@centient/secrets 0.8.0 → 0.10.0

package/dist/vault/vault.d.ts

@@ -11,11 +11,69 @@
  * The active backend is selected once at module load by calling each backend's
  * static `detect()` method in order and choosing the first one that returns true.
  *
+ * **Explicit selection (ADR-004) sits in front of that cascade.** `secrets.backend`
+ * (or `CENTIENT_SECRETS_BACKEND`) names a backend directly and fails closed if it
+ * is unusable — it is never silently substituted. `OnePasswordVault` is reachable
+ * *only* this way: having `op` installed is not consent to route credentials into
+ * someone's 1Password vault.
+ *
  * Session TTL: 4 hours from the last successful read/write.
  *
- * Error handling: all functions return null/false on failure — never throw.
+ * Error handling: a *storage* failure is reported as `null`/`false` — the
+ * backend contract is non-throwing. Three things do throw, because they are
+ * not storage outcomes: a policy `before` hook rejecting the operation
+ * (ADR-002 §1.0.0), a backend surfacing an unexpected transport failure from
+ * `retrieve`/`listKeys`, and a malformed credential key
+ * (`InvalidCredentialKeyError`, see the key-validation section below).
+ */
+import type { KeychainDeps } from "../crypto/darwin-keychain.js";
+import type { SecretState } from "../secret-state.js";
+import type { VaultBackend, VaultType } from "./types.js";
+/**
+ * The keychain service every credential VALUE lives under. Exported because
+ * the migration helper (`migrateLoginCredentialToSystem`) and operator
+ * tooling have to name the same service — a second literal somewhere else is
+ * how a migration silently moves nothing.
  */
-import type { VaultType } from "./types.js";
+export declare const AUTH_KEYCHAIN_SERVICE = "centient-auth";
+/**
+ * Wraps the macOS Keychain helper functions as a VaultBackend.
+ *
+ * Every method routes through `crypto/darwin-keychain.ts` (#188), so credential
+ * values inherit explicit System-keychain reads in a sessionless context,
+ * `-U` replace-in-place writes and `-T /usr/bin/security` reader
+ * preauthorization — the same posture the KeyProvider layer gets for the vault
+ * master key.
+ *
+ * Only available on macOS (darwin).
+ */
+export declare class KeychainVault implements VaultBackend {
+    private readonly deps;
+    /**
+     * @param deps - Injection seam for the `security` CLI and the
+     *   platform/environment that decide the read path. Omitted in production;
+     *   supplied by tests so the exact argv is assertable.
+     */
+    constructor(deps?: Partial<KeychainDeps>);
+    static detect(): boolean;
+    store(key: string, value: string): boolean;
+    retrieve(key: string): string | null;
+    delete(key: string): boolean;
+    listKeys(prefix?: string): Promise<string[]>;
+    /**
+     * The credential state probe: runs the SAME read {@link retrieve} would run
+     * in this context — same path, same explicit target — then discards the
+     * value and returns only the value-free {@link SecretState}.
+     *
+     * A metadata-only lookup would be cheaper and would leave the secret on
+     * disk, but it can only report presence: an item whose ACL does not
+     * preauthorize the reader, or that sits in a locked keychain, is present and
+     * unreadable, and calling that `found` hands a caller trusted state that is
+     * wrong in exactly the direction #188 exists to fix. `found` here means the
+     * reader will get bytes.
+     */
+    probe(key: string): SecretState;
+}
 /**
  * Returns true if the in-process session is still within the TTL window.
  * This does NOT validate the token itself — use validateToken() for that.
@@ -31,9 +89,12 @@ export declare function getActiveVaultType(): VaultType;
 /**
  * Store a credential in the active vault backend.
  *
- * @param key     - Logical key name (e.g. 'auth-token', 'refresh-token')
+ * @param key     - Logical key name (e.g. 'auth-token', 'refresh-token').
+ *                  Must match the key grammar — see "Key validation" above.
  * @param value   - The credential value to store
  * @returns true on success, false if the backend write fails
+ * @throws {InvalidCredentialKeyError} if `key` does not match the grammar.
+ *   Nothing is written and no backend is contacted.
  */
 export declare function storeCredential(key: string, value: string): Promise<boolean>;
 /**
@@ -41,6 +102,10 @@ export declare function storeCredential(key: string, value: string): Promise<boo
  *
  * @param key - Logical key name (e.g. 'auth-token')
  * @returns The stored value, or null if not found / backend unavailable
+ * @throws {InvalidCredentialKeyError} if `key` does not match the grammar.
+ *   Deliberately not `null`: "malformed" and "not stored" are different
+ *   answers, and returning the not-found shape for the first is the silent
+ *   degradation this path used to have.
  */
 export declare function getCredential(key: string): Promise<string | null>;
 /**
@@ -48,6 +113,9 @@ export declare function getCredential(key: string): Promise<string | null>;
  *
  * @param key - Logical key name (e.g. 'auth-token')
  * @returns true on success (including "already deleted"), false on unexpected error
+ * @throws {InvalidCredentialKeyError} if `key` does not match the grammar.
+ *   Not reported as an idempotent success: such a key was never storable, so
+ *   "already deleted" would be a claim the vault cannot make.
  */
 export declare function deleteCredential(key: string): Promise<boolean>;
 /**
@@ -64,7 +132,15 @@ export declare function deleteCredential(key: string): Promise<boolean>;
  * Note: credential keys must match `isValidKey` — lowercase alphanumeric
  * plus hyphen and dot, first and last character alphanumeric, <=64 chars.
  * Both `-` and `.` work as namespace separators; pick whichever convention
- * reads best.
+ * reads best. **This is enforced, not merely documented** (#168): every
+ * function on this path rejects a non-conforming key before dispatching.
+ *
+ * A `prefix` is checked against `isValidKeyPrefix` rather than `isValidKey`,
+ * so it may end on a separator — `"soma.anthropic."` is the intended way to
+ * scope an enumeration to a namespace, and is not itself a valid key.
+ *
+ * @throws {InvalidCredentialKeyError} if `prefix` could not be the leading
+ *   substring of any valid key.
  *
  * @example
  *   // Enumerate all soma-owned Anthropic credentials
@@ -75,4 +151,40 @@ export declare function deleteCredential(key: string): Promise<boolean>;
  *   }
  */
 export declare function listCredentials(prefix?: string): Promise<string[]>;
+/** A value-free answer about one credential in one backend. */
+export interface BackendStateProbe {
+    /** Always `"value"` — distinguishes this from the key-layer probe. */
+    layer: "value";
+    /** Which backend answered. */
+    backend: VaultType;
+    state: SecretState;
+}
+/**
+ * Probe one credential's state in a specific backend.
+ *
+ * Backends that implement `probe()` answer directly. For the rest this falls
+ * back to a `retrieve()`-based mapping — the value is discarded immediately
+ * and never returned — which yields `found`/`absent` honestly and `failed`
+ * when the backend threw. It never invents `locked`, because a backend that
+ * did not report one cannot be assumed to have one, and it never converts a
+ * throw into `absent`.
+ *
+ * Both paths answer readability, not mere presence: the fallback runs the real
+ * `retrieve()`, and an implementing backend is required to exercise the same
+ * access path it would for a read (see `VaultBackend.probe`). `found`
+ * therefore means the reader will get bytes.
+ *
+ * @throws {InvalidCredentialKeyError} if `key` does not match the grammar —
+ *   the same rule every other vault entry point enforces (#168). Policy hooks
+ *   are deliberately NOT run: a probe reads no value, so there is nothing for
+ *   an access-control hook to allow or deny.
+ */
+export declare function probeVaultBackendState(backend: VaultBackend, type: VaultType, key: string): Promise<BackendStateProbe>;
+/**
+ * Probe one credential's state in the backend this process actually uses.
+ *
+ * The value-layer half of the two-layer probe; see `probeKeyProviderState()`
+ * for the vault master key.
+ */
+export declare function probeBackendState(key: string): Promise<BackendStateProbe>;
 //# sourceMappingURL=vault.d.ts.map

package/dist/vault/vault.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../src/vault/vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAYH,OAAO,KAAK,EAAgB,SAAS,EAAE,MAAM,YAAY,CAAC;AAiE1D;;;GAGG;AACH,wBAAgB,cAAc,IAAI,OAAO,CAGxC;AAkBD;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,SAAS,CAE9C;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAalB;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA0BvE;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAYpE;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA2BxE"}
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../src/vault/vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AASH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAMtD,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAe1D;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,kBAAkB,CAAC;AAOrD;;;;;;;;;;GAUG;AACH,qBAAa,aAAc,YAAW,YAAY;IAMpC,OAAO,CAAC,QAAQ,CAAC,IAAI;IALjC;;;;OAIG;gBAC0B,IAAI,GAAE,OAAO,CAAC,YAAY,CAAM;IAE7D,MAAM,CAAC,MAAM,IAAI,OAAO;IAIxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAI1C,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAIpC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAItB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAIlD;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW;CAGhC;AAmFD;;;GAGG;AACH,wBAAgB,cAAc,IAAI,OAAO,CAGxC;AAoFD;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,SAAS,CAE9C;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAqBlB;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAkCvE;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAoBpE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAmCxE;AAuBD,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,KAAK,EAAE,OAAO,CAAC;IACf,8BAA8B;IAC9B,OAAO,EAAE,SAAS,CAAC;IACnB,KAAK,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE,SAAS,EACf,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,iBAAiB,CAAC,CAiC5B;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAE/E"}

package/dist/vault/vault.js

@@ -11,53 +11,152 @@
  * The active backend is selected once at module load by calling each backend's
  * static `detect()` method in order and choosing the first one that returns true.
  *
+ * **Explicit selection (ADR-004) sits in front of that cascade.** `secrets.backend`
+ * (or `CENTIENT_SECRETS_BACKEND`) names a backend directly and fails closed if it
+ * is unusable — it is never silently substituted. `OnePasswordVault` is reachable
+ * *only* this way: having `op` installed is not consent to route credentials into
+ * someone's 1Password vault.
+ *
  * Session TTL: 4 hours from the last successful read/write.
  *
- * Error handling: all functions return null/false on failure — never throw.
+ * Error handling: a *storage* failure is reported as `null`/`false` — the
+ * backend contract is non-throwing. Three things do throw, because they are
+ * not storage outcomes: a policy `before` hook rejecting the operation
+ * (ADR-002 §1.0.0), a backend surfacing an unexpected transport failure from
+ * `retrieve`/`listKeys`, and a malformed credential key
+ * (`InvalidCredentialKeyError`, see the key-validation section below).
  */
 import { storeStringInKeychain, getStringFromKeychain, deleteFromKeychain, listAccountsInKeychain, } from "../crypto/vault-common.js";
+import { probeKeychainCredentialState } from "../crypto/darwin-keychain.js";
 import { WindowsVault } from "./vault-windows.js";
 import { LibsecretVault } from "./vault-libsecret.js";
 import { GpgVault } from "./vault-gpg.js";
 import { EnvVault } from "./vault-env.js";
-import { runBeforeHooks, runAfterHooks } from "./policy.js";
+import { OnePasswordVault } from "./vault-onepassword.js";
+import { loadConfig } from "../key-providers/resolve.js";
+import { runBeforeHooks, runAfterHooks, rejectedEventType } from "./policy.js";
+import { assertValidKey, isValidKey, isValidKeyPrefix } from "./vault-utils.js";
+import { InvalidCredentialKeyError } from "./session-vault-errors.js";
 // =============================================================================
 // Constants
 // =============================================================================
-const AUTH_KEYCHAIN_SERVICE = "centient-auth";
+/**
+ * The keychain service every credential VALUE lives under. Exported because
+ * the migration helper (`migrateLoginCredentialToSystem`) and operator
+ * tooling have to name the same service — a second literal somewhere else is
+ * how a migration silently moves nothing.
+ */
+export const AUTH_KEYCHAIN_SERVICE = "centient-auth";
 const SESSION_TTL_MS = 4 * 60 * 60 * 1000; // 4 hours
 // =============================================================================
 // KeychainVault wrapper
 // =============================================================================
 /**
- * Wraps the existing macOS Keychain helper functions as a VaultBackend.
+ * Wraps the macOS Keychain helper functions as a VaultBackend.
+ *
+ * Every method routes through `crypto/darwin-keychain.ts` (#188), so credential
+ * values inherit explicit System-keychain reads in a sessionless context,
+ * `-U` replace-in-place writes and `-T /usr/bin/security` reader
+ * preauthorization — the same posture the KeyProvider layer gets for the vault
+ * master key.
+ *
  * Only available on macOS (darwin).
  */
-class KeychainVault {
+export class KeychainVault {
+    deps;
+    /**
+     * @param deps - Injection seam for the `security` CLI and the
+     *   platform/environment that decide the read path. Omitted in production;
+     *   supplied by tests so the exact argv is assertable.
+     */
+    constructor(deps = {}) {
+        this.deps = deps;
+    }
     static detect() {
         return process.platform === "darwin";
     }
     store(key, value) {
-        return storeStringInKeychain(AUTH_KEYCHAIN_SERVICE, key, value);
+        return storeStringInKeychain(AUTH_KEYCHAIN_SERVICE, key, value, this.deps);
     }
     retrieve(key) {
-        return getStringFromKeychain(AUTH_KEYCHAIN_SERVICE, key);
+        return getStringFromKeychain(AUTH_KEYCHAIN_SERVICE, key, this.deps);
     }
     delete(key) {
-        return deleteFromKeychain(AUTH_KEYCHAIN_SERVICE, key);
+        return deleteFromKeychain(AUTH_KEYCHAIN_SERVICE, key, this.deps);
     }
     async listKeys(prefix) {
-        return listAccountsInKeychain(AUTH_KEYCHAIN_SERVICE, prefix);
+        return listAccountsInKeychain(AUTH_KEYCHAIN_SERVICE, prefix, this.deps);
+    }
+    /**
+     * The credential state probe: runs the SAME read {@link retrieve} would run
+     * in this context — same path, same explicit target — then discards the
+     * value and returns only the value-free {@link SecretState}.
+     *
+     * A metadata-only lookup would be cheaper and would leave the secret on
+     * disk, but it can only report presence: an item whose ACL does not
+     * preauthorize the reader, or that sits in a locked keychain, is present and
+     * unreadable, and calling that `found` hands a caller trusted state that is
+     * wrong in exactly the direction #188 exists to fix. `found` here means the
+     * reader will get bytes.
+     */
+    probe(key) {
+        return probeKeychainCredentialState(AUTH_KEYCHAIN_SERVICE, key, this.deps);
     }
 }
 // =============================================================================
 // Cascade initialization
 // =============================================================================
 /**
- * Selects the first available vault backend in priority order:
+ * Read the explicitly-selected backend, env taking precedence over config —
+ * the same env > config order the key layer uses (ADR-001).
+ *
+ * Returns null when nothing is explicitly selected, which is the signal to run
+ * the auto-cascade unchanged.
+ */
+function resolveExplicitBackend() {
+    const envBackend = process.env.CENTIENT_SECRETS_BACKEND?.trim();
+    const config = loadConfig().secrets ?? {};
+    const selected = envBackend || config.backend;
+    if (!selected)
+        return null;
+    if (selected !== "1password") {
+        throw new Error(`Unknown secrets backend "${selected}". Supported explicit backends: 1password.`);
+    }
+    const envVault = process.env.CENTIENT_OP_VAULT?.trim();
+    const onePasswordBackend = {
+        ...config.onePasswordBackend,
+        ...(envVault ? { vault: envVault } : {}),
+    };
+    return { type: selected, onePasswordBackend };
+}
+/**
+ * Selects the credential-storage backend.
+ *
+ * **Explicit selection wins and fails closed** (ADR-004 §1): if config or env
+ * names a backend that then turns out to be unusable — no vault configured, `op`
+ * missing or unauthenticated — this throws rather than quietly continuing down
+ * the auto-cascade. Falling through would silently store credentials somewhere
+ * other than where the operator said, which is the whole class of surprise the
+ * opt-in model exists to prevent (P2).
+ *
+ * With no explicit selection, the historical auto-cascade runs unchanged:
  *   Keychain -> Windows -> Libsecret -> GPG -> Env
+ * 1Password is **never** auto-selected — `op` being installed is not consent to
+ * route credentials into it.
  */
 function initVaultBackend() {
+    const explicit = resolveExplicitBackend();
+    if (explicit !== null) {
+        // Constructor throws on a missing vault name — the fail-closed half of §1.
+        const backend = new OnePasswordVault(explicit.onePasswordBackend);
+        if (!OnePasswordVault.detect(true)) {
+            throw new Error('secrets backend "1password" was explicitly selected, but the 1Password CLI ' +
+                "(`op`) is unavailable or not authenticated. Install `op` and sign in, or set " +
+                "OP_SERVICE_ACCOUNT_TOKEN. Refusing to fall back to another backend — an " +
+                "explicit backend choice is never silently substituted.");
+        }
+        return { backend, type: "1password" };
+    }
     if (KeychainVault.detect())
         return { backend: new KeychainVault(), type: "keychain" };
     if (WindowsVault.detect())
@@ -88,14 +187,66 @@ function touchSession() {
     lastAccessAt = Date.now();
 }
 // =============================================================================
+// Key validation (#168)
+//
+// The key grammar is enforced HERE, once, for every backend — not per backend.
+// Before #168 it was documented on `listCredentials` and enforced nowhere on
+// the shared path: `KeychainVault` (cascade position 1, and therefore the
+// active backend on every Mac) and `EnvVault` (position 5, the always-available
+// fallback) accepted anything, while GPG/libsecret/Windows/1Password refused
+// it. A key such as `Auth_Token` consequently stored fine on darwin and was
+// unreadable on every other backend — the silent write/read asymmetry the
+// invariant exists to prevent. One rule enforced once at the boundary is the
+// only shape in which that stays true as backends are added (P6/P2).
+//
+// Validation runs BEFORE the policy `before` hooks. A malformed key is a
+// caller-contract violation, not a policy decision — there is no well-formed
+// operation for a policy to allow or deny, and an access-control hook should
+// never be handed a key the storage layer has already ruled out. The rejection
+// is still audited: the `after` hooks fire with the same `*_rejected` event a
+// policy denial produces, so a refused operation is never invisible to the
+// audit trail. Unlike a policy denial, every policy's `after` hook fires —
+// none was entered, so there is no partially-entered stack to respect.
+// =============================================================================
+/**
+ * Audit the rejection of `op` and hand `err` back for the caller to throw.
+ *
+ * Split out so the four public functions reject identically. It returns the
+ * error rather than throwing it so the call site reads `throw rejectKey(...)`
+ * — the `throw` stays visible where control flow actually leaves.
+ */
+function rejectKey(op, err, start) {
+    runAfterHooks({
+        type: rejectedEventType(op),
+        timestamp: new Date().toISOString(),
+        backend: activeVaultType,
+        ...(op.key !== undefined ? { key: op.key } : {}),
+        ...(op.prefix !== undefined ? { prefix: op.prefix } : {}),
+        error: err.message,
+        durationMs: performance.now() - start,
+    });
+    return err;
+}
+/** Reject a malformed key for a keyed operation, auditing the rejection. */
+function guardKey(key, type, start) {
+    if (isValidKey(key))
+        return;
+    throw rejectKey({ type, key }, new InvalidCredentialKeyError(key, type, "key"), start);
+}
+/** Reject a malformed enumeration prefix, auditing the rejection. */
+function guardPrefix(prefix, start) {
+    if (prefix === undefined || isValidKeyPrefix(prefix))
+        return;
+    throw rejectKey({ type: "enumerate", prefix }, new InvalidCredentialKeyError(prefix, "enumerate", "prefix"), start);
+}
+// =============================================================================
 // Public API
 //
-// Known limitation (0.5.0): when a `before` policy hook rejects an
-// operation by throwing, the rejection propagates to the caller but no
-// `after` event is emitted. This means policy-rejected operations are
-// invisible to the audit trail. The full onion model — where `after`
-// hooks on already-entered policies still fire on abort — ships in 1.0
-// as part of `createSecretsClient`. See ADR-002 §1.0.0.
+// Policy-rejected operations are audited: when a `before` hook throws,
+// the rejection propagates to the caller AND the `after` hooks of the
+// already-entered policies fire with a `*_rejected` event (see
+// `runBeforeHooks` in policy.ts), so a denied operation is never
+// invisible to the audit trail. ADR-002 §1.0.0.
 // =============================================================================
 /**
  * Returns the type identifier for the active vault backend.
@@ -109,13 +260,24 @@ export function getActiveVaultType() {
 /**
  * Store a credential in the active vault backend.
  *
- * @param key     - Logical key name (e.g. 'auth-token', 'refresh-token')
+ * @param key     - Logical key name (e.g. 'auth-token', 'refresh-token').
+ *                  Must match the key grammar — see "Key validation" above.
  * @param value   - The credential value to store
  * @returns true on success, false if the backend write fails
+ * @throws {InvalidCredentialKeyError} if `key` does not match the grammar.
+ *   Nothing is written and no backend is contacted.
  */
 export async function storeCredential(key, value) {
     const start = performance.now();
-    await runBeforeHooks({ type: "write", key });
+    guardKey(key, "write", start);
+    await runBeforeHooks({ type: "write", key }, (error) => ({
+        type: "credential_write_rejected",
+        timestamp: new Date().toISOString(),
+        backend: activeVaultType,
+        key,
+        error,
+        durationMs: performance.now() - start,
+    }));
     const success = activeBackend.store(key, value);
     if (success)
         touchSession();
@@ -133,10 +295,22 @@ export async function storeCredential(key, value) {
  *
  * @param key - Logical key name (e.g. 'auth-token')
  * @returns The stored value, or null if not found / backend unavailable
+ * @throws {InvalidCredentialKeyError} if `key` does not match the grammar.
+ *   Deliberately not `null`: "malformed" and "not stored" are different
+ *   answers, and returning the not-found shape for the first is the silent
+ *   degradation this path used to have.
  */
 export async function getCredential(key) {
     const start = performance.now();
-    await runBeforeHooks({ type: "read", key });
+    guardKey(key, "read", start);
+    await runBeforeHooks({ type: "read", key }, (error) => ({
+        type: "credential_read_rejected",
+        timestamp: new Date().toISOString(),
+        backend: activeVaultType,
+        key,
+        error,
+        durationMs: performance.now() - start,
+    }));
     let value;
     try {
         value = activeBackend.retrieve(key);
@@ -168,10 +342,21 @@ export async function getCredential(key) {
  *
  * @param key - Logical key name (e.g. 'auth-token')
  * @returns true on success (including "already deleted"), false on unexpected error
+ * @throws {InvalidCredentialKeyError} if `key` does not match the grammar.
+ *   Not reported as an idempotent success: such a key was never storable, so
+ *   "already deleted" would be a claim the vault cannot make.
  */
 export async function deleteCredential(key) {
     const start = performance.now();
-    await runBeforeHooks({ type: "delete", key });
+    guardKey(key, "delete", start);
+    await runBeforeHooks({ type: "delete", key }, (error) => ({
+        type: "credential_delete_rejected",
+        timestamp: new Date().toISOString(),
+        backend: activeVaultType,
+        key,
+        error,
+        durationMs: performance.now() - start,
+    }));
     const success = activeBackend.delete(key);
     runAfterHooks({
         type: success ? "credential_deleted" : "credential_delete_failed",
@@ -196,7 +381,15 @@ export async function deleteCredential(key) {
  * Note: credential keys must match `isValidKey` — lowercase alphanumeric
  * plus hyphen and dot, first and last character alphanumeric, <=64 chars.
  * Both `-` and `.` work as namespace separators; pick whichever convention
- * reads best.
+ * reads best. **This is enforced, not merely documented** (#168): every
+ * function on this path rejects a non-conforming key before dispatching.
+ *
+ * A `prefix` is checked against `isValidKeyPrefix` rather than `isValidKey`,
+ * so it may end on a separator — `"soma.anthropic."` is the intended way to
+ * scope an enumeration to a namespace, and is not itself a valid key.
+ *
+ * @throws {InvalidCredentialKeyError} if `prefix` could not be the leading
+ *   substring of any valid key.
  *
  * @example
  *   // Enumerate all soma-owned Anthropic credentials
@@ -208,7 +401,15 @@ export async function deleteCredential(key) {
  */
 export async function listCredentials(prefix) {
     const start = performance.now();
-    await runBeforeHooks({ type: "enumerate", prefix });
+    guardPrefix(prefix, start);
+    await runBeforeHooks({ type: "enumerate", prefix }, (error) => ({
+        type: "credential_enumerate_rejected",
+        timestamp: new Date().toISOString(),
+        backend: activeVaultType,
+        prefix,
+        error,
+        durationMs: performance.now() - start,
+    }));
     let keys;
     try {
         keys = await activeBackend.listKeys(prefix);
@@ -236,4 +437,69 @@ export async function listCredentials(prefix) {
     });
     return keys;
 }
+/**
+ * Probe one credential's state in a specific backend.
+ *
+ * Backends that implement `probe()` answer directly. For the rest this falls
+ * back to a `retrieve()`-based mapping — the value is discarded immediately
+ * and never returned — which yields `found`/`absent` honestly and `failed`
+ * when the backend threw. It never invents `locked`, because a backend that
+ * did not report one cannot be assumed to have one, and it never converts a
+ * throw into `absent`.
+ *
+ * Both paths answer readability, not mere presence: the fallback runs the real
+ * `retrieve()`, and an implementing backend is required to exercise the same
+ * access path it would for a read (see `VaultBackend.probe`). `found`
+ * therefore means the reader will get bytes.
+ *
+ * @throws {InvalidCredentialKeyError} if `key` does not match the grammar —
+ *   the same rule every other vault entry point enforces (#168). Policy hooks
+ *   are deliberately NOT run: a probe reads no value, so there is nothing for
+ *   an access-control hook to allow or deny.
+ */
+export async function probeVaultBackendState(backend, type, key) {
+    assertValidKey(key, "read");
+    if (typeof backend.probe === "function") {
+        try {
+            return { layer: "value", backend: type, state: await backend.probe(key) };
+        }
+        catch (err) {
+            return {
+                layer: "value",
+                backend: type,
+                state: {
+                    kind: "failed",
+                    detail: err instanceof Error ? err.message : String(err),
+                },
+            };
+        }
+    }
+    try {
+        const value = backend.retrieve(key);
+        return {
+            layer: "value",
+            backend: type,
+            state: value !== null ? { kind: "found" } : { kind: "absent" },
+        };
+    }
+    catch (err) {
+        return {
+            layer: "value",
+            backend: type,
+            state: {
+                kind: "failed",
+                detail: err instanceof Error ? err.message : String(err),
+            },
+        };
+    }
+}
+/**
+ * Probe one credential's state in the backend this process actually uses.
+ *
+ * The value-layer half of the two-layer probe; see `probeKeyProviderState()`
+ * for the vault master key.
+ */
+export async function probeBackendState(key) {
+    return probeVaultBackendState(activeBackend, activeVaultType, key);
+}
 //# sourceMappingURL=vault.js.map

package/dist/vault/vault.js.map

@@ -1 +1 @@
-{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../src/vault/vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5D,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAC9C,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AAErD,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,aAAa;IACjB,MAAM,CAAC,MAAM;QACX,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,GAAW,EAAE,KAAa;QAC9B,OAAO,qBAAqB,CAAC,qBAAqB,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAClE,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,qBAAqB,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,OAAO,kBAAkB,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAe;QAC5B,OAAO,sBAAsB,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC;CACF;AAED,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF;;;GAGG;AACH,SAAS,gBAAgB;IACvB,IAAI,aAAa,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,aAAa,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACtF,IAAI,YAAY,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACnF,IAAI,cAAc,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACzF,IAAI,QAAQ,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACvE,OAAO,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,gBAAgB,EAAE,CAAC;AAE7E,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF,yDAAyD;AACzD,IAAI,YAAY,GAAkB,IAAI,CAAC;AAEvC;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,cAAc,CAAC;AACpD,CAAC;AAED,qDAAqD;AACrD,SAAS,YAAY;IACnB,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAC5B,CAAC;AAED,gFAAgF;AAChF,aAAa;AACb,EAAE;AACF,mEAAmE;AACnE,uEAAuE;AACvE,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,wDAAwD;AACxD,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAW,EACX,KAAa;IAEb,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,OAAO;QAAE,YAAY,EAAE,CAAC;IAC5B,aAAa,CAAC;QACZ,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,yBAAyB;QAChE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5C,IAAI,KAAoB,CAAC;IACzB,IAAI,CAAC;QACH,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,aAAa,CAAC;YACZ,IAAI,EAAE,wBAAwB;YAC9B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,eAAe;YACxB,GAAG;YACH,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACvD,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;SACtC,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,KAAK,KAAK,IAAI;QAAE,YAAY,EAAE,CAAC;IACnC,aAAa,CAAC;QACZ,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,yBAAyB;QACpE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1C,aAAa,CAAC;QACZ,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,0BAA0B;QACjE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAe;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;IACpD,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,aAAa,CAAC;YACZ,IAAI,EAAE,6BAA6B;YACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,eAAe;YACxB,MAAM;YACN,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACvD,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;SACtC,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,YAAY,EAAE,CAAC;IACpC,aAAa,CAAC;QACZ,IAAI,EAAE,uBAAuB;QAC7B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,MAAM;QACN,QAAQ,EAAE,IAAI,CAAC,MAAM;QACrB,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../src/vault/vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAG5E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAKzD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAE/E,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEtE,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AACrD,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AAErD,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF;;;;;;;;;;GAUG;AACH,MAAM,OAAO,aAAa;IAMK;IAL7B;;;;OAIG;IACH,YAA6B,OAA8B,EAAE;QAAhC,SAAI,GAAJ,IAAI,CAA4B;IAAG,CAAC;IAEjE,MAAM,CAAC,MAAM;QACX,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,GAAW,EAAE,KAAa;QAC9B,OAAO,qBAAqB,CAAC,qBAAqB,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,qBAAqB,CAAC,qBAAqB,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,OAAO,kBAAkB,CAAC,qBAAqB,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAe;QAC5B,OAAO,sBAAsB,CAAC,qBAAqB,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,GAAW;QACf,OAAO,4BAA4B,CAAC,qBAAqB,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,CAAC;CACF;AAED,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF;;;;;;GAMG;AACH,SAAS,sBAAsB;IAI7B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAC;IAChE,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,UAAU,IAAI,MAAM,CAAC,OAAO,CAAC;IAC9C,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,4BAA4B,QAAQ,4CAA4C,CACjF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACvD,MAAM,kBAAkB,GAA6B;QACnD,GAAG,MAAM,CAAC,kBAAkB;QAC5B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzC,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,gBAAgB;IACvB,MAAM,QAAQ,GAAG,sBAAsB,EAAE,CAAC;IAC1C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,2EAA2E;QAC3E,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QAClE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,6EAA6E;gBAC3E,+EAA+E;gBAC/E,0EAA0E;gBAC1E,wDAAwD,CAC3D,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACxC,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,aAAa,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACtF,IAAI,YAAY,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACnF,IAAI,cAAc,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACzF,IAAI,QAAQ,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACvE,OAAO,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,gBAAgB,EAAE,CAAC;AAE7E,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF,yDAAyD;AACzD,IAAI,YAAY,GAAkB,IAAI,CAAC;AAEvC;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,cAAc,CAAC;AACpD,CAAC;AAED,qDAAqD;AACrD,SAAS,YAAY;IACnB,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAC5B,CAAC;AAED,gFAAgF;AAChF,wBAAwB;AACxB,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,0EAA0E;AAC1E,gFAAgF;AAChF,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,6EAA6E;AAC7E,qEAAqE;AACrE,EAAE;AACF,yEAAyE;AACzE,6EAA6E;AAC7E,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,2EAA2E;AAC3E,2EAA2E;AAC3E,uEAAuE;AACvE,gFAAgF;AAEhF;;;;;;GAMG;AACH,SAAS,SAAS,CAChB,EAAoB,EACpB,GAA8B,EAC9B,KAAa;IAEb,aAAa,CAAC;QACZ,IAAI,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAC3B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,KAAK,EAAE,GAAG,CAAC,OAAO;QAClB,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAC5E,SAAS,QAAQ,CACf,GAAW,EACX,IAAiC,EACjC,KAAa;IAEb,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO;IAC5B,MAAM,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,yBAAyB,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;AACzF,CAAC;AAED,qEAAqE;AACrE,SAAS,WAAW,CAAC,MAA0B,EAAE,KAAa;IAC5D,IAAI,MAAM,KAAK,SAAS,IAAI,gBAAgB,CAAC,MAAM,CAAC;QAAE,OAAO;IAC7D,MAAM,SAAS,CACb,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAC7B,IAAI,yBAAyB,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,EAC5D,KAAK,CACN,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,aAAa;AACb,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,+DAA+D;AAC/D,iEAAiE;AACjE,gDAAgD;AAChD,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAW,EACX,KAAa;IAEb,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9B,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACvD,IAAI,EAAE,2BAA2B;QACjC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,KAAK;QACL,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,OAAO;QAAE,YAAY,EAAE,CAAC;IAC5B,aAAa,CAAC;QACZ,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,yBAAyB;QAChE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7B,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtD,IAAI,EAAE,0BAA0B;QAChC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,KAAK;QACL,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC,CAAC;IACJ,IAAI,KAAoB,CAAC;IACzB,IAAI,CAAC;QACH,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,aAAa,CAAC;YACZ,IAAI,EAAE,wBAAwB;YAC9B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,eAAe;YACxB,GAAG;YACH,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACvD,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;SACtC,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,KAAK,KAAK,IAAI;QAAE,YAAY,EAAE,CAAC;IACnC,aAAa,CAAC;QACZ,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,yBAAyB;QACpE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/B,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI,EAAE,4BAA4B;QAClC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,KAAK;QACL,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1C,aAAa,CAAC;QACZ,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,0BAA0B;QACjE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAe;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3B,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9D,IAAI,EAAE,+BAA+B;QACrC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,MAAM;QACN,KAAK;QACL,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC,CAAC;IACJ,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,aAAa,CAAC;YACZ,IAAI,EAAE,6BAA6B;YACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,eAAe;YACxB,MAAM;YACN,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACvD,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;SACtC,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,YAAY,EAAE,CAAC;IACpC,aAAa,CAAC;QACZ,IAAI,EAAE,uBAAuB;QAC7B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,MAAM;QACN,QAAQ,EAAE,IAAI,CAAC,MAAM;QACrB,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAgCD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAqB,EACrB,IAAe,EACf,GAAW;IAEX,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5B,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACzD;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpC,OAAO;YACL,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC/D,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,IAAI;YACb,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACzD;SACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAW;IACjD,OAAO,sBAAsB,CAAC,aAAa,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC;AACrE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@centient/secrets",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "Cross-platform secrets vault with AES-256-GCM encryption and platform-native key storage",
   "repository": {
     "type": "git",