@centient/secrets 0.5.0 → 0.6.0

package/dist/crypto/vault-common.d.ts

@@ -16,23 +16,36 @@ export declare const KEY_LENGTH = 32;
  *
  * The returned Buffer layout is:
  *   [IV (12 bytes)] [AuthTag (16 bytes)] [Ciphertext (variable)]
+ *
+ * Optionally accepts `aad` (Additional Authenticated Data) — additional
+ * bytes bound into the auth tag but not encrypted. Callers that want to
+ * bind a ciphertext to its identity (e.g. vault file path + schema version)
+ * should pass a stable `aad`; the same bytes MUST be passed to `decrypt()`
+ * or auth-tag verification fails cleanly. When `aad` is omitted, behaviour
+ * is unchanged (backward-compatible).
  */
-export declare function encrypt(plaintext: string, key: Buffer): Buffer;
+export declare function encrypt(plaintext: string, key: Buffer, aad?: Buffer): Buffer;
 /**
  * Decrypt a Buffer produced by `encrypt()`.
  * Returns the plaintext string, or null if decryption fails.
+ *
+ * If the ciphertext was produced with `aad`, the same bytes must be passed
+ * here. Mismatched or missing `aad` fails auth-tag verification and returns
+ * null, identical to any other decryption failure. Callers that need to
+ * distinguish auth-tag-fail from tampering should inspect context (known
+ * key, known AAD) rather than relying on the error shape.
  */
-export declare function decrypt(data: Buffer, key: Buffer): string | null;
+export declare function decrypt(data: Buffer, key: Buffer, aad?: Buffer): string | null;
 /**
  * Encrypt a JSON-serializable object. Convenience wrapper over `encrypt()`.
  * Returns null if serialization fails (should not happen with plain objects).
  */
-export declare function encryptObject(data: Record<string, unknown>, key: Buffer): Buffer | null;
+export declare function encryptObject(data: Record<string, unknown>, key: Buffer, aad?: Buffer): Buffer | null;
 /**
  * Decrypt a Buffer to a JSON object. Convenience wrapper over `decrypt()`.
  * Returns null if decryption or parsing fails.
  */
-export declare function decryptObject(data: Buffer, key: Buffer): Record<string, unknown> | null;
+export declare function decryptObject(data: Buffer, key: Buffer, aad?: Buffer): Record<string, unknown> | null;
 /**
  * Invalidate all cached enumeration results. Called automatically
  * by `storeStringInKeychain` and `deleteFromKeychain` so that

package/dist/crypto/vault-common.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vault-common.d.ts","sourceRoot":"","sources":["../../src/crypto/vault-common.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAaH,eAAO,MAAM,SAAS,EAAG,aAAsB,CAAC;AAChD,eAAO,MAAM,SAAS,KAAK,CAAC;AAC5B,eAAO,MAAM,eAAe,KAAK,CAAC;AAClC,eAAO,MAAM,UAAU,KAAK,CAAC;AAM7B;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAS9D;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgBhE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,MAAM,GACV,MAAM,GAAG,IAAI,CAMf;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACV,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAYhC;AAkBD;;;;GAIG;AACH,wBAAgB,2BAA2B,IAAI,IAAI,CAElD;AAMD;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,MAAM,GAAG,IAAI,CAYf;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,GACV,OAAO,CAsBT;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,OAAO,CAsBT;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,MAAM,GAAG,IAAI,CAWf;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,OAAO,CAaT;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,EAAE,CAsDV"}
+{"version":3,"file":"vault-common.d.ts","sourceRoot":"","sources":["../../src/crypto/vault-common.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAaH,eAAO,MAAM,SAAS,EAAG,aAAsB,CAAC;AAChD,eAAO,MAAM,SAAS,KAAK,CAAC;AAC5B,eAAO,MAAM,eAAe,KAAK,CAAC;AAClC,eAAO,MAAM,UAAU,KAAK,CAAC;AAM7B;;;;;;;;;;;;GAYG;AACH,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAU5E;AAED;;;;;;;;;GASG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiB9E;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,MAAM,EACX,GAAG,CAAC,EAAE,MAAM,GACX,MAAM,GAAG,IAAI,CAMf;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,GAAG,CAAC,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAYhC;AAkBD;;;;GAIG;AACH,wBAAgB,2BAA2B,IAAI,IAAI,CAElD;AAMD;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,MAAM,GAAG,IAAI,CAYf;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,GACV,OAAO,CAsBT;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,OAAO,CAsBT;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,MAAM,GAAG,IAAI,CAWf;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,OAAO,CAaT;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,EAAE,CAsDV"}

package/dist/crypto/vault-common.js

@@ -24,10 +24,19 @@ export const KEY_LENGTH = 32;
  *
  * The returned Buffer layout is:
  *   [IV (12 bytes)] [AuthTag (16 bytes)] [Ciphertext (variable)]
+ *
+ * Optionally accepts `aad` (Additional Authenticated Data) — additional
+ * bytes bound into the auth tag but not encrypted. Callers that want to
+ * bind a ciphertext to its identity (e.g. vault file path + schema version)
+ * should pass a stable `aad`; the same bytes MUST be passed to `decrypt()`
+ * or auth-tag verification fails cleanly. When `aad` is omitted, behaviour
+ * is unchanged (backward-compatible).
  */
-export function encrypt(plaintext, key) {
+export function encrypt(plaintext, key, aad) {
     const iv = randomBytes(IV_LENGTH);
     const cipher = createCipheriv(ALGORITHM, key, iv);
+    if (aad !== undefined)
+        cipher.setAAD(aad);
     const encrypted = Buffer.concat([
         cipher.update(plaintext, "utf8"),
         cipher.final(),
@@ -38,8 +47,14 @@ export function encrypt(plaintext, key) {
 /**
  * Decrypt a Buffer produced by `encrypt()`.
  * Returns the plaintext string, or null if decryption fails.
+ *
+ * If the ciphertext was produced with `aad`, the same bytes must be passed
+ * here. Mismatched or missing `aad` fails auth-tag verification and returns
+ * null, identical to any other decryption failure. Callers that need to
+ * distinguish auth-tag-fail from tampering should inspect context (known
+ * key, known AAD) rather than relying on the error shape.
  */
-export function decrypt(data, key) {
+export function decrypt(data, key, aad) {
     try {
         if (data.length < IV_LENGTH + AUTH_TAG_LENGTH)
             return null;
@@ -48,6 +63,8 @@ export function decrypt(data, key) {
         const ciphertext = data.subarray(IV_LENGTH + AUTH_TAG_LENGTH);
         const decipher = createDecipheriv(ALGORITHM, key, iv);
         decipher.setAuthTag(authTag);
+        if (aad !== undefined)
+            decipher.setAAD(aad);
         const decrypted = Buffer.concat([
             decipher.update(ciphertext),
             decipher.final(),
@@ -62,9 +79,9 @@ export function decrypt(data, key) {
  * Encrypt a JSON-serializable object. Convenience wrapper over `encrypt()`.
  * Returns null if serialization fails (should not happen with plain objects).
  */
-export function encryptObject(data, key) {
+export function encryptObject(data, key, aad) {
     try {
-        return encrypt(JSON.stringify(data), key);
+        return encrypt(JSON.stringify(data), key, aad);
     }
     catch {
         return null;
@@ -74,8 +91,8 @@ export function encryptObject(data, key) {
  * Decrypt a Buffer to a JSON object. Convenience wrapper over `decrypt()`.
  * Returns null if decryption or parsing fails.
  */
-export function decryptObject(data, key) {
-    const plaintext = decrypt(data, key);
+export function decryptObject(data, key, aad) {
+    const plaintext = decrypt(data, key, aad);
     if (plaintext === null)
         return null;
     try {

package/dist/crypto/vault-common.js.map

@@ -1 +1 @@
-{"version":3,"file":"vault-common.js","sourceRoot":"","sources":["../../src/crypto/vault-common.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,WAAW,GACZ,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,CAAC,MAAM,SAAS,GAAG,aAAsB,CAAC;AAChD,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC;AAC5B,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAClC,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,CAAC;AAE7B,gFAAgF;AAChF,0BAA0B;AAC1B,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,SAAiB,EAAE,GAAW;IACpD,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;QAChC,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACpC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,GAAW;IAC/C,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,GAAG,SAAS,GAAG,eAAe;YAAE,OAAO,IAAI,CAAC;QAC3D,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,eAAe,CAAC,CAAC;QACtE,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,eAAe,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACtD,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;YAC3B,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,IAA6B,EAC7B,GAAW;IAEX,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,GAAW;IAEX,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrC,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAiC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAWD,MAAM,0BAA0B,GAAG,KAAK,CAAC;AACzC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA8B,CAAC;AAEhE,SAAS,gBAAgB,CAAC,OAAe,EAAE,MAA0B;IACnE,OAAO,GAAG,OAAO,KAAK,MAAM,IAAI,EAAE,EAAE,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B;IACzC,iBAAiB,CAAC,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,gFAAgF;AAChF,6CAA6C;AAC7C,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,OAAe;IAEf,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CACzB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAC7D,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACtD,CAAC,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,OAAe,EACf,GAAW;IAEX,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnC,2DAA2D;QAC3D,IAAI,CAAC;YACH,YAAY,CACV,UAAU,EACV,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,EACzD,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACpC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;QACD,YAAY,CACV,UAAU,EACV,CAAC,sBAAsB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,EAC9E,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACpC,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,OAAe,EACf,KAAa;IAEb,IAAI,CAAC;QACH,wBAAwB;QACxB,IAAI,CAAC;YACH,YAAY,CACV,UAAU,EACV,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,EACzD,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACpC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;QACD,YAAY,CACV,UAAU,EACV,CAAC,sBAAsB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,EAC7E,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACpC,CAAC;QACF,2BAA2B,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,OAAe;IAEf,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CACzB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAC7D,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACtD,CAAC,IAAI,EAAE,CAAC;QACT,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,OAAe;IAEf,IAAI,CAAC;QACH,YAAY,CACV,UAAU,EACV,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,EACzD,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACpC,CAAC;QACF,2BAA2B,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,MAAe;IAEf,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1D,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CACzB,UAAU,EACV,CAAC,eAAe,CAAC,EACjB;QACE,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;QAC/B,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KAC5B,CACF,CAAC;IAEF,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,WAAW,GAAkB,IAAI,CAAC;IAEtC,MAAM,KAAK,GAAG,GAAS,EAAE;QACvB,IAAI,WAAW,KAAK,OAAO,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACpD,IAAI,MAAM,KAAK,SAAS,IAAI,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3D,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,WAAW,GAAG,IAAI,CAAC;QACnB,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,KAAK,EAAE,CAAC;YACR,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YACrD,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YACrD,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;IACH,CAAC;IACD,KAAK,EAAE,CAAC;IAER,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE;QACxB,IAAI;QACJ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,0BAA0B;KACnD,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"vault-common.js","sourceRoot":"","sources":["../../src/crypto/vault-common.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,WAAW,GACZ,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,CAAC,MAAM,SAAS,GAAG,aAAsB,CAAC;AAChD,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC;AAC5B,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAClC,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,CAAC;AAE7B,gFAAgF;AAChF,0BAA0B;AAC1B,gFAAgF;AAEhF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,OAAO,CAAC,SAAiB,EAAE,GAAW,EAAE,GAAY;IAClE,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,GAAG,KAAK,SAAS;QAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;QAChC,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACpC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,GAAW,EAAE,GAAY;IAC7D,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,GAAG,SAAS,GAAG,eAAe;YAAE,OAAO,IAAI,CAAC;QAC3D,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,eAAe,CAAC,CAAC;QACtE,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,eAAe,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACtD,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,GAAG,KAAK,SAAS;YAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;YAC3B,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,IAA6B,EAC7B,GAAW,EACX,GAAY;IAEZ,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,GAAW,EACX,GAAY;IAEZ,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAiC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAWD,MAAM,0BAA0B,GAAG,KAAK,CAAC;AACzC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA8B,CAAC;AAEhE,SAAS,gBAAgB,CAAC,OAAe,EAAE,MAA0B;IACnE,OAAO,GAAG,OAAO,KAAK,MAAM,IAAI,EAAE,EAAE,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B;IACzC,iBAAiB,CAAC,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,gFAAgF;AAChF,6CAA6C;AAC7C,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,OAAe;IAEf,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CACzB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAC7D,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACtD,CAAC,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,OAAe,EACf,GAAW;IAEX,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnC,2DAA2D;QAC3D,IAAI,CAAC;YACH,YAAY,CACV,UAAU,EACV,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,EACzD,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACpC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;QACD,YAAY,CACV,UAAU,EACV,CAAC,sBAAsB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,EAC9E,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACpC,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,OAAe,EACf,KAAa;IAEb,IAAI,CAAC;QACH,wBAAwB;QACxB,IAAI,CAAC;YACH,YAAY,CACV,UAAU,EACV,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,EACzD,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACpC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;QACD,YAAY,CACV,UAAU,EACV,CAAC,sBAAsB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,EAC7E,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACpC,CAAC;QACF,2BAA2B,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,OAAe;IAEf,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CACzB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAC7D,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACtD,CAAC,IAAI,EAAE,CAAC;QACT,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,OAAe;IAEf,IAAI,CAAC;QACH,YAAY,CACV,UAAU,EACV,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,EACzD,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACpC,CAAC;QACF,2BAA2B,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,MAAe;IAEf,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1D,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CACzB,UAAU,EACV,CAAC,eAAe,CAAC,EACjB;QACE,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;QAC/B,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KAC5B,CACF,CAAC;IAEF,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,WAAW,GAAkB,IAAI,CAAC;IAEtC,MAAM,KAAK,GAAG,GAAS,EAAE;QACvB,IAAI,WAAW,KAAK,OAAO,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACpD,IAAI,MAAM,KAAK,SAAS,IAAI,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3D,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,WAAW,GAAG,IAAI,CAAC;QACnB,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,KAAK,EAAE,CAAC;YACR,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YACrD,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YACrD,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;IACH,CAAC;IACD,KAAK,EAAE,CAAC;IAER,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE;QACxB,IAAI;QACJ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,0BAA0B;KACnD,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/index.d.ts

@@ -15,4 +15,7 @@ export { resolveKeyProvider, getProviderByType, loadConfig, saveSecretsConfig }
 export { isValidKey } from "./vault/vault-utils.js";
 export { setSecretsPolicies, getActivePolicies, auditTrail } from "./vault/policy.js";
 export type { SecretsPolicy, SecretsEvent, SecretsEventType, SecretsOperation, AuditTrailOptions } from "./vault/policy.js";
+export { openVault, VAULT_SCHEMA_VERSION, VAULT_AAD_PREFIX, DEFAULT_VAULT_PATH, DEFAULT_SIDECAR_PATH } from "./vault/session-vault.js";
+export { VaultError, VaultUnlockError, VaultDecryptError, VaultRollbackError, VaultClosedError, VaultLockError, } from "./vault/session-vault.js";
+export type { SessionVault, OpenVaultOptions, CoherenceStrategy } from "./vault/session-vault.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAG7F,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzI,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAGtF,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3I,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGhE,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAGhG,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG3D,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGpJ,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,iBAAiB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/H,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAGlH,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGpD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACtF,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAG7F,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzI,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAGtF,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3I,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGhE,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAGhG,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG3D,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGpJ,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,iBAAiB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/H,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAGlH,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGpD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACtF,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAM5H,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACvI,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,GACf,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/index.js

@@ -19,4 +19,10 @@ export { resolveKeyProvider, getProviderByType, loadConfig, saveSecretsConfig }
 export { isValidKey } from "./vault/vault-utils.js";
 // Policy
 export { setSecretsPolicies, getActivePolicies, auditTrail } from "./vault/policy.js";
+// Session-backed vault (envelope encryption, single unlock per session)
+// Recommended for long-running processes (daemons) holding N credentials;
+// supersedes per-item `getCredential` calls for those consumers. See
+// packages/secrets/docs/session-vault.md and issue #40 for the threat model.
+export { openVault, VAULT_SCHEMA_VERSION, VAULT_AAD_PREFIX, DEFAULT_VAULT_PATH, DEFAULT_SIDECAR_PATH } from "./vault/session-vault.js";
+export { VaultError, VaultUnlockError, VaultDecryptError, VaultRollbackError, VaultClosedError, VaultLockError, } from "./vault/session-vault.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE7F,mBAAmB;AACnB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGzI,qBAAqB;AACrB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3I,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,yBAAyB;AACzB,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEhG,MAAM;AACN,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGlD,2EAA2E;AAC3E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAIpJ,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAElH,aAAa;AACb,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,SAAS;AACT,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE7F,mBAAmB;AACnB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGzI,qBAAqB;AACrB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3I,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,yBAAyB;AACzB,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEhG,MAAM;AACN,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGlD,2EAA2E;AAC3E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAIpJ,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAElH,aAAa;AACb,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,SAAS;AACT,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGtF,wEAAwE;AACxE,0EAA0E;AAC1E,qEAAqE;AACrE,6EAA6E;AAC7E,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACvI,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,GACf,MAAM,0BAA0B,CAAC"}

package/dist/vault/file-lock.d.ts

@@ -0,0 +1,33 @@
+/**
+ * File lock — native exclusive advisory lock for vault writes.
+ *
+ * Extracted from session-vault.ts (M3) so session-vault remains focused on
+ * orchestration. The lock itself is filesystem-level (O_EXCL create on a
+ * `.lock` file) and cooperative: it only protects against writers that call
+ * `acquireWriteLock` before mutating.
+ *
+ * The lock file contains the holding process's PID so stale-lock stealing can
+ * distinguish "our PID still owns it" from "the previous holder crashed." On
+ * steal we write-and-verify to avoid two racing processes both thinking they
+ * stole the same stale lock (M2).
+ */
+/** Max time a writer will wait to acquire the file lock before giving up. */
+export declare const LOCK_TIMEOUT_MS = 5000;
+/** Poll interval when waiting on a held lock. */
+export declare const LOCK_RETRY_INTERVAL_MS = 25;
+/** Stale-lock threshold — if a lock file is older than this, assume crash. */
+export declare const LOCK_STALE_MS = 30000;
+/**
+ * Acquire an exclusive write lock via O_EXCL on `{vaultPath}.lock`. Yields
+ * the event loop between retries (no busy-spin) up to `LOCK_TIMEOUT_MS`.
+ * Locks older than `LOCK_STALE_MS` are considered orphaned (the holding
+ * process crashed) and stolen with a pid-verification handshake so two
+ * concurrent stealers can't both claim ownership.
+ *
+ * Returns a release function. Releasing is idempotent and swallows ENOENT
+ * (the lock file may have been stolen by another process after we already
+ * finished our critical section — that's fine; the lockfile, not the fd,
+ * is what matters).
+ */
+export declare function acquireWriteLock(vaultPath: string): Promise<() => void>;
+//# sourceMappingURL=file-lock.d.ts.map

package/dist/vault/file-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-lock.d.ts","sourceRoot":"","sources":["../../src/vault/file-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAaH,6EAA6E;AAC7E,eAAO,MAAM,eAAe,OAAQ,CAAC;AAErC,iDAAiD;AACjD,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC,8EAA8E;AAC9E,eAAO,MAAM,aAAa,QAAS,CAAC;AAEpC;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAwG7E"}

package/dist/vault/file-lock.js

@@ -0,0 +1,143 @@
+/**
+ * File lock — native exclusive advisory lock for vault writes.
+ *
+ * Extracted from session-vault.ts (M3) so session-vault remains focused on
+ * orchestration. The lock itself is filesystem-level (O_EXCL create on a
+ * `.lock` file) and cooperative: it only protects against writers that call
+ * `acquireWriteLock` before mutating.
+ *
+ * The lock file contains the holding process's PID so stale-lock stealing can
+ * distinguish "our PID still owns it" from "the previous holder crashed." On
+ * steal we write-and-verify to avoid two racing processes both thinking they
+ * stole the same stale lock (M2).
+ */
+import { openSync, closeSync, writeFileSync, readFileSync, statSync, unlinkSync, } from "node:fs";
+import { VaultLockError } from "./session-vault-errors.js";
+/** Max time a writer will wait to acquire the file lock before giving up. */
+export const LOCK_TIMEOUT_MS = 5_000;
+/** Poll interval when waiting on a held lock. */
+export const LOCK_RETRY_INTERVAL_MS = 25;
+/** Stale-lock threshold — if a lock file is older than this, assume crash. */
+export const LOCK_STALE_MS = 30_000;
+/**
+ * Acquire an exclusive write lock via O_EXCL on `{vaultPath}.lock`. Yields
+ * the event loop between retries (no busy-spin) up to `LOCK_TIMEOUT_MS`.
+ * Locks older than `LOCK_STALE_MS` are considered orphaned (the holding
+ * process crashed) and stolen with a pid-verification handshake so two
+ * concurrent stealers can't both claim ownership.
+ *
+ * Returns a release function. Releasing is idempotent and swallows ENOENT
+ * (the lock file may have been stolen by another process after we already
+ * finished our critical section — that's fine; the lockfile, not the fd,
+ * is what matters).
+ */
+export async function acquireWriteLock(vaultPath) {
+    const lockPath = `${vaultPath}.lock`;
+    const deadline = Date.now() + LOCK_TIMEOUT_MS;
+    const ourPid = process.pid;
+    const ourToken = `${ourPid}`;
+    while (Date.now() < deadline) {
+        // Attempt the happy path: create-exclusive.
+        try {
+            const fd = openSync(lockPath, "wx");
+            try {
+                // Write our pid so stale-lock stealing can verify ownership.
+                writeFileSync(lockPath, ourToken);
+            }
+            catch {
+                // Best-effort; even if we can't write pid, we still hold the lock.
+            }
+            // closeSync can throw on exotic filesystems; the lockfile — not the fd —
+            // is what matters, so swallow errors here. The release closure unlinks
+            // the file regardless (M2).
+            try {
+                closeSync(fd);
+            }
+            catch {
+                // Non-fatal.
+            }
+            return () => {
+                try {
+                    unlinkSync(lockPath);
+                }
+                catch {
+                    // Lock file may have been removed by stale-lock stealing in another
+                    // process; ignore — our critical section is over regardless.
+                }
+            };
+        }
+        catch (err) {
+            if (err.code !== "EEXIST")
+                throw err;
+            // EEXIST: someone holds it. Check for staleness.
+            try {
+                const lockStat = statSync(lockPath);
+                if (Date.now() - lockStat.mtimeMs > LOCK_STALE_MS) {
+                    // Stale. Steal with a write-and-verify handshake so two racing
+                    // stealers can't both claim ownership. Whoever's token survives
+                    // the read-back wins.
+                    try {
+                        unlinkSync(lockPath);
+                    }
+                    catch {
+                        // Another process may have already stolen it; loop and retry.
+                        continue;
+                    }
+                    try {
+                        const fd = openSync(lockPath, "wx");
+                        try {
+                            writeFileSync(lockPath, ourToken);
+                        }
+                        catch {
+                            // Non-fatal; proceed to verification.
+                        }
+                        try {
+                            closeSync(fd);
+                        }
+                        catch {
+                            // Non-fatal.
+                        }
+                        // Verification: read back and confirm our token is there. If a
+                        // racer wrote first we'll see their token and back off.
+                        try {
+                            const recorded = readFileSync(lockPath, "utf8").trim();
+                            if (recorded !== ourToken) {
+                                // We lost the steal race; loop and retry normally.
+                                continue;
+                            }
+                        }
+                        catch {
+                            // Read failed — treat as loss and retry.
+                            continue;
+                        }
+                        return () => {
+                            try {
+                                unlinkSync(lockPath);
+                            }
+                            catch {
+                                // Same rationale as happy-path release.
+                            }
+                        };
+                    }
+                    catch (stealErr) {
+                        if (stealErr.code === "EEXIST") {
+                            // Another process stole it between our unlink and open; retry.
+                            continue;
+                        }
+                        throw stealErr;
+                    }
+                }
+            }
+            catch {
+                // statSync failed — lock was just released, or racing cleanup.
+                // Fall through to sleep-and-retry.
+            }
+            // Held by a non-stale writer. Yield the event loop — do NOT busy-spin
+            // (C1). This allows every other async task on this event loop to run
+            // while we wait.
+            await new Promise((resolve) => setTimeout(resolve, LOCK_RETRY_INTERVAL_MS));
+        }
+    }
+    throw new VaultLockError(`Timed out after ${LOCK_TIMEOUT_MS}ms waiting for vault write lock at ${lockPath}`);
+}
+//# sourceMappingURL=file-lock.js.map

package/dist/vault/file-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-lock.js","sourceRoot":"","sources":["../../src/vault/file-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,QAAQ,EACR,SAAS,EACT,aAAa,EACb,YAAY,EACZ,QAAQ,EACR,UAAU,GACX,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC;AAErC,iDAAiD;AACjD,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAEzC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC;AAEpC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,SAAiB;IACtD,MAAM,QAAQ,GAAG,GAAG,SAAS,OAAO,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAC3B,MAAM,QAAQ,GAAG,GAAG,MAAM,EAAE,CAAC;IAE7B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,4CAA4C;QAC5C,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC;gBACH,6DAA6D;gBAC7D,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;YACrE,CAAC;YACD,yEAAyE;YACzE,uEAAuE;YACvE,4BAA4B;YAC5B,IAAI,CAAC;gBACH,SAAS,CAAC,EAAE,CAAC,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,aAAa;YACf,CAAC;YACD,OAAO,GAAG,EAAE;gBACV,IAAI,CAAC;oBACH,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACvB,CAAC;gBAAC,MAAM,CAAC;oBACP,oEAAoE;oBACpE,6DAA6D;gBAC/D,CAAC;YACH,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;YAEhE,iDAAiD;YACjD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACpC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,GAAG,aAAa,EAAE,CAAC;oBAClD,+DAA+D;oBAC/D,gEAAgE;oBAChE,sBAAsB;oBACtB,IAAI,CAAC;wBACH,UAAU,CAAC,QAAQ,CAAC,CAAC;oBACvB,CAAC;oBAAC,MAAM,CAAC;wBACP,8DAA8D;wBAC9D,SAAS;oBACX,CAAC;oBACD,IAAI,CAAC;wBACH,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;wBACpC,IAAI,CAAC;4BACH,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;wBACpC,CAAC;wBAAC,MAAM,CAAC;4BACP,sCAAsC;wBACxC,CAAC;wBACD,IAAI,CAAC;4BACH,SAAS,CAAC,EAAE,CAAC,CAAC;wBAChB,CAAC;wBAAC,MAAM,CAAC;4BACP,aAAa;wBACf,CAAC;wBACD,+DAA+D;wBAC/D,wDAAwD;wBACxD,IAAI,CAAC;4BACH,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;4BACvD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gCAC1B,mDAAmD;gCACnD,SAAS;4BACX,CAAC;wBACH,CAAC;wBAAC,MAAM,CAAC;4BACP,yCAAyC;4BACzC,SAAS;wBACX,CAAC;wBACD,OAAO,GAAG,EAAE;4BACV,IAAI,CAAC;gCACH,UAAU,CAAC,QAAQ,CAAC,CAAC;4BACvB,CAAC;4BAAC,MAAM,CAAC;gCACP,wCAAwC;4BAC1C,CAAC;wBACH,CAAC,CAAC;oBACJ,CAAC;oBAAC,OAAO,QAAQ,EAAE,CAAC;wBAClB,IAAK,QAAkC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;4BAC1D,+DAA+D;4BAC/D,SAAS;wBACX,CAAC;wBACD,MAAM,QAAQ,CAAC;oBACjB,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,+DAA+D;gBAC/D,mCAAmC;YACrC,CAAC;YAED,sEAAsE;YACtE,qEAAqE;YACrE,iBAAiB;YACjB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAClC,UAAU,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAC5C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,cAAc,CACtB,mBAAmB,eAAe,sCAAsC,QAAQ,EAAE,CACnF,CAAC;AACJ,CAAC"}

package/dist/vault/session-vault-errors.d.ts

@@ -0,0 +1,38 @@
+/**
+ * SessionVault error classes — extracted so helper modules (file-lock,
+ * sidecar) can throw them without creating an import cycle back into
+ * session-vault.ts.
+ *
+ * Each subclass restores the prototype chain with `Object.setPrototypeOf`
+ * so `instanceof VaultError` etc. remains robust when the class is consumed
+ * across an ES transpile boundary (L2 — matches the EngramError pattern in
+ * `packages/sdk/src/errors.ts`).
+ */
+/** Base class for SessionVault errors. */
+export declare class VaultError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+/** Thrown when the master key can't be retrieved from the configured provider. */
+export declare class VaultUnlockError extends VaultError {
+    constructor(message: string);
+}
+/** Thrown when decryption fails — wrong key, corrupted file, or AAD mismatch. */
+export declare class VaultDecryptError extends VaultError {
+    constructor(message: string);
+}
+/** Thrown when rollback is detected and not explicitly accepted. */
+export declare class VaultRollbackError extends VaultError {
+    readonly expected: number;
+    readonly actual: number;
+    constructor(expected: number, actual: number);
+}
+/** Thrown when operations are attempted on a closed vault. */
+export declare class VaultClosedError extends VaultError {
+    constructor();
+}
+/** Thrown when the write-path file lock can't be acquired within the timeout. */
+export declare class VaultLockError extends VaultError {
+    constructor(message: string);
+}
+//# sourceMappingURL=session-vault-errors.d.ts.map

package/dist/vault/session-vault-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-vault-errors.d.ts","sourceRoot":"","sources":["../../src/vault/session-vault-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,0CAA0C;AAC1C,qBAAa,UAAW,SAAQ,KAAK;aACP,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1D;AAED,kFAAkF;AAClF,qBAAa,gBAAiB,SAAQ,UAAU;gBAClC,OAAO,EAAE,MAAM;CAK5B;AAED,iFAAiF;AACjF,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,OAAO,EAAE,MAAM;CAK5B;AAED,oEAAoE;AACpE,qBAAa,kBAAmB,SAAQ,UAAU;aAE9B,QAAQ,EAAE,MAAM;aAChB,MAAM,EAAE,MAAM;gBADd,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM;CAWjC;AAED,8DAA8D;AAC9D,qBAAa,gBAAiB,SAAQ,UAAU;;CAM/C;AAED,iFAAiF;AACjF,qBAAa,cAAe,SAAQ,UAAU;gBAChC,OAAO,EAAE,MAAM;CAK5B"}

package/dist/vault/session-vault-errors.js

@@ -0,0 +1,67 @@
+/**
+ * SessionVault error classes — extracted so helper modules (file-lock,
+ * sidecar) can throw them without creating an import cycle back into
+ * session-vault.ts.
+ *
+ * Each subclass restores the prototype chain with `Object.setPrototypeOf`
+ * so `instanceof VaultError` etc. remains robust when the class is consumed
+ * across an ES transpile boundary (L2 — matches the EngramError pattern in
+ * `packages/sdk/src/errors.ts`).
+ */
+/** Base class for SessionVault errors. */
+export class VaultError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "VaultError";
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/** Thrown when the master key can't be retrieved from the configured provider. */
+export class VaultUnlockError extends VaultError {
+    constructor(message) {
+        super("VAULT_UNLOCK_FAILED", message);
+        this.name = "VaultUnlockError";
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/** Thrown when decryption fails — wrong key, corrupted file, or AAD mismatch. */
+export class VaultDecryptError extends VaultError {
+    constructor(message) {
+        super("VAULT_DECRYPT_FAILED", message);
+        this.name = "VaultDecryptError";
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/** Thrown when rollback is detected and not explicitly accepted. */
+export class VaultRollbackError extends VaultError {
+    expected;
+    actual;
+    constructor(expected, actual) {
+        super("VAULT_VERSION_ROLLBACK_DETECTED", `Vault version rollback detected: sidecar expects version >= ${expected}, ` +
+            `but vault file reports version ${actual}. If this is an intentional ` +
+            `restore, pass { acceptRollback: true } to openVault().`);
+        this.expected = expected;
+        this.actual = actual;
+        this.name = "VaultRollbackError";
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/** Thrown when operations are attempted on a closed vault. */
+export class VaultClosedError extends VaultError {
+    constructor() {
+        super("VAULT_CLOSED", "Vault has been closed; reopen with openVault() to continue.");
+        this.name = "VaultClosedError";
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/** Thrown when the write-path file lock can't be acquired within the timeout. */
+export class VaultLockError extends VaultError {
+    constructor(message) {
+        super("VAULT_LOCK_FAILED", message);
+        this.name = "VaultLockError";
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+//# sourceMappingURL=session-vault-errors.js.map

package/dist/vault/session-vault-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-vault-errors.js","sourceRoot":"","sources":["../../src/vault/session-vault-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,0CAA0C;AAC1C,MAAM,OAAO,UAAW,SAAQ,KAAK;IACP;IAA5B,YAA4B,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QADW,SAAI,GAAJ,IAAI,CAAQ;QAEtC,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,oEAAoE;AACpE,MAAM,OAAO,kBAAmB,SAAQ,UAAU;IAE9B;IACA;IAFlB,YACkB,QAAgB,EAChB,MAAc;QAE9B,KAAK,CACH,iCAAiC,EACjC,+DAA+D,QAAQ,IAAI;YACzE,kCAAkC,MAAM,8BAA8B;YACtE,wDAAwD,CAC3D,CAAC;QARc,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;QAQ9B,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,8DAA8D;AAC9D,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAC9C;QACE,KAAK,CAAC,cAAc,EAAE,6DAA6D,CAAC,CAAC;QACrF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,OAAO,cAAe,SAAQ,UAAU;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF"}

package/dist/vault/session-vault.d.ts

@@ -0,0 +1,147 @@
+/**
+ * SessionVault — public session-backed envelope vault API.
+ *
+ * Opens the CLI's encrypted vault file once per session (one KeyProvider
+ * prompt), caches the decrypted contents in RAM, and serves reads without
+ * further prompts. External writes (e.g. the CLI in another shell) become
+ * visible via mtime-check coherence on every read.
+ *
+ * Addresses the per-item Keychain-prompt problem flagged in issue #40:
+ * long-running daemons (centient-labs/maintainer) holding N credentials
+ * across a long lifetime should not reach into the OS keychain on every
+ * access. Envelope encryption with a single master-key unlock matches
+ * industry standard (KMS, HashiCorp Vault, 1Password, Bitwarden).
+ *
+ * ## Threat model (what this protects and doesn't)
+ *
+ * - Protects against filesystem-read-only adversaries (ciphertext is AEAD
+ *   encrypted; forging plaintext requires the master key).
+ * - Protects against live-session and cold-start vault-file rollback by a
+ *   filesystem-write-only adversary via the combined in-payload
+ *   `vaultVersion` + sidecar-file `highestSeenVersion` scheme.
+ * - Does NOT protect against an adversary with **both** master-key access
+ *   and filesystem write — game over for any local envelope vault.
+ * - Does NOT protect against an adversary with write access to the vault
+ *   directory who chooses to downgrade both vault and sidecar in lockstep
+ *   — the sidecar lives next to the vault. If your threat model includes
+ *   adversarial writes to `~/.centient/secrets/`, use a secrets service
+ *   with remote attestation (HashiCorp Vault, AWS Secrets Manager,
+ *   1Password Connect) instead.
+ * - Session key is in process RAM for the full session lifetime. Any code
+ *   with execution in the process has access to all secrets in the vault.
+ *   Operators running daemons with this API SHOULD disable core dumps
+ *   (`ulimit -c 0` / `prlimit --core=0`) and disable the Node.js inspector
+ *   (`NODE_OPTIONS=--inspect` grants heap read to anyone on the inspector
+ *   socket — a full master-key compromise vector).
+ * - On macOS, a newly-started process will still prompt the user for
+ *   Keychain access even if another process holds the vault open.
+ *   Keychain ACLs are per-process, not per-vault-file.
+ */
+import type { KeyProviderType } from "../key-providers/types.js";
+import { VaultError, VaultUnlockError, VaultDecryptError, VaultRollbackError, VaultClosedError, VaultLockError } from "./session-vault-errors.js";
+export { VaultError, VaultUnlockError, VaultDecryptError, VaultRollbackError, VaultClosedError, VaultLockError, };
+/** Current payload schema version — bump requires a compat migration. */
+export declare const VAULT_SCHEMA_VERSION = 1;
+/** Default vault file location — same path the CLI uses, so they share state. */
+export declare const DEFAULT_VAULT_PATH: string;
+/** Default sidecar location — stores highest-ever-seen vault version. */
+export declare const DEFAULT_SIDECAR_PATH: string;
+/**
+ * AAD prefix — static byte header mixed into the vault ciphertext's
+ * Additional Authenticated Data. Binding this prefix into AAD means a
+ * ciphertext from some other AES-GCM user with the same key cannot be
+ * substituted into the vault. Exported so test fixtures can produce AAD
+ * consistent with the real implementation without duplicating the constant.
+ */
+export declare const VAULT_AAD_PREFIX = "centient-secrets-vault";
+/**
+ * Coherence strategy governs how the open vault reconciles in-memory state
+ * with concurrent external writes to the vault file.
+ */
+export type CoherenceStrategy = "mtime-check" | "strict" | "best-effort";
+/** Options for {@link openVault}. All fields are optional. */
+export interface OpenVaultOptions {
+    /** Alternate vault file path. Defaults to the same path the CLI uses. */
+    path?: string;
+    /** Alternate sidecar path. Defaults to vault directory + `vault.seen-version`. */
+    sidecarPath?: string;
+    /**
+     * Coherence strategy for concurrent external writes. Default `mtime-check`:
+     * stat on every read; re-decrypt if mtime advanced. `strict` throws on stale
+     * snapshot. `best-effort` keeps the in-memory snapshot until `reload()`.
+     */
+    coherence?: CoherenceStrategy;
+    /**
+     * Opt-in acceptance of a detected rollback (sidecar version > vault version).
+     * Emits a scary warning on stderr. Use only when the operator explicitly
+     * intends to restore an older vault (backup restore, etc.).
+     */
+    acceptRollback?: boolean;
+    /**
+     * Opt-in acceptance of a missing sidecar. Default behaviour (`false`) is to
+     * **refuse** to open the vault when the sidecar is absent — this enforces
+     * the security invariant that rollback protection is always in effect.
+     * Pass `true` for legitimate first-use contexts (fresh install, test
+     * fixtures, post-migration) to auto-initialize `seenVersion = vaultVersion`
+     * with a stderr warning. See docs/session-vault.md §Missing sidecar.
+     */
+    acceptMissingSidecar?: boolean;
+    /**
+     * Optional auto-close TTL in milliseconds. Not set by default — daemons run
+     * forever; forced re-auth undoes the point of a session vault. Useful for
+     * short-lived script consumers that want defense-in-depth.
+     */
+    ttlMs?: number;
+}
+/**
+ * A long-lived handle to an unlocked vault. Construct with {@link openVault};
+ * close with {@link SessionVault.close}. Operations are async so policy
+ * `before` hooks can await (e.g. remote attestation).
+ */
+export interface SessionVault {
+    /** Read a secret by name. Returns null if the name isn't in the vault. */
+    get(name: string): Promise<string | null>;
+    /** List all secret names, optionally prefix-filtered. Sorted ascending. */
+    list(prefix?: string): Promise<string[]>;
+    /** Write a secret. Re-encrypts and saves the vault file atomically. */
+    set(name: string, value: string): Promise<void>;
+    /** Delete a secret. Returns true if the name existed and was removed. */
+    delete(name: string): Promise<boolean>;
+    /** Force an immediate reload from disk regardless of coherence strategy. */
+    reload(): Promise<void>;
+    /** Release the session key and in-memory state. No-op if already closed. */
+    close(): void;
+    /** Diagnostic — the KeyProvider that unlocked this session. */
+    readonly provider: KeyProviderType;
+    /** Diagnostic — absolute path of the vault file. */
+    readonly path: string;
+    /** Diagnostic — the current in-memory vault version. */
+    readonly vaultVersion: number;
+}
+/**
+ * Open an encrypted session vault.
+ *
+ * Resolves the configured {@link KeyProvider} to obtain the master key,
+ * decrypts the vault file bound to its resolved real path (symlink-aware),
+ * checks rollback detection via the sidecar, and returns a long-lived
+ * {@link SessionVault} handle that serves reads from memory.
+ *
+ * @param opts - {@link OpenVaultOptions}. All fields are optional; defaults
+ *   use the same paths the `centient secrets` CLI uses.
+ * @returns An open {@link SessionVault}. Call `close()` when done.
+ * @throws {@link VaultError} `VAULT_NOT_FOUND` when the vault file is absent.
+ * @throws {@link VaultUnlockError} when the KeyProvider cannot return a key.
+ * @throws {@link VaultDecryptError} when decryption fails (wrong key, AAD
+ *   mismatch, corrupted payload).
+ * @throws {@link VaultRollbackError} when the sidecar indicates a rollback
+ *   and `acceptRollback` is not set.
+ *
+ * @example
+ * ```ts
+ * const vault = await openVault({ ttlMs: 60_000 });
+ * const apiKey = await vault.get("openai-api-key");
+ * vault.close();
+ * ```
+ */
+export declare function openVault(opts?: OpenVaultOptions): Promise<SessionVault>;
+//# sourceMappingURL=session-vault.d.ts.map