  */
 export class GpgVault {
+    name = "gpg";
     /**
      * Returns true if GPG is installed and at least one public key is available.
      */

package/dist/vault/vault-gpg.js.map

@@ -1 +1 @@
-{"version":3,"file":"vault-gpg.js","sourceRoot":"","sources":["../../src/vault/vault-gpg.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;AAEtD,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF;;GAEG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,IAAI,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,SAAS,aAAa;IACpB,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CACzB,KAAK,EACL,CAAC,aAAa,EAAE,eAAe,CAAC,EAChC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACtD,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,6EAA6E;gBAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC9B,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC7B,IAAI,CAAC,WAAW,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;oBAAE,SAAS;gBAC5E,IAAI,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACjD,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,WAAW;AACX,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,OAAO,QAAQ;IACnB;;OAEG;IACH,MAAM,CAAC,MAAM;QACX,IAAI,CAAC;YACH,YAAY,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,gBAAgB,EAAE,KAAK,IAAI,CAAC;IACrC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAW,EAAE,KAAa;QAC9B,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;YACjC,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YAEjC,aAAa,EAAE,CAAC;YAEhB,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YACpC,YAAY,CACV,KAAK,EACL,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,EACtD;gBACE,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CACF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,GAAW;QAClB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,YAAY,CACzB,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,EACtC;gBACE,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CACF,CAAC;YACF,OAAO,MAAM,IAAI,IAAI,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,GAAW;QAChB,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC9B,IAAI,CAAC;YACH,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qDAAqD;YACrD,IACE,GAAG,KAAK,IAAI;gBACZ,OAAO,GAAG,KAAK,QAAQ;gBACvB,MAAM,IAAI,GAAG;gBACZ,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAChD,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,QAAQ,CAAC,MAAe;QAC5B,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IACE,GAAG,KAAK,IAAI;gBACZ,OAAO,GAAG,KAAK,QAAQ;gBACvB,MAAM,IAAI,GAAG;gBACZ,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAChD,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,SAAS;YACvD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC9D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"vault-gpg.js","sourceRoot":"","sources":["../../src/vault/vault-gpg.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;AAEtD,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF;;GAEG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,IAAI,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,SAAS,aAAa;IACpB,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CACzB,KAAK,EACL,CAAC,aAAa,EAAE,eAAe,CAAC,EAChC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACtD,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,6EAA6E;gBAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC9B,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC7B,IAAI,CAAC,WAAW,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;oBAAE,SAAS;gBAC5E,IAAI,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACjD,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,WAAW;AACX,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,OAAO,QAAQ;IACV,IAAI,GAAG,KAAK,CAAC;IAEtB;;OAEG;IACH,MAAM,CAAC,MAAM;QACX,IAAI,CAAC;YACH,YAAY,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,gBAAgB,EAAE,KAAK,IAAI,CAAC;IACrC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAW,EAAE,KAAa;QAC9B,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;YACjC,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YAEjC,aAAa,EAAE,CAAC;YAEhB,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YACpC,YAAY,CACV,KAAK,EACL,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,EACtD;gBACE,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CACF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,GAAW;QAClB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,YAAY,CACzB,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,EACtC;gBACE,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CACF,CAAC;YACF,OAAO,MAAM,IAAI,IAAI,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,GAAW;QAChB,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC9B,IAAI,CAAC;YACH,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qDAAqD;YACrD,IACE,GAAG,KAAK,IAAI;gBACZ,OAAO,GAAG,KAAK,QAAQ;gBACvB,MAAM,IAAI,GAAG;gBACZ,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAChD,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,QAAQ,CAAC,MAAe;QAC5B,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IACE,GAAG,KAAK,IAAI;gBACZ,OAAO,GAAG,KAAK,QAAQ;gBACvB,MAAM,IAAI,GAAG;gBACZ,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAChD,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,SAAS;YACvD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC9D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/vault/vault-libsecret.d.ts

@@ -24,6 +24,7 @@ import type { VaultBackend } from "./types.js";
  *   }
  */
 export declare class LibsecretVault implements VaultBackend {
+    readonly name = "libsecret";
     /**
      * Returns true if `secret-tool` is available on this system.
      * Uses `which secret-tool` — returns false if not found or command fails.

package/dist/vault/vault-libsecret.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vault-libsecret.d.ts","sourceRoot":"","sources":["../../src/vault/vault-libsecret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAsB/C;;;;;;;;;GASG;AACH,qBAAa,cAAe,YAAW,YAAY;IACjD;;;OAGG;IACH,MAAM,CAAC,MAAM,IAAI,OAAO;IAYxB;;;;;;OAMG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAiB1C;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAiBpC;;;;;OAKG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAmB5B;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAelD;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,qBAAqB;IAa7B;;;;OAIG;YACW,eAAe;IAyD7B;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;CA2B9B"}
+{"version":3,"file":"vault-libsecret.d.ts","sourceRoot":"","sources":["../../src/vault/vault-libsecret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAsB/C;;;;;;;;;GASG;AACH,qBAAa,cAAe,YAAW,YAAY;IACjD,QAAQ,CAAC,IAAI,eAAe;IAE5B;;;OAGG;IACH,MAAM,CAAC,MAAM,IAAI,OAAO;IAYxB;;;;;;OAMG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAkB1C;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAkBpC;;;;;OAKG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAoB5B;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAelD;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,qBAAqB;IAa7B;;;;OAIG;YACW,eAAe;IAyD7B;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;CA4B9B"}