@centient/secrets 0.7.0 → 0.9.0

package/README.md

@@ -72,6 +72,56 @@ Provider auto-detection prefers OS-backed storage: 1Password, then Keychain,
 then passphrase as the last fallback. Set `secrets.provider: "passphrase"` in
 `~/.centient/config.json` to select it explicitly.
 
+### Per-consumer vault keys
+
+By default `KeychainProvider` targets a single shared Keychain item
+(`service="centient-vault"`, `account="vault-key"`), so every consumer on a
+machine unlocks its vault with the *same* master key. Two complementary options
+let each consumer use its own key (issue #80). Both are additive — with no
+options the behaviour is byte-identical to before, and existing vaults keep
+opening.
+
+**Name your own Keychain item** — the lightweight path. Pass `keychain` to
+`openVault()` (threaded into internal provider resolution) so your consumer's
+master key lives under its own Keychain item:
+
+```ts
+import { openVault } from "@centient/secrets";
+
+// Encrypts/decrypts this vault under the "burnrate-vault" Keychain item
+// instead of the global "centient-vault" item.
+const vault = await openVault({ keychain: { service: "burnrate-vault" } });
+```
+
+Or construct the provider directly:
+
+```ts
+import { KeychainProvider } from "@centient/secrets";
+
+const provider = new KeychainProvider({ service: "burnrate-vault", account: "k" });
+```
+
+**Inject your own provider** — full control, and the headless-testability path.
+Pass `keyProvider` and `openVault()` uses it verbatim, skipping internal
+resolution (config + auto-detection) entirely. This lets you drive `openVault()`
+in tests against a throwaway in-memory provider with no real Keychain:
+
+```ts
+import { openVault, type KeyProvider } from "@centient/secrets";
+
+const stub: KeyProvider = {
+  name: "keychain",
+  getKey: () => myTestMasterKey, // 32-byte Buffer
+  storeKey: () => true,
+  deleteKey: () => true,
+};
+
+const vault = await openVault({ keyProvider: stub });
+```
+
+A custom provider can also wrap any backend (remote KMS, HSM, env-injected key)
+as long as it implements the `KeyProvider` interface.
+
 ### Passphrase provider
 
 For hosts without an OS keychain or 1Password CLI (e.g. a headless Linux box

package/dist/index.d.ts

@@ -9,14 +9,15 @@ export { runSecrets } from "./cli/secrets-cli.js";
 export type { SecretsOptions } from "./cli/secrets-cli.js";
 export { getKeyFromKeychain, storeKeyInKeychain, storeStringInKeychain, getStringFromKeychain, deleteFromKeychain } from "./crypto/vault-common.js";
 export type { KeyProvider, KeyProviderError, KeyProviderType, OnePasswordConfig, SecretsConfig, CentientConfig } from "./key-providers/types.js";
-export { KeychainProvider } from "./key-providers/keychain-provider.js";
+export { KeychainProvider, DEFAULT_KEYCHAIN_SERVICE, DEFAULT_KEYCHAIN_ACCOUNT, } from "./key-providers/keychain-provider.js";
+export type { KeychainProviderOptions } from "./key-providers/keychain-provider.js";
 export { OnePasswordProvider } from "./key-providers/onepassword-provider.js";
 export { PassphraseProvider, DEFAULT_PASSPHRASE_KDF_PARAMS, DEFAULT_PASSPHRASE_VAULT_PATH, PASSPHRASE_KDF, PASSPHRASE_METADATA_VERSION, PASSPHRASE_SALT_LENGTH, PASSPHRASE_VERIFIER_ALGORITHM, PASSPHRASE_VERIFIER_CONTEXT, derivePassphraseKey, passphraseMetadataPathForVault, } from "./key-providers/passphrase-provider.js";
 export type { PassphraseKdfParams, PassphraseMetadata, PassphrasePrompt, PassphraseProviderOptions, } from "./key-providers/passphrase-provider.js";
 export { resolveKeyProvider, getProviderByType, loadConfig, saveSecretsConfig } from "./key-providers/resolve.js";
 export type { ResolveKeyProviderOptions } from "./key-providers/resolve.js";
 export { isValidKey } from "./vault/vault-utils.js";
-export { setSecretsPolicies, getActivePolicies, auditTrail } from "./vault/policy.js";
+export { setSecretsPolicies, getActivePolicies, auditTrail, rejectedEventType } from "./vault/policy.js";
 export type { SecretsPolicy, SecretsEvent, SecretsEventType, SecretsOperation, AuditTrailOptions } from "./vault/policy.js";
 export { openVault, VAULT_SCHEMA_VERSION, VAULT_AAD_PREFIX, DEFAULT_VAULT_PATH, DEFAULT_SIDECAR_PATH } from "./vault/session-vault.js";
 export { VaultError, VaultUnlockError, VaultDecryptError, VaultRollbackError, VaultClosedError, VaultLockError, } from "./vault/session-vault.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAG7F,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzI,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAGtF,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3I,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGhE,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAGhG,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG3D,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGpJ,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AACjJ,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,6BAA6B,EAC7B,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,EAC3B,mBAAmB,EACnB,8BAA8B,GAC/B,MAAM,wCAAwC,CAAC;AAChD,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAClH,YAAY,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAG5E,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGpD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACtF,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAM5H,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACvI,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,GACf,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAG7F,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzI,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAGtF,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3I,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGhE,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAGhG,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG3D,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGpJ,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AACjJ,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,6BAA6B,EAC7B,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,EAC3B,mBAAmB,EACnB,8BAA8B,GAC/B,MAAM,wCAAwC,CAAC;AAChD,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAClH,YAAY,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAG5E,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGpD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACzG,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAM5H,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACvI,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,GACf,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/index.js

@@ -12,14 +12,14 @@ export { getEnvironmentManager, EnvironmentManager } from "./environment/Environ
 export { runSecrets } from "./cli/secrets-cli.js";
 // Key storage helpers (legacy — prefer key-providers for vault key access)
 export { getKeyFromKeychain, storeKeyInKeychain, storeStringInKeychain, getStringFromKeychain, deleteFromKeychain } from "./crypto/vault-common.js";
-export { KeychainProvider } from "./key-providers/keychain-provider.js";
+export { KeychainProvider, DEFAULT_KEYCHAIN_SERVICE, DEFAULT_KEYCHAIN_ACCOUNT, } from "./key-providers/keychain-provider.js";
 export { OnePasswordProvider } from "./key-providers/onepassword-provider.js";
 export { PassphraseProvider, DEFAULT_PASSPHRASE_KDF_PARAMS, DEFAULT_PASSPHRASE_VAULT_PATH, PASSPHRASE_KDF, PASSPHRASE_METADATA_VERSION, PASSPHRASE_SALT_LENGTH, PASSPHRASE_VERIFIER_ALGORITHM, PASSPHRASE_VERIFIER_CONTEXT, derivePassphraseKey, passphraseMetadataPathForVault, } from "./key-providers/passphrase-provider.js";
 export { resolveKeyProvider, getProviderByType, loadConfig, saveSecretsConfig } from "./key-providers/resolve.js";
 // Validation
 export { isValidKey } from "./vault/vault-utils.js";
 // Policy
-export { setSecretsPolicies, getActivePolicies, auditTrail } from "./vault/policy.js";
+export { setSecretsPolicies, getActivePolicies, auditTrail, rejectedEventType } from "./vault/policy.js";
 // Session-backed vault (envelope encryption, single unlock per session)
 // Recommended for long-running processes (daemons) holding N credentials;
 // supersedes per-item `getCredential` calls for those consumers. See

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE7F,mBAAmB;AACnB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGzI,qBAAqB;AACrB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3I,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,yBAAyB;AACzB,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEhG,MAAM;AACN,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGlD,2EAA2E;AAC3E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAIpJ,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,6BAA6B,EAC7B,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,EAC3B,mBAAmB,EACnB,8BAA8B,GAC/B,MAAM,wCAAwC,CAAC;AAOhD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAGlH,aAAa;AACb,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,SAAS;AACT,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGtF,wEAAwE;AACxE,0EAA0E;AAC1E,qEAAqE;AACrE,6EAA6E;AAC7E,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACvI,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,GACf,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE7F,mBAAmB;AACnB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGzI,qBAAqB;AACrB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3I,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,yBAAyB;AACzB,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEhG,MAAM;AACN,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGlD,2EAA2E;AAC3E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAIpJ,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,6BAA6B,EAC7B,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,EAC3B,mBAAmB,EACnB,8BAA8B,GAC/B,MAAM,wCAAwC,CAAC;AAOhD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAGlH,aAAa;AACb,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,SAAS;AACT,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAGzG,wEAAwE;AACxE,0EAA0E;AAC1E,qEAAqE;AACrE,6EAA6E;AAC7E,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACvI,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,GACf,MAAM,0BAA0B,CAAC"}

package/dist/key-providers/index.d.ts

@@ -1,5 +1,6 @@
 export type { KeyProvider, KeyProviderError, KeyProviderType, OnePasswordConfig, SecretsConfig, CentientConfig } from "./types.js";
-export { KeychainProvider } from "./keychain-provider.js";
+export { KeychainProvider, DEFAULT_KEYCHAIN_SERVICE, DEFAULT_KEYCHAIN_ACCOUNT, } from "./keychain-provider.js";
+export type { KeychainProviderOptions } from "./keychain-provider.js";
 export { OnePasswordProvider } from "./onepassword-provider.js";
 export { PassphraseProvider, DEFAULT_PASSPHRASE_KDF_PARAMS, DEFAULT_PASSPHRASE_VAULT_PATH, PASSPHRASE_KDF, PASSPHRASE_METADATA_VERSION, PASSPHRASE_SALT_LENGTH, PASSPHRASE_VERIFIER_ALGORITHM, PASSPHRASE_VERIFIER_CONTEXT, passphraseMetadataPathForVault, derivePassphraseKey, } from "./passphrase-provider.js";
 export type { PassphraseKdfParams, PassphraseMetadata, PassphrasePrompt, PassphraseProviderOptions, } from "./passphrase-provider.js";

package/dist/key-providers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/key-providers/index.ts"],"names":[],"mappings":"AACA,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACnI,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,6BAA6B,EAC7B,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,EAC3B,8BAA8B,EAC9B,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACpG,YAAY,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/key-providers/index.ts"],"names":[],"mappings":"AACA,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACnI,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,6BAA6B,EAC7B,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,EAC3B,8BAA8B,EAC9B,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACpG,YAAY,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC"}

package/dist/key-providers/index.js

@@ -1,4 +1,4 @@
-export { KeychainProvider } from "./keychain-provider.js";
+export { KeychainProvider, DEFAULT_KEYCHAIN_SERVICE, DEFAULT_KEYCHAIN_ACCOUNT, } from "./keychain-provider.js";
 export { OnePasswordProvider } from "./onepassword-provider.js";
 export { PassphraseProvider, DEFAULT_PASSPHRASE_KDF_PARAMS, DEFAULT_PASSPHRASE_VAULT_PATH, PASSPHRASE_KDF, PASSPHRASE_METADATA_VERSION, PASSPHRASE_SALT_LENGTH, PASSPHRASE_VERIFIER_ALGORITHM, PASSPHRASE_VERIFIER_CONTEXT, passphraseMetadataPathForVault, derivePassphraseKey, } from "./passphrase-provider.js";
 export { resolveKeyProvider, getProviderByType, loadConfig, saveSecretsConfig } from "./resolve.js";

package/dist/key-providers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/key-providers/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,6BAA6B,EAC7B,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,EAC3B,8BAA8B,EAC9B,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAOlC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/key-providers/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,6BAA6B,EAC7B,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,EAC3B,8BAA8B,EAC9B,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAOlC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC"}

package/dist/key-providers/keychain-provider.d.ts

@@ -8,8 +8,38 @@
  * with the system Keychain, which prompts for Touch ID or system password.
  */
 import type { KeyProvider, KeyProviderType } from "./types.js";
+/**
+ * Default Keychain item coordinates. These are the historical values every
+ * consumer shared before per-consumer keys existed — keeping them as the
+ * defaults guarantees existing vaults keep opening with no options passed.
+ */
+export declare const DEFAULT_KEYCHAIN_SERVICE = "centient-vault";
+export declare const DEFAULT_KEYCHAIN_ACCOUNT = "vault-key";
+/**
+ * Per-consumer Keychain item coordinates.
+ *
+ * A consumer that wants its own master key (rather than sharing the global
+ * `centient-vault`/`vault-key` item with every other consumer on the machine)
+ * names its own Keychain item here — e.g. `{ service: "burnrate-vault" }`.
+ * Omitted fields fall back to the historical defaults so behaviour is
+ * byte-identical to before when no options are supplied.
+ */
+export interface KeychainProviderOptions {
+    /** Keychain service name. Defaults to {@link DEFAULT_KEYCHAIN_SERVICE}. */
+    service?: string;
+    /** Keychain account name. Defaults to {@link DEFAULT_KEYCHAIN_ACCOUNT}. */
+    account?: string;
+}
 export declare class KeychainProvider implements KeyProvider {
     readonly name: KeyProviderType;
+    private readonly service;
+    private readonly account;
+    /**
+     * @param options - Optional per-consumer Keychain item coordinates. With no
+     *   options the provider targets the historical `centient-vault`/`vault-key`
+     *   item, so existing vaults keep opening unchanged.
+     */
+    constructor(options?: KeychainProviderOptions);
     /** Returns true if running on macOS. */
     static detect(): boolean;
     getKey(): Buffer | null;

package/dist/key-providers/keychain-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keychain-provider.d.ts","sourceRoot":"","sources":["../../src/key-providers/keychain-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAa/D,qBAAa,gBAAiB,YAAW,WAAW;IAClD,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAc;IAE5C,wCAAwC;IACxC,MAAM,CAAC,MAAM,IAAI,OAAO;IAIxB,MAAM,IAAI,MAAM,GAAG,IAAI;IAIvB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAI9B,SAAS,IAAI,OAAO;CAGrB"}
+{"version":3,"file":"keychain-provider.d.ts","sourceRoot":"","sources":["../../src/key-providers/keychain-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAM/D;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,mBAAmB,CAAC;AACzD,eAAO,MAAM,wBAAwB,cAAc,CAAC;AAMpD;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAMD,qBAAa,gBAAiB,YAAW,WAAW;IAClD,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAc;IAE5C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IAEjC;;;;OAIG;gBACS,OAAO,GAAE,uBAA4B;IAKjD,wCAAwC;IACxC,MAAM,CAAC,MAAM,IAAI,OAAO;IAIxB,MAAM,IAAI,MAAM,GAAG,IAAI;IAIvB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAI9B,SAAS,IAAI,OAAO;CAGrB"}

package/dist/key-providers/keychain-provider.js

@@ -11,25 +11,41 @@ import { getKeyFromKeychain, storeKeyInKeychain, deleteFromKeychain, } from "../
 // =============================================================================
 // Constants
 // =============================================================================
-const KEYCHAIN_SERVICE = "centient-vault";
-const KEYCHAIN_ACCOUNT = "vault-key";
+/**
+ * Default Keychain item coordinates. These are the historical values every
+ * consumer shared before per-consumer keys existed — keeping them as the
+ * defaults guarantees existing vaults keep opening with no options passed.
+ */
+export const DEFAULT_KEYCHAIN_SERVICE = "centient-vault";
+export const DEFAULT_KEYCHAIN_ACCOUNT = "vault-key";
 // =============================================================================
 // Implementation
 // =============================================================================
 export class KeychainProvider {
     name = "keychain";
+    service;
+    account;
+    /**
+     * @param options - Optional per-consumer Keychain item coordinates. With no
+     *   options the provider targets the historical `centient-vault`/`vault-key`
+     *   item, so existing vaults keep opening unchanged.
+     */
+    constructor(options = {}) {
+        this.service = options.service ?? DEFAULT_KEYCHAIN_SERVICE;
+        this.account = options.account ?? DEFAULT_KEYCHAIN_ACCOUNT;
+    }
     /** Returns true if running on macOS. */
     static detect() {
         return process.platform === "darwin";
     }
     getKey() {
-        return getKeyFromKeychain(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+        return getKeyFromKeychain(this.service, this.account);
     }
     storeKey(key) {
-        return storeKeyInKeychain(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, key);
+        return storeKeyInKeychain(this.service, this.account, key);
     }
     deleteKey() {
-        return deleteFromKeychain(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+        return deleteFromKeychain(this.service, this.account);
     }
 }
 //# sourceMappingURL=keychain-provider.js.map

package/dist/key-providers/keychain-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"keychain-provider.js","sourceRoot":"","sources":["../../src/key-providers/keychain-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAGnC,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAC1C,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAErC,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,MAAM,OAAO,gBAAgB;IAClB,IAAI,GAAoB,UAAU,CAAC;IAE5C,wCAAwC;IACxC,MAAM,CAAC,MAAM;QACX,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACvC,CAAC;IAED,MAAM;QACJ,OAAO,kBAAkB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;IAChE,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,kBAAkB,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC;IAED,SAAS;QACP,OAAO,kBAAkB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;IAChE,CAAC;CACF"}
+{"version":3,"file":"keychain-provider.js","sourceRoot":"","sources":["../../src/key-providers/keychain-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAGnC,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,gBAAgB,CAAC;AACzD,MAAM,CAAC,MAAM,wBAAwB,GAAG,WAAW,CAAC;AAsBpD,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,MAAM,OAAO,gBAAgB;IAClB,IAAI,GAAoB,UAAU,CAAC;IAE3B,OAAO,CAAS;IAChB,OAAO,CAAS;IAEjC;;;;OAIG;IACH,YAAY,UAAmC,EAAE;QAC/C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,wBAAwB,CAAC;QAC3D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,wBAAwB,CAAC;IAC7D,CAAC;IAED,wCAAwC;IACxC,MAAM,CAAC,MAAM;QACX,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACvC,CAAC;IAED,MAAM;QACJ,OAAO,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IAED,SAAS;QACP,OAAO,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;CACF"}

package/dist/key-providers/resolve.d.ts

@@ -10,10 +10,20 @@
  *   2. Auto-detection — 1Password if `op` is available, else Keychain on macOS,
  *      else passphrase when an interactive TTY is available
  */
+import type { KeychainProviderOptions } from "./keychain-provider.js";
 import type { KeyProvider, KeyProviderType, CentientConfig, SecretsConfig } from "./types.js";
 export interface ResolveKeyProviderOptions {
     /** Vault path used by providers with per-vault metadata. */
     vaultPath?: string;
+    /**
+     * Per-consumer Keychain item coordinates. When the resolved provider is the
+     * macOS Keychain, these name the Keychain item so a consumer can use its own
+     * master key (e.g. `{ service: "burnrate-vault" }`) instead of sharing the
+     * global `centient-vault`/`vault-key` item with every other consumer on the
+     * machine. Omitted/undefined fields fall back to the historical defaults,
+     * so the no-options path is byte-identical to before.
+     */
+    keychain?: KeychainProviderOptions;
 }
 /**
  * Load the global centient config file.

package/dist/key-providers/resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/key-providers/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAQH,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EACf,cAAc,EACd,aAAa,EACd,MAAM,YAAY,CAAC;AASpB,MAAM,WAAW,yBAAyB;IACxC,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD;;;GAGG;AACH,wBAAgB,UAAU,IAAI,cAAc,CAY3C;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAWjE;AAMD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,yBAA8B,GAAG;IAC3E,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,WAAW,CAAC;IACtB,MAAM,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC3B,GAAG;IACF,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1C,CAWA;AA6GD;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,eAAe,EACrB,MAAM,CAAC,EAAE,aAAa,EACtB,OAAO,GAAE,yBAA8B,GACtC,WAAW,GAAG,IAAI,CAepB"}
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/key-providers/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAGtE,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EACf,cAAc,EACd,aAAa,EACd,MAAM,YAAY,CAAC;AASpB,MAAM,WAAW,yBAAyB;IACxC,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC;AAMD;;;GAGG;AACH,wBAAgB,UAAU,IAAI,cAAc,CAY3C;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAWjE;AAMD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,yBAA8B,GAAG;IAC3E,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,WAAW,CAAC;IACtB,MAAM,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC3B,GAAG;IACF,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1C,CAWA;AAqHD;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,eAAe,EACrB,MAAM,CAAC,EAAE,aAAa,EACtB,OAAO,GAAE,yBAA8B,GACtC,WAAW,GAAG,IAAI,CAiBpB"}

package/dist/key-providers/resolve.js

@@ -96,7 +96,11 @@ function resolveExplicit(type, config, options = {}) {
                     },
                 };
             }
-            return { ok: true, provider: new KeychainProvider(), method: "config" };
+            return {
+                ok: true,
+                provider: new KeychainProvider(options.keychain),
+                method: "config",
+            };
         }
         case "1password": {
             if (!OnePasswordProvider.detect()) {
@@ -152,7 +156,11 @@ function resolveAuto(config, options = {}) {
     }
     // Fall back to Keychain on macOS
     if (KeychainProvider.detect()) {
-        return { ok: true, provider: new KeychainProvider(), method: "auto" };
+        return {
+            ok: true,
+            provider: new KeychainProvider(options.keychain),
+            method: "auto",
+        };
     }
     // Interactive fallback for headless/Linux hosts without OS key storage.
     if (PassphraseProvider.detect()) {
@@ -180,7 +188,9 @@ function resolveAuto(config, options = {}) {
 export function getProviderByType(type, config, options = {}) {
     switch (type) {
         case "keychain":
-            return KeychainProvider.detect() ? new KeychainProvider() : null;
+            return KeychainProvider.detect()
+                ? new KeychainProvider(options.keychain)
+                : null;
         case "1password":
             return OnePasswordProvider.detect()
                 ? new OnePasswordProvider(config?.onePassword)

package/dist/key-providers/resolve.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/key-providers/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAQ9D,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;AAChE,MAAM,mBAAmB,GAAG,iCAAiC,CAAC;AAO9D,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,MAAwB,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAsB;IACtD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAmB,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;QACzC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAqC,EAAE;IAQxE,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC;IAErC,sCAAsC;IACtC,IAAI,aAAa,EAAE,QAAQ,EAAE,CAAC;QAC5B,OAAO,eAAe,CAAC,aAAa,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IACzE,CAAC;IAED,0BAA0B;IAC1B,OAAO,WAAW,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,IAAqB,EACrB,MAAsB,EACtB,UAAqC,EAAE;IAEvC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC/B,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE;wBACL,IAAI,EAAE,sBAAsB;wBAC5B,OAAO,EACL,6FAA6F;qBAChG;iBACF,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,gBAAgB,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC1E,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClC,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;gBACxD,MAAM,IAAI,GAAG,QAAQ;oBACnB,CAAC,CAAC,gFAAgF;oBAClF,CAAC,CAAC,6GAA6G,CAAC;gBAClH,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE;wBACL,IAAI,EAAE,sBAAsB;wBAC5B,OAAO,EAAE,6DAA6D,IAAI,EAAE;qBAC7E;iBACF,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,QAAQ,EAAE,IAAI,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC;gBACtD,MAAM,EAAE,QAAQ;aACjB,CAAC;QACJ,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,QAAQ,EAAE,IAAI,kBAAkB,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;gBAClE,MAAM,EAAE,QAAQ;aACjB,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACL,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,yBAAyB,IAAc,iBAAiB,mBAAmB,GAAG;iBACxF;aACF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAClB,MAAsB,EACtB,UAAqC,EAAE;IAEvC,4DAA4D;IAC5D,IAAI,mBAAmB,CAAC,MAAM,EAAE,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,IAAI,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC;YACtD,MAAM,EAAE,MAAM;SACf,CAAC;IACJ,CAAC;IAED,iCAAiC;IACjC,IAAI,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,gBAAgB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACxE,CAAC;IAED,wEAAwE;IACxE,IAAI,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;QAChC,OAAO;YACL,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,IAAI,kBAAkB,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;YAClE,MAAM,EAAE,MAAM;SACf,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE;YACL,IAAI,EAAE,aAAa;YACnB,OAAO,EACL,6BAA6B;gBAC7B,yDAAyD;gBACzD,qCAAqC;gBACrC,qEAAqE;SACxE;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAqB,EACrB,MAAsB,EACtB,UAAqC,EAAE;IAEvC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU;YACb,OAAO,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACnE,KAAK,WAAW;YACd,OAAO,mBAAmB,CAAC,MAAM,EAAE;gBACjC,CAAC,CAAC,IAAI,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC;gBAC9C,CAAC,CAAC,IAAI,CAAC;QACX,KAAK,YAAY;YACf,OAAO,kBAAkB,CAAC,MAAM,EAAE;gBAChC,CAAC,CAAC,IAAI,kBAAkB,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC1D,CAAC,CAAC,IAAI,CAAC;QACX;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/key-providers/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAQ9D,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;AAChE,MAAM,mBAAmB,GAAG,iCAAiC,CAAC;AAgB9D,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,MAAwB,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAsB;IACtD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAmB,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;QACzC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAqC,EAAE;IAQxE,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC;IAErC,sCAAsC;IACtC,IAAI,aAAa,EAAE,QAAQ,EAAE,CAAC;QAC5B,OAAO,eAAe,CAAC,aAAa,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IACzE,CAAC;IAED,0BAA0B;IAC1B,OAAO,WAAW,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,IAAqB,EACrB,MAAsB,EACtB,UAAqC,EAAE;IAEvC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC/B,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE;wBACL,IAAI,EAAE,sBAAsB;wBAC5B,OAAO,EACL,6FAA6F;qBAChG;iBACF,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,QAAQ,EAAE,IAAI,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAChD,MAAM,EAAE,QAAQ;aACjB,CAAC;QACJ,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClC,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;gBACxD,MAAM,IAAI,GAAG,QAAQ;oBACnB,CAAC,CAAC,gFAAgF;oBAClF,CAAC,CAAC,6GAA6G,CAAC;gBAClH,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE;wBACL,IAAI,EAAE,sBAAsB;wBAC5B,OAAO,EAAE,6DAA6D,IAAI,EAAE;qBAC7E;iBACF,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,QAAQ,EAAE,IAAI,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC;gBACtD,MAAM,EAAE,QAAQ;aACjB,CAAC;QACJ,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,QAAQ,EAAE,IAAI,kBAAkB,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;gBAClE,MAAM,EAAE,QAAQ;aACjB,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACL,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,yBAAyB,IAAc,iBAAiB,mBAAmB,GAAG;iBACxF;aACF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAClB,MAAsB,EACtB,UAAqC,EAAE;IAEvC,4DAA4D;IAC5D,IAAI,mBAAmB,CAAC,MAAM,EAAE,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,IAAI,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC;YACtD,MAAM,EAAE,MAAM;SACf,CAAC;IACJ,CAAC;IAED,iCAAiC;IACjC,IAAI,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9B,OAAO;YACL,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,IAAI,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC;YAChD,MAAM,EAAE,MAAM;SACf,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,IAAI,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;QAChC,OAAO;YACL,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,IAAI,kBAAkB,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;YAClE,MAAM,EAAE,MAAM;SACf,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE;YACL,IAAI,EAAE,aAAa;YACnB,OAAO,EACL,6BAA6B;gBAC7B,yDAAyD;gBACzD,qCAAqC;gBACrC,qEAAqE;SACxE;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAqB,EACrB,MAAsB,EACtB,UAAqC,EAAE;IAEvC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU;YACb,OAAO,gBAAgB,CAAC,MAAM,EAAE;gBAC9B,CAAC,CAAC,IAAI,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACxC,CAAC,CAAC,IAAI,CAAC;QACX,KAAK,WAAW;YACd,OAAO,mBAAmB,CAAC,MAAM,EAAE;gBACjC,CAAC,CAAC,IAAI,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC;gBAC9C,CAAC,CAAC,IAAI,CAAC;QACX,KAAK,YAAY;YACf,OAAO,kBAAkB,CAAC,MAAM,EAAE;gBAChC,CAAC,CAAC,IAAI,kBAAkB,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC1D,CAAC,CAAC,IAAI,CAAC;QACX;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/vault/policy.d.ts

@@ -8,8 +8,13 @@
  * stack described in ADR-002.
  *
  * Execution model:
- *   1. `before` hooks run top-to-bottom. If any throws, the operation
- *      is aborted and the error propagates to the caller.
+ *   1. `before` hooks run top-to-bottom. If one throws, the operation
+ *      is aborted and the error propagates to the caller — but the
+ *      `after` hooks of already-entered policies (those whose `before`
+ *      hook already completed) still fire with a `*_rejected` event, so
+ *      a policy-denied operation is audited rather than vanishing
+ *      (ADR-002 §1.0.0). The rejecting policy's own `after` hook does
+ *      not fire — its `before` hook did not complete.
  *   2. The backend operation executes.
  *   3. `after` hooks run bottom-to-top with a structured event
  *      describing the outcome. Exceptions in `after` hooks are
@@ -17,7 +22,7 @@
  *      failures must never break credential operations.
  */
 import type { VaultType } from "./types.js";
-export type SecretsEventType = "credential_read" | "credential_read_missing" | "credential_read_failed" | "credential_written" | "credential_write_failed" | "credential_deleted" | "credential_delete_failed" | "credential_enumerated" | "credential_enumerate_failed";
+export type SecretsEventType = "credential_read" | "credential_read_missing" | "credential_read_failed" | "credential_read_rejected" | "credential_written" | "credential_write_failed" | "credential_write_rejected" | "credential_deleted" | "credential_delete_failed" | "credential_delete_rejected" | "credential_enumerated" | "credential_enumerate_failed" | "credential_enumerate_rejected";
 export interface SecretsEvent {
     type: SecretsEventType;
     timestamp: string;
@@ -33,14 +38,40 @@ export interface SecretsOperation {
     key?: string;
     prefix?: string;
 }
+/**
+ * The audit event type emitted when a `before` hook rejects an
+ * operation. Single source of truth for the operation→`*_rejected`
+ * mapping, shared by the cascade vault and the session vault.
+ */
+export declare function rejectedEventType(op: SecretsOperation): SecretsEventType;
 export interface SecretsPolicy {
     readonly name: string;
+    /** `before` hooks may be async; they are awaited before the operation runs. */
     before?(op: SecretsOperation): void | Promise<void>;
+    /**
+     * `after` hooks MUST be synchronous (return type is `void`, not
+     * `Promise<void>`). The runner invokes them synchronously and catches
+     * only synchronous throws — a `Promise` returned from an `after` hook
+     * is not awaited, so its rejection would escape as an unhandled
+     * rejection rather than being swallowed with the one-time warning. Do
+     * audit I/O via a fire-and-forget sink the hook itself owns, or buffer
+     * and flush outside the hook.
+     */
     after?(event: SecretsEvent): void;
 }
 export declare function setSecretsPolicies(policies: SecretsPolicy[]): void;
 export declare function getActivePolicies(): readonly SecretsPolicy[];
-export declare function runBeforeHooks(op: SecretsOperation): Promise<void>;
+/**
+ * Run `before` hooks top-to-bottom. If a hook throws, the operation is
+ * rejected: the `after` hooks of the already-entered policies (indices
+ * `0..i-1`, bottom-to-top) fire with the event built by
+ * `makeRejectionEvent` so the denied operation is still audited, then the
+ * original error is re-thrown to abort the operation. The rejecting
+ * policy's own `after` hook is intentionally skipped — its `before` hook
+ * did not complete, so the policy was not fully entered. See ADR-002
+ * §1.0.0.
+ */
+export declare function runBeforeHooks(op: SecretsOperation, makeRejectionEvent: (error: string) => SecretsEvent): Promise<void>;
 export declare function runAfterHooks(event: SecretsEvent): void;
 export interface AuditTrailOptions {
     sink: (event: SecretsEvent) => void;

package/dist/vault/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/vault/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAM5C,MAAM,MAAM,gBAAgB,GACxB,iBAAiB,GACjB,yBAAyB,GACzB,wBAAwB,GACxB,oBAAoB,GACpB,yBAAyB,GACzB,oBAAoB,GACpB,0BAA0B,GAC1B,uBAAuB,GACvB,6BAA6B,CAAC;AAElC,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,gBAAgB,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,SAAS,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAMD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAMD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,CAAC,EAAE,EAAE,gBAAgB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,KAAK,CAAC,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAAC;CACnC;AASD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,IAAI,CAGlE;AAED,wBAAgB,iBAAiB,IAAI,SAAS,aAAa,EAAE,CAE5D;AAED,wBAAsB,cAAc,CAAC,EAAE,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAIxE;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAiBvD;AAMD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IACpC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,iBAAiB,GAAG,aAAa,CAejE"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/vault/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAM5C,MAAM,MAAM,gBAAgB,GACxB,iBAAiB,GACjB,yBAAyB,GACzB,wBAAwB,GACxB,0BAA0B,GAC1B,oBAAoB,GACpB,yBAAyB,GACzB,2BAA2B,GAC3B,oBAAoB,GACpB,0BAA0B,GAC1B,4BAA4B,GAC5B,uBAAuB,GACvB,6BAA6B,GAC7B,+BAA+B,CAAC;AAEpC,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,gBAAgB,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,SAAS,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAMD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,gBAAgB,GAAG,gBAAgB,CAiBxE;AAMD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,MAAM,CAAC,CAAC,EAAE,EAAE,gBAAgB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD;;;;;;;;OAQG;IACH,KAAK,CAAC,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAAC;CACnC;AASD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,IAAI,CAGlE;AAED,wBAAgB,iBAAiB,IAAI,SAAS,aAAa,EAAE,CAE5D;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,gBAAgB,EACpB,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,YAAY,GAClD,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAEvD;AAkCD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IACpC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,iBAAiB,GAAG,aAAa,CAejE"}

package/dist/vault/policy.js

@@ -8,14 +8,42 @@
  * stack described in ADR-002.
  *
  * Execution model:
- *   1. `before` hooks run top-to-bottom. If any throws, the operation
- *      is aborted and the error propagates to the caller.
+ *   1. `before` hooks run top-to-bottom. If one throws, the operation
+ *      is aborted and the error propagates to the caller — but the
+ *      `after` hooks of already-entered policies (those whose `before`
+ *      hook already completed) still fire with a `*_rejected` event, so
+ *      a policy-denied operation is audited rather than vanishing
+ *      (ADR-002 §1.0.0). The rejecting policy's own `after` hook does
+ *      not fire — its `before` hook did not complete.
  *   2. The backend operation executes.
  *   3. `after` hooks run bottom-to-top with a structured event
  *      describing the outcome. Exceptions in `after` hooks are
  *      swallowed with a one-time stderr warning — audit infrastructure
  *      failures must never break credential operations.
  */
+/**
+ * The audit event type emitted when a `before` hook rejects an
+ * operation. Single source of truth for the operation→`*_rejected`
+ * mapping, shared by the cascade vault and the session vault.
+ */
+export function rejectedEventType(op) {
+    switch (op.type) {
+        case "read":
+            return "credential_read_rejected";
+        case "write":
+            return "credential_write_rejected";
+        case "delete":
+            return "credential_delete_rejected";
+        case "enumerate":
+            return "credential_enumerate_rejected";
+        default: {
+            // Exhaustiveness guard: if a new SecretsOperation["type"] is added
+            // without a case here, this assignment fails to compile.
+            const unreachable = op.type;
+            throw new Error(`unhandled operation type: ${String(unreachable)}`);
+        }
+    }
+}
 // =============================================================================
 // Policy registry
 // =============================================================================
@@ -28,14 +56,45 @@ export function setSecretsPolicies(policies) {
 export function getActivePolicies() {
     return activePolicies;
 }
-export async function runBeforeHooks(op) {
-    for (const policy of activePolicies) {
-        if (policy.before)
+/**
+ * Run `before` hooks top-to-bottom. If a hook throws, the operation is
+ * rejected: the `after` hooks of the already-entered policies (indices
+ * `0..i-1`, bottom-to-top) fire with the event built by
+ * `makeRejectionEvent` so the denied operation is still audited, then the
+ * original error is re-thrown to abort the operation. The rejecting
+ * policy's own `after` hook is intentionally skipped — its `before` hook
+ * did not complete, so the policy was not fully entered. See ADR-002
+ * §1.0.0.
+ */
+export async function runBeforeHooks(op, makeRejectionEvent) {
+    for (let i = 0; i < activePolicies.length; i++) {
+        const policy = activePolicies[i];
+        if (!policy.before)
+            continue;
+        try {
             await policy.before(op);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            runAfterHooksForRange(makeRejectionEvent(msg), i - 1);
+            throw err;
+        }
     }
 }
 export function runAfterHooks(event) {
-    for (let i = activePolicies.length - 1; i >= 0; i--) {
+    runAfterHooksForRange(event, activePolicies.length - 1);
+}
+/**
+ * Run `after` hooks for policies `fromIndex..0` (bottom-to-top). A
+ * negative `fromIndex` is a no-op (no policy was entered). Synchronous
+ * hook exceptions are swallowed best-effort with a one-time stderr
+ * warning — audit-infrastructure failures must never break credential
+ * operations. `after` hooks are synchronous by contract (see
+ * `SecretsPolicy.after`); a hook that returns a rejected `Promise` is
+ * not awaited here, so it would surface as an unhandled rejection.
+ */
+function runAfterHooksForRange(event, fromIndex) {
+    for (let i = fromIndex; i >= 0; i--) {
         const policy = activePolicies[i];
         if (policy.after) {
             try {

package/dist/vault/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/vault/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAkDH,gFAAgF;AAChF,kBAAkB;AAClB,gFAAgF;AAEhF,IAAI,cAAc,GAAoB,EAAE,CAAC;AACzC,IAAI,mBAAmB,GAAG,KAAK,CAAC;AAEhC,MAAM,UAAU,kBAAkB,CAAC,QAAyB;IAC1D,cAAc,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC/B,mBAAmB,GAAG,KAAK,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAoB;IACvD,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,MAAM;YAAE,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAmB;IAC/C,KAAK,IAAI,CAAC,GAAG,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAE,CAAC;QAClC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBACzB,mBAAmB,GAAG,IAAI,CAAC;oBAC3B,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qBAAqB,MAAM,CAAC,IAAI,mCAAmC,GAAG,IAAI,CAC3E,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAWD,MAAM,UAAU,UAAU,CAAC,IAAuB;IAChD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;IAC/C,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,KAAK,CAAC,KAAmB;YACvB,IACE,CAAC,YAAY;gBACb,CAAC,KAAK,CAAC,IAAI,KAAK,iBAAiB;oBAC/B,KAAK,CAAC,IAAI,KAAK,yBAAyB,CAAC,EAC3C,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/vault/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AA4CH;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAoB;IACpD,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,0BAA0B,CAAC;QACpC,KAAK,OAAO;YACV,OAAO,2BAA2B,CAAC;QACrC,KAAK,QAAQ;YACX,OAAO,4BAA4B,CAAC;QACtC,KAAK,WAAW;YACd,OAAO,+BAA+B,CAAC;QACzC,OAAO,CAAC,CAAC,CAAC;YACR,mEAAmE;YACnE,yDAAyD;YACzD,MAAM,WAAW,GAAU,EAAE,CAAC,IAAI,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;AACH,CAAC;AAsBD,gFAAgF;AAChF,kBAAkB;AAClB,gFAAgF;AAEhF,IAAI,cAAc,GAAoB,EAAE,CAAC;AACzC,IAAI,mBAAmB,GAAG,KAAK,CAAC;AAEhC,MAAM,UAAU,kBAAkB,CAAC,QAAyB;IAC1D,cAAc,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC/B,mBAAmB,GAAG,KAAK,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAoB,EACpB,kBAAmD;IAEnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAE,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,SAAS;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,qBAAqB,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACtD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAmB;IAC/C,qBAAqB,CAAC,KAAK,EAAE,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAAC,KAAmB,EAAE,SAAiB;IACnE,KAAK,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAE,CAAC;QAClC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBACzB,mBAAmB,GAAG,IAAI,CAAC;oBAC3B,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qBAAqB,MAAM,CAAC,IAAI,mCAAmC,GAAG,IAAI,CAC3E,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAWD,MAAM,UAAU,UAAU,CAAC,IAAuB;IAChD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;IAC/C,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,KAAK,CAAC,KAAmB;YACvB,IACE,CAAC,YAAY;gBACb,CAAC,KAAK,CAAC,IAAI,KAAK,iBAAiB;oBAC/B,KAAK,CAAC,IAAI,KAAK,yBAAyB,CAAC,EAC3C,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/vault/session-vault.d.ts

@@ -37,7 +37,8 @@
  *   Keychain access even if another process holds the vault open.
  *   Keychain ACLs are per-process, not per-vault-file.
  */
-import type { KeyProviderType } from "../key-providers/types.js";
+import type { KeychainProviderOptions } from "../key-providers/keychain-provider.js";
+import type { KeyProvider, KeyProviderType } from "../key-providers/types.js";
 import { VaultError, VaultUnlockError, VaultDecryptError, VaultRollbackError, VaultClosedError, VaultLockError } from "./session-vault-errors.js";
 export { VaultError, VaultUnlockError, VaultDecryptError, VaultRollbackError, VaultClosedError, VaultLockError, };
 /** Current payload schema version — bump requires a compat migration. */
@@ -92,6 +93,35 @@ export interface OpenVaultOptions {
      * short-lived script consumers that want defense-in-depth.
      */
     ttlMs?: number;
+    /**
+     * Explicitly inject the {@link KeyProvider} that unlocks the vault. When
+     * provided, openVault() uses it directly and skips internal resolution
+     * (config file + auto-detection) entirely.
+     *
+     * Two use cases:
+     *   1. Headless testability — pass a throwaway in-memory/stub provider so
+     *      openVault() can be exercised without touching the real Keychain.
+     *   2. Full control — a consumer that constructs its own provider (e.g. a
+     *      `KeychainProvider({ service: "burnrate-vault" })`, a remote KMS
+     *      adapter) injects it wholesale instead of going through config.
+     *
+     * For the common "I just want my own Keychain item" case, prefer the
+     * lighter-weight {@link OpenVaultOptions.keychain} field, which names the
+     * Keychain item without requiring a whole provider.
+     */
+    keyProvider?: KeyProvider;
+    /**
+     * Per-consumer Keychain item coordinates, threaded into internal provider
+     * resolution. Lets a consumer name its own Keychain item (e.g.
+     * `{ service: "burnrate-vault" }`) so it gets its own master key instead of
+     * sharing the global `centient-vault`/`vault-key` item with every other
+     * consumer on the machine — without injecting a whole {@link KeyProvider}.
+     *
+     * Ignored when {@link OpenVaultOptions.keyProvider} is supplied (the injected
+     * provider owns its own storage coordinates). Omitted fields fall back to the
+     * historical defaults, so the no-options path is unchanged.
+     */
+    keychain?: KeychainProviderOptions;
 }
 /**
  * A long-lived handle to an unlocked vault. Construct with {@link openVault};

package/dist/vault/session-vault.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-vault.d.ts","sourceRoot":"","sources":["../../src/vault/session-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAiBH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAejE,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACf,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,GACf,CAAC;AAMF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,iFAAiF;AACjF,eAAO,MAAM,kBAAkB,QAAuD,CAAC;AAEvF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,QAKhC,CAAC;AAKF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,2BAA2B,CAAC;AA2BzD;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,aAAa,GAAG,QAAQ,GAAG,aAAa,CAAC;AAEzE,8DAA8D;AAC9D,MAAM,WAAW,gBAAgB;IAC/B,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,0EAA0E;IAC1E,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1C,2EAA2E;IAC3E,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,uEAAuE;IACvE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,yEAAyE;IACzE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,4EAA4E;IAC5E,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,4EAA4E;IAC5E,KAAK,IAAI,IAAI,CAAC;IACd,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AA2ED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,SAAS,CAAC,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,YAAY,CAAC,CAsJlF"}
+{"version":3,"file":"session-vault.d.ts","sourceRoot":"","sources":["../../src/vault/session-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAkBH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAgB9E,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACf,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,GACf,CAAC;AAMF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,iFAAiF;AACjF,eAAO,MAAM,kBAAkB,QAAuD,CAAC;AAEvF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,QAKhC,CAAC;AAKF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,2BAA2B,CAAC;AA2BzD;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,aAAa,GAAG,QAAQ,GAAG,aAAa,CAAC;AAEzE,8DAA8D;AAC9D,MAAM,WAAW,gBAAgB;IAC/B,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;OAeG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,0EAA0E;IAC1E,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1C,2EAA2E;IAC3E,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,uEAAuE;IACvE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,yEAAyE;IACzE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,4EAA4E;IAC5E,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,4EAA4E;IAC5E,KAAK,IAAI,IAAI,CAAC;IACd,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AA2ED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,SAAS,CAAC,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,YAAY,CAAC,CAmKlF"}

package/dist/vault/session-vault.js

@@ -43,7 +43,7 @@ import { homedir } from "node:os";
 import { createHash, randomBytes } from "node:crypto";
 import { encryptObject, decryptObject } from "../crypto/vault-common.js";
 import { resolveKeyProvider } from "../key-providers/resolve.js";
-import { runBeforeHooks, runAfterHooks, } from "./policy.js";
+import { runBeforeHooks, runAfterHooks, rejectedEventType, } from "./policy.js";
 import { acquireWriteLock } from "./file-lock.js";
 import { readSidecar, writeSidecar, checkSidecarPerms, VAULT_FILE_MODE, VAULT_DIR_MODE, } from "./sidecar.js";
 import { VaultError, VaultUnlockError, VaultDecryptError, VaultRollbackError, VaultClosedError, VaultLockError, } from "./session-vault-errors.js";
@@ -171,12 +171,27 @@ export async function openVault(opts = {}) {
     }
     checkVaultPerms(vaultPath);
     checkSidecarPerms(sidecarPath);
-    // --- Unlock via configured KeyProvider ---
-    const providerResult = resolveKeyProvider({ vaultPath });
-    if (!providerResult.ok) {
-        throw new VaultUnlockError(providerResult.error.message);
+    // --- Unlock via injected or configured KeyProvider ---
+    //
+    // An explicitly injected provider (opts.keyProvider) wins and bypasses
+    // internal resolution entirely — this is the headless-testability and
+    // full-control path. Otherwise resolve from config + auto-detection,
+    // threading per-consumer Keychain coordinates (opts.keychain) through so a
+    // consumer can name its own Keychain item without injecting a whole provider.
+    let provider;
+    if (opts.keyProvider !== undefined) {
+        provider = opts.keyProvider;
+    }
+    else {
+        const resolveOpts = { vaultPath };
+        if (opts.keychain !== undefined)
+            resolveOpts.keychain = opts.keychain;
+        const providerResult = resolveKeyProvider(resolveOpts);
+        if (!providerResult.ok) {
+            throw new VaultUnlockError(providerResult.error.message);
+        }
+        provider = providerResult.provider;
     }
-    const provider = providerResult.provider;
     const key = provider.getKey();
     if (!key) {
         const providerError = provider.getLastError?.();
@@ -465,7 +480,16 @@ function buildVault(args) {
      */
     const withAudit = async (op, successType, missingType, failType, fn, extras) => {
         assertOpen();
-        await runBeforeHooks(op);
+        const beforeStart = Date.now();
+        await runBeforeHooks(op, (error) => ({
+            type: rejectedEventType(op),
+            timestamp: new Date(beforeStart).toISOString(),
+            backend: "session-vault",
+            key: op.key,
+            prefix: op.prefix,
+            error,
+            durationMs: Date.now() - beforeStart,
+        }));
         // Re-check after the await — TTL or sibling close() could have fired
         // while before-hooks awaited (H2).
         assertOpen();

package/dist/vault/session-vault.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-vault.js","sourceRoot":"","sources":["../../src/vault/session-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EACL,UAAU,EACV,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEjE,OAAO,EACL,cAAc,EACd,aAAa,GAGd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EACL,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,GACf,MAAM,2BAA2B,CAAC;AAEnC,kEAAkE;AAClE,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,GACf,CAAC;AAEF,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,yEAAyE;AACzE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAEtC,iFAAiF;AACjF,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;AAEvF,yEAAyE;AACzE,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CACtC,OAAO,EAAE,EACT,WAAW,EACX,SAAS,EACT,oBAAoB,CACrB,CAAC;AAEF,0CAA0C;AAC1C,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AA8FzD,gFAAgF;AAChF,uCAAuC;AACvC,gFAAgF;AAEhF;;;;;;;;;;GAUG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,yEAAyE;QACzE,8BAA8B;QAC9B,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC;QACtE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;;;;;;;;GASG;AACH,SAAS,SAAS,CAAC,qBAA6B,EAAE,MAAc;IAC9D,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,GAAG,gBAAgB,KAAK,MAAM,IAAI,qBAAqB,EAAE,CAAC;SACjE,MAAM,EAAE,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,YAAY,GAAG,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC;QACrC,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iCAAiC,IAAI,uBAAuB;gBAC1D,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,kBAAkB;gBACnE,uBAAuB,IAAI,IAAI,CAClC,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;IACzD,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAyB,EAAE;IACzD,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,IAAI,kBAAkB,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,WAAW,CAC7B,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC,CACnE,CAAC;IACF,MAAM,SAAS,GAAsB,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC;IACrE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IAEzB,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,UAAU,CAClB,iBAAiB,EACjB,2BAA2B,SAAS,8CAA8C,CACnF,CAAC;IACJ,CAAC;IAED,eAAe,CAAC,SAAS,CAAC,CAAC;IAC3B,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAE/B,4CAA4C;IAC5C,MAAM,cAAc,GAAG,kBAAkB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,gBAAgB,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC;IACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,aAAa,GAAG,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC;QAChD,MAAM,IAAI,gBAAgB,CACxB,aAAa,EAAE,OAAO;YACpB,eAAe,QAAQ,CAAC,IAAI,gEAAgE,CAC/F,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAEvD,gCAAgC;IAChC,EAAE;IACF,yDAAyD;IACzD,qEAAqE;IACrE,wEAAwE;IACxE,2EAA2E;IAC3E,2EAA2E;IAC3E,kEAAkE;IAClE,4EAA4E;IAC5E,EAAE;IACF,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,kEAAkE;IAClE,2BAA2B;IAC3B,MAAM,YAAY,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,OAAO,GAAG,aAAa,CAAC,YAAY,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACpD,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,aAAa,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAChD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,GAAG,MAAM,CAAC;YACjB,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,iBAAiB,CACzB,8BAA8B,SAAS,iEAAiE,oBAAoB,qCAAqC,CAClK,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,oEAAoE;QACpE,0EAA0E;QAC1E,4DAA4D;QAC5D,IAAI,cAAc,IAAI,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,EAAE,CAAC;YAC7C,MAAM,OAAO,GAA2B,EAAE,CAAC;YAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7C,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;oBAC1B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACZ,MAAM,IAAI,iBAAiB,CACzB,wEAAwE,CAAC,kDAAkD,CAC5H,CAAC;gBACJ,CAAC;gBACD,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;YACD,OAAO,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;YAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,2DAA2D,SAAS,IAAI;gBACtE,+BAA+B,oBAAoB,oCAAoC,CAC1F,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,iBAAiB,CACzB,+EAA+E,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,iEAAiE;QACjE,oEAAoE;QACpE,qEAAqE;QACrE,qEAAqE;QACrE,EAAE;QACF,uEAAuE;QACvE,oEAAoE;QACpE,yEAAyE;QACzE,IAAI,IAAI,CAAC,oBAAoB,KAAK,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC1D,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,UAAU,CAClB,uBAAuB,EACvB,gBAAgB,WAAW,4CAA4C;gBACrE,kEAAkE;gBAClE,uEAAuE;gBACvE,iEAAiE;gBACjE,sEAAsE,CACzE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,4BAA4B,CAAC;QACxF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mCAAmC,WAAW,eAAe;YAC3D,iCAAiC,OAAO,CAAC,YAAY,QAAQ,MAAM,KAAK,CAC3E,CAAC;QACF,YAAY,CAAC,WAAW,EAAE,EAAE,kBAAkB,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC1E,CAAC;SAAM,IAAI,OAAO,CAAC,YAAY,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC7D,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACjC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,kBAAkB,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iEAAiE;YAC/D,GAAG,OAAO,CAAC,kBAAkB,YAAY,OAAO,CAAC,YAAY,IAAI;YACjE,8DAA8D;YAC9D,qBAAqB,CACxB,CAAC;QACF,YAAY,CAAC,WAAW,EAAE,EAAE,kBAAkB,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC1E,CAAC;SAAM,IAAI,OAAO,CAAC,YAAY,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC7D,YAAY,CAAC,WAAW,EAAE,EAAE,kBAAkB,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,UAAU,CAAC;QAChB,SAAS;QACT,WAAW;QACX,QAAQ,EAAE,QAAQ,CAAC,IAAuB;QAC1C,SAAS;QACT,GAAG;QACH,GAAG;QACH,cAAc,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE;QACtC,cAAc,EAAE,OAAO,CAAC,YAAY;QACpC,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAkBD,SAAS,UAAU,CAAC,IAAoB;IACtC,IAAI,GAAG,GAAkB,IAAI,CAAC,GAAG,CAAC;IAClC,IAAI,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC;IAClC,IAAI,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC;IACvC,4EAA4E;IAC5E,4EAA4E;IAC5E,+DAA+D;IAC/D,IAAI,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC;IAC/C,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,IAAI,QAAQ,GAA0B,IAAI,CAAC;IAC3C,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE;YACzB,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACf,QAAQ,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,MAAM,UAAU,GAAG,GAAS,EAAE;QAC5B,IAAI,MAAM,IAAI,GAAG,KAAK,IAAI;YAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;IAC3D,CAAC,CAAC;IAEF;;;;OAIG;IACH,MAAM,WAAW,GAAG,GAAS,EAAE;QAC7B,IAAI,IAAI,CAAC,SAAS,KAAK,aAAa;YAAE,OAAO;QAC7C,0EAA0E;QAC1E,2DAA2D;QAC3D,IAAI,EAA+B,CAAC;QACpC,IAAI,CAAC;YACH,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,MAAM,IAAI,UAAU,CAClB,oBAAoB,EACpB,cAAc,IAAI,CAAC,SAAS,0BAA0B,CACvD,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,EAAE,CAAC,OAAO,KAAK,OAAO;YAAE,OAAO;QACnC,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,EAAE,CAAC,OAAO,GAAG,OAAO,EAAE,CAAC;YACxD,qEAAqE;YACrE,MAAM,IAAI,UAAU,CAClB,sBAAsB,EACtB,yCAAyC,EAAE,CAAC,OAAO,eAAe,OAAO,+BAA+B,CACzG,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3C,uEAAuE;QACvE,uEAAuE;QACvE,gEAAgE;QAChE,IAAI,OAAO,GAAG,aAAa,CAAC,KAAK,EAAE,GAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACnD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,GAAG,aAAa,CAAC,KAAK,EAAE,GAAI,CAAC,CAAC;YACrC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,iBAAiB,CACzB,gGAAgG,CACjG,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,qEAAqE;YACrE,IAAI,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,EAAE,CAAC;gBAC3B,MAAM,aAAa,GAA2B,EAAE,CAAC;gBACjD,IAAI,EAAE,GAAG,IAAI,CAAC;gBACd,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC7C,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;wBAAC,EAAE,GAAG,KAAK,CAAC;wBAAC,MAAM;oBAAC,CAAC;oBACjD,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBACvB,CAAC;gBACD,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,MAAM,IAAI,iBAAiB,CACzB,kFAAkF,CACnF,CAAC;gBACJ,CAAC;gBACD,OAAO,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;YACnE,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,iBAAiB,CACzB,kFAAkF,CACnF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QACjC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACpC,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC;QACrB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,YAAY,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAC1E,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,kBAAkB,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC,CAAC;IAEF;;;;;OAKG;IACH,MAAM,OAAO,GAAG,KAAK,EACnB,OAAkD,EACnC,EAAE;QACjB,UAAU,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,mEAAmE;YACnE,8CAA8C;YAC9C,UAAU,EAAE,CAAC;YACb,WAAW,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,CAAC;YACd,MAAM,WAAW,GAAG,YAAY,GAAG,CAAC,CAAC;YACrC,MAAM,OAAO,GAAiB;gBAC5B,MAAM,EAAE,oBAAoB;gBAC5B,YAAY,EAAE,WAAW;gBACzB,OAAO,EAAE,IAAI;aACd,CAAC;YACF,MAAM,SAAS,GAAG,aAAa,CAC7B,OAA6C,EAC7C,GAAI,EACJ,IAAI,CAAC,GAAG,CACT,CAAC;YACF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,UAAU,CAAC,sBAAsB,EAAE,6CAA6C,CAAC,CAAC;YAC9F,CAAC;YACD,qEAAqE;YACrE,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,kEAAkE;YAClE,QAAQ;YACR,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC9E,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;YAC3E,aAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;YAC9D,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACrC,uEAAuE;YACvE,uEAAuE;YACvE,mDAAmD;YACnD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,kBAAkB,IAAI,CAAC,EAAE,WAAW,CAAC,CAAC;YAC3E,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,kBAAkB,EAAE,UAAU,EAAE,CAAC,CAAC;YAEnE,kEAAkE;YAClE,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,GAAG,WAAW,CAAC;YAC3B,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC;QAC7C,CAAC;gBAAS,CAAC;YACT,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,IAAI,MAAM;YAAE,OAAO;QACnB,MAAM,GAAG,IAAI,CAAC;QACd,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,YAAY,CAAC,QAAQ,CAAC,CAAC;YACvB,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,yEAAyE;YACzE,4EAA4E;YAC5E,wEAAwE;YACxE,wEAAwE;YACxE,gEAAgE;YAChE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,GAAG,GAAG,IAAI,CAAC;QACb,CAAC;QACD,gEAAgE;QAChE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAClB,CAAC;QACD,OAAO,GAAG,EAAE,CAAC;IACf,CAAC,CAAC;IAEF;;;;;;;;;;;;;;;OAeG;IACH,MAAM,SAAS,GAAG,KAAK,EACrB,EAAoB,EACpB,WAA6B,EAC7B,WAAoC,EACpC,QAA0B,EAC1B,EAAwB,EACxB,MAAoD,EACxC,EAAE;QACd,UAAU,EAAE,CAAC;QACb,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC;QACzB,qEAAqE;QACrE,mCAAmC;QACnC,UAAU,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,EAAE,EAAE,CAAC;YACzB,MAAM,SAAS,GACb,WAAW,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,KAAK,CAAC,CAAC;YAC9D,aAAa,CAAC;gBACZ,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW;gBAC3C,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;gBACxC,OAAO,EAAE,eAAe;gBACxB,GAAG,EAAE,EAAE,CAAC,GAAG;gBACX,MAAM,EAAE,EAAE,CAAC,MAAM;gBACjB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9C,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;aAC/B,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,aAAa,CAAC;gBACZ,IAAI,EAAE,QAAQ;gBACd,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;gBACxC,OAAO,EAAE,eAAe;gBACxB,GAAG,EAAE,EAAE,CAAC,GAAG;gBACX,MAAM,EAAE,EAAE,CAAC,MAAM;gBACjB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACvD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;aAC/B,CAAC,CAAC;YACH,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,GAAG,CAAC,IAAY;YACd,OAAO,SAAS,CACd,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAC3B,iBAAiB,EACjB,yBAAyB,EACzB,wBAAwB,EACxB,GAAG,EAAE;gBACH,WAAW,EAAE,CAAC;gBACd,OAAO,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACjD,CAAC,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAe;YAClB,OAAO,SAAS,CACd,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAC7B,uBAAuB,EACvB,IAAI,EACJ,6BAA6B,EAC7B,GAAG,EAAE;gBACH,WAAW,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC1C,OAAO,MAAM,KAAK,SAAS;oBACzB,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YAChD,CAAC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CACxC,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,KAAa;YACnC,uEAAuE;YACvE,qEAAqE;YACrE,YAAY,CAAC,IAAI,CAAC,CAAC;YACnB,OAAO,SAAS,CACd,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAC5B,oBAAoB,EACpB,IAAI,EACJ,yBAAyB,EACzB,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;gBACxB,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YACxB,CAAC,CAAC,CACH,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,IAAY;YACjB,OAAO,SAAS,CACd,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,EAC7B,oBAAoB,EACpB,0BAA0B,EAC1B,0BAA0B,EAC1B,KAAK,IAAI,EAAE;gBACT,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACrC,MAAM,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;oBACxB,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;gBACvB,CAAC,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC;YACd,CAAC,CACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,MAAM;YACV,UAAU,EAAE,CAAC;YACb,IAAI,EAA+B,CAAC;YACpC,IAAI,CAAC;gBACH,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACrD,MAAM,IAAI,UAAU,CAClB,oBAAoB,EACpB,cAAc,IAAI,CAAC,SAAS,0BAA0B,CACvD,CAAC;gBACJ,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC3C,6CAA6C;YAC7C,UAAU,EAAE,CAAC;YACb,qEAAqE;YACrE,uEAAuE;YACvE,IAAI,OAAO,GAAG,aAAa,CAAC,KAAK,EAAE,GAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YACnD,IAAI,OAAO,KAAK,IAAI;gBAAE,OAAO,GAAG,aAAa,CAAC,KAAK,EAAE,GAAI,CAAC,CAAC;YAC3D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,iBAAiB,CACzB,wFAAwF,CACzF,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YACvC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,IAAI,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,EAAE,CAAC;oBAC3B,MAAM,aAAa,GAA2B,EAAE,CAAC;oBACjD,IAAI,EAAE,GAAG,IAAI,CAAC;oBACd,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC7C,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;4BAAC,EAAE,GAAG,KAAK,CAAC;4BAAC,MAAM;wBAAC,CAAC;wBACjD,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;oBACvB,CAAC;oBACD,IAAI,CAAC,EAAE,EAAE,CAAC;wBACR,MAAM,IAAI,iBAAiB,CACzB,0EAA0E,CAC3E,CAAC;oBACJ,CAAC;oBACD,OAAO,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;gBACnE,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,iBAAiB,CACzB,0EAA0E,CAC3E,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;YACjC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;YACpC,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC;QACvB,CAAC;QAED,KAAK,EAAE,OAAO;QAEd,IAAI,QAAQ;YACV,OAAO,IAAI,CAAC,QAAQ,CAAC;QACvB,CAAC;QACD,IAAI,IAAI;YACN,OAAO,IAAI,CAAC,SAAS,CAAC;QACxB,CAAC;QACD,IAAI,YAAY;YACd,OAAO,YAAY,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,OAAgC;IACvD,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtC,IACE,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC;QAC5B,SAAS,GAAG,CAAC;QACb,SAAS,GAAG,MAAM,CAAC,gBAAgB,EACnC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,yEAAyE;IACzE,kCAAkC;IAClC,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;QACxB,KAAK,GAAG,CAAC;QACT,KAAK,GAAG,MAAM,CAAC,gBAAgB,EAC/B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,OAAO,UAAU,KAAK,QAAQ;QAC9B,UAAU,KAAK,IAAI;QACnB,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EACzB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,UAAqC,CAAC;IACzD,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACvC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IACD,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,YAAY,EAAE,KAAK;QACnB,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,gCAAgC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QAClC,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,uBAAuB,eAAe,uBAAuB,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,6DAA6D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CACpF,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,uEAAuE;IACvE,wCAAwC;IACxC,4CAA4C;IAC5C,IAAI,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,wGAAwG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAC/H,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"session-vault.js","sourceRoot":"","sources":["../../src/vault/session-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EACL,UAAU,EACV,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAIjE,OAAO,EACL,cAAc,EACd,aAAa,EACb,iBAAiB,GAGlB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EACL,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,GACf,MAAM,2BAA2B,CAAC;AAEnC,kEAAkE;AAClE,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,GACf,CAAC;AAEF,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,yEAAyE;AACzE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAEtC,iFAAiF;AACjF,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;AAEvF,yEAAyE;AACzE,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CACtC,OAAO,EAAE,EACT,WAAW,EACX,SAAS,EACT,oBAAoB,CACrB,CAAC;AAEF,0CAA0C;AAC1C,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AA2HzD,gFAAgF;AAChF,uCAAuC;AACvC,gFAAgF;AAEhF;;;;;;;;;;GAUG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,yEAAyE;QACzE,8BAA8B;QAC9B,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC;QACtE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;;;;;;;;GASG;AACH,SAAS,SAAS,CAAC,qBAA6B,EAAE,MAAc;IAC9D,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,GAAG,gBAAgB,KAAK,MAAM,IAAI,qBAAqB,EAAE,CAAC;SACjE,MAAM,EAAE,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,YAAY,GAAG,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC;QACrC,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iCAAiC,IAAI,uBAAuB;gBAC1D,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,kBAAkB;gBACnE,uBAAuB,IAAI,IAAI,CAClC,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;IACzD,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAyB,EAAE;IACzD,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,IAAI,kBAAkB,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,WAAW,CAC7B,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC,CACnE,CAAC;IACF,MAAM,SAAS,GAAsB,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC;IACrE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IAEzB,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,UAAU,CAClB,iBAAiB,EACjB,2BAA2B,SAAS,8CAA8C,CACnF,CAAC;IACJ,CAAC;IAED,eAAe,CAAC,SAAS,CAAC,CAAC;IAC3B,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAE/B,wDAAwD;IACxD,EAAE;IACF,uEAAuE;IACvE,sEAAsE;IACtE,qEAAqE;IACrE,2EAA2E;IAC3E,8EAA8E;IAC9E,IAAI,QAAqB,CAAC;IAC1B,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnC,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC;IAC9B,CAAC;SAAM,CAAC;QACN,MAAM,WAAW,GAA8B,EAAE,SAAS,EAAE,CAAC;QAC7D,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,WAAW,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QACtE,MAAM,cAAc,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;QACvD,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,gBAAgB,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC;QACD,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC;IACrC,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,aAAa,GAAG,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC;QAChD,MAAM,IAAI,gBAAgB,CACxB,aAAa,EAAE,OAAO;YACpB,eAAe,QAAQ,CAAC,IAAI,gEAAgE,CAC/F,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAEvD,gCAAgC;IAChC,EAAE;IACF,yDAAyD;IACzD,qEAAqE;IACrE,wEAAwE;IACxE,2EAA2E;IAC3E,2EAA2E;IAC3E,kEAAkE;IAClE,4EAA4E;IAC5E,EAAE;IACF,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,kEAAkE;IAClE,2BAA2B;IAC3B,MAAM,YAAY,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,OAAO,GAAG,aAAa,CAAC,YAAY,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACpD,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,aAAa,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAChD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,GAAG,MAAM,CAAC;YACjB,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,iBAAiB,CACzB,8BAA8B,SAAS,iEAAiE,oBAAoB,qCAAqC,CAClK,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,oEAAoE;QACpE,0EAA0E;QAC1E,4DAA4D;QAC5D,IAAI,cAAc,IAAI,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,EAAE,CAAC;YAC7C,MAAM,OAAO,GAA2B,EAAE,CAAC;YAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7C,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;oBAC1B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACZ,MAAM,IAAI,iBAAiB,CACzB,wEAAwE,CAAC,kDAAkD,CAC5H,CAAC;gBACJ,CAAC;gBACD,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;YACD,OAAO,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;YAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,2DAA2D,SAAS,IAAI;gBACtE,+BAA+B,oBAAoB,oCAAoC,CAC1F,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,iBAAiB,CACzB,+EAA+E,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,iEAAiE;QACjE,oEAAoE;QACpE,qEAAqE;QACrE,qEAAqE;QACrE,EAAE;QACF,uEAAuE;QACvE,oEAAoE;QACpE,yEAAyE;QACzE,IAAI,IAAI,CAAC,oBAAoB,KAAK,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC1D,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,UAAU,CAClB,uBAAuB,EACvB,gBAAgB,WAAW,4CAA4C;gBACrE,kEAAkE;gBAClE,uEAAuE;gBACvE,iEAAiE;gBACjE,sEAAsE,CACzE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,4BAA4B,CAAC;QACxF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mCAAmC,WAAW,eAAe;YAC3D,iCAAiC,OAAO,CAAC,YAAY,QAAQ,MAAM,KAAK,CAC3E,CAAC;QACF,YAAY,CAAC,WAAW,EAAE,EAAE,kBAAkB,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC1E,CAAC;SAAM,IAAI,OAAO,CAAC,YAAY,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC7D,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACjC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,kBAAkB,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iEAAiE;YAC/D,GAAG,OAAO,CAAC,kBAAkB,YAAY,OAAO,CAAC,YAAY,IAAI;YACjE,8DAA8D;YAC9D,qBAAqB,CACxB,CAAC;QACF,YAAY,CAAC,WAAW,EAAE,EAAE,kBAAkB,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC1E,CAAC;SAAM,IAAI,OAAO,CAAC,YAAY,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC7D,YAAY,CAAC,WAAW,EAAE,EAAE,kBAAkB,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,UAAU,CAAC;QAChB,SAAS;QACT,WAAW;QACX,QAAQ,EAAE,QAAQ,CAAC,IAAuB;QAC1C,SAAS;QACT,GAAG;QACH,GAAG;QACH,cAAc,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE;QACtC,cAAc,EAAE,OAAO,CAAC,YAAY;QACpC,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAkBD,SAAS,UAAU,CAAC,IAAoB;IACtC,IAAI,GAAG,GAAkB,IAAI,CAAC,GAAG,CAAC;IAClC,IAAI,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC;IAClC,IAAI,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC;IACvC,4EAA4E;IAC5E,4EAA4E;IAC5E,+DAA+D;IAC/D,IAAI,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC;IAC/C,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,IAAI,QAAQ,GAA0B,IAAI,CAAC;IAC3C,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE;YACzB,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACf,QAAQ,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,MAAM,UAAU,GAAG,GAAS,EAAE;QAC5B,IAAI,MAAM,IAAI,GAAG,KAAK,IAAI;YAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;IAC3D,CAAC,CAAC;IAEF;;;;OAIG;IACH,MAAM,WAAW,GAAG,GAAS,EAAE;QAC7B,IAAI,IAAI,CAAC,SAAS,KAAK,aAAa;YAAE,OAAO;QAC7C,0EAA0E;QAC1E,2DAA2D;QAC3D,IAAI,EAA+B,CAAC;QACpC,IAAI,CAAC;YACH,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,MAAM,IAAI,UAAU,CAClB,oBAAoB,EACpB,cAAc,IAAI,CAAC,SAAS,0BAA0B,CACvD,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,EAAE,CAAC,OAAO,KAAK,OAAO;YAAE,OAAO;QACnC,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,EAAE,CAAC,OAAO,GAAG,OAAO,EAAE,CAAC;YACxD,qEAAqE;YACrE,MAAM,IAAI,UAAU,CAClB,sBAAsB,EACtB,yCAAyC,EAAE,CAAC,OAAO,eAAe,OAAO,+BAA+B,CACzG,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3C,uEAAuE;QACvE,uEAAuE;QACvE,gEAAgE;QAChE,IAAI,OAAO,GAAG,aAAa,CAAC,KAAK,EAAE,GAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACnD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,GAAG,aAAa,CAAC,KAAK,EAAE,GAAI,CAAC,CAAC;YACrC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,iBAAiB,CACzB,gGAAgG,CACjG,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,qEAAqE;YACrE,IAAI,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,EAAE,CAAC;gBAC3B,MAAM,aAAa,GAA2B,EAAE,CAAC;gBACjD,IAAI,EAAE,GAAG,IAAI,CAAC;gBACd,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC7C,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;wBAAC,EAAE,GAAG,KAAK,CAAC;wBAAC,MAAM;oBAAC,CAAC;oBACjD,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBACvB,CAAC;gBACD,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,MAAM,IAAI,iBAAiB,CACzB,kFAAkF,CACnF,CAAC;gBACJ,CAAC;gBACD,OAAO,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;YACnE,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,iBAAiB,CACzB,kFAAkF,CACnF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QACjC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACpC,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC;QACrB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,YAAY,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAC1E,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,kBAAkB,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC,CAAC;IAEF;;;;;OAKG;IACH,MAAM,OAAO,GAAG,KAAK,EACnB,OAAkD,EACnC,EAAE;QACjB,UAAU,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,mEAAmE;YACnE,8CAA8C;YAC9C,UAAU,EAAE,CAAC;YACb,WAAW,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,CAAC;YACd,MAAM,WAAW,GAAG,YAAY,GAAG,CAAC,CAAC;YACrC,MAAM,OAAO,GAAiB;gBAC5B,MAAM,EAAE,oBAAoB;gBAC5B,YAAY,EAAE,WAAW;gBACzB,OAAO,EAAE,IAAI;aACd,CAAC;YACF,MAAM,SAAS,GAAG,aAAa,CAC7B,OAA6C,EAC7C,GAAI,EACJ,IAAI,CAAC,GAAG,CACT,CAAC;YACF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,UAAU,CAAC,sBAAsB,EAAE,6CAA6C,CAAC,CAAC;YAC9F,CAAC;YACD,qEAAqE;YACrE,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,kEAAkE;YAClE,QAAQ;YACR,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC9E,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;YAC3E,aAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;YAC9D,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACrC,uEAAuE;YACvE,uEAAuE;YACvE,mDAAmD;YACnD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,kBAAkB,IAAI,CAAC,EAAE,WAAW,CAAC,CAAC;YAC3E,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,kBAAkB,EAAE,UAAU,EAAE,CAAC,CAAC;YAEnE,kEAAkE;YAClE,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,GAAG,WAAW,CAAC;YAC3B,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC;QAC7C,CAAC;gBAAS,CAAC;YACT,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,IAAI,MAAM;YAAE,OAAO;QACnB,MAAM,GAAG,IAAI,CAAC;QACd,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,YAAY,CAAC,QAAQ,CAAC,CAAC;YACvB,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,yEAAyE;YACzE,4EAA4E;YAC5E,wEAAwE;YACxE,wEAAwE;YACxE,gEAAgE;YAChE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,GAAG,GAAG,IAAI,CAAC;QACb,CAAC;QACD,gEAAgE;QAChE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAClB,CAAC;QACD,OAAO,GAAG,EAAE,CAAC;IACf,CAAC,CAAC;IAEF;;;;;;;;;;;;;;;OAeG;IACH,MAAM,SAAS,GAAG,KAAK,EACrB,EAAoB,EACpB,WAA6B,EAC7B,WAAoC,EACpC,QAA0B,EAC1B,EAAwB,EACxB,MAAoD,EACxC,EAAE;QACd,UAAU,EAAE,CAAC;QACb,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,MAAM,cAAc,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC3B,SAAS,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;YAC9C,OAAO,EAAE,eAAe;YACxB,GAAG,EAAE,EAAE,CAAC,GAAG;YACX,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK;YACL,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW;SACrC,CAAC,CAAC,CAAC;QACJ,qEAAqE;QACrE,mCAAmC;QACnC,UAAU,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,EAAE,EAAE,CAAC;YACzB,MAAM,SAAS,GACb,WAAW,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,KAAK,CAAC,CAAC;YAC9D,aAAa,CAAC;gBACZ,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW;gBAC3C,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;gBACxC,OAAO,EAAE,eAAe;gBACxB,GAAG,EAAE,EAAE,CAAC,GAAG;gBACX,MAAM,EAAE,EAAE,CAAC,MAAM;gBACjB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9C,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;aAC/B,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,aAAa,CAAC;gBACZ,IAAI,EAAE,QAAQ;gBACd,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;gBACxC,OAAO,EAAE,eAAe;gBACxB,GAAG,EAAE,EAAE,CAAC,GAAG;gBACX,MAAM,EAAE,EAAE,CAAC,MAAM;gBACjB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACvD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;aAC/B,CAAC,CAAC;YACH,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,GAAG,CAAC,IAAY;YACd,OAAO,SAAS,CACd,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAC3B,iBAAiB,EACjB,yBAAyB,EACzB,wBAAwB,EACxB,GAAG,EAAE;gBACH,WAAW,EAAE,CAAC;gBACd,OAAO,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACjD,CAAC,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAe;YAClB,OAAO,SAAS,CACd,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAC7B,uBAAuB,EACvB,IAAI,EACJ,6BAA6B,EAC7B,GAAG,EAAE;gBACH,WAAW,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC1C,OAAO,MAAM,KAAK,SAAS;oBACzB,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YAChD,CAAC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CACxC,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,KAAa;YACnC,uEAAuE;YACvE,qEAAqE;YACrE,YAAY,CAAC,IAAI,CAAC,CAAC;YACnB,OAAO,SAAS,CACd,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAC5B,oBAAoB,EACpB,IAAI,EACJ,yBAAyB,EACzB,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;gBACxB,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YACxB,CAAC,CAAC,CACH,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,IAAY;YACjB,OAAO,SAAS,CACd,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,EAC7B,oBAAoB,EACpB,0BAA0B,EAC1B,0BAA0B,EAC1B,KAAK,IAAI,EAAE;gBACT,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACrC,MAAM,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;oBACxB,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;gBACvB,CAAC,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC;YACd,CAAC,CACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,MAAM;YACV,UAAU,EAAE,CAAC;YACb,IAAI,EAA+B,CAAC;YACpC,IAAI,CAAC;gBACH,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACrD,MAAM,IAAI,UAAU,CAClB,oBAAoB,EACpB,cAAc,IAAI,CAAC,SAAS,0BAA0B,CACvD,CAAC;gBACJ,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC3C,6CAA6C;YAC7C,UAAU,EAAE,CAAC;YACb,qEAAqE;YACrE,uEAAuE;YACvE,IAAI,OAAO,GAAG,aAAa,CAAC,KAAK,EAAE,GAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YACnD,IAAI,OAAO,KAAK,IAAI;gBAAE,OAAO,GAAG,aAAa,CAAC,KAAK,EAAE,GAAI,CAAC,CAAC;YAC3D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,iBAAiB,CACzB,wFAAwF,CACzF,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YACvC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,IAAI,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,EAAE,CAAC;oBAC3B,MAAM,aAAa,GAA2B,EAAE,CAAC;oBACjD,IAAI,EAAE,GAAG,IAAI,CAAC;oBACd,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC7C,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;4BAAC,EAAE,GAAG,KAAK,CAAC;4BAAC,MAAM;wBAAC,CAAC;wBACjD,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;oBACvB,CAAC;oBACD,IAAI,CAAC,EAAE,EAAE,CAAC;wBACR,MAAM,IAAI,iBAAiB,CACzB,0EAA0E,CAC3E,CAAC;oBACJ,CAAC;oBACD,OAAO,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;gBACnE,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,iBAAiB,CACzB,0EAA0E,CAC3E,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;YACjC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;YACpC,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC;QACvB,CAAC;QAED,KAAK,EAAE,OAAO;QAEd,IAAI,QAAQ;YACV,OAAO,IAAI,CAAC,QAAQ,CAAC;QACvB,CAAC;QACD,IAAI,IAAI;YACN,OAAO,IAAI,CAAC,SAAS,CAAC;QACxB,CAAC;QACD,IAAI,YAAY;YACd,OAAO,YAAY,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,OAAgC;IACvD,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtC,IACE,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC;QAC5B,SAAS,GAAG,CAAC;QACb,SAAS,GAAG,MAAM,CAAC,gBAAgB,EACnC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,yEAAyE;IACzE,kCAAkC;IAClC,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;QACxB,KAAK,GAAG,CAAC;QACT,KAAK,GAAG,MAAM,CAAC,gBAAgB,EAC/B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,OAAO,UAAU,KAAK,QAAQ;QAC9B,UAAU,KAAK,IAAI;QACnB,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EACzB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,UAAqC,CAAC;IACzD,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACvC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IACD,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,YAAY,EAAE,KAAK;QACnB,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,gCAAgC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QAClC,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,uBAAuB,eAAe,uBAAuB,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,6DAA6D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CACpF,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,uEAAuE;IACvE,wCAAwC;IACxC,4CAA4C;IAC5C,IAAI,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,wGAAwG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAC/H,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/vault/vault-libsecret.d.ts

@@ -62,12 +62,30 @@ export declare class LibsecretVault implements VaultBackend {
      * `secret-tool search --all` and parses `attribute.key` lines.
      * The fallback still briefly materializes secret values on stdout;
      * the JSDoc on the `secret-tool` path in the fallback documents
-     * this trade-off.
+     * this trade-off. Because that fallback is a security-relevant
+     * degradation, a host that advertises a session bus yet still fails
+     * the D-Bus path emits a one-time stderr warning
+     * (`warnOnDbusDegradation`); a genuinely bus-less host stays quiet
+     * since the fallback is the documented, expected behavior there.
      *
      * No results -> empty list. A transient failure from both paths is
      * propagated per the VaultBackend contract so the caller can retry.
      */
     listKeys(prefix?: string): Promise<string[]>;
+    /**
+     * The secret-tool fallback briefly materializes secret values on
+     * stdout (see `listKeysViaSecretTool`), so reverting to it from the
+     * secure D-Bus path is a security-relevant degradation that must not
+     * be silent (DESIGN-PHILOSOPHY: no silent degradation).
+     *
+     * But a host with no session bus at all — an SSH session or headless
+     * server with no `DBUS_SESSION_BUS_ADDRESS` — is the *documented,
+     * expected* fallback case, not a degradation, so warning there would
+     * be noise. We therefore warn (once per process) only when a session
+     * bus is advertised yet the D-Bus enumeration still failed: that is an
+     * unexpected failure of the path that was supposed to work.
+     */
+    private warnOnDbusDegradation;
     /**
      * D-Bus primary path for listKeys — no secret values cross process
      * memory. Uses dynamic import so `dbus-next` is only loaded on

package/dist/vault/vault-libsecret.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vault-libsecret.d.ts","sourceRoot":"","sources":["../../src/vault/vault-libsecret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAc/C;;;;;;;;;GASG;AACH,qBAAa,cAAe,YAAW,YAAY;IACjD;;;OAGG;IACH,MAAM,CAAC,MAAM,IAAI,OAAO;IAYxB;;;;;;OAMG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAiB1C;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAiBpC;;;;;OAKG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAmB5B;;;;;;;;;;;;;;;;;;;OAmBG;IACG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAQlD;;;;OAIG;YACW,eAAe;IAyD7B;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;CA2B9B"}
+{"version":3,"file":"vault-libsecret.d.ts","sourceRoot":"","sources":["../../src/vault/vault-libsecret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAsB/C;;;;;;;;;GASG;AACH,qBAAa,cAAe,YAAW,YAAY;IACjD;;;OAGG;IACH,MAAM,CAAC,MAAM,IAAI,OAAO;IAYxB;;;;;;OAMG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAiB1C;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAiBpC;;;;;OAKG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAmB5B;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAelD;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,qBAAqB;IAa7B;;;;OAIG;YACW,eAAe;IAyD7B;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;CA2B9B"}

package/dist/vault/vault-libsecret.js

@@ -15,6 +15,13 @@ import { isValidKey } from "./vault-utils.js";
 // =============================================================================
 const SERVICE_ATTR = "centient";
 const LABEL = "centient-auth";
+/**
+ * One-time guard so a "secure D-Bus enumeration degraded to secret-tool"
+ * warning is emitted at most once per process (mirrors the audit-policy
+ * warning idiom in policy.ts), avoiding a log flood when enumeration is
+ * called in a loop.
+ */
+let dbusFallbackWarned = false;
 // =============================================================================
 // LibsecretVault
 // =============================================================================
@@ -126,7 +133,11 @@ export class LibsecretVault {
      * `secret-tool search --all` and parses `attribute.key` lines.
      * The fallback still briefly materializes secret values on stdout;
      * the JSDoc on the `secret-tool` path in the fallback documents
-     * this trade-off.
+     * this trade-off. Because that fallback is a security-relevant
+     * degradation, a host that advertises a session bus yet still fails
+     * the D-Bus path emits a one-time stderr warning
+     * (`warnOnDbusDegradation`); a genuinely bus-less host stays quiet
+     * since the fallback is the documented, expected behavior there.
      *
      * No results -> empty list. A transient failure from both paths is
      * propagated per the VaultBackend contract so the caller can retry.
@@ -135,10 +146,42 @@ export class LibsecretVault {
         try {
             return await this.listKeysViaDbus(prefix);
         }
-        catch {
+        catch (err) {
+            // Intentionally broad: the contract is "if the secure D-Bus path
+            // cannot enumerate for ANY reason, degrade to secret-tool" — the
+            // dominant cause is a bus-less host, but a protocol/variant error
+            // should fall back too rather than fail the read. The degradation
+            // is never silent (warnOnDbusDegradation surfaces an unexpected
+            // failure once), so a swallowed cause is still observable.
+            this.warnOnDbusDegradation(err);
             return this.listKeysViaSecretTool(prefix);
         }
     }
+    /**
+     * The secret-tool fallback briefly materializes secret values on
+     * stdout (see `listKeysViaSecretTool`), so reverting to it from the
+     * secure D-Bus path is a security-relevant degradation that must not
+     * be silent (DESIGN-PHILOSOPHY: no silent degradation).
+     *
+     * But a host with no session bus at all — an SSH session or headless
+     * server with no `DBUS_SESSION_BUS_ADDRESS` — is the *documented,
+     * expected* fallback case, not a degradation, so warning there would
+     * be noise. We therefore warn (once per process) only when a session
+     * bus is advertised yet the D-Bus enumeration still failed: that is an
+     * unexpected failure of the path that was supposed to work.
+     */
+    warnOnDbusDegradation(err) {
+        if (dbusFallbackWarned)
+            return;
+        const sessionBus = process.env.DBUS_SESSION_BUS_ADDRESS;
+        if (sessionBus === undefined || sessionBus.length === 0)
+            return;
+        dbusFallbackWarned = true;
+        const msg = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`[secrets] libsecret D-Bus enumeration failed despite an active session ` +
+            `bus; falling back to \`secret-tool search\`, which briefly materializes ` +
+            `secret values on stdout. Cause: ${msg}\n`);
+    }
     /**
      * D-Bus primary path for listKeys — no secret values cross process
      * memory. Uses dynamic import so `dbus-next` is only loaded on

package/dist/vault/vault-libsecret.js.map

@@ -1 +1 @@
-{"version":3,"file":"vault-libsecret.js","sourceRoot":"","sources":["../../src/vault/vault-libsecret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,YAAY,GAAG,UAAU,CAAC;AAChC,MAAM,KAAK,GAAG,eAAe,CAAC;AAE9B,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;;;;;;;;GASG;AACH,MAAM,OAAO,cAAc;IACzB;;;OAGG;IACH,MAAM,CAAC,MAAM;QACX,IAAI,CAAC;YACH,QAAQ,CAAC,mBAAmB,EAAE;gBAC5B,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,GAAW,EAAE,KAAa;QAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,IAAI,CAAC;YACH,QAAQ,CACN,8BAA8B,KAAK,aAAa,YAAY,SAAS,GAAG,GAAG,EAC3E;gBACE,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,KAAK,EAAE,KAAK;aACb,CACF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,GAAW;QAClB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,QAAQ,CACrB,8BAA8B,YAAY,SAAS,GAAG,GAAG,EACzD;gBACE,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CACF,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,GAAW;QAChB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,IAAI,CAAC;YACH,QAAQ,CACN,6BAA6B,YAAY,SAAS,GAAG,GAAG,EACxD;gBACE,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CACF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;YACzD,sEAAsE;YACtE,6DAA6D;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,QAAQ,CAAC,MAAe;QAC5B,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,eAAe,CAAC,MAAe;QAC3C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAE9B,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,cAAc,CACzC,yBAAyB,EACzB,0BAA0B,CAC3B,CAAC;YACF,oEAAoE;YACpE,kEAAkE;YAClE,+FAA+F;YAC/F,MAAM,OAAO,GAAG,UAAU,CAAC,YAAY,CAAC,gCAAgC,CAAQ,CAAC;YAEjF,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,WAAW,CAClD,EAAE,OAAO,EAAE,YAAY,EAAE,CACF,CAAC;YAE1B,MAAM,QAAQ,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC;YAC1C,MAAM,IAAI,GAAa,EAAE,CAAC;YAE1B,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;gBAChC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,cAAc,CACtC,yBAAyB,EACzB,QAAQ,CACT,CAAC;gBACF,gHAAgH;gBAChH,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,iCAAiC,CAAQ,CAAC;gBAC7E,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAC3B,6BAA6B,EAC7B,YAAY,CACgD,CAAC;gBAE/D,6DAA6D;gBAC7D,gEAAgE;gBAChE,8DAA8D;gBAC9D,4CAA4C;gBAC5C,IAAI,CAAC,KAAK,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;oBAAE,SAAS;gBAE3D,IAAI,MAA0B,CAAC;gBAC/B,KAAK,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;oBAChD,IAAI,QAAQ,EAAE,KAAK,KAAK,KAAK,EAAE,CAAC;wBAC9B,MAAM,GAAG,SAAS,EAAE,KAAK,CAAC;wBAC1B,MAAM;oBACR,CAAC;gBACH,CAAC;gBACD,IAAI,MAAM,KAAK,SAAS;oBAAE,SAAS;gBACnC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;oBAAE,SAAS;gBACjE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,qBAAqB,CAAC,MAAe;QAC3C,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,QAAQ,CACf,oCAAoC,YAAY,EAAE,EAClD;gBACE,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAI,GAAkC,EAAE,MAAM,CAAC;YAC3D,IAAI,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC5B,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,SAAS;YACvD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAC/B,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC9D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"vault-libsecret.js","sourceRoot":"","sources":["../../src/vault/vault-libsecret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,YAAY,GAAG,UAAU,CAAC;AAChC,MAAM,KAAK,GAAG,eAAe,CAAC;AAE9B;;;;;GAKG;AACH,IAAI,kBAAkB,GAAG,KAAK,CAAC;AAE/B,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;;;;;;;;GASG;AACH,MAAM,OAAO,cAAc;IACzB;;;OAGG;IACH,MAAM,CAAC,MAAM;QACX,IAAI,CAAC;YACH,QAAQ,CAAC,mBAAmB,EAAE;gBAC5B,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,GAAW,EAAE,KAAa;QAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,IAAI,CAAC;YACH,QAAQ,CACN,8BAA8B,KAAK,aAAa,YAAY,SAAS,GAAG,GAAG,EAC3E;gBACE,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,KAAK,EAAE,KAAK;aACb,CACF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,GAAW;QAClB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,QAAQ,CACrB,8BAA8B,YAAY,SAAS,GAAG,GAAG,EACzD;gBACE,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CACF,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,GAAW;QAChB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,IAAI,CAAC;YACH,QAAQ,CACN,6BAA6B,YAAY,SAAS,GAAG,GAAG,EACxD;gBACE,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CACF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;YACzD,sEAAsE;YACtE,6DAA6D;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,CAAC,QAAQ,CAAC,MAAe;QAC5B,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,iEAAiE;YACjE,iEAAiE;YACjE,kEAAkE;YAClE,kEAAkE;YAClE,gEAAgE;YAChE,2DAA2D;YAC3D,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,qBAAqB,CAAC,GAAY;QACxC,IAAI,kBAAkB;YAAE,OAAO;QAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QACxD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAChE,kBAAkB,GAAG,IAAI,CAAC;QAC1B,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yEAAyE;YACvE,0EAA0E;YAC1E,mCAAmC,GAAG,IAAI,CAC7C,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,eAAe,CAAC,MAAe;QAC3C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAE9B,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,cAAc,CACzC,yBAAyB,EACzB,0BAA0B,CAC3B,CAAC;YACF,oEAAoE;YACpE,kEAAkE;YAClE,+FAA+F;YAC/F,MAAM,OAAO,GAAG,UAAU,CAAC,YAAY,CAAC,gCAAgC,CAAQ,CAAC;YAEjF,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,WAAW,CAClD,EAAE,OAAO,EAAE,YAAY,EAAE,CACF,CAAC;YAE1B,MAAM,QAAQ,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC;YAC1C,MAAM,IAAI,GAAa,EAAE,CAAC;YAE1B,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;gBAChC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,cAAc,CACtC,yBAAyB,EACzB,QAAQ,CACT,CAAC;gBACF,gHAAgH;gBAChH,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,iCAAiC,CAAQ,CAAC;gBAC7E,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAC3B,6BAA6B,EAC7B,YAAY,CACgD,CAAC;gBAE/D,6DAA6D;gBAC7D,gEAAgE;gBAChE,8DAA8D;gBAC9D,4CAA4C;gBAC5C,IAAI,CAAC,KAAK,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;oBAAE,SAAS;gBAE3D,IAAI,MAA0B,CAAC;gBAC/B,KAAK,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;oBAChD,IAAI,QAAQ,EAAE,KAAK,KAAK,KAAK,EAAE,CAAC;wBAC9B,MAAM,GAAG,SAAS,EAAE,KAAK,CAAC;wBAC1B,MAAM;oBACR,CAAC;gBACH,CAAC;gBACD,IAAI,MAAM,KAAK,SAAS;oBAAE,SAAS;gBACnC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;oBAAE,SAAS;gBACjE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,qBAAqB,CAAC,MAAe;QAC3C,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,QAAQ,CACf,oCAAoC,YAAY,EAAE,EAClD;gBACE,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAI,GAAkC,EAAE,MAAM,CAAC;YAC3D,IAAI,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC5B,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,SAAS;YACvD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAC/B,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC9D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/vault/vault.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../src/vault/vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAYH,OAAO,KAAK,EAAgB,SAAS,EAAE,MAAM,YAAY,CAAC;AAiE1D;;;GAGG;AACH,wBAAgB,cAAc,IAAI,OAAO,CAGxC;AAkBD;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,SAAS,CAE9C;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAalB;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA0BvE;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAYpE;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA2BxE"}
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../src/vault/vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAYH,OAAO,KAAK,EAAgB,SAAS,EAAE,MAAM,YAAY,CAAC;AAiE1D;;;GAGG;AACH,wBAAgB,cAAc,IAAI,OAAO,CAGxC;AAiBD;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,SAAS,CAE9C;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAoBlB;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiCvE;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAmBpE;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAkCxE"}

package/dist/vault/vault.js

@@ -90,12 +90,11 @@ function touchSession() {
 // =============================================================================
 // Public API
 //
-// Known limitation (0.5.0): when a `before` policy hook rejects an
-// operation by throwing, the rejection propagates to the caller but no
-// `after` event is emitted. This means policy-rejected operations are
-// invisible to the audit trail. The full onion model — where `after`
-// hooks on already-entered policies still fire on abort — ships in 1.0
-// as part of `createSecretsClient`. See ADR-002 §1.0.0.
+// Policy-rejected operations are audited: when a `before` hook throws,
+// the rejection propagates to the caller AND the `after` hooks of the
+// already-entered policies fire with a `*_rejected` event (see
+// `runBeforeHooks` in policy.ts), so a denied operation is never
+// invisible to the audit trail. ADR-002 §1.0.0.
 // =============================================================================
 /**
  * Returns the type identifier for the active vault backend.
@@ -115,7 +114,14 @@ export function getActiveVaultType() {
  */
 export async function storeCredential(key, value) {
     const start = performance.now();
-    await runBeforeHooks({ type: "write", key });
+    await runBeforeHooks({ type: "write", key }, (error) => ({
+        type: "credential_write_rejected",
+        timestamp: new Date().toISOString(),
+        backend: activeVaultType,
+        key,
+        error,
+        durationMs: performance.now() - start,
+    }));
     const success = activeBackend.store(key, value);
     if (success)
         touchSession();
@@ -136,7 +142,14 @@ export async function storeCredential(key, value) {
  */
 export async function getCredential(key) {
     const start = performance.now();
-    await runBeforeHooks({ type: "read", key });
+    await runBeforeHooks({ type: "read", key }, (error) => ({
+        type: "credential_read_rejected",
+        timestamp: new Date().toISOString(),
+        backend: activeVaultType,
+        key,
+        error,
+        durationMs: performance.now() - start,
+    }));
     let value;
     try {
         value = activeBackend.retrieve(key);
@@ -171,7 +184,14 @@ export async function getCredential(key) {
  */
 export async function deleteCredential(key) {
     const start = performance.now();
-    await runBeforeHooks({ type: "delete", key });
+    await runBeforeHooks({ type: "delete", key }, (error) => ({
+        type: "credential_delete_rejected",
+        timestamp: new Date().toISOString(),
+        backend: activeVaultType,
+        key,
+        error,
+        durationMs: performance.now() - start,
+    }));
     const success = activeBackend.delete(key);
     runAfterHooks({
         type: success ? "credential_deleted" : "credential_delete_failed",
@@ -208,7 +228,14 @@ export async function deleteCredential(key) {
  */
 export async function listCredentials(prefix) {
     const start = performance.now();
-    await runBeforeHooks({ type: "enumerate", prefix });
+    await runBeforeHooks({ type: "enumerate", prefix }, (error) => ({
+        type: "credential_enumerate_rejected",
+        timestamp: new Date().toISOString(),
+        backend: activeVaultType,
+        prefix,
+        error,
+        durationMs: performance.now() - start,
+    }));
     let keys;
     try {
         keys = await activeBackend.listKeys(prefix);

package/dist/vault/vault.js.map

@@ -1 +1 @@
-{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../src/vault/vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5D,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAC9C,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AAErD,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,aAAa;IACjB,MAAM,CAAC,MAAM;QACX,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,GAAW,EAAE,KAAa;QAC9B,OAAO,qBAAqB,CAAC,qBAAqB,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAClE,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,qBAAqB,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,OAAO,kBAAkB,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAe;QAC5B,OAAO,sBAAsB,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC;CACF;AAED,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF;;;GAGG;AACH,SAAS,gBAAgB;IACvB,IAAI,aAAa,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,aAAa,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACtF,IAAI,YAAY,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACnF,IAAI,cAAc,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACzF,IAAI,QAAQ,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACvE,OAAO,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,gBAAgB,EAAE,CAAC;AAE7E,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF,yDAAyD;AACzD,IAAI,YAAY,GAAkB,IAAI,CAAC;AAEvC;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,cAAc,CAAC;AACpD,CAAC;AAED,qDAAqD;AACrD,SAAS,YAAY;IACnB,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAC5B,CAAC;AAED,gFAAgF;AAChF,aAAa;AACb,EAAE;AACF,mEAAmE;AACnE,uEAAuE;AACvE,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,wDAAwD;AACxD,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAW,EACX,KAAa;IAEb,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,OAAO;QAAE,YAAY,EAAE,CAAC;IAC5B,aAAa,CAAC;QACZ,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,yBAAyB;QAChE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5C,IAAI,KAAoB,CAAC;IACzB,IAAI,CAAC;QACH,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,aAAa,CAAC;YACZ,IAAI,EAAE,wBAAwB;YAC9B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,eAAe;YACxB,GAAG;YACH,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACvD,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;SACtC,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,KAAK,KAAK,IAAI;QAAE,YAAY,EAAE,CAAC;IACnC,aAAa,CAAC;QACZ,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,yBAAyB;QACpE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1C,aAAa,CAAC;QACZ,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,0BAA0B;QACjE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAe;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;IACpD,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,aAAa,CAAC;YACZ,IAAI,EAAE,6BAA6B;YACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,eAAe;YACxB,MAAM;YACN,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACvD,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;SACtC,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,YAAY,EAAE,CAAC;IACpC,aAAa,CAAC;QACZ,IAAI,EAAE,uBAAuB;QAC7B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,MAAM;QACN,QAAQ,EAAE,IAAI,CAAC,MAAM;QACrB,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../src/vault/vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5D,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAC9C,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AAErD,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,aAAa;IACjB,MAAM,CAAC,MAAM;QACX,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,GAAW,EAAE,KAAa;QAC9B,OAAO,qBAAqB,CAAC,qBAAqB,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAClE,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,qBAAqB,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,OAAO,kBAAkB,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAe;QAC5B,OAAO,sBAAsB,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC;CACF;AAED,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF;;;GAGG;AACH,SAAS,gBAAgB;IACvB,IAAI,aAAa,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,aAAa,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACtF,IAAI,YAAY,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACnF,IAAI,cAAc,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACzF,IAAI,QAAQ,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACvE,OAAO,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,gBAAgB,EAAE,CAAC;AAE7E,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF,yDAAyD;AACzD,IAAI,YAAY,GAAkB,IAAI,CAAC;AAEvC;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,cAAc,CAAC;AACpD,CAAC;AAED,qDAAqD;AACrD,SAAS,YAAY;IACnB,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAC5B,CAAC;AAED,gFAAgF;AAChF,aAAa;AACb,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,+DAA+D;AAC/D,iEAAiE;AACjE,gDAAgD;AAChD,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAW,EACX,KAAa;IAEb,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACvD,IAAI,EAAE,2BAA2B;QACjC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,KAAK;QACL,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,OAAO;QAAE,YAAY,EAAE,CAAC;IAC5B,aAAa,CAAC;QACZ,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,yBAAyB;QAChE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtD,IAAI,EAAE,0BAA0B;QAChC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,KAAK;QACL,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC,CAAC;IACJ,IAAI,KAAoB,CAAC;IACzB,IAAI,CAAC;QACH,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,aAAa,CAAC;YACZ,IAAI,EAAE,wBAAwB;YAC9B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,eAAe;YACxB,GAAG;YACH,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACvD,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;SACtC,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,KAAK,KAAK,IAAI;QAAE,YAAY,EAAE,CAAC;IACnC,aAAa,CAAC;QACZ,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,yBAAyB;QACpE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI,EAAE,4BAA4B;QAClC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,KAAK;QACL,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1C,aAAa,CAAC;QACZ,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,0BAA0B;QACjE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAe;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9D,IAAI,EAAE,+BAA+B;QACrC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,MAAM;QACN,KAAK;QACL,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC,CAAC;IACJ,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,aAAa,CAAC;YACZ,IAAI,EAAE,6BAA6B;YACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,eAAe;YACxB,MAAM;YACN,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACvD,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;SACtC,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,YAAY,EAAE,CAAC;IACpC,aAAa,CAAC;QACZ,IAAI,EAAE,uBAAuB;QAC7B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,MAAM;QACN,QAAQ,EAAE,IAAI,CAAC,MAAM;QACrB,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@centient/secrets",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Cross-platform secrets vault with AES-256-GCM encryption and platform-native key storage",
   "repository": {
     "type": "git",