@centient/secrets 0.6.0 → 0.8.0

package/dist/key-providers/index.js

@@ -1,4 +1,5 @@
-export { KeychainProvider } from "./keychain-provider.js";
+export { KeychainProvider, DEFAULT_KEYCHAIN_SERVICE, DEFAULT_KEYCHAIN_ACCOUNT, } from "./keychain-provider.js";
 export { OnePasswordProvider } from "./onepassword-provider.js";
+export { PassphraseProvider, DEFAULT_PASSPHRASE_KDF_PARAMS, DEFAULT_PASSPHRASE_VAULT_PATH, PASSPHRASE_KDF, PASSPHRASE_METADATA_VERSION, PASSPHRASE_SALT_LENGTH, PASSPHRASE_VERIFIER_ALGORITHM, PASSPHRASE_VERIFIER_CONTEXT, passphraseMetadataPathForVault, derivePassphraseKey, } from "./passphrase-provider.js";
 export { resolveKeyProvider, getProviderByType, loadConfig, saveSecretsConfig } from "./resolve.js";
 //# sourceMappingURL=index.js.map

package/dist/key-providers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/key-providers/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/key-providers/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,6BAA6B,EAC7B,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,EAC3B,8BAA8B,EAC9B,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAOlC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC"}

package/dist/key-providers/keychain-provider.d.ts

@@ -8,8 +8,38 @@
  * with the system Keychain, which prompts for Touch ID or system password.
  */
 import type { KeyProvider, KeyProviderType } from "./types.js";
+/**
+ * Default Keychain item coordinates. These are the historical values every
+ * consumer shared before per-consumer keys existed — keeping them as the
+ * defaults guarantees existing vaults keep opening with no options passed.
+ */
+export declare const DEFAULT_KEYCHAIN_SERVICE = "centient-vault";
+export declare const DEFAULT_KEYCHAIN_ACCOUNT = "vault-key";
+/**
+ * Per-consumer Keychain item coordinates.
+ *
+ * A consumer that wants its own master key (rather than sharing the global
+ * `centient-vault`/`vault-key` item with every other consumer on the machine)
+ * names its own Keychain item here — e.g. `{ service: "burnrate-vault" }`.
+ * Omitted fields fall back to the historical defaults so behaviour is
+ * byte-identical to before when no options are supplied.
+ */
+export interface KeychainProviderOptions {
+    /** Keychain service name. Defaults to {@link DEFAULT_KEYCHAIN_SERVICE}. */
+    service?: string;
+    /** Keychain account name. Defaults to {@link DEFAULT_KEYCHAIN_ACCOUNT}. */
+    account?: string;
+}
 export declare class KeychainProvider implements KeyProvider {
     readonly name: KeyProviderType;
+    private readonly service;
+    private readonly account;
+    /**
+     * @param options - Optional per-consumer Keychain item coordinates. With no
+     *   options the provider targets the historical `centient-vault`/`vault-key`
+     *   item, so existing vaults keep opening unchanged.
+     */
+    constructor(options?: KeychainProviderOptions);
     /** Returns true if running on macOS. */
     static detect(): boolean;
     getKey(): Buffer | null;

package/dist/key-providers/keychain-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keychain-provider.d.ts","sourceRoot":"","sources":["../../src/key-providers/keychain-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAa/D,qBAAa,gBAAiB,YAAW,WAAW;IAClD,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAc;IAE5C,wCAAwC;IACxC,MAAM,CAAC,MAAM,IAAI,OAAO;IAIxB,MAAM,IAAI,MAAM,GAAG,IAAI;IAIvB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAI9B,SAAS,IAAI,OAAO;CAGrB"}
+{"version":3,"file":"keychain-provider.d.ts","sourceRoot":"","sources":["../../src/key-providers/keychain-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAM/D;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,mBAAmB,CAAC;AACzD,eAAO,MAAM,wBAAwB,cAAc,CAAC;AAMpD;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAMD,qBAAa,gBAAiB,YAAW,WAAW;IAClD,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAc;IAE5C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IAEjC;;;;OAIG;gBACS,OAAO,GAAE,uBAA4B;IAKjD,wCAAwC;IACxC,MAAM,CAAC,MAAM,IAAI,OAAO;IAIxB,MAAM,IAAI,MAAM,GAAG,IAAI;IAIvB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAI9B,SAAS,IAAI,OAAO;CAGrB"}

package/dist/key-providers/keychain-provider.js

@@ -11,25 +11,41 @@ import { getKeyFromKeychain, storeKeyInKeychain, deleteFromKeychain, } from "../
 // =============================================================================
 // Constants
 // =============================================================================
-const KEYCHAIN_SERVICE = "centient-vault";
-const KEYCHAIN_ACCOUNT = "vault-key";
+/**
+ * Default Keychain item coordinates. These are the historical values every
+ * consumer shared before per-consumer keys existed — keeping them as the
+ * defaults guarantees existing vaults keep opening with no options passed.
+ */
+export const DEFAULT_KEYCHAIN_SERVICE = "centient-vault";
+export const DEFAULT_KEYCHAIN_ACCOUNT = "vault-key";
 // =============================================================================
 // Implementation
 // =============================================================================
 export class KeychainProvider {
     name = "keychain";
+    service;
+    account;
+    /**
+     * @param options - Optional per-consumer Keychain item coordinates. With no
+     *   options the provider targets the historical `centient-vault`/`vault-key`
+     *   item, so existing vaults keep opening unchanged.
+     */
+    constructor(options = {}) {
+        this.service = options.service ?? DEFAULT_KEYCHAIN_SERVICE;
+        this.account = options.account ?? DEFAULT_KEYCHAIN_ACCOUNT;
+    }
     /** Returns true if running on macOS. */
     static detect() {
         return process.platform === "darwin";
     }
     getKey() {
-        return getKeyFromKeychain(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+        return getKeyFromKeychain(this.service, this.account);
     }
     storeKey(key) {
-        return storeKeyInKeychain(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, key);
+        return storeKeyInKeychain(this.service, this.account, key);
     }
     deleteKey() {
-        return deleteFromKeychain(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+        return deleteFromKeychain(this.service, this.account);
     }
 }
 //# sourceMappingURL=keychain-provider.js.map

package/dist/key-providers/keychain-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"keychain-provider.js","sourceRoot":"","sources":["../../src/key-providers/keychain-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAGnC,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAC1C,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAErC,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,MAAM,OAAO,gBAAgB;IAClB,IAAI,GAAoB,UAAU,CAAC;IAE5C,wCAAwC;IACxC,MAAM,CAAC,MAAM;QACX,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACvC,CAAC;IAED,MAAM;QACJ,OAAO,kBAAkB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;IAChE,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,kBAAkB,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC;IAED,SAAS;QACP,OAAO,kBAAkB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;IAChE,CAAC;CACF"}
+{"version":3,"file":"keychain-provider.js","sourceRoot":"","sources":["../../src/key-providers/keychain-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAGnC,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,gBAAgB,CAAC;AACzD,MAAM,CAAC,MAAM,wBAAwB,GAAG,WAAW,CAAC;AAsBpD,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,MAAM,OAAO,gBAAgB;IAClB,IAAI,GAAoB,UAAU,CAAC;IAE3B,OAAO,CAAS;IAChB,OAAO,CAAS;IAEjC;;;;OAIG;IACH,YAAY,UAAmC,EAAE;QAC/C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,wBAAwB,CAAC;QAC3D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,wBAAwB,CAAC;IAC7D,CAAC;IAED,wCAAwC;IACxC,MAAM,CAAC,MAAM;QACX,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACvC,CAAC;IAED,MAAM;QACJ,OAAO,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IAED,SAAS;QACP,OAAO,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;CACF"}

package/dist/key-providers/passphrase-provider.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Key Provider — Passphrase
+ *
+ * Derives the vault encryption key from a human-entered passphrase using a
+ * per-vault salt. The passphrase and derived key are never persisted; only
+ * non-secret KDF metadata plus a verifier are written beside the vault.
+ */
+import type { KeyProvider, KeyProviderError, KeyProviderType } from "./types.js";
+export declare const PASSPHRASE_METADATA_VERSION = 1;
+export declare const PASSPHRASE_KDF: "scrypt";
+export declare const PASSPHRASE_VERIFIER_ALGORITHM: "hmac-sha256";
+export declare const PASSPHRASE_VERIFIER_CONTEXT = "centient-secrets-passphrase:v1";
+export declare const PASSPHRASE_SALT_LENGTH = 32;
+export declare const DEFAULT_PASSPHRASE_VAULT_PATH: string;
+export declare const DEFAULT_PASSPHRASE_KDF_PARAMS: PassphraseKdfParams;
+export interface PassphraseKdfParams {
+    /** scrypt CPU/memory cost parameter. */
+    N: number;
+    /** scrypt block size parameter. */
+    r: number;
+    /** scrypt parallelization parameter. */
+    p: number;
+    /** Derived key length in bytes. */
+    keyLength: number;
+    /** Node scrypt memory ceiling in bytes. */
+    maxmem: number;
+}
+export interface PassphraseMetadata {
+    version: typeof PASSPHRASE_METADATA_VERSION;
+    kdf: typeof PASSPHRASE_KDF;
+    params: PassphraseKdfParams;
+    salt: string;
+    verifier: {
+        algorithm: typeof PASSPHRASE_VERIFIER_ALGORITHM;
+        value: string;
+    };
+}
+export type PassphrasePrompt = (message: string) => string | null;
+export interface PassphraseProviderOptions {
+    /** Vault path used to derive the default metadata location. */
+    vaultPath?: string;
+    /** Explicit metadata file path; primarily useful for tests. */
+    metadataPath?: string;
+    /** Hidden prompt implementation; tests can inject a deterministic prompt. */
+    prompt?: PassphrasePrompt;
+    /** KDF params for setup; defaults are intentionally production-cost. */
+    params?: PassphraseKdfParams;
+}
+export declare function passphraseMetadataPathForVault(vaultPath: string): string;
+export declare class PassphraseProvider implements KeyProvider {
+    readonly name: KeyProviderType;
+    private readonly metadataPath;
+    private readonly prompt;
+    private readonly setupParams;
+    private lastError;
+    constructor(options?: PassphraseProviderOptions);
+    /** Returns true when a passphrase can be requested from this process. */
+    static detect(): boolean;
+    get metadataFile(): string;
+    getLastError(): KeyProviderError | null;
+    getKey(): Buffer | null;
+    /**
+     * Passphrase providers do not store caller-supplied random keys.
+     * Use setupKey() so the vault key is derived from the passphrase.
+     */
+    storeKey(_key: Buffer): boolean;
+    /**
+     * Initialize passphrase metadata and return the derived key for bootstrap
+     * encryption. Only salt, KDF params, and verifier are persisted.
+     */
+    setupKey(): Buffer | null;
+    deleteKey(): boolean;
+    private readMetadata;
+    private promptForPassphrase;
+    private clearLastError;
+    private setLastError;
+}
+export declare function derivePassphraseKey(passphrase: string, salt: Buffer, params?: PassphraseKdfParams): Buffer;
+//# sourceMappingURL=passphrase-provider.d.ts.map

package/dist/key-providers/passphrase-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passphrase-provider.d.ts","sourceRoot":"","sources":["../../src/key-providers/passphrase-provider.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAYH,OAAO,KAAK,EACV,WAAW,EACX,gBAAgB,EAChB,eAAe,EAChB,MAAM,YAAY,CAAC;AAMpB,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAC7C,eAAO,MAAM,cAAc,EAAG,QAAiB,CAAC;AAChD,eAAO,MAAM,6BAA6B,EAAG,aAAsB,CAAC;AACpE,eAAO,MAAM,2BAA2B,mCAAmC,CAAC;AAC5E,eAAO,MAAM,sBAAsB,KAAK,CAAC;AACzC,eAAO,MAAM,6BAA6B,QAKzC,CAAC;AAEF,eAAO,MAAM,6BAA6B,EAAE,mBAM3C,CAAC;AAMF,MAAM,WAAW,mBAAmB;IAClC,wCAAwC;IACxC,CAAC,EAAE,MAAM,CAAC;IACV,mCAAmC;IACnC,CAAC,EAAE,MAAM,CAAC;IACV,wCAAwC;IACxC,CAAC,EAAE,MAAM,CAAC;IACV,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,2BAA2B,CAAC;IAC5C,GAAG,EAAE,OAAO,cAAc,CAAC;IAC3B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE;QACR,SAAS,EAAE,OAAO,6BAA6B,CAAC;QAChD,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;AAElE,MAAM,WAAW,yBAAyB;IACxC,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,wEAAwE;IACxE,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B;AAMD,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAMxE;AAMD,qBAAa,kBAAmB,YAAW,WAAW;IACpD,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAgB;IAE9C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsB;IAClD,OAAO,CAAC,SAAS,CAAiC;gBAEtC,OAAO,GAAE,yBAA8B;IAQnD,yEAAyE;IACzE,MAAM,CAAC,MAAM,IAAI,OAAO;IAIxB,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,YAAY,IAAI,gBAAgB,GAAG,IAAI;IAIvC,MAAM,IAAI,MAAM,GAAG,IAAI;IAmCvB;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAQ/B;;;OAGG;IACH,QAAQ,IAAI,MAAM,GAAG,IAAI;IA8DzB,SAAS,IAAI,OAAO;IAcpB,OAAO,CAAC,YAAY;IA2BpB,OAAO,CAAC,mBAAmB;IAiB3B,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,YAAY;CAGrB;AAMD,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,mBAAmD,GAC1D,MAAM,CAOR"}

package/dist/key-providers/passphrase-provider.js

@@ -0,0 +1,298 @@
+/**
+ * Key Provider — Passphrase
+ *
+ * Derives the vault encryption key from a human-entered passphrase using a
+ * per-vault salt. The passphrase and derived key are never persisted; only
+ * non-secret KDF metadata plus a verifier are written beside the vault.
+ */
+import { mkdirSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
+import { dirname, basename, join } from "node:path";
+import { createHmac, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
+import { homedir } from "node:os";
+import { promptHiddenSync } from "../cli/hidden-prompt.js";
+// =============================================================================
+// Constants
+// =============================================================================
+export const PASSPHRASE_METADATA_VERSION = 1;
+export const PASSPHRASE_KDF = "scrypt";
+export const PASSPHRASE_VERIFIER_ALGORITHM = "hmac-sha256";
+export const PASSPHRASE_VERIFIER_CONTEXT = "centient-secrets-passphrase:v1";
+export const PASSPHRASE_SALT_LENGTH = 32;
+export const DEFAULT_PASSPHRASE_VAULT_PATH = join(homedir(), ".centient", "secrets", "vault.enc");
+export const DEFAULT_PASSPHRASE_KDF_PARAMS = {
+    N: 2 ** 17,
+    r: 8,
+    p: 1,
+    keyLength: 32,
+    maxmem: 192 * 1024 * 1024,
+};
+// =============================================================================
+// Path helpers
+// =============================================================================
+export function passphraseMetadataPathForVault(vaultPath) {
+    const name = basename(vaultPath);
+    const metadataName = name.endsWith(".enc")
+        ? `${name.slice(0, -".enc".length)}.passphrase.json`
+        : `${name}.passphrase.json`;
+    return join(dirname(vaultPath), metadataName);
+}
+// =============================================================================
+// Implementation
+// =============================================================================
+export class PassphraseProvider {
+    name = "passphrase";
+    metadataPath;
+    prompt;
+    setupParams;
+    lastError = null;
+    constructor(options = {}) {
+        this.metadataPath =
+            options.metadataPath ??
+                passphraseMetadataPathForVault(options.vaultPath ?? DEFAULT_PASSPHRASE_VAULT_PATH);
+        this.prompt = options.prompt ?? promptHiddenSync;
+        this.setupParams = options.params ?? DEFAULT_PASSPHRASE_KDF_PARAMS;
+    }
+    /** Returns true when a passphrase can be requested from this process. */
+    static detect() {
+        return process.stdin.isTTY === true;
+    }
+    get metadataFile() {
+        return this.metadataPath;
+    }
+    getLastError() {
+        return this.lastError;
+    }
+    getKey() {
+        this.clearLastError();
+        const metadata = this.readMetadata();
+        if (metadata === null)
+            return null;
+        const passphrase = this.promptForPassphrase("Vault passphrase: ");
+        if (passphrase === null)
+            return null;
+        const salt = Buffer.from(metadata.salt, "base64");
+        const expectedVerifier = Buffer.from(metadata.verifier.value, "base64");
+        let key;
+        try {
+            key = derivePassphraseKey(passphrase, salt, metadata.params);
+        }
+        catch (err) {
+            this.setLastError("KDF_FAILED", `Failed to derive passphrase key: ${err instanceof Error ? err.message : String(err)}`);
+            return null;
+        }
+        if (!verifyKey(key, expectedVerifier)) {
+            key.fill(0);
+            this.setLastError("PASSPHRASE_VERIFICATION_FAILED", "Passphrase verification failed. Check the passphrase for this vault and try again.");
+            return null;
+        }
+        return key;
+    }
+    /**
+     * Passphrase providers do not store caller-supplied random keys.
+     * Use setupKey() so the vault key is derived from the passphrase.
+     */
+    storeKey(_key) {
+        this.setLastError("UNSUPPORTED_OPERATION", "Passphrase provider derives the vault key from a typed passphrase and cannot store a caller-supplied key. Use setupKey() during vault initialization.");
+        return false;
+    }
+    /**
+     * Initialize passphrase metadata and return the derived key for bootstrap
+     * encryption. Only salt, KDF params, and verifier are persisted.
+     */
+    setupKey() {
+        this.clearLastError();
+        const passphrase = this.promptForPassphrase("Create vault passphrase: ");
+        if (passphrase === null)
+            return null;
+        if (passphrase.length === 0) {
+            this.setLastError("EMPTY_PASSPHRASE", "Passphrase cannot be empty.");
+            return null;
+        }
+        const confirmation = this.promptForPassphrase("Confirm vault passphrase: ");
+        if (confirmation === null)
+            return null;
+        if (passphrase !== confirmation) {
+            this.setLastError("PASSPHRASE_MISMATCH", "Passphrases did not match; passphrase metadata was not written.");
+            return null;
+        }
+        const salt = randomBytes(PASSPHRASE_SALT_LENGTH);
+        let key;
+        try {
+            key = derivePassphraseKey(passphrase, salt, this.setupParams);
+        }
+        catch (err) {
+            this.setLastError("KDF_FAILED", `Failed to derive passphrase key: ${err instanceof Error ? err.message : String(err)}`);
+            return null;
+        }
+        const metadata = {
+            version: PASSPHRASE_METADATA_VERSION,
+            kdf: PASSPHRASE_KDF,
+            params: { ...this.setupParams },
+            salt: salt.toString("base64"),
+            verifier: {
+                algorithm: PASSPHRASE_VERIFIER_ALGORITHM,
+                value: createVerifier(key).toString("base64"),
+            },
+        };
+        try {
+            mkdirSync(dirname(this.metadataPath), { recursive: true, mode: 0o700 });
+            writeFileSync(this.metadataPath, JSON.stringify(metadata, null, 2) + "\n", { encoding: "utf8", mode: 0o600 });
+        }
+        catch (err) {
+            key.fill(0);
+            this.setLastError("METADATA_WRITE_FAILED", `Failed to write passphrase metadata at ${this.metadataPath}: ${err instanceof Error ? err.message : String(err)}`);
+            return null;
+        }
+        return key;
+    }
+    deleteKey() {
+        this.clearLastError();
+        try {
+            rmSync(this.metadataPath, { force: true });
+            return true;
+        }
+        catch (err) {
+            this.setLastError("METADATA_DELETE_FAILED", `Failed to delete passphrase metadata at ${this.metadataPath}: ${err instanceof Error ? err.message : String(err)}`);
+            return false;
+        }
+    }
+    readMetadata() {
+        let parsed;
+        try {
+            parsed = JSON.parse(readFileSync(this.metadataPath, "utf8"));
+        }
+        catch (err) {
+            const notFound = isNotFoundError(err);
+            this.setLastError(notFound ? "METADATA_NOT_FOUND" : "METADATA_READ_FAILED", notFound
+                ? `Passphrase provider is not initialized for this vault. Run \`centient secrets init\` from an interactive terminal, or configure another secrets.provider.`
+                : `Failed to read passphrase metadata at ${this.metadataPath}: ${err instanceof Error ? err.message : String(err)}`);
+            return null;
+        }
+        const metadata = validateMetadata(parsed);
+        if (metadata === null) {
+            this.setLastError("METADATA_INVALID", `Passphrase metadata at ${this.metadataPath} is invalid or unsupported.`);
+            return null;
+        }
+        return metadata;
+    }
+    promptForPassphrase(message) {
+        try {
+            const value = this.prompt(message);
+            if (value === null) {
+                this.setLastError("PASSPHRASE_INTERRUPTED", "Passphrase entry was interrupted.");
+                return null;
+            }
+            return value;
+        }
+        catch (err) {
+            this.setLastError("PASSPHRASE_PROMPT_FAILED", err instanceof Error ? err.message : String(err));
+            return null;
+        }
+    }
+    clearLastError() {
+        this.lastError = null;
+    }
+    setLastError(code, message) {
+        this.lastError = { code, message };
+    }
+}
+// =============================================================================
+// Crypto helpers
+// =============================================================================
+export function derivePassphraseKey(passphrase, salt, params = DEFAULT_PASSPHRASE_KDF_PARAMS) {
+    return scryptSync(passphrase, salt, params.keyLength, {
+        N: params.N,
+        r: params.r,
+        p: params.p,
+        maxmem: params.maxmem,
+    });
+}
+function createVerifier(key) {
+    return createHmac("sha256", key)
+        .update(PASSPHRASE_VERIFIER_CONTEXT, "utf8")
+        .digest();
+}
+function verifyKey(key, expectedVerifier) {
+    const actualVerifier = createVerifier(key);
+    try {
+        return (actualVerifier.length === expectedVerifier.length &&
+            timingSafeEqual(actualVerifier, expectedVerifier));
+    }
+    finally {
+        actualVerifier.fill(0);
+    }
+}
+function validateMetadata(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return null;
+    }
+    const record = value;
+    if (record.version !== PASSPHRASE_METADATA_VERSION ||
+        record.kdf !== PASSPHRASE_KDF ||
+        typeof record.salt !== "string") {
+        return null;
+    }
+    const params = validateParams(record.params);
+    if (params === null)
+        return null;
+    const verifierRaw = record.verifier;
+    if (typeof verifierRaw !== "object" ||
+        verifierRaw === null ||
+        Array.isArray(verifierRaw)) {
+        return null;
+    }
+    const verifier = verifierRaw;
+    if (verifier.algorithm !== PASSPHRASE_VERIFIER_ALGORITHM ||
+        typeof verifier.value !== "string") {
+        return null;
+    }
+    const salt = Buffer.from(record.salt, "base64");
+    const verifierValue = Buffer.from(verifier.value, "base64");
+    if (salt.length < 16 || verifierValue.length !== 32)
+        return null;
+    return {
+        version: PASSPHRASE_METADATA_VERSION,
+        kdf: PASSPHRASE_KDF,
+        params,
+        salt: record.salt,
+        verifier: {
+            algorithm: PASSPHRASE_VERIFIER_ALGORITHM,
+            value: verifier.value,
+        },
+    };
+}
+function validateParams(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return null;
+    }
+    const record = value;
+    const params = {
+        N: Number(record.N),
+        r: Number(record.r),
+        p: Number(record.p),
+        keyLength: Number(record.keyLength),
+        maxmem: Number(record.maxmem),
+    };
+    if (!Number.isSafeInteger(params.N) ||
+        !Number.isSafeInteger(params.r) ||
+        !Number.isSafeInteger(params.p) ||
+        !Number.isSafeInteger(params.keyLength) ||
+        !Number.isSafeInteger(params.maxmem) ||
+        params.N <= 1 ||
+        !isPowerOfTwo(params.N) ||
+        params.r <= 0 ||
+        params.p <= 0 ||
+        params.keyLength !== 32 ||
+        params.maxmem <= 0) {
+        return null;
+    }
+    return params;
+}
+function isPowerOfTwo(value) {
+    return value >= 2 && Math.log2(value) % 1 === 0;
+}
+function isNotFoundError(err) {
+    return (err instanceof Error &&
+        err.code === "ENOENT");
+}
+//# sourceMappingURL=passphrase-provider.js.map

package/dist/key-providers/passphrase-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passphrase-provider.js","sourceRoot":"","sources":["../../src/key-providers/passphrase-provider.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,SAAS,EACT,YAAY,EACZ,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAO3D,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAC7C,MAAM,CAAC,MAAM,cAAc,GAAG,QAAiB,CAAC;AAChD,MAAM,CAAC,MAAM,6BAA6B,GAAG,aAAsB,CAAC;AACpE,MAAM,CAAC,MAAM,2BAA2B,GAAG,gCAAgC,CAAC;AAC5E,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AACzC,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAC/C,OAAO,EAAE,EACT,WAAW,EACX,SAAS,EACT,WAAW,CACZ,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAwB;IAChE,CAAC,EAAE,CAAC,IAAI,EAAE;IACV,CAAC,EAAE,CAAC;IACJ,CAAC,EAAE,CAAC;IACJ,SAAS,EAAE,EAAE;IACb,MAAM,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;CAC1B,CAAC;AA2CF,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF,MAAM,UAAU,8BAA8B,CAAC,SAAiB;IAC9D,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACxC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB;QACpD,CAAC,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC,CAAC;AAChD,CAAC;AAED,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,MAAM,OAAO,kBAAkB;IACpB,IAAI,GAAoB,YAAY,CAAC;IAE7B,YAAY,CAAS;IACrB,MAAM,CAAmB;IACzB,WAAW,CAAsB;IAC1C,SAAS,GAA4B,IAAI,CAAC;IAElD,YAAY,UAAqC,EAAE;QACjD,IAAI,CAAC,YAAY;YACf,OAAO,CAAC,YAAY;gBACpB,8BAA8B,CAAC,OAAO,CAAC,SAAS,IAAI,6BAA6B,CAAC,CAAC;QACrF,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,gBAAgB,CAAC;QACjD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,MAAM,IAAI,6BAA6B,CAAC;IACrE,CAAC;IAED,yEAAyE;IACzE,MAAM,CAAC,MAAM;QACX,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC;IACtC,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,MAAM;QACJ,IAAI,CAAC,cAAc,EAAE,CAAC;QAEtB,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAEnC,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;QAClE,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAErC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAClD,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAExE,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,YAAY,CACf,YAAY,EACZ,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACvF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,YAAY,CACf,gCAAgC,EAChC,oFAAoF,CACrF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,IAAY;QACnB,IAAI,CAAC,YAAY,CACf,uBAAuB,EACvB,uJAAuJ,CACxJ,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,QAAQ;QACN,IAAI,CAAC,cAAc,EAAE,CAAC;QAEtB,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,2BAA2B,CAAC,CAAC;QACzE,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,6BAA6B,CAAC,CAAC;YACrE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC5E,IAAI,YAAY,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;YAChC,IAAI,CAAC,YAAY,CACf,qBAAqB,EACrB,iEAAiE,CAClE,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,sBAAsB,CAAC,CAAC;QACjD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,YAAY,CACf,YAAY,EACZ,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACvF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAuB;YACnC,OAAO,EAAE,2BAA2B;YACpC,GAAG,EAAE,cAAc;YACnB,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE;YAC/B,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC7B,QAAQ,EAAE;gBACR,SAAS,EAAE,6BAA6B;gBACxC,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;aAC9C;SACF,CAAC;QAEF,IAAI,CAAC;YACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACxE,aAAa,CACX,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EACxC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAClC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,YAAY,CACf,uBAAuB,EACvB,0CAA0C,IAAI,CAAC,YAAY,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnH,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,SAAS;QACP,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,YAAY,CACf,wBAAwB,EACxB,2CAA2C,IAAI,CAAC,YAAY,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACpH,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,CAAC,YAAY,CACf,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,sBAAsB,EACxD,QAAQ;gBACN,CAAC,CAAC,2JAA2J;gBAC7J,CAAC,CAAC,yCAAyC,IAAI,CAAC,YAAY,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACtH,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,YAAY,CACf,kBAAkB,EAClB,0BAA0B,IAAI,CAAC,YAAY,6BAA6B,CACzE,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,mBAAmB,CAAC,OAAe;QACzC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,IAAI,CAAC,YAAY,CAAC,wBAAwB,EAAE,mCAAmC,CAAC,CAAC;gBACjF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,YAAY,CACf,0BAA0B,EAC1B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,cAAc;QACpB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;IAEO,YAAY,CAAC,IAAY,EAAE,OAAe;QAChD,IAAI,CAAC,SAAS,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACrC,CAAC;CACF;AAED,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,MAAM,UAAU,mBAAmB,CACjC,UAAkB,EAClB,IAAY,EACZ,SAA8B,6BAA6B;IAE3D,OAAO,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE;QACpD,CAAC,EAAE,MAAM,CAAC,CAAC;QACX,CAAC,EAAE,MAAM,CAAC,CAAC;QACX,CAAC,EAAE,MAAM,CAAC,CAAC;QACX,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC;SAC7B,MAAM,CAAC,2BAA2B,EAAE,MAAM,CAAC;SAC3C,MAAM,EAAE,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,gBAAwB;IACtD,MAAM,cAAc,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,OAAO,CACL,cAAc,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM;YACjD,eAAe,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAClD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IACE,MAAM,CAAC,OAAO,KAAK,2BAA2B;QAC9C,MAAM,CAAC,GAAG,KAAK,cAAc;QAC7B,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAC/B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEjC,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC;IACpC,IACE,OAAO,WAAW,KAAK,QAAQ;QAC/B,WAAW,KAAK,IAAI;QACpB,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,WAAsC,CAAC;IACxD,IACE,QAAQ,CAAC,SAAS,KAAK,6BAA6B;QACpD,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,EAClC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,aAAa,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAEjE,OAAO;QACL,OAAO,EAAE,2BAA2B;QACpC,GAAG,EAAE,cAAc;QACnB,MAAM;QACN,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE;YACR,SAAS,EAAE,6BAA6B;YACxC,KAAK,EAAE,QAAQ,CAAC,KAAK;SACtB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,MAAM,GAAwB;QAClC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACnB,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACnB,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;QACnC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;KAC9B,CAAC;IAEF,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/B,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/B,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/B,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC;QACvC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC;QACpC,MAAM,CAAC,CAAC,IAAI,CAAC;QACb,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;QACvB,MAAM,CAAC,CAAC,IAAI,CAAC;QACb,MAAM,CAAC,CAAC,IAAI,CAAC;QACb,MAAM,CAAC,SAAS,KAAK,EAAE;QACvB,MAAM,CAAC,MAAM,IAAI,CAAC,EAClB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,OAAO,CACL,GAAG,YAAY,KAAK;QACnB,GAA6B,CAAC,IAAI,KAAK,QAAQ,CACjD,CAAC;AACJ,CAAC"}

package/dist/key-providers/resolve.d.ts

@@ -7,9 +7,24 @@
  *
  * Resolution order:
  *   1. Explicit config (secrets.provider field) — use it; fail if unavailable
- *   2. Auto-detection — 1Password if `op` is available, else Keychain on macOS
+ *   2. Auto-detection — 1Password if `op` is available, else Keychain on macOS,
+ *      else passphrase when an interactive TTY is available
  */
+import type { KeychainProviderOptions } from "./keychain-provider.js";
 import type { KeyProvider, KeyProviderType, CentientConfig, SecretsConfig } from "./types.js";
+export interface ResolveKeyProviderOptions {
+    /** Vault path used by providers with per-vault metadata. */
+    vaultPath?: string;
+    /**
+     * Per-consumer Keychain item coordinates. When the resolved provider is the
+     * macOS Keychain, these name the Keychain item so a consumer can use its own
+     * master key (e.g. `{ service: "burnrate-vault" }`) instead of sharing the
+     * global `centient-vault`/`vault-key` item with every other consumer on the
+     * machine. Omitted/undefined fields fall back to the historical defaults,
+     * so the no-options path is byte-identical to before.
+     */
+    keychain?: KeychainProviderOptions;
+}
 /**
  * Load the global centient config file.
  * Returns an empty object if the file doesn't exist or is malformed.
@@ -27,7 +42,7 @@ export declare function saveSecretsConfig(secrets: SecretsConfig): boolean;
  * @returns An object with the resolved provider, or an error message
  *          if the explicitly configured provider is unavailable.
  */
-export declare function resolveKeyProvider(): {
+export declare function resolveKeyProvider(options?: ResolveKeyProviderOptions): {
     ok: true;
     provider: KeyProvider;
     method: "config" | "auto";
@@ -42,5 +57,5 @@ export declare function resolveKeyProvider(): {
  * Get a specific provider by type, regardless of config.
  * Used by the migrate command to construct source/target providers.
  */
-export declare function getProviderByType(type: KeyProviderType, config?: SecretsConfig): KeyProvider | null;
+export declare function getProviderByType(type: KeyProviderType, config?: SecretsConfig, options?: ResolveKeyProviderOptions): KeyProvider | null;
 //# sourceMappingURL=resolve.d.ts.map

package/dist/key-providers/resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/key-providers/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EACf,cAAc,EACd,aAAa,EACd,MAAM,YAAY,CAAC;AAYpB;;;GAGG;AACH,wBAAgB,UAAU,IAAI,cAAc,CAY3C;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAWjE;AAMD;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI;IACpC,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,WAAW,CAAC;IACtB,MAAM,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC3B,GAAG;IACF,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1C,CAWA;AAyFD;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,eAAe,EACrB,MAAM,CAAC,EAAE,aAAa,GACrB,WAAW,GAAG,IAAI,CAWpB"}
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/key-providers/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAGtE,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EACf,cAAc,EACd,aAAa,EACd,MAAM,YAAY,CAAC;AASpB,MAAM,WAAW,yBAAyB;IACxC,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC;AAMD;;;GAGG;AACH,wBAAgB,UAAU,IAAI,cAAc,CAY3C;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAWjE;AAMD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,yBAA8B,GAAG;IAC3E,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,WAAW,CAAC;IACtB,MAAM,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC3B,GAAG;IACF,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1C,CAWA;AAqHD;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,eAAe,EACrB,MAAM,CAAC,EAAE,aAAa,EACtB,OAAO,GAAE,yBAA8B,GACtC,WAAW,GAAG,IAAI,CAiBpB"}