@centient/secrets 0.5.0 → 0.7.0

package/dist/key-providers/passphrase-provider.js

@@ -0,0 +1,298 @@
+/**
+ * Key Provider — Passphrase
+ *
+ * Derives the vault encryption key from a human-entered passphrase using a
+ * per-vault salt. The passphrase and derived key are never persisted; only
+ * non-secret KDF metadata plus a verifier are written beside the vault.
+ */
+import { mkdirSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
+import { dirname, basename, join } from "node:path";
+import { createHmac, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
+import { homedir } from "node:os";
+import { promptHiddenSync } from "../cli/hidden-prompt.js";
+// =============================================================================
+// Constants
+// =============================================================================
+export const PASSPHRASE_METADATA_VERSION = 1;
+export const PASSPHRASE_KDF = "scrypt";
+export const PASSPHRASE_VERIFIER_ALGORITHM = "hmac-sha256";
+export const PASSPHRASE_VERIFIER_CONTEXT = "centient-secrets-passphrase:v1";
+export const PASSPHRASE_SALT_LENGTH = 32;
+export const DEFAULT_PASSPHRASE_VAULT_PATH = join(homedir(), ".centient", "secrets", "vault.enc");
+export const DEFAULT_PASSPHRASE_KDF_PARAMS = {
+    N: 2 ** 17,
+    r: 8,
+    p: 1,
+    keyLength: 32,
+    maxmem: 192 * 1024 * 1024,
+};
+// =============================================================================
+// Path helpers
+// =============================================================================
+export function passphraseMetadataPathForVault(vaultPath) {
+    const name = basename(vaultPath);
+    const metadataName = name.endsWith(".enc")
+        ? `${name.slice(0, -".enc".length)}.passphrase.json`
+        : `${name}.passphrase.json`;
+    return join(dirname(vaultPath), metadataName);
+}
+// =============================================================================
+// Implementation
+// =============================================================================
+export class PassphraseProvider {
+    name = "passphrase";
+    metadataPath;
+    prompt;
+    setupParams;
+    lastError = null;
+    constructor(options = {}) {
+        this.metadataPath =
+            options.metadataPath ??
+                passphraseMetadataPathForVault(options.vaultPath ?? DEFAULT_PASSPHRASE_VAULT_PATH);
+        this.prompt = options.prompt ?? promptHiddenSync;
+        this.setupParams = options.params ?? DEFAULT_PASSPHRASE_KDF_PARAMS;
+    }
+    /** Returns true when a passphrase can be requested from this process. */
+    static detect() {
+        return process.stdin.isTTY === true;
+    }
+    get metadataFile() {
+        return this.metadataPath;
+    }
+    getLastError() {
+        return this.lastError;
+    }
+    getKey() {
+        this.clearLastError();
+        const metadata = this.readMetadata();
+        if (metadata === null)
+            return null;
+        const passphrase = this.promptForPassphrase("Vault passphrase: ");
+        if (passphrase === null)
+            return null;
+        const salt = Buffer.from(metadata.salt, "base64");
+        const expectedVerifier = Buffer.from(metadata.verifier.value, "base64");
+        let key;
+        try {
+            key = derivePassphraseKey(passphrase, salt, metadata.params);
+        }
+        catch (err) {
+            this.setLastError("KDF_FAILED", `Failed to derive passphrase key: ${err instanceof Error ? err.message : String(err)}`);
+            return null;
+        }
+        if (!verifyKey(key, expectedVerifier)) {
+            key.fill(0);
+            this.setLastError("PASSPHRASE_VERIFICATION_FAILED", "Passphrase verification failed. Check the passphrase for this vault and try again.");
+            return null;
+        }
+        return key;
+    }
+    /**
+     * Passphrase providers do not store caller-supplied random keys.
+     * Use setupKey() so the vault key is derived from the passphrase.
+     */
+    storeKey(_key) {
+        this.setLastError("UNSUPPORTED_OPERATION", "Passphrase provider derives the vault key from a typed passphrase and cannot store a caller-supplied key. Use setupKey() during vault initialization.");
+        return false;
+    }
+    /**
+     * Initialize passphrase metadata and return the derived key for bootstrap
+     * encryption. Only salt, KDF params, and verifier are persisted.
+     */
+    setupKey() {
+        this.clearLastError();
+        const passphrase = this.promptForPassphrase("Create vault passphrase: ");
+        if (passphrase === null)
+            return null;
+        if (passphrase.length === 0) {
+            this.setLastError("EMPTY_PASSPHRASE", "Passphrase cannot be empty.");
+            return null;
+        }
+        const confirmation = this.promptForPassphrase("Confirm vault passphrase: ");
+        if (confirmation === null)
+            return null;
+        if (passphrase !== confirmation) {
+            this.setLastError("PASSPHRASE_MISMATCH", "Passphrases did not match; passphrase metadata was not written.");
+            return null;
+        }
+        const salt = randomBytes(PASSPHRASE_SALT_LENGTH);
+        let key;
+        try {
+            key = derivePassphraseKey(passphrase, salt, this.setupParams);
+        }
+        catch (err) {
+            this.setLastError("KDF_FAILED", `Failed to derive passphrase key: ${err instanceof Error ? err.message : String(err)}`);
+            return null;
+        }
+        const metadata = {
+            version: PASSPHRASE_METADATA_VERSION,
+            kdf: PASSPHRASE_KDF,
+            params: { ...this.setupParams },
+            salt: salt.toString("base64"),
+            verifier: {
+                algorithm: PASSPHRASE_VERIFIER_ALGORITHM,
+                value: createVerifier(key).toString("base64"),
+            },
+        };
+        try {
+            mkdirSync(dirname(this.metadataPath), { recursive: true, mode: 0o700 });
+            writeFileSync(this.metadataPath, JSON.stringify(metadata, null, 2) + "\n", { encoding: "utf8", mode: 0o600 });
+        }
+        catch (err) {
+            key.fill(0);
+            this.setLastError("METADATA_WRITE_FAILED", `Failed to write passphrase metadata at ${this.metadataPath}: ${err instanceof Error ? err.message : String(err)}`);
+            return null;
+        }
+        return key;
+    }
+    deleteKey() {
+        this.clearLastError();
+        try {
+            rmSync(this.metadataPath, { force: true });
+            return true;
+        }
+        catch (err) {
+            this.setLastError("METADATA_DELETE_FAILED", `Failed to delete passphrase metadata at ${this.metadataPath}: ${err instanceof Error ? err.message : String(err)}`);
+            return false;
+        }
+    }
+    readMetadata() {
+        let parsed;
+        try {
+            parsed = JSON.parse(readFileSync(this.metadataPath, "utf8"));
+        }
+        catch (err) {
+            const notFound = isNotFoundError(err);
+            this.setLastError(notFound ? "METADATA_NOT_FOUND" : "METADATA_READ_FAILED", notFound
+                ? `Passphrase provider is not initialized for this vault. Run \`centient secrets init\` from an interactive terminal, or configure another secrets.provider.`
+                : `Failed to read passphrase metadata at ${this.metadataPath}: ${err instanceof Error ? err.message : String(err)}`);
+            return null;
+        }
+        const metadata = validateMetadata(parsed);
+        if (metadata === null) {
+            this.setLastError("METADATA_INVALID", `Passphrase metadata at ${this.metadataPath} is invalid or unsupported.`);
+            return null;
+        }
+        return metadata;
+    }
+    promptForPassphrase(message) {
+        try {
+            const value = this.prompt(message);
+            if (value === null) {
+                this.setLastError("PASSPHRASE_INTERRUPTED", "Passphrase entry was interrupted.");
+                return null;
+            }
+            return value;
+        }
+        catch (err) {
+            this.setLastError("PASSPHRASE_PROMPT_FAILED", err instanceof Error ? err.message : String(err));
+            return null;
+        }
+    }
+    clearLastError() {
+        this.lastError = null;
+    }
+    setLastError(code, message) {
+        this.lastError = { code, message };
+    }
+}
+// =============================================================================
+// Crypto helpers
+// =============================================================================
+export function derivePassphraseKey(passphrase, salt, params = DEFAULT_PASSPHRASE_KDF_PARAMS) {
+    return scryptSync(passphrase, salt, params.keyLength, {
+        N: params.N,
+        r: params.r,
+        p: params.p,
+        maxmem: params.maxmem,
+    });
+}
+function createVerifier(key) {
+    return createHmac("sha256", key)
+        .update(PASSPHRASE_VERIFIER_CONTEXT, "utf8")
+        .digest();
+}
+function verifyKey(key, expectedVerifier) {
+    const actualVerifier = createVerifier(key);
+    try {
+        return (actualVerifier.length === expectedVerifier.length &&
+            timingSafeEqual(actualVerifier, expectedVerifier));
+    }
+    finally {
+        actualVerifier.fill(0);
+    }
+}
+function validateMetadata(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return null;
+    }
+    const record = value;
+    if (record.version !== PASSPHRASE_METADATA_VERSION ||
+        record.kdf !== PASSPHRASE_KDF ||
+        typeof record.salt !== "string") {
+        return null;
+    }
+    const params = validateParams(record.params);
+    if (params === null)
+        return null;
+    const verifierRaw = record.verifier;
+    if (typeof verifierRaw !== "object" ||
+        verifierRaw === null ||
+        Array.isArray(verifierRaw)) {
+        return null;
+    }
+    const verifier = verifierRaw;
+    if (verifier.algorithm !== PASSPHRASE_VERIFIER_ALGORITHM ||
+        typeof verifier.value !== "string") {
+        return null;
+    }
+    const salt = Buffer.from(record.salt, "base64");
+    const verifierValue = Buffer.from(verifier.value, "base64");
+    if (salt.length < 16 || verifierValue.length !== 32)
+        return null;
+    return {
+        version: PASSPHRASE_METADATA_VERSION,
+        kdf: PASSPHRASE_KDF,
+        params,
+        salt: record.salt,
+        verifier: {
+            algorithm: PASSPHRASE_VERIFIER_ALGORITHM,
+            value: verifier.value,
+        },
+    };
+}
+function validateParams(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return null;
+    }
+    const record = value;
+    const params = {
+        N: Number(record.N),
+        r: Number(record.r),
+        p: Number(record.p),
+        keyLength: Number(record.keyLength),
+        maxmem: Number(record.maxmem),
+    };
+    if (!Number.isSafeInteger(params.N) ||
+        !Number.isSafeInteger(params.r) ||
+        !Number.isSafeInteger(params.p) ||
+        !Number.isSafeInteger(params.keyLength) ||
+        !Number.isSafeInteger(params.maxmem) ||
+        params.N <= 1 ||
+        !isPowerOfTwo(params.N) ||
+        params.r <= 0 ||
+        params.p <= 0 ||
+        params.keyLength !== 32 ||
+        params.maxmem <= 0) {
+        return null;
+    }
+    return params;
+}
+function isPowerOfTwo(value) {
+    return value >= 2 && Math.log2(value) % 1 === 0;
+}
+function isNotFoundError(err) {
+    return (err instanceof Error &&
+        err.code === "ENOENT");
+}
+//# sourceMappingURL=passphrase-provider.js.map

package/dist/key-providers/passphrase-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passphrase-provider.js","sourceRoot":"","sources":["../../src/key-providers/passphrase-provider.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,SAAS,EACT,YAAY,EACZ,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAO3D,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAC7C,MAAM,CAAC,MAAM,cAAc,GAAG,QAAiB,CAAC;AAChD,MAAM,CAAC,MAAM,6BAA6B,GAAG,aAAsB,CAAC;AACpE,MAAM,CAAC,MAAM,2BAA2B,GAAG,gCAAgC,CAAC;AAC5E,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AACzC,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAC/C,OAAO,EAAE,EACT,WAAW,EACX,SAAS,EACT,WAAW,CACZ,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAwB;IAChE,CAAC,EAAE,CAAC,IAAI,EAAE;IACV,CAAC,EAAE,CAAC;IACJ,CAAC,EAAE,CAAC;IACJ,SAAS,EAAE,EAAE;IACb,MAAM,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;CAC1B,CAAC;AA2CF,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF,MAAM,UAAU,8BAA8B,CAAC,SAAiB;IAC9D,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACxC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB;QACpD,CAAC,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC,CAAC;AAChD,CAAC;AAED,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,MAAM,OAAO,kBAAkB;IACpB,IAAI,GAAoB,YAAY,CAAC;IAE7B,YAAY,CAAS;IACrB,MAAM,CAAmB;IACzB,WAAW,CAAsB;IAC1C,SAAS,GAA4B,IAAI,CAAC;IAElD,YAAY,UAAqC,EAAE;QACjD,IAAI,CAAC,YAAY;YACf,OAAO,CAAC,YAAY;gBACpB,8BAA8B,CAAC,OAAO,CAAC,SAAS,IAAI,6BAA6B,CAAC,CAAC;QACrF,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,gBAAgB,CAAC;QACjD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,MAAM,IAAI,6BAA6B,CAAC;IACrE,CAAC;IAED,yEAAyE;IACzE,MAAM,CAAC,MAAM;QACX,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC;IACtC,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,MAAM;QACJ,IAAI,CAAC,cAAc,EAAE,CAAC;QAEtB,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAEnC,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;QAClE,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAErC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAClD,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAExE,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,YAAY,CACf,YAAY,EACZ,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACvF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,YAAY,CACf,gCAAgC,EAChC,oFAAoF,CACrF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,IAAY;QACnB,IAAI,CAAC,YAAY,CACf,uBAAuB,EACvB,uJAAuJ,CACxJ,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,QAAQ;QACN,IAAI,CAAC,cAAc,EAAE,CAAC;QAEtB,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,2BAA2B,CAAC,CAAC;QACzE,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,6BAA6B,CAAC,CAAC;YACrE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC5E,IAAI,YAAY,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;YAChC,IAAI,CAAC,YAAY,CACf,qBAAqB,EACrB,iEAAiE,CAClE,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,sBAAsB,CAAC,CAAC;QACjD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,YAAY,CACf,YAAY,EACZ,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACvF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAuB;YACnC,OAAO,EAAE,2BAA2B;YACpC,GAAG,EAAE,cAAc;YACnB,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE;YAC/B,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC7B,QAAQ,EAAE;gBACR,SAAS,EAAE,6BAA6B;gBACxC,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;aAC9C;SACF,CAAC;QAEF,IAAI,CAAC;YACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACxE,aAAa,CACX,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EACxC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAClC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,YAAY,CACf,uBAAuB,EACvB,0CAA0C,IAAI,CAAC,YAAY,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnH,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,SAAS;QACP,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,YAAY,CACf,wBAAwB,EACxB,2CAA2C,IAAI,CAAC,YAAY,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACpH,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,CAAC,YAAY,CACf,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,sBAAsB,EACxD,QAAQ;gBACN,CAAC,CAAC,2JAA2J;gBAC7J,CAAC,CAAC,yCAAyC,IAAI,CAAC,YAAY,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACtH,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,YAAY,CACf,kBAAkB,EAClB,0BAA0B,IAAI,CAAC,YAAY,6BAA6B,CACzE,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,mBAAmB,CAAC,OAAe;QACzC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,IAAI,CAAC,YAAY,CAAC,wBAAwB,EAAE,mCAAmC,CAAC,CAAC;gBACjF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,YAAY,CACf,0BAA0B,EAC1B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,cAAc;QACpB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;IAEO,YAAY,CAAC,IAAY,EAAE,OAAe;QAChD,IAAI,CAAC,SAAS,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACrC,CAAC;CACF;AAED,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,MAAM,UAAU,mBAAmB,CACjC,UAAkB,EAClB,IAAY,EACZ,SAA8B,6BAA6B;IAE3D,OAAO,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE;QACpD,CAAC,EAAE,MAAM,CAAC,CAAC;QACX,CAAC,EAAE,MAAM,CAAC,CAAC;QACX,CAAC,EAAE,MAAM,CAAC,CAAC;QACX,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC;SAC7B,MAAM,CAAC,2BAA2B,EAAE,MAAM,CAAC;SAC3C,MAAM,EAAE,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,gBAAwB;IACtD,MAAM,cAAc,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,OAAO,CACL,cAAc,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM;YACjD,eAAe,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAClD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IACE,MAAM,CAAC,OAAO,KAAK,2BAA2B;QAC9C,MAAM,CAAC,GAAG,KAAK,cAAc;QAC7B,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAC/B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEjC,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC;IACpC,IACE,OAAO,WAAW,KAAK,QAAQ;QAC/B,WAAW,KAAK,IAAI;QACpB,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,WAAsC,CAAC;IACxD,IACE,QAAQ,CAAC,SAAS,KAAK,6BAA6B;QACpD,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,EAClC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,aAAa,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAEjE,OAAO;QACL,OAAO,EAAE,2BAA2B;QACpC,GAAG,EAAE,cAAc;QACnB,MAAM;QACN,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE;YACR,SAAS,EAAE,6BAA6B;YACxC,KAAK,EAAE,QAAQ,CAAC,KAAK;SACtB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,MAAM,GAAwB;QAClC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACnB,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACnB,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;QACnC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;KAC9B,CAAC;IAEF,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/B,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/B,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/B,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC;QACvC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC;QACpC,MAAM,CAAC,CAAC,IAAI,CAAC;QACb,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;QACvB,MAAM,CAAC,CAAC,IAAI,CAAC;QACb,MAAM,CAAC,CAAC,IAAI,CAAC;QACb,MAAM,CAAC,SAAS,KAAK,EAAE;QACvB,MAAM,CAAC,MAAM,IAAI,CAAC,EAClB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,OAAO,CACL,GAAG,YAAY,KAAK;QACnB,GAA6B,CAAC,IAAI,KAAK,QAAQ,CACjD,CAAC;AACJ,CAAC"}

package/dist/key-providers/resolve.d.ts

@@ -7,9 +7,14 @@
  *
  * Resolution order:
  *   1. Explicit config (secrets.provider field) — use it; fail if unavailable
- *   2. Auto-detection — 1Password if `op` is available, else Keychain on macOS
+ *   2. Auto-detection — 1Password if `op` is available, else Keychain on macOS,
+ *      else passphrase when an interactive TTY is available
  */
 import type { KeyProvider, KeyProviderType, CentientConfig, SecretsConfig } from "./types.js";
+export interface ResolveKeyProviderOptions {
+    /** Vault path used by providers with per-vault metadata. */
+    vaultPath?: string;
+}
 /**
  * Load the global centient config file.
  * Returns an empty object if the file doesn't exist or is malformed.
@@ -27,7 +32,7 @@ export declare function saveSecretsConfig(secrets: SecretsConfig): boolean;
  * @returns An object with the resolved provider, or an error message
  *          if the explicitly configured provider is unavailable.
  */
-export declare function resolveKeyProvider(): {
+export declare function resolveKeyProvider(options?: ResolveKeyProviderOptions): {
     ok: true;
     provider: KeyProvider;
     method: "config" | "auto";
@@ -42,5 +47,5 @@ export declare function resolveKeyProvider(): {
  * Get a specific provider by type, regardless of config.
  * Used by the migrate command to construct source/target providers.
  */
-export declare function getProviderByType(type: KeyProviderType, config?: SecretsConfig): KeyProvider | null;
+export declare function getProviderByType(type: KeyProviderType, config?: SecretsConfig, options?: ResolveKeyProviderOptions): KeyProvider | null;
 //# sourceMappingURL=resolve.d.ts.map

package/dist/key-providers/resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/key-providers/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EACf,cAAc,EACd,aAAa,EACd,MAAM,YAAY,CAAC;AAYpB;;;GAGG;AACH,wBAAgB,UAAU,IAAI,cAAc,CAY3C;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAWjE;AAMD;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI;IACpC,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,WAAW,CAAC;IACtB,MAAM,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC3B,GAAG;IACF,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1C,CAWA;AAyFD;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,eAAe,EACrB,MAAM,CAAC,EAAE,aAAa,GACrB,WAAW,GAAG,IAAI,CAWpB"}
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/key-providers/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAQH,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EACf,cAAc,EACd,aAAa,EACd,MAAM,YAAY,CAAC;AASpB,MAAM,WAAW,yBAAyB;IACxC,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD;;;GAGG;AACH,wBAAgB,UAAU,IAAI,cAAc,CAY3C;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAWjE;AAMD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,yBAA8B,GAAG;IAC3E,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,WAAW,CAAC;IACtB,MAAM,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC3B,GAAG;IACF,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1C,CAWA;AA6GD;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,eAAe,EACrB,MAAM,CAAC,EAAE,aAAa,EACtB,OAAO,GAAE,yBAA8B,GACtC,WAAW,GAAG,IAAI,CAepB"}

package/dist/key-providers/resolve.js

@@ -7,17 +7,20 @@
  *
  * Resolution order:
  *   1. Explicit config (secrets.provider field) — use it; fail if unavailable
- *   2. Auto-detection — 1Password if `op` is available, else Keychain on macOS
+ *   2. Auto-detection — 1Password if `op` is available, else Keychain on macOS,
+ *      else passphrase when an interactive TTY is available
  */
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs";
 import { join } from "path";
 import { homedir } from "os";
 import { KeychainProvider } from "./keychain-provider.js";
 import { OnePasswordProvider } from "./onepassword-provider.js";
+import { PassphraseProvider } from "./passphrase-provider.js";
 // =============================================================================
 // Constants
 // =============================================================================
 const CONFIG_PATH = join(homedir(), ".centient", "config.json");
+const SUPPORTED_PROVIDERS = "keychain, 1password, passphrase";
 // =============================================================================
 // Config I/O
 // =============================================================================
@@ -67,21 +70,21 @@ export function saveSecretsConfig(secrets) {
  * @returns An object with the resolved provider, or an error message
  *          if the explicitly configured provider is unavailable.
  */
-export function resolveKeyProvider() {
+export function resolveKeyProvider(options = {}) {
     const config = loadConfig();
     const secretsConfig = config.secrets;
     // Explicit config — honor it strictly
     if (secretsConfig?.provider) {
-        return resolveExplicit(secretsConfig.provider, secretsConfig);
+        return resolveExplicit(secretsConfig.provider, secretsConfig, options);
     }
     // Auto-detection fallback
-    return resolveAuto(secretsConfig);
+    return resolveAuto(secretsConfig, options);
 }
 /**
  * Resolve an explicitly configured provider.
  * Fails if the provider is not available on this system.
  */
-function resolveExplicit(type, config) {
+function resolveExplicit(type, config, options = {}) {
     switch (type) {
         case "keychain": {
             if (!KeychainProvider.detect()) {
@@ -115,12 +118,19 @@ function resolveExplicit(type, config) {
                 method: "config",
             };
         }
+        case "passphrase": {
+            return {
+                ok: true,
+                provider: new PassphraseProvider({ vaultPath: options.vaultPath }),
+                method: "config",
+            };
+        }
         default: {
             return {
                 ok: false,
                 error: {
                     code: "UNKNOWN_PROVIDER",
-                    message: `Unknown key provider "${type}". Supported: keychain, 1password.`,
+                    message: `Unknown key provider "${type}". Supported: ${SUPPORTED_PROVIDERS}.`,
                 },
             };
         }
@@ -128,9 +138,10 @@ function resolveExplicit(type, config) {
 }
 /**
  * Auto-detect the best available provider.
- * Prefers 1Password (enables headless), falls back to Keychain on macOS.
+ * Prefers 1Password (enables headless), falls back to Keychain on macOS,
+ * then passphrase for interactive headless/Linux operators.
  */
-function resolveAuto(config) {
+function resolveAuto(config, options = {}) {
     // Prefer 1Password if available (enables headless use case)
     if (OnePasswordProvider.detect()) {
         return {
@@ -143,13 +154,22 @@ function resolveAuto(config) {
     if (KeychainProvider.detect()) {
         return { ok: true, provider: new KeychainProvider(), method: "auto" };
     }
+    // Interactive fallback for headless/Linux hosts without OS key storage.
+    if (PassphraseProvider.detect()) {
+        return {
+            ok: true,
+            provider: new PassphraseProvider({ vaultPath: options.vaultPath }),
+            method: "auto",
+        };
+    }
     return {
         ok: false,
         error: {
             code: "NO_PROVIDER",
             message: "No key provider available. " +
                 "Install the 1Password CLI (`op`) for headless support, " +
-                "or run on macOS for Keychain support.",
+                "run on macOS for Keychain support, " +
+                "or run from an interactive terminal to use the passphrase provider.",
         },
     };
 }
@@ -157,7 +177,7 @@ function resolveAuto(config) {
  * Get a specific provider by type, regardless of config.
  * Used by the migrate command to construct source/target providers.
  */
-export function getProviderByType(type, config) {
+export function getProviderByType(type, config, options = {}) {
     switch (type) {
         case "keychain":
             return KeychainProvider.detect() ? new KeychainProvider() : null;
@@ -165,6 +185,10 @@ export function getProviderByType(type, config) {
             return OnePasswordProvider.detect()
                 ? new OnePasswordProvider(config?.onePassword)
                 : null;
+        case "passphrase":
+            return PassphraseProvider.detect()
+                ? new PassphraseProvider({ vaultPath: options.vaultPath })
+                : null;
         default:
             return null;
     }

package/dist/key-providers/resolve.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/key-providers/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAQhE,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;AAEhE,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,MAAwB,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAsB;IACtD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAmB,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;QACzC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB;IAQhC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC;IAErC,sCAAsC;IACtC,IAAI,aAAa,EAAE,QAAQ,EAAE,CAAC;QAC5B,OAAO,eAAe,CAAC,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAChE,CAAC;IAED,0BAA0B;IAC1B,OAAO,WAAW,CAAC,aAAa,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,IAAqB,EACrB,MAAsB;IAEtB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC/B,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE;wBACL,IAAI,EAAE,sBAAsB;wBAC5B,OAAO,EACL,6FAA6F;qBAChG;iBACF,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,gBAAgB,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC1E,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClC,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;gBACxD,MAAM,IAAI,GAAG,QAAQ;oBACnB,CAAC,CAAC,gFAAgF;oBAClF,CAAC,CAAC,6GAA6G,CAAC;gBAClH,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE;wBACL,IAAI,EAAE,sBAAsB;wBAC5B,OAAO,EAAE,6DAA6D,IAAI,EAAE;qBAC7E;iBACF,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,QAAQ,EAAE,IAAI,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC;gBACtD,MAAM,EAAE,QAAQ;aACjB,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACL,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,yBAAyB,IAAc,oCAAoC;iBACrF;aACF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAClB,MAAsB;IAEtB,4DAA4D;IAC5D,IAAI,mBAAmB,CAAC,MAAM,EAAE,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,IAAI,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC;YACtD,MAAM,EAAE,MAAM;SACf,CAAC;IACJ,CAAC;IAED,iCAAiC;IACjC,IAAI,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,gBAAgB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACxE,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE;YACL,IAAI,EAAE,aAAa;YACnB,OAAO,EACL,6BAA6B;gBAC7B,yDAAyD;gBACzD,uCAAuC;SAC1C;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAqB,EACrB,MAAsB;IAEtB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU;YACb,OAAO,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACnE,KAAK,WAAW;YACd,OAAO,mBAAmB,CAAC,MAAM,EAAE;gBACjC,CAAC,CAAC,IAAI,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC;gBAC9C,CAAC,CAAC,IAAI,CAAC;QACX;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/key-providers/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAQ9D,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;AAChE,MAAM,mBAAmB,GAAG,iCAAiC,CAAC;AAO9D,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,MAAwB,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAsB;IACtD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAmB,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;QACzC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAqC,EAAE;IAQxE,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC;IAErC,sCAAsC;IACtC,IAAI,aAAa,EAAE,QAAQ,EAAE,CAAC;QAC5B,OAAO,eAAe,CAAC,aAAa,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IACzE,CAAC;IAED,0BAA0B;IAC1B,OAAO,WAAW,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,IAAqB,EACrB,MAAsB,EACtB,UAAqC,EAAE;IAEvC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC/B,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE;wBACL,IAAI,EAAE,sBAAsB;wBAC5B,OAAO,EACL,6FAA6F;qBAChG;iBACF,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,gBAAgB,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC1E,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClC,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;gBACxD,MAAM,IAAI,GAAG,QAAQ;oBACnB,CAAC,CAAC,gFAAgF;oBAClF,CAAC,CAAC,6GAA6G,CAAC;gBAClH,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE;wBACL,IAAI,EAAE,sBAAsB;wBAC5B,OAAO,EAAE,6DAA6D,IAAI,EAAE;qBAC7E;iBACF,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,QAAQ,EAAE,IAAI,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC;gBACtD,MAAM,EAAE,QAAQ;aACjB,CAAC;QACJ,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,QAAQ,EAAE,IAAI,kBAAkB,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;gBAClE,MAAM,EAAE,QAAQ;aACjB,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACL,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,yBAAyB,IAAc,iBAAiB,mBAAmB,GAAG;iBACxF;aACF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAClB,MAAsB,EACtB,UAAqC,EAAE;IAEvC,4DAA4D;IAC5D,IAAI,mBAAmB,CAAC,MAAM,EAAE,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,IAAI,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC;YACtD,MAAM,EAAE,MAAM;SACf,CAAC;IACJ,CAAC;IAED,iCAAiC;IACjC,IAAI,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,gBAAgB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACxE,CAAC;IAED,wEAAwE;IACxE,IAAI,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;QAChC,OAAO;YACL,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,IAAI,kBAAkB,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;YAClE,MAAM,EAAE,MAAM;SACf,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE;YACL,IAAI,EAAE,aAAa;YACnB,OAAO,EACL,6BAA6B;gBAC7B,yDAAyD;gBACzD,qCAAqC;gBACrC,qEAAqE;SACxE;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAqB,EACrB,MAAsB,EACtB,UAAqC,EAAE;IAEvC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU;YACb,OAAO,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACnE,KAAK,WAAW;YACd,OAAO,mBAAmB,CAAC,MAAM,EAAE;gBACjC,CAAC,CAAC,IAAI,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC;gBAC9C,CAAC,CAAC,IAAI,CAAC;QACX,KAAK,YAAY;YACf,OAAO,kBAAkB,CAAC,MAAM,EAAE;gBAChC,CAAC,CAAC,IAAI,kBAAkB,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC1D,CAAC,CAAC,IAAI,CAAC;QACX;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/key-providers/types.d.ts

@@ -3,13 +3,18 @@
  *
  * Abstracts vault encryption key storage behind a provider interface.
  * Implementations retrieve/store the 32-byte AES-256-GCM key from
- * different backends (macOS Keychain, 1Password, etc.).
+ * different backends (macOS Keychain, 1Password, passphrase KDF, etc.).
  *
  * All methods return null/false on failure — never throw (consistent
  * with vault-common.ts conventions).
  */
 /** Supported key provider backends. */
-export type KeyProviderType = "keychain" | "1password";
+export type KeyProviderType = "keychain" | "1password" | "passphrase";
+/** Optional diagnostic exposed after a provider returns null/false. */
+export interface KeyProviderError {
+    code: string;
+    message: string;
+}
 /**
  * Interface for vault encryption key storage providers.
  *
@@ -34,12 +39,25 @@ export interface KeyProvider {
      * @returns true on success, false on failure.
      */
     storeKey(key: Buffer): boolean;
+    /**
+     * Optional provider-specific setup that returns the key to use for vault
+     * bootstrap encryption. Providers that derive keys rather than store
+     * caller-supplied random keys should implement this instead of storing key.
+     */
+    setupKey?(): Buffer | null;
     /**
      * Delete the stored vault encryption key.
      *
      * @returns true if deleted (or did not exist), false on unexpected failure.
      */
     deleteKey(): boolean;
+    /**
+     * Optional diagnostic for the most recent null/false result.
+     *
+     * This preserves the non-throwing provider contract while allowing callers
+     * to surface clear auth failures such as wrong passphrase or non-TTY prompt.
+     */
+    getLastError?(): KeyProviderError | null;
 }
 /** 1Password-specific configuration. */
 export interface OnePasswordConfig {

package/dist/key-providers/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/key-providers/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,uCAAuC;AACvC,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,WAAW,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAE/B;;;;OAIG;IACH,MAAM,IAAI,MAAM,GAAG,IAAI,CAAC;IAExB;;;;;;;OAOG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAE/B;;;;OAIG;IACH,SAAS,IAAI,OAAO,CAAC;CACtB;AAMD,wCAAwC;AACxC,MAAM,WAAW,iBAAiB;IAChC,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,iEAAiE;AACjE,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,mCAAmC;IACnC,WAAW,CAAC,EAAE,iBAAiB,CAAC;CACjC;AAED,sDAAsD;AACtD,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/key-providers/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,uCAAuC;AACvC,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,WAAW,GAAG,YAAY,CAAC;AAEtE,uEAAuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAE/B;;;;OAIG;IACH,MAAM,IAAI,MAAM,GAAG,IAAI,CAAC;IAExB;;;;;;;OAOG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAE/B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,MAAM,GAAG,IAAI,CAAC;IAE3B;;;;OAIG;IACH,SAAS,IAAI,OAAO,CAAC;IAErB;;;;;OAKG;IACH,YAAY,CAAC,IAAI,gBAAgB,GAAG,IAAI,CAAC;CAC1C;AAMD,wCAAwC;AACxC,MAAM,WAAW,iBAAiB;IAChC,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,iEAAiE;AACjE,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,mCAAmC;IACnC,WAAW,CAAC,EAAE,iBAAiB,CAAC;CACjC;AAED,sDAAsD;AACtD,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB"}

package/dist/key-providers/types.js

@@ -3,7 +3,7 @@
  *
  * Abstracts vault encryption key storage behind a provider interface.
  * Implementations retrieve/store the 32-byte AES-256-GCM key from
- * different backends (macOS Keychain, 1Password, etc.).
+ * different backends (macOS Keychain, 1Password, passphrase KDF, etc.).
  *
  * All methods return null/false on failure — never throw (consistent
  * with vault-common.ts conventions).

package/dist/vault/file-lock.d.ts

@@ -0,0 +1,33 @@
+/**
+ * File lock — native exclusive advisory lock for vault writes.
+ *
+ * Extracted from session-vault.ts (M3) so session-vault remains focused on
+ * orchestration. The lock itself is filesystem-level (O_EXCL create on a
+ * `.lock` file) and cooperative: it only protects against writers that call
+ * `acquireWriteLock` before mutating.
+ *
+ * The lock file contains the holding process's PID so stale-lock stealing can
+ * distinguish "our PID still owns it" from "the previous holder crashed." On
+ * steal we write-and-verify to avoid two racing processes both thinking they
+ * stole the same stale lock (M2).
+ */
+/** Max time a writer will wait to acquire the file lock before giving up. */
+export declare const LOCK_TIMEOUT_MS = 5000;
+/** Poll interval when waiting on a held lock. */
+export declare const LOCK_RETRY_INTERVAL_MS = 25;
+/** Stale-lock threshold — if a lock file is older than this, assume crash. */
+export declare const LOCK_STALE_MS = 30000;
+/**
+ * Acquire an exclusive write lock via O_EXCL on `{vaultPath}.lock`. Yields
+ * the event loop between retries (no busy-spin) up to `LOCK_TIMEOUT_MS`.
+ * Locks older than `LOCK_STALE_MS` are considered orphaned (the holding
+ * process crashed) and stolen with a pid-verification handshake so two
+ * concurrent stealers can't both claim ownership.
+ *
+ * Returns a release function. Releasing is idempotent and swallows ENOENT
+ * (the lock file may have been stolen by another process after we already
+ * finished our critical section — that's fine; the lockfile, not the fd,
+ * is what matters).
+ */
+export declare function acquireWriteLock(vaultPath: string): Promise<() => void>;
+//# sourceMappingURL=file-lock.d.ts.map

package/dist/vault/file-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-lock.d.ts","sourceRoot":"","sources":["../../src/vault/file-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAaH,6EAA6E;AAC7E,eAAO,MAAM,eAAe,OAAQ,CAAC;AAErC,iDAAiD;AACjD,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC,8EAA8E;AAC9E,eAAO,MAAM,aAAa,QAAS,CAAC;AAEpC;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAwG7E"}