@centient/secrets 0.2.0 → 0.4.0

package/dist/index.js

@@ -2,7 +2,7 @@
 export { encrypt, decrypt, encryptObject, decryptObject } from "./crypto/vault-common.js";
 export { ALGORITHM, IV_LENGTH, AUTH_TAG_LENGTH, KEY_LENGTH } from "./crypto/vault-common.js";
 // Credential vault
-export { storeCredential, getCredential, deleteCredential, getActiveVaultType, isSessionValid } from "./vault/vault.js";
+export { storeCredential, getCredential, deleteCredential, listCredentials, getActiveVaultType, isSessionValid } from "./vault/vault.js";
 // Platform detection
 export { isTTY, canUnicode, isHeadless, canLaunchBrowser, isCIEnvironment, isDockerContainer, isSSHSession } from "./platform/platform.js";
 export { isAgentEnvironment } from "./platform/agent-detect.js";
@@ -10,8 +10,11 @@ export { isAgentEnvironment } from "./platform/agent-detect.js";
 export { getEnvironmentManager, EnvironmentManager } from "./environment/EnvironmentManager.js";
 // CLI
 export { runSecrets } from "./cli/secrets-cli.js";
-// Key storage helpers
+// Key storage helpers (legacy — prefer key-providers for vault key access)
 export { getKeyFromKeychain, storeKeyInKeychain, storeStringInKeychain, getStringFromKeychain, deleteFromKeychain } from "./crypto/vault-common.js";
+export { KeychainProvider } from "./key-providers/keychain-provider.js";
+export { OnePasswordProvider } from "./key-providers/onepassword-provider.js";
+export { resolveKeyProvider, getProviderByType, loadConfig, saveSecretsConfig } from "./key-providers/resolve.js";
 // Validation
 export { isValidKey } from "./vault/vault-utils.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE7F,mBAAmB;AACnB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGxH,qBAAqB;AACrB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3I,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,yBAAyB;AACzB,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEhG,MAAM;AACN,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGlD,sBAAsB;AACtB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEpJ,aAAa;AACb,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE7F,mBAAmB;AACnB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGzI,qBAAqB;AACrB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3I,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,yBAAyB;AACzB,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEhG,MAAM;AACN,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGlD,2EAA2E;AAC3E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAIpJ,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAElH,aAAa;AACb,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/key-providers/index.d.ts

@@ -0,0 +1,5 @@
+export type { KeyProvider, KeyProviderType, OnePasswordConfig, SecretsConfig, CentientConfig } from "./types.js";
+export { KeychainProvider } from "./keychain-provider.js";
+export { OnePasswordProvider } from "./onepassword-provider.js";
+export { resolveKeyProvider, getProviderByType, loadConfig, saveSecretsConfig } from "./resolve.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/key-providers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/key-providers/index.ts"],"names":[],"mappings":"AACA,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,iBAAiB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjH,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC"}

package/dist/key-providers/index.js

@@ -0,0 +1,4 @@
+export { KeychainProvider } from "./keychain-provider.js";
+export { OnePasswordProvider } from "./onepassword-provider.js";
+export { resolveKeyProvider, getProviderByType, loadConfig, saveSecretsConfig } from "./resolve.js";
+//# sourceMappingURL=index.js.map

package/dist/key-providers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/key-providers/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC"}

package/dist/key-providers/keychain-provider.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Key Provider — macOS Keychain
+ *
+ * Wraps the existing getKeyFromKeychain / storeKeyInKeychain functions
+ * from vault-common.ts as a KeyProvider implementation.
+ *
+ * Only available on macOS (darwin). Uses the `security` CLI to interact
+ * with the system Keychain, which prompts for Touch ID or system password.
+ */
+import type { KeyProvider, KeyProviderType } from "./types.js";
+export declare class KeychainProvider implements KeyProvider {
+    readonly name: KeyProviderType;
+    /** Returns true if running on macOS. */
+    static detect(): boolean;
+    getKey(): Buffer | null;
+    storeKey(key: Buffer): boolean;
+    deleteKey(): boolean;
+}
+//# sourceMappingURL=keychain-provider.d.ts.map

package/dist/key-providers/keychain-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain-provider.d.ts","sourceRoot":"","sources":["../../src/key-providers/keychain-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAa/D,qBAAa,gBAAiB,YAAW,WAAW;IAClD,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAc;IAE5C,wCAAwC;IACxC,MAAM,CAAC,MAAM,IAAI,OAAO;IAIxB,MAAM,IAAI,MAAM,GAAG,IAAI;IAIvB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAI9B,SAAS,IAAI,OAAO;CAGrB"}

package/dist/key-providers/keychain-provider.js

@@ -0,0 +1,35 @@
+/**
+ * Key Provider — macOS Keychain
+ *
+ * Wraps the existing getKeyFromKeychain / storeKeyInKeychain functions
+ * from vault-common.ts as a KeyProvider implementation.
+ *
+ * Only available on macOS (darwin). Uses the `security` CLI to interact
+ * with the system Keychain, which prompts for Touch ID or system password.
+ */
+import { getKeyFromKeychain, storeKeyInKeychain, deleteFromKeychain, } from "../crypto/vault-common.js";
+// =============================================================================
+// Constants
+// =============================================================================
+const KEYCHAIN_SERVICE = "centient-vault";
+const KEYCHAIN_ACCOUNT = "vault-key";
+// =============================================================================
+// Implementation
+// =============================================================================
+export class KeychainProvider {
+    name = "keychain";
+    /** Returns true if running on macOS. */
+    static detect() {
+        return process.platform === "darwin";
+    }
+    getKey() {
+        return getKeyFromKeychain(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+    }
+    storeKey(key) {
+        return storeKeyInKeychain(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, key);
+    }
+    deleteKey() {
+        return deleteFromKeychain(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+    }
+}
+//# sourceMappingURL=keychain-provider.js.map

package/dist/key-providers/keychain-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain-provider.js","sourceRoot":"","sources":["../../src/key-providers/keychain-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAGnC,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAC1C,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAErC,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,MAAM,OAAO,gBAAgB;IAClB,IAAI,GAAoB,UAAU,CAAC;IAE5C,wCAAwC;IACxC,MAAM,CAAC,MAAM;QACX,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACvC,CAAC;IAED,MAAM;QACJ,OAAO,kBAAkB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;IAChE,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,kBAAkB,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC;IAED,SAAS;QACP,OAAO,kBAAkB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;IAChE,CAAC;CACF"}

package/dist/key-providers/onepassword-provider.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Key Provider — 1Password
+ *
+ * Stores and retrieves the vault encryption key via the 1Password `op` CLI.
+ * Supports three auth modes transparently:
+ *
+ *   1. Desktop app integration — user has 1Password running with CLI enabled
+ *   2. Service account — OP_SERVICE_ACCOUNT_TOKEN env var (headless/CI)
+ *   3. CLI session — user ran `op signin` (OP_SESSION_* env var)
+ *
+ * The `op` CLI handles auth selection internally; this provider just
+ * shells out to `op read` / `op item create` / `op item edit`.
+ *
+ * No dependency on @1password/sdk — uses execFileSync only.
+ */
+import type { KeyProvider, KeyProviderType, OnePasswordConfig } from "./types.js";
+export declare class OnePasswordProvider implements KeyProvider {
+    readonly name: KeyProviderType;
+    private readonly vault;
+    private readonly item;
+    constructor(config?: OnePasswordConfig);
+    /**
+     * Detect whether 1Password CLI is available and authenticated.
+     *
+     * Returns true if:
+     *   - `op` binary is in PATH, AND
+     *   - Either OP_SERVICE_ACCOUNT_TOKEN is set, or at least one account
+     *     is configured (desktop app / prior sign-in).
+     */
+    static detect(): boolean;
+    getKey(): Buffer | null;
+    storeKey(key: Buffer): boolean;
+    deleteKey(): boolean;
+    private itemExists;
+    private createItem;
+    private updateItem;
+}
+//# sourceMappingURL=onepassword-provider.d.ts.map

package/dist/key-providers/onepassword-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"onepassword-provider.d.ts","sourceRoot":"","sources":["../../src/key-providers/onepassword-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAclF,qBAAa,mBAAoB,YAAW,WAAW;IACrD,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAe;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;gBAElB,MAAM,CAAC,EAAE,iBAAiB;IAKtC;;;;;;;OAOG;IACH,MAAM,CAAC,MAAM,IAAI,OAAO;IA8BxB,MAAM,IAAI,MAAM,GAAG,IAAI;IAkBvB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAU9B,SAAS,IAAI,OAAO;IAkBpB,OAAO,CAAC,UAAU;IAalB,OAAO,CAAC,UAAU;IAmBlB,OAAO,CAAC,UAAU;CAgBnB"}

package/dist/key-providers/onepassword-provider.js

@@ -0,0 +1,146 @@
+/**
+ * Key Provider — 1Password
+ *
+ * Stores and retrieves the vault encryption key via the 1Password `op` CLI.
+ * Supports three auth modes transparently:
+ *
+ *   1. Desktop app integration — user has 1Password running with CLI enabled
+ *   2. Service account — OP_SERVICE_ACCOUNT_TOKEN env var (headless/CI)
+ *   3. CLI session — user ran `op signin` (OP_SESSION_* env var)
+ *
+ * The `op` CLI handles auth selection internally; this provider just
+ * shells out to `op read` / `op item create` / `op item edit`.
+ *
+ * No dependency on @1password/sdk — uses execFileSync only.
+ */
+import { execFileSync } from "child_process";
+// =============================================================================
+// Defaults
+// =============================================================================
+const DEFAULT_VAULT = "Private";
+const DEFAULT_ITEM = "centient-vault-key";
+const FIELD_NAME = "password";
+// =============================================================================
+// Implementation
+// =============================================================================
+export class OnePasswordProvider {
+    name = "1password";
+    vault;
+    item;
+    constructor(config) {
+        this.vault = config?.vault || DEFAULT_VAULT;
+        this.item = config?.item || DEFAULT_ITEM;
+    }
+    /**
+     * Detect whether 1Password CLI is available and authenticated.
+     *
+     * Returns true if:
+     *   - `op` binary is in PATH, AND
+     *   - Either OP_SERVICE_ACCOUNT_TOKEN is set, or at least one account
+     *     is configured (desktop app / prior sign-in).
+     */
+    static detect() {
+        // Check op binary exists
+        try {
+            execFileSync("op", ["--version"], {
+                stdio: ["pipe", "pipe", "pipe"],
+                timeout: 5000,
+            });
+        }
+        catch {
+            return false;
+        }
+        // Service account mode — no further checks needed
+        if (process.env.OP_SERVICE_ACCOUNT_TOKEN) {
+            return true;
+        }
+        // Interactive mode — check for configured accounts
+        try {
+            const output = execFileSync("op", ["account", "list", "--format=json"], { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 5000 }).trim();
+            // Returns "[]" when no accounts are configured
+            return output !== "[]" && output.length > 2;
+        }
+        catch {
+            return false;
+        }
+    }
+    getKey() {
+        try {
+            const ref = `op://${this.vault}/${this.item}/${FIELD_NAME}`;
+            const result = execFileSync("op", ["read", ref], {
+                encoding: "utf8",
+                stdio: ["pipe", "pipe", "pipe"],
+                timeout: 30000,
+            }).trim();
+            if (!result)
+                return null;
+            const buf = Buffer.from(result, "hex");
+            // Sanity check: vault key must be exactly 32 bytes
+            if (buf.length !== 32)
+                return null;
+            return buf;
+        }
+        catch {
+            return null;
+        }
+    }
+    storeKey(key) {
+        const keyHex = key.toString("hex");
+        // Check if item already exists
+        if (this.itemExists()) {
+            return this.updateItem(keyHex);
+        }
+        return this.createItem(keyHex);
+    }
+    deleteKey() {
+        try {
+            execFileSync("op", ["item", "delete", this.item, "--vault", this.vault], { stdio: ["pipe", "pipe", "pipe"], timeout: 30000 });
+            return true;
+        }
+        catch {
+            // Item may not exist — treat as success
+            return true;
+        }
+    }
+    // ---------------------------------------------------------------------------
+    // Private helpers
+    // ---------------------------------------------------------------------------
+    itemExists() {
+        try {
+            execFileSync("op", ["item", "get", this.item, "--vault", this.vault, "--format=json"], { stdio: ["pipe", "pipe", "pipe"], timeout: 15000 });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    createItem(keyHex) {
+        try {
+            execFileSync("op", [
+                "item", "create",
+                "--category", "Password",
+                "--title", this.item,
+                "--vault", this.vault,
+                `${FIELD_NAME}=${keyHex}`,
+            ], { stdio: ["pipe", "pipe", "pipe"], timeout: 30000 });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    updateItem(keyHex) {
+        try {
+            execFileSync("op", [
+                "item", "edit", this.item,
+                "--vault", this.vault,
+                `${FIELD_NAME}=${keyHex}`,
+            ], { stdio: ["pipe", "pipe", "pipe"], timeout: 30000 });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+//# sourceMappingURL=onepassword-provider.js.map

package/dist/key-providers/onepassword-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"onepassword-provider.js","sourceRoot":"","sources":["../../src/key-providers/onepassword-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C,gFAAgF;AAChF,WAAW;AACX,gFAAgF;AAEhF,MAAM,aAAa,GAAG,SAAS,CAAC;AAChC,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAC1C,MAAM,UAAU,GAAG,UAAU,CAAC;AAE9B,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,MAAM,OAAO,mBAAmB;IACrB,IAAI,GAAoB,WAAW,CAAC;IAC5B,KAAK,CAAS;IACd,IAAI,CAAS;IAE9B,YAAY,MAA0B;QACpC,IAAI,CAAC,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,aAAa,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,YAAY,CAAC;IAC3C,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,MAAM;QACX,yBAAyB;QACzB,IAAI,CAAC;YACH,YAAY,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE;gBAChC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QAED,kDAAkD;QAClD,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,mDAAmD;QACnD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CACzB,IAAI,EACJ,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,CAAC,EACpC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CACrE,CAAC,IAAI,EAAE,CAAC;YACT,+CAA+C;YAC/C,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,MAAM;QACJ,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC;YAC5D,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE;gBAC/C,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,OAAO,EAAE,KAAK;aACf,CAAC,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACvC,mDAAmD;YACnD,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;gBAAE,OAAO,IAAI,CAAC;YACnC,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAEnC,+BAA+B;QAC/B,IAAI,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAED,SAAS;QACP,IAAI,CAAC;YACH,YAAY,CACV,IAAI,EACJ,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EACpD,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CACpD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAEtE,UAAU;QAChB,IAAI,CAAC;YACH,YAAY,CACV,IAAI,EACJ,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC,EAClE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CACpD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,MAAc;QAC/B,IAAI,CAAC;YACH,YAAY,CACV,IAAI,EACJ;gBACE,MAAM,EAAE,QAAQ;gBAChB,YAAY,EAAE,UAAU;gBACxB,SAAS,EAAE,IAAI,CAAC,IAAI;gBACpB,SAAS,EAAE,IAAI,CAAC,KAAK;gBACrB,GAAG,UAAU,IAAI,MAAM,EAAE;aAC1B,EACD,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CACpD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,MAAc;QAC/B,IAAI,CAAC;YACH,YAAY,CACV,IAAI,EACJ;gBACE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI;gBACzB,SAAS,EAAE,IAAI,CAAC,KAAK;gBACrB,GAAG,UAAU,IAAI,MAAM,EAAE;aAC1B,EACD,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CACpD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}

package/dist/key-providers/resolve.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Key Provider — Resolution & Configuration
+ *
+ * Loads provider configuration from ~/.centient/config.json and resolves
+ * the appropriate KeyProvider implementation. Supports explicit config
+ * and auto-detection fallback.
+ *
+ * Resolution order:
+ *   1. Explicit config (secrets.provider field) — use it; fail if unavailable
+ *   2. Auto-detection — 1Password if `op` is available, else Keychain on macOS
+ */
+import type { KeyProvider, KeyProviderType, CentientConfig, SecretsConfig } from "./types.js";
+/**
+ * Load the global centient config file.
+ * Returns an empty object if the file doesn't exist or is malformed.
+ */
+export declare function loadConfig(): CentientConfig;
+/**
+ * Write the global centient config file.
+ * Merges the secrets section into any existing config.
+ * Returns true on success.
+ */
+export declare function saveSecretsConfig(secrets: SecretsConfig): boolean;
+/**
+ * Resolve the active KeyProvider based on config and environment.
+ *
+ * @returns An object with the resolved provider, or an error message
+ *          if the explicitly configured provider is unavailable.
+ */
+export declare function resolveKeyProvider(): {
+    ok: true;
+    provider: KeyProvider;
+    method: "config" | "auto";
+} | {
+    ok: false;
+    error: {
+        code: string;
+        message: string;
+    };
+};
+/**
+ * Get a specific provider by type, regardless of config.
+ * Used by the migrate command to construct source/target providers.
+ */
+export declare function getProviderByType(type: KeyProviderType, config?: SecretsConfig): KeyProvider | null;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/key-providers/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/key-providers/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EACf,cAAc,EACd,aAAa,EACd,MAAM,YAAY,CAAC;AAYpB;;;GAGG;AACH,wBAAgB,UAAU,IAAI,cAAc,CAY3C;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAWjE;AAMD;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI;IACpC,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,WAAW,CAAC;IACtB,MAAM,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC3B,GAAG;IACF,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1C,CAWA;AAyFD;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,eAAe,EACrB,MAAM,CAAC,EAAE,aAAa,GACrB,WAAW,GAAG,IAAI,CAWpB"}

package/dist/key-providers/resolve.js

@@ -0,0 +1,172 @@
+/**
+ * Key Provider — Resolution & Configuration
+ *
+ * Loads provider configuration from ~/.centient/config.json and resolves
+ * the appropriate KeyProvider implementation. Supports explicit config
+ * and auto-detection fallback.
+ *
+ * Resolution order:
+ *   1. Explicit config (secrets.provider field) — use it; fail if unavailable
+ *   2. Auto-detection — 1Password if `op` is available, else Keychain on macOS
+ */
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+import { KeychainProvider } from "./keychain-provider.js";
+import { OnePasswordProvider } from "./onepassword-provider.js";
+// =============================================================================
+// Constants
+// =============================================================================
+const CONFIG_PATH = join(homedir(), ".centient", "config.json");
+// =============================================================================
+// Config I/O
+// =============================================================================
+/**
+ * Load the global centient config file.
+ * Returns an empty object if the file doesn't exist or is malformed.
+ */
+export function loadConfig() {
+    try {
+        if (!existsSync(CONFIG_PATH))
+            return {};
+        const raw = readFileSync(CONFIG_PATH, "utf8");
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+            return {};
+        }
+        return parsed;
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Write the global centient config file.
+ * Merges the secrets section into any existing config.
+ * Returns true on success.
+ */
+export function saveSecretsConfig(secrets) {
+    try {
+        const existing = loadConfig();
+        const merged = { ...existing, secrets };
+        const dir = join(homedir(), ".centient");
+        mkdirSync(dir, { recursive: true });
+        writeFileSync(CONFIG_PATH, JSON.stringify(merged, null, 2) + "\n", "utf8");
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// =============================================================================
+// Provider Resolution
+// =============================================================================
+/**
+ * Resolve the active KeyProvider based on config and environment.
+ *
+ * @returns An object with the resolved provider, or an error message
+ *          if the explicitly configured provider is unavailable.
+ */
+export function resolveKeyProvider() {
+    const config = loadConfig();
+    const secretsConfig = config.secrets;
+    // Explicit config — honor it strictly
+    if (secretsConfig?.provider) {
+        return resolveExplicit(secretsConfig.provider, secretsConfig);
+    }
+    // Auto-detection fallback
+    return resolveAuto(secretsConfig);
+}
+/**
+ * Resolve an explicitly configured provider.
+ * Fails if the provider is not available on this system.
+ */
+function resolveExplicit(type, config) {
+    switch (type) {
+        case "keychain": {
+            if (!KeychainProvider.detect()) {
+                return {
+                    ok: false,
+                    error: {
+                        code: "PROVIDER_UNAVAILABLE",
+                        message: 'Key provider "keychain" is configured but macOS Keychain is not available on this platform.',
+                    },
+                };
+            }
+            return { ok: true, provider: new KeychainProvider(), method: "config" };
+        }
+        case "1password": {
+            if (!OnePasswordProvider.detect()) {
+                const hasToken = !!process.env.OP_SERVICE_ACCOUNT_TOKEN;
+                const hint = hasToken
+                    ? "OP_SERVICE_ACCOUNT_TOKEN is set but the `op` CLI binary was not found in PATH."
+                    : "Install the 1Password CLI (`op`) and either enable desktop app integration or set OP_SERVICE_ACCOUNT_TOKEN.";
+                return {
+                    ok: false,
+                    error: {
+                        code: "PROVIDER_UNAVAILABLE",
+                        message: `Key provider "1password" is configured but not available. ${hint}`,
+                    },
+                };
+            }
+            return {
+                ok: true,
+                provider: new OnePasswordProvider(config?.onePassword),
+                method: "config",
+            };
+        }
+        default: {
+            return {
+                ok: false,
+                error: {
+                    code: "UNKNOWN_PROVIDER",
+                    message: `Unknown key provider "${type}". Supported: keychain, 1password.`,
+                },
+            };
+        }
+    }
+}
+/**
+ * Auto-detect the best available provider.
+ * Prefers 1Password (enables headless), falls back to Keychain on macOS.
+ */
+function resolveAuto(config) {
+    // Prefer 1Password if available (enables headless use case)
+    if (OnePasswordProvider.detect()) {
+        return {
+            ok: true,
+            provider: new OnePasswordProvider(config?.onePassword),
+            method: "auto",
+        };
+    }
+    // Fall back to Keychain on macOS
+    if (KeychainProvider.detect()) {
+        return { ok: true, provider: new KeychainProvider(), method: "auto" };
+    }
+    return {
+        ok: false,
+        error: {
+            code: "NO_PROVIDER",
+            message: "No key provider available. " +
+                "Install the 1Password CLI (`op`) for headless support, " +
+                "or run on macOS for Keychain support.",
+        },
+    };
+}
+/**
+ * Get a specific provider by type, regardless of config.
+ * Used by the migrate command to construct source/target providers.
+ */
+export function getProviderByType(type, config) {
+    switch (type) {
+        case "keychain":
+            return KeychainProvider.detect() ? new KeychainProvider() : null;
+        case "1password":
+            return OnePasswordProvider.detect()
+                ? new OnePasswordProvider(config?.onePassword)
+                : null;
+        default:
+            return null;
+    }
+}
+//# sourceMappingURL=resolve.js.map

package/dist/key-providers/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/key-providers/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAQhE,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;AAEhE,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,MAAwB,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAsB;IACtD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAmB,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;QACzC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB;IAQhC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC;IAErC,sCAAsC;IACtC,IAAI,aAAa,EAAE,QAAQ,EAAE,CAAC;QAC5B,OAAO,eAAe,CAAC,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAChE,CAAC;IAED,0BAA0B;IAC1B,OAAO,WAAW,CAAC,aAAa,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,IAAqB,EACrB,MAAsB;IAEtB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC/B,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE;wBACL,IAAI,EAAE,sBAAsB;wBAC5B,OAAO,EACL,6FAA6F;qBAChG;iBACF,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,gBAAgB,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC1E,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClC,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;gBACxD,MAAM,IAAI,GAAG,QAAQ;oBACnB,CAAC,CAAC,gFAAgF;oBAClF,CAAC,CAAC,6GAA6G,CAAC;gBAClH,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE;wBACL,IAAI,EAAE,sBAAsB;wBAC5B,OAAO,EAAE,6DAA6D,IAAI,EAAE;qBAC7E;iBACF,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,QAAQ,EAAE,IAAI,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC;gBACtD,MAAM,EAAE,QAAQ;aACjB,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACL,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,yBAAyB,IAAc,oCAAoC;iBACrF;aACF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAClB,MAAsB;IAEtB,4DAA4D;IAC5D,IAAI,mBAAmB,CAAC,MAAM,EAAE,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,IAAI,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC;YACtD,MAAM,EAAE,MAAM;SACf,CAAC;IACJ,CAAC;IAED,iCAAiC;IACjC,IAAI,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,gBAAgB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACxE,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE;YACL,IAAI,EAAE,aAAa;YACnB,OAAO,EACL,6BAA6B;gBAC7B,yDAAyD;gBACzD,uCAAuC;SAC1C;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAqB,EACrB,MAAsB;IAEtB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU;YACb,OAAO,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACnE,KAAK,WAAW;YACd,OAAO,mBAAmB,CAAC,MAAM,EAAE;gBACjC,CAAC,CAAC,IAAI,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC;gBAC9C,CAAC,CAAC,IAAI,CAAC;QACX;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/key-providers/types.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Key Provider — Type Definitions
+ *
+ * Abstracts vault encryption key storage behind a provider interface.
+ * Implementations retrieve/store the 32-byte AES-256-GCM key from
+ * different backends (macOS Keychain, 1Password, etc.).
+ *
+ * All methods return null/false on failure — never throw (consistent
+ * with vault-common.ts conventions).
+ */
+/** Supported key provider backends. */
+export type KeyProviderType = "keychain" | "1password";
+/**
+ * Interface for vault encryption key storage providers.
+ *
+ * Each provider encapsulates its own storage details (keychain service names,
+ * 1Password vault/item paths, etc.). Callers interact only through getKey/storeKey.
+ */
+export interface KeyProvider {
+    /** Provider identifier for display and config. */
+    readonly name: KeyProviderType;
+    /**
+     * Retrieve the vault encryption key.
+     *
+     * @returns 32-byte key as Buffer, or null if not found / auth fails.
+     */
+    getKey(): Buffer | null;
+    /**
+     * Store the vault encryption key.
+     *
+     * Overwrites any existing key in the provider's storage.
+     *
+     * @param key - 32-byte encryption key
+     * @returns true on success, false on failure.
+     */
+    storeKey(key: Buffer): boolean;
+    /**
+     * Delete the stored vault encryption key.
+     *
+     * @returns true if deleted (or did not exist), false on unexpected failure.
+     */
+    deleteKey(): boolean;
+}
+/** 1Password-specific configuration. */
+export interface OnePasswordConfig {
+    /** 1Password vault name (default: "Private"). */
+    vault?: string;
+    /** 1Password item name (default: "centient-vault-key"). */
+    item?: string;
+}
+/** Global secrets configuration from ~/.centient/config.json. */
+export interface SecretsConfig {
+    /** Explicit provider choice. Omit for auto-detection. */
+    provider?: KeyProviderType;
+    /** 1Password-specific settings. */
+    onePassword?: OnePasswordConfig;
+}
+/** Top-level structure of ~/.centient/config.json. */
+export interface CentientConfig {
+    secrets?: SecretsConfig;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/key-providers/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/key-providers/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,uCAAuC;AACvC,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,WAAW,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAE/B;;;;OAIG;IACH,MAAM,IAAI,MAAM,GAAG,IAAI,CAAC;IAExB;;;;;;;OAOG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAE/B;;;;OAIG;IACH,SAAS,IAAI,OAAO,CAAC;CACtB;AAMD,wCAAwC;AACxC,MAAM,WAAW,iBAAiB;IAChC,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,iEAAiE;AACjE,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,mCAAmC;IACnC,WAAW,CAAC,EAAE,iBAAiB,CAAC;CACjC;AAED,sDAAsD;AACtD,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB"}

package/dist/key-providers/types.js

@@ -0,0 +1,12 @@
+/**
+ * Key Provider — Type Definitions
+ *
+ * Abstracts vault encryption key storage behind a provider interface.
+ * Implementations retrieve/store the 32-byte AES-256-GCM key from
+ * different backends (macOS Keychain, 1Password, etc.).
+ *
+ * All methods return null/false on failure — never throw (consistent
+ * with vault-common.ts conventions).
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/key-providers/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/key-providers/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}