@centient/secrets 0.8.0 → 0.10.0

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE7F,mBAAmB;AACnB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGzI,qBAAqB;AACrB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3I,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,yBAAyB;AACzB,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEhG,MAAM;AACN,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGlD,2EAA2E;AAC3E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAIpJ,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,6BAA6B,EAC7B,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,EAC3B,mBAAmB,EACnB,8BAA8B,GAC/B,MAAM,wCAAwC,CAAC;AAOhD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAGlH,aAAa;AACb,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,SAAS;AACT,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGtF,wEAAwE;AACxE,0EAA0E;AAC1E,qEAAqE;AACrE,6EAA6E;AAC7E,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACvI,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,GACf,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE7F,mBAAmB;AACnB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAS/K,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE7E,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAGnF,qBAAqB;AACrB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3I,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,2EAA2E;AAC3E,4EAA4E;AAC5E,4EAA4E;AAC5E,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAGzH,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,0CAA0C;AAC1C,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,sBAAsB,EACtB,4BAA4B,EAC5B,wBAAwB,EACxB,uBAAuB,EACvB,6BAA6B,EAC7B,8BAA8B,EAC9B,wBAAwB,EACxB,uBAAuB;AACvB,2EAA2E;AAC3E,6EAA6E;AAC7E,4BAA4B;AAC5B,4BAA4B,EAC5B,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,EACpB,8BAA8B,EAC9B,kBAAkB,EAClB,sBAAsB,EACtB,UAAU,EACV,oBAAoB,EACpB,aAAa,EACb,YAAY,GACb,MAAM,6BAA6B,CAAC;AAUrC,yBAAyB;AACzB,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEhG,MAAM;AACN,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGlD,2EAA2E;AAC3E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAIpJ,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEzI,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEtG,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,6BAA6B,EAC7B,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,EAC3B,mBAAmB,EACnB,8BAA8B,GAC/B,MAAM,wCAAwC,CAAC;AAOhD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAGlH,gFAAgF;AAChF,8EAA8E;AAC9E,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,cAAc,EACd,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAGhC,SAAS;AACT,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAGzG,wEAAwE;AACxE,0EAA0E;AAC1E,qEAAqE;AACrE,6EAA6E;AAC7E,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACnJ,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC"}

package/dist/key-providers/keychain-provider.d.ts

@@ -1,12 +1,22 @@
 /**
  * Key Provider — macOS Keychain
  *
- * Wraps the existing getKeyFromKeychain / storeKeyInKeychain functions
- * from vault-common.ts as a KeyProvider implementation.
+ * Wraps the getKeyFromKeychain / storeKeyInKeychain functions from
+ * vault-common.ts as a KeyProvider implementation. Those in turn delegate to
+ * the hardened `security` core in `crypto/darwin-keychain.ts` (#188), so the
+ * vault MASTER KEY inherits the same posture as credential values: explicit
+ * System-keychain reads in a sessionless context, `-U` replace-in-place
+ * writes, and `-T /usr/bin/security` reader preauthorization.
+ *
+ * Fixing only the value layer would have been half a fix — the master key
+ * would have become unreadable in exactly the contexts the values had just
+ * become readable in.
  *
  * Only available on macOS (darwin). Uses the `security` CLI to interact
  * with the system Keychain, which prompts for Touch ID or system password.
  */
+import type { KeychainDeps } from "../crypto/darwin-keychain.js";
+import type { SecretState } from "../secret-state.js";
 import type { KeyProvider, KeyProviderType } from "./types.js";
 /**
  * Default Keychain item coordinates. These are the historical values every
@@ -29,11 +39,18 @@ export interface KeychainProviderOptions {
     service?: string;
     /** Keychain account name. Defaults to {@link DEFAULT_KEYCHAIN_ACCOUNT}. */
     account?: string;
+    /**
+     * Injection seam for the `security` CLI and the platform/environment that
+     * decide the read path (#188). Omitted in production; supplied by tests so
+     * the exact argv is assertable without touching a real keychain.
+     */
+    deps?: Partial<KeychainDeps>;
 }
 export declare class KeychainProvider implements KeyProvider {
     readonly name: KeyProviderType;
     private readonly service;
     private readonly account;
+    private readonly deps;
     /**
      * @param options - Optional per-consumer Keychain item coordinates. With no
      *   options the provider targets the historical `centient-vault`/`vault-key`
@@ -45,5 +62,16 @@ export declare class KeychainProvider implements KeyProvider {
     getKey(): Buffer | null;
     storeKey(key: Buffer): boolean;
     deleteKey(): boolean;
+    /**
+     * The five-way state of the vault master key, value-free (#188).
+     *
+     * Runs the SAME read {@link getKey} would run in this context, then discards
+     * the key and returns only the value-free {@link SecretState}. A
+     * metadata-only lookup would answer presence, not readability — and a key
+     * that is present but sits behind an ACL this context cannot satisfy is
+     * exactly the case a caller needs told apart from "no key stored". `found`
+     * here means the reader will get bytes.
+     */
+    probeKey(): SecretState;
 }
 //# sourceMappingURL=keychain-provider.d.ts.map

package/dist/key-providers/keychain-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keychain-provider.d.ts","sourceRoot":"","sources":["../../src/key-providers/keychain-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAM/D;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,mBAAmB,CAAC;AACzD,eAAO,MAAM,wBAAwB,cAAc,CAAC;AAMpD;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAMD,qBAAa,gBAAiB,YAAW,WAAW;IAClD,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAc;IAE5C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IAEjC;;;;OAIG;gBACS,OAAO,GAAE,uBAA4B;IAKjD,wCAAwC;IACxC,MAAM,CAAC,MAAM,IAAI,OAAO;IAIxB,MAAM,IAAI,MAAM,GAAG,IAAI;IAIvB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAI9B,SAAS,IAAI,OAAO;CAGrB"}
+{"version":3,"file":"keychain-provider.d.ts","sourceRoot":"","sources":["../../src/key-providers/keychain-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAQH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAM/D;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,mBAAmB,CAAC;AACzD,eAAO,MAAM,wBAAwB,cAAc,CAAC;AAMpD;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;CAC9B;AAMD,qBAAa,gBAAiB,YAAW,WAAW;IAClD,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAc;IAE5C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAwB;IAE7C;;;;OAIG;gBACS,OAAO,GAAE,uBAA4B;IAMjD,wCAAwC;IACxC,MAAM,CAAC,MAAM,IAAI,OAAO;IAIxB,MAAM,IAAI,MAAM,GAAG,IAAI;IAIvB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAI9B,SAAS,IAAI,OAAO;IAIpB;;;;;;;;;OASG;IACH,QAAQ,IAAI,WAAW;CAGxB"}

package/dist/key-providers/keychain-provider.js

@@ -1,13 +1,22 @@
 /**
  * Key Provider — macOS Keychain
  *
- * Wraps the existing getKeyFromKeychain / storeKeyInKeychain functions
- * from vault-common.ts as a KeyProvider implementation.
+ * Wraps the getKeyFromKeychain / storeKeyInKeychain functions from
+ * vault-common.ts as a KeyProvider implementation. Those in turn delegate to
+ * the hardened `security` core in `crypto/darwin-keychain.ts` (#188), so the
+ * vault MASTER KEY inherits the same posture as credential values: explicit
+ * System-keychain reads in a sessionless context, `-U` replace-in-place
+ * writes, and `-T /usr/bin/security` reader preauthorization.
+ *
+ * Fixing only the value layer would have been half a fix — the master key
+ * would have become unreadable in exactly the contexts the values had just
+ * become readable in.
  *
  * Only available on macOS (darwin). Uses the `security` CLI to interact
  * with the system Keychain, which prompts for Touch ID or system password.
  */
 import { getKeyFromKeychain, storeKeyInKeychain, deleteFromKeychain, } from "../crypto/vault-common.js";
+import { probeKeychainCredentialState } from "../crypto/darwin-keychain.js";
 // =============================================================================
 // Constants
 // =============================================================================
@@ -25,6 +34,7 @@ export class KeychainProvider {
     name = "keychain";
     service;
     account;
+    deps;
     /**
      * @param options - Optional per-consumer Keychain item coordinates. With no
      *   options the provider targets the historical `centient-vault`/`vault-key`
@@ -33,19 +43,33 @@ export class KeychainProvider {
     constructor(options = {}) {
         this.service = options.service ?? DEFAULT_KEYCHAIN_SERVICE;
         this.account = options.account ?? DEFAULT_KEYCHAIN_ACCOUNT;
+        this.deps = options.deps ?? {};
     }
     /** Returns true if running on macOS. */
     static detect() {
         return process.platform === "darwin";
     }
     getKey() {
-        return getKeyFromKeychain(this.service, this.account);
+        return getKeyFromKeychain(this.service, this.account, this.deps);
     }
     storeKey(key) {
-        return storeKeyInKeychain(this.service, this.account, key);
+        return storeKeyInKeychain(this.service, this.account, key, this.deps);
     }
     deleteKey() {
-        return deleteFromKeychain(this.service, this.account);
+        return deleteFromKeychain(this.service, this.account, this.deps);
+    }
+    /**
+     * The five-way state of the vault master key, value-free (#188).
+     *
+     * Runs the SAME read {@link getKey} would run in this context, then discards
+     * the key and returns only the value-free {@link SecretState}. A
+     * metadata-only lookup would answer presence, not readability — and a key
+     * that is present but sits behind an ACL this context cannot satisfy is
+     * exactly the case a caller needs told apart from "no key stored". `found`
+     * here means the reader will get bytes.
+     */
+    probeKey() {
+        return probeKeychainCredentialState(this.service, this.account, this.deps);
     }
 }
 //# sourceMappingURL=keychain-provider.js.map

package/dist/key-providers/keychain-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"keychain-provider.js","sourceRoot":"","sources":["../../src/key-providers/keychain-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAGnC,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,gBAAgB,CAAC;AACzD,MAAM,CAAC,MAAM,wBAAwB,GAAG,WAAW,CAAC;AAsBpD,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,MAAM,OAAO,gBAAgB;IAClB,IAAI,GAAoB,UAAU,CAAC;IAE3B,OAAO,CAAS;IAChB,OAAO,CAAS;IAEjC;;;;OAIG;IACH,YAAY,UAAmC,EAAE;QAC/C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,wBAAwB,CAAC;QAC3D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,wBAAwB,CAAC;IAC7D,CAAC;IAED,wCAAwC;IACxC,MAAM,CAAC,MAAM;QACX,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACvC,CAAC;IAED,MAAM;QACJ,OAAO,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IAED,SAAS;QACP,OAAO,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;CACF"}
+{"version":3,"file":"keychain-provider.js","sourceRoot":"","sources":["../../src/key-providers/keychain-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAK5E,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,gBAAgB,CAAC;AACzD,MAAM,CAAC,MAAM,wBAAwB,GAAG,WAAW,CAAC;AA4BpD,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,MAAM,OAAO,gBAAgB;IAClB,IAAI,GAAoB,UAAU,CAAC;IAE3B,OAAO,CAAS;IAChB,OAAO,CAAS;IAChB,IAAI,CAAwB;IAE7C;;;;OAIG;IACH,YAAY,UAAmC,EAAE;QAC/C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,wBAAwB,CAAC;QAC3D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,wBAAwB,CAAC;QAC3D,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;IACjC,CAAC;IAED,wCAAwC;IACxC,MAAM,CAAC,MAAM;QACX,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACvC,CAAC;IAED,MAAM;QACJ,OAAO,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC;IAED,SAAS;QACP,OAAO,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;;;;OASG;IACH,QAAQ;QACN,OAAO,4BAA4B,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,CAAC;CACF"}

package/dist/key-providers/onepassword-provider.d.ts

@@ -9,9 +9,21 @@
  *   3. CLI session — user ran `op signin` (OP_SESSION_* env var)
  *
  * The `op` CLI handles auth selection internally; this provider just
- * shells out to `op read` / `op item create` / `op item edit`.
+ * shells out to `op read` / `op item create` through the shared `op-cli.ts`
+ * helper (ADR-004 §6), which it co-owns with the credential-value backend
+ * `OnePasswordVault`.
  *
- * No dependency on @1password/sdk — uses execFileSync only.
+ * No dependency on @1password/sdk — `execFileSync` only.
+ *
+ * **Key material never reaches argv (#102).** `storeKey` builds the item JSON
+ * in-process and pipes it to `op item create -` via `runOp`'s `input` option —
+ * the argv-safe seam ADR-004 §4 specifies and `OnePasswordVault.store` already
+ * uses. Nothing readable in `ps` / `/proc/<pid>/cmdline` carries the key. This
+ * closes ADR-001's "Process argument visibility" negative, which had the hex
+ * key in a `password=<hex>` argv element for the life of the call.
+ *
+ * `getKey` uses `op read`, whose only argv is a non-secret `op://` reference —
+ * the value comes back on stdout, so that path was never exposed.
  */
 import type { KeyProvider, KeyProviderType, OnePasswordConfig } from "./types.js";
 export declare class OnePasswordProvider implements KeyProvider {
@@ -29,10 +41,58 @@ export declare class OnePasswordProvider implements KeyProvider {
      */
     static detect(): boolean;
     getKey(): Buffer | null;
+    /**
+     * Store the vault key. Overwrites any existing item.
+     *
+     * The hex travels on **stdin** inside an item template and never appears in
+     * argv (#102): the template goes to `op item create -` through `runOp`'s
+     * `input` option, the argv-safe seam ADR-004 §4 specifies. Item ids, titles
+     * and vault names are not secret and stay on the command line.
+     *
+     * ## Ordering: create first, delete the old item last
+     *
+     * `op item edit` has no stdin template form, so the overwrite cannot be an
+     * edit-in-place without putting `password=<hex>` back in argv. The write is
+     * therefore a replace — but a **non-destructive** one, sequenced so no window
+     * exists in which the master key is absent from 1Password:
+     *
+     *   1. Resolve the existing item's id (absent ⇒ plain create, no step 3).
+     *   2. Create the replacement under the **same canonical title** — `op`
+     *      permits duplicate titles — and capture the new item's id.
+     *      Create fails ⇒ the old item is untouched and this returns false.
+     *   3. Delete the **old** item by id. Delete fails ⇒ roll back by deleting
+     *      the **new** item by id, leaving the old one in place, and return false.
+     *
+     * The key is only ever removed from 1Password after its replacement durably
+     * exists. Nothing here renames, so there is no window where a rename failure
+     * strands the item under a title `getKey` cannot read.
+     *
+     * **Residual window (double failure).** If step 3's delete fails *and* the
+     * rollback delete of the new item also fails, both items remain and this
+     * returns false. That is not a loss: no key is destroyed, and {@link getKey}
+     * does not silently pick one — `op read` on an ambiguous title fails, so the
+     * caller gets a loud failure rather than a wrong key. The operator resolves
+     * it by deleting whichever item is stale.
+     */
     storeKey(key: Buffer): boolean;
     deleteKey(): boolean;
-    private itemExists;
-    private createItem;
-    private updateItem;
+    /**
+     * The id of the existing key item, or null when there is none.
+     *
+     * @throws when 1Password cannot be asked, or answers with an item whose id
+     *   we cannot read. Both are "unknown", not "absent" — and {@link storeKey}
+     *   must not treat unknown as absent, or a transient read failure would end
+     *   with two items under one title.
+     */
+    private findItemId;
+    /**
+     * Delete an item by id or title, treating "no such item" as the desired end
+     * state.
+     *
+     * Unlike {@link deleteKey}, an auth or network failure is **rethrown** — the
+     * {@link storeKey} path needs to distinguish "the old item is gone" from
+     * "we could not remove it", because only the second case must roll back.
+     */
+    private deleteItem;
 }
 //# sourceMappingURL=onepassword-provider.d.ts.map

package/dist/key-providers/onepassword-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"onepassword-provider.d.ts","sourceRoot":"","sources":["../../src/key-providers/onepassword-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAclF,qBAAa,mBAAoB,YAAW,WAAW;IACrD,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAe;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;gBAElB,MAAM,CAAC,EAAE,iBAAiB;IAKtC;;;;;;;OAOG;IACH,MAAM,CAAC,MAAM,IAAI,OAAO;IA8BxB,MAAM,IAAI,MAAM,GAAG,IAAI;IAkBvB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAU9B,SAAS,IAAI,OAAO;IAkBpB,OAAO,CAAC,UAAU;IAalB,OAAO,CAAC,UAAU;IAmBlB,OAAO,CAAC,UAAU;CAgBnB"}
+{"version":3,"file":"onepassword-provider.d.ts","sourceRoot":"","sources":["../../src/key-providers/onepassword-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAqBlF,qBAAa,mBAAoB,YAAW,WAAW;IACrD,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAe;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;gBAElB,MAAM,CAAC,EAAE,iBAAiB;IAKtC;;;;;;;OAOG;IACH,MAAM,CAAC,MAAM,IAAI,OAAO;IAIxB,MAAM,IAAI,MAAM,GAAG,IAAI;IAcvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAsD9B,SAAS,IAAI,OAAO;IAcpB;;;;;;;OAOG;IACH,OAAO,CAAC,UAAU;IAsBlB;;;;;;;OAOG;IACH,OAAO,CAAC,UAAU;CAUnB"}

package/dist/key-providers/onepassword-provider.js

@@ -9,11 +9,23 @@
  *   3. CLI session — user ran `op signin` (OP_SESSION_* env var)
  *
  * The `op` CLI handles auth selection internally; this provider just
- * shells out to `op read` / `op item create` / `op item edit`.
+ * shells out to `op read` / `op item create` through the shared `op-cli.ts`
+ * helper (ADR-004 §6), which it co-owns with the credential-value backend
+ * `OnePasswordVault`.
  *
- * No dependency on @1password/sdk — uses execFileSync only.
+ * No dependency on @1password/sdk — `execFileSync` only.
+ *
+ * **Key material never reaches argv (#102).** `storeKey` builds the item JSON
+ * in-process and pipes it to `op item create -` via `runOp`'s `input` option —
+ * the argv-safe seam ADR-004 §4 specifies and `OnePasswordVault.store` already
+ * uses. Nothing readable in `ps` / `/proc/<pid>/cmdline` carries the key. This
+ * closes ADR-001's "Process argument visibility" negative, which had the hex
+ * key in a `password=<hex>` argv element for the life of the call.
+ *
+ * `getKey` uses `op read`, whose only argv is a non-secret `op://` reference —
+ * the value comes back on stdout, so that path was never exposed.
  */
-import { execFileSync } from "child_process";
+import { detectOpCli, runOp, OpCliError, OP_READ_TIMEOUT_MS, OP_WRITE_TIMEOUT_MS, } from "./op-cli.js";
 // =============================================================================
 // Defaults
 // =============================================================================
@@ -40,38 +52,12 @@ export class OnePasswordProvider {
      *     is configured (desktop app / prior sign-in).
      */
     static detect() {
-        // Check op binary exists
-        try {
-            execFileSync("op", ["--version"], {
-                stdio: ["pipe", "pipe", "pipe"],
-                timeout: 5000,
-            });
-        }
-        catch {
-            return false;
-        }
-        // Service account mode — no further checks needed
-        if (process.env.OP_SERVICE_ACCOUNT_TOKEN) {
-            return true;
-        }
-        // Interactive mode — check for configured accounts
-        try {
-            const output = execFileSync("op", ["account", "list", "--format=json"], { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 5000 }).trim();
-            // Returns "[]" when no accounts are configured
-            return output !== "[]" && output.length > 2;
-        }
-        catch {
-            return false;
-        }
+        return detectOpCli();
     }
     getKey() {
         try {
             const ref = `op://${this.vault}/${this.item}/${FIELD_NAME}`;
-            const result = execFileSync("op", ["read", ref], {
-                encoding: "utf8",
-                stdio: ["pipe", "pipe", "pipe"],
-                timeout: 30000,
-            }).trim();
+            const result = runOp(["read", ref], { timeoutMs: OP_WRITE_TIMEOUT_MS });
             if (!result)
                 return null;
             const buf = Buffer.from(result, "hex");
@@ -84,63 +70,169 @@ export class OnePasswordProvider {
             return null;
         }
     }
+    /**
+     * Store the vault key. Overwrites any existing item.
+     *
+     * The hex travels on **stdin** inside an item template and never appears in
+     * argv (#102): the template goes to `op item create -` through `runOp`'s
+     * `input` option, the argv-safe seam ADR-004 §4 specifies. Item ids, titles
+     * and vault names are not secret and stay on the command line.
+     *
+     * ## Ordering: create first, delete the old item last
+     *
+     * `op item edit` has no stdin template form, so the overwrite cannot be an
+     * edit-in-place without putting `password=<hex>` back in argv. The write is
+     * therefore a replace — but a **non-destructive** one, sequenced so no window
+     * exists in which the master key is absent from 1Password:
+     *
+     *   1. Resolve the existing item's id (absent ⇒ plain create, no step 3).
+     *   2. Create the replacement under the **same canonical title** — `op`
+     *      permits duplicate titles — and capture the new item's id.
+     *      Create fails ⇒ the old item is untouched and this returns false.
+     *   3. Delete the **old** item by id. Delete fails ⇒ roll back by deleting
+     *      the **new** item by id, leaving the old one in place, and return false.
+     *
+     * The key is only ever removed from 1Password after its replacement durably
+     * exists. Nothing here renames, so there is no window where a rename failure
+     * strands the item under a title `getKey` cannot read.
+     *
+     * **Residual window (double failure).** If step 3's delete fails *and* the
+     * rollback delete of the new item also fails, both items remain and this
+     * returns false. That is not a loss: no key is destroyed, and {@link getKey}
+     * does not silently pick one — `op read` on an ambiguous title fails, so the
+     * caller gets a loud failure rather than a wrong key. The operator resolves
+     * it by deleting whichever item is stale.
+     */
     storeKey(key) {
-        const keyHex = key.toString("hex");
-        // Check if item already exists
-        if (this.itemExists()) {
-            return this.updateItem(keyHex);
-        }
-        return this.createItem(keyHex);
-    }
-    deleteKey() {
+        const item = {
+            title: this.item,
+            category: "PASSWORD",
+            vault: { name: this.vault },
+            fields: [
+                { id: FIELD_NAME, type: "CONCEALED", value: key.toString("hex") },
+            ],
+        };
+        // Step 1. What is already there? A failure to answer that is a failure to
+        // store: creating blind would risk leaving two items under one title.
+        let oldId;
         try {
-            execFileSync("op", ["item", "delete", this.item, "--vault", this.vault], { stdio: ["pipe", "pipe", "pipe"], timeout: 30000 });
-            return true;
+            oldId = this.findItemId();
         }
         catch {
-            // Item may not exist — treat as success
-            return true;
+            return false;
         }
-    }
-    // ---------------------------------------------------------------------------
-    // Private helpers
-    // ---------------------------------------------------------------------------
-    itemExists() {
+        // Step 2. Write the replacement. Until this succeeds nothing is removed.
+        let newId;
         try {
-            execFileSync("op", ["item", "get", this.item, "--vault", this.vault, "--format=json"], { stdio: ["pipe", "pipe", "pipe"], timeout: 15000 });
-            return true;
+            const created = runOp(["item", "create", "--format=json", "-"], {
+                input: JSON.stringify(item),
+                timeoutMs: OP_WRITE_TIMEOUT_MS,
+            });
+            newId = parseItemId(created);
         }
         catch {
             return false;
         }
-    }
-    createItem(keyHex) {
+        if (oldId === null)
+            return true;
+        // Step 3. Retire the superseded item, by id so the duplicate title cannot
+        // make the delete ambiguous.
         try {
-            execFileSync("op", [
-                "item", "create",
-                "--category", "Password",
-                "--title", this.item,
-                "--vault", this.vault,
-                `${FIELD_NAME}=${keyHex}`,
-            ], { stdio: ["pipe", "pipe", "pipe"], timeout: 30000 });
+            this.deleteItem(oldId);
             return true;
         }
         catch {
+            // Roll back: the store did not complete, so the vault should look as it
+            // did before. Deleting the new item leaves the old key readable.
+            if (newId !== null) {
+                try {
+                    this.deleteItem(newId);
+                }
+                catch {
+                    // Double failure — see "Residual window" above. Both items remain;
+                    // getKey fails loudly on the ambiguous title rather than returning a
+                    // key that may be the wrong one, and neither key is lost.
+                }
+            }
             return false;
         }
     }
-    updateItem(keyHex) {
+    deleteKey() {
         try {
-            execFileSync("op", [
-                "item", "edit", this.item,
-                "--vault", this.vault,
-                `${FIELD_NAME}=${keyHex}`,
-            ], { stdio: ["pipe", "pipe", "pipe"], timeout: 30000 });
-            return true;
+            this.deleteItem(this.item);
         }
         catch {
-            return false;
+            // Unchanged from before #102: this entry point reports success for any
+            // failure, not just a missing item.
+        }
+        return true;
+    }
+    // ---------------------------------------------------------------------------
+    // Private helpers
+    // ---------------------------------------------------------------------------
+    /**
+     * The id of the existing key item, or null when there is none.
+     *
+     * @throws when 1Password cannot be asked, or answers with an item whose id
+     *   we cannot read. Both are "unknown", not "absent" — and {@link storeKey}
+     *   must not treat unknown as absent, or a transient read failure would end
+     *   with two items under one title.
+     */
+    findItemId() {
+        let raw;
+        try {
+            raw = runOp(["item", "get", this.item, "--vault", this.vault, "--format=json"], { timeoutMs: OP_READ_TIMEOUT_MS });
         }
+        catch (err) {
+            if (err instanceof OpCliError && err.isNotFound)
+                return null;
+            throw err;
+        }
+        const id = parseItemId(raw);
+        if (id === null) {
+            throw new Error(`op item get ${this.item} returned no readable item id — refusing to ` +
+                "create a second item under the same title");
+        }
+        return id;
+    }
+    /**
+     * Delete an item by id or title, treating "no such item" as the desired end
+     * state.
+     *
+     * Unlike {@link deleteKey}, an auth or network failure is **rethrown** — the
+     * {@link storeKey} path needs to distinguish "the old item is gone" from
+     * "we could not remove it", because only the second case must roll back.
+     */
+    deleteItem(ref) {
+        try {
+            runOp(["item", "delete", ref, "--vault", this.vault], {
+                timeoutMs: OP_WRITE_TIMEOUT_MS,
+            });
+        }
+        catch (err) {
+            if (err instanceof OpCliError && err.isNotFound)
+                return;
+            throw err;
+        }
+    }
+}
+// =============================================================================
+// Helpers
+// =============================================================================
+/** The `id` of an item in `op … --format=json` output, or null if unreadable. */
+function parseItemId(raw) {
+    if (raw === "")
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
     }
+    if (typeof parsed !== "object" || parsed === null)
+        return null;
+    const id = parsed.id;
+    return typeof id === "string" && id.length > 0 ? id : null;
 }
 //# sourceMappingURL=onepassword-provider.js.map

package/dist/key-providers/onepassword-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"onepassword-provider.js","sourceRoot":"","sources":["../../src/key-providers/onepassword-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C,gFAAgF;AAChF,WAAW;AACX,gFAAgF;AAEhF,MAAM,aAAa,GAAG,SAAS,CAAC;AAChC,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAC1C,MAAM,UAAU,GAAG,UAAU,CAAC;AAE9B,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,MAAM,OAAO,mBAAmB;IACrB,IAAI,GAAoB,WAAW,CAAC;IAC5B,KAAK,CAAS;IACd,IAAI,CAAS;IAE9B,YAAY,MAA0B;QACpC,IAAI,CAAC,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,aAAa,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,YAAY,CAAC;IAC3C,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,MAAM;QACX,yBAAyB;QACzB,IAAI,CAAC;YACH,YAAY,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE;gBAChC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QAED,kDAAkD;QAClD,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,mDAAmD;QACnD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CACzB,IAAI,EACJ,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,CAAC,EACpC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CACrE,CAAC,IAAI,EAAE,CAAC;YACT,+CAA+C;YAC/C,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,MAAM;QACJ,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC;YAC5D,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE;gBAC/C,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,OAAO,EAAE,KAAK;aACf,CAAC,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACvC,mDAAmD;YACnD,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;gBAAE,OAAO,IAAI,CAAC;YACnC,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAEnC,+BAA+B;QAC/B,IAAI,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAED,SAAS;QACP,IAAI,CAAC;YACH,YAAY,CACV,IAAI,EACJ,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EACpD,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CACpD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAEtE,UAAU;QAChB,IAAI,CAAC;YACH,YAAY,CACV,IAAI,EACJ,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC,EAClE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CACpD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,MAAc;QAC/B,IAAI,CAAC;YACH,YAAY,CACV,IAAI,EACJ;gBACE,MAAM,EAAE,QAAQ;gBAChB,YAAY,EAAE,UAAU;gBACxB,SAAS,EAAE,IAAI,CAAC,IAAI;gBACpB,SAAS,EAAE,IAAI,CAAC,KAAK;gBACrB,GAAG,UAAU,IAAI,MAAM,EAAE;aAC1B,EACD,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CACpD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,MAAc;QAC/B,IAAI,CAAC;YACH,YAAY,CACV,IAAI,EACJ;gBACE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI;gBACzB,SAAS,EAAE,IAAI,CAAC,KAAK;gBACrB,GAAG,UAAU,IAAI,MAAM,EAAE;aAC1B,EACD,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CACpD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"onepassword-provider.js","sourceRoot":"","sources":["../../src/key-providers/onepassword-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EACL,WAAW,EACX,KAAK,EACL,UAAU,EACV,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,gFAAgF;AAChF,WAAW;AACX,gFAAgF;AAEhF,MAAM,aAAa,GAAG,SAAS,CAAC;AAChC,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAC1C,MAAM,UAAU,GAAG,UAAU,CAAC;AAE9B,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,MAAM,OAAO,mBAAmB;IACrB,IAAI,GAAoB,WAAW,CAAC;IAC5B,KAAK,CAAS;IACd,IAAI,CAAS;IAE9B,YAAY,MAA0B;QACpC,IAAI,CAAC,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,aAAa,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,YAAY,CAAC;IAC3C,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,MAAM;QACX,OAAO,WAAW,EAAE,CAAC;IACvB,CAAC;IAED,MAAM;QACJ,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC;YAC5D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACvC,mDAAmD;YACnD,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;gBAAE,OAAO,IAAI,CAAC;YACnC,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,QAAQ,CAAC,GAAW;QAClB,MAAM,IAAI,GAAG;YACX,KAAK,EAAE,IAAI,CAAC,IAAI;YAChB,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE;YAC3B,MAAM,EAAE;gBACN,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;aAClE;SACF,CAAC;QAEF,0EAA0E;QAC1E,sEAAsE;QACtE,IAAI,KAAoB,CAAC;QACzB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QAED,yEAAyE;QACzE,IAAI,KAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,CAAC,EAAE;gBAC9D,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC3B,SAAS,EAAE,mBAAmB;aAC/B,CAAC,CAAC;YACH,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAEhC,0EAA0E;QAC1E,6BAA6B;QAC7B,IAAI,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,iEAAiE;YACjE,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,IAAI,CAAC;oBACH,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;gBACzB,CAAC;gBAAC,MAAM,CAAC;oBACP,mEAAmE;oBACnE,qEAAqE;oBACrE,0DAA0D;gBAC5D,CAAC;YACH,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,SAAS;QACP,IAAI,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,oCAAoC;QACtC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E;;;;;;;OAOG;IACK,UAAU;QAChB,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,KAAK,CACT,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC,EAClE,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAClC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC;YAC7D,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,CAAC,IAAI,8CAA8C;gBACpE,2CAA2C,CAC9C,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;;;;OAOG;IACK,UAAU,CAAC,GAAW;QAC5B,IAAI,CAAC;YACH,KAAK,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;gBACpD,SAAS,EAAE,mBAAmB;aAC/B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,UAAU;gBAAE,OAAO;YACxD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,iFAAiF;AACjF,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,EAAE,GAAI,MAA2B,CAAC,EAAE,CAAC;IAC3C,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC"}

package/dist/key-providers/op-cli.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Shared 1Password `op` CLI helper (ADR-004 §6).
+ *
+ * Two independent layers call `op` for different purposes — `OnePasswordProvider`
+ * for the vault *encryption key* (ADR-001) and `OnePasswordVault` for credential
+ * *values* (ADR-004) — and before this module each carried its own copy of the
+ * availability probe and its own `execFileSync` invocation. One source of truth
+ * for how `op` is invoked, how long it may take, and what "available and
+ * authenticated" means (P6).
+ *
+ * No dependency on `@1password/sdk` — `execFileSync` only, matching ADR-001's
+ * zero-new-runtime-deps position.
+ */
+/** Probe calls (`--version`, `account list`) — fast or the CLI is unusable. */
+export declare const OP_PROBE_TIMEOUT_MS = 5000;
+/** Metadata reads (`item get`, `item list`) — a network round-trip. */
+export declare const OP_READ_TIMEOUT_MS = 15000;
+/** Mutations and secret reads — desktop-app approval may sit in front of these. */
+export declare const OP_WRITE_TIMEOUT_MS = 30000;
+/** Options for {@link runOp}. */
+export interface RunOpOptions {
+    /**
+     * Data piped to `op` on **stdin**. This is the argv-safe path for secret
+     * values (ADR-004 §4): anything passed here is invisible to `ps`, unlike an
+     * `field=value` argv element.
+     */
+    input?: string;
+    /** Wall-clock timeout. Defaults to {@link OP_READ_TIMEOUT_MS}. */
+    timeoutMs?: number;
+}
+/** A failed `op` invocation, with whatever the CLI wrote to stderr. */
+export declare class OpCliError extends Error {
+    /** The argv `op` was called with — never contains secret values. */
+    readonly args: readonly string[];
+    /** `op`'s stderr, trimmed; empty when the process produced none. */
+    readonly stderr: string;
+    /** The underlying spawn/exit error. Narrows `Error.cause` to this value. */
+    readonly cause: unknown;
+    constructor(
+    /** The argv `op` was called with — never contains secret values. */
+    args: readonly string[], 
+    /** `op`'s stderr, trimmed; empty when the process produced none. */
+    stderr: string, 
+    /** The underlying spawn/exit error. Narrows `Error.cause` to this value. */
+    cause: unknown);
+    /**
+     * True when the failure is 1Password reporting the item simply is not there,
+     * as opposed to an auth, network, or configuration problem.
+     *
+     * The distinction is load-bearing for ADR-004 §7: a not-found is a normal
+     * `null`/`false` return, while an unexpected failure additionally warrants a
+     * one-time stderr warning so a misconfiguration cannot stay silent (P2).
+     * `op` has no stable exit code for this, so the message is the only signal.
+     */
+    get isNotFound(): boolean;
+}
+/**
+ * Invoke `op` and return its stdout, trimmed.
+ *
+ * @param args - argv after the binary. **Never** put a secret value here — pass
+ *   it via {@link RunOpOptions.input} instead (ADR-004 §4).
+ * @throws {@link OpCliError} on spawn failure, non-zero exit, or timeout.
+ */
+export declare function runOp(args: readonly string[], opts?: RunOpOptions): string;
+/**
+ * Whether the `op` CLI is present **and** authenticated.
+ *
+ * True when the binary is on `PATH` and either `OP_SERVICE_ACCOUNT_TOKEN` is
+ * set (headless/CI mode, which needs no further check) or at least one account
+ * is configured (desktop app or a prior `op signin`).
+ *
+ * This answers only "can we talk to 1Password?" — it says nothing about whether
+ * a caller *should*. ADR-004's credential backend is opt-in precisely because
+ * `op` being installed must never by itself route secrets into 1Password (§1);
+ * that selection decision belongs to the caller, not here.
+ */
+export declare function detectOpCli(): boolean;
+//# sourceMappingURL=op-cli.d.ts.map

package/dist/key-providers/op-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"op-cli.d.ts","sourceRoot":"","sources":["../../src/key-providers/op-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAQH,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,OAAQ,CAAC;AAEzC,uEAAuE;AACvE,eAAO,MAAM,kBAAkB,QAAS,CAAC;AAEzC,mFAAmF;AACnF,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAM1C,iCAAiC;AACjC,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,uEAAuE;AACvE,qBAAa,UAAW,SAAQ,KAAK;IAEjC,oEAAoE;aACpD,IAAI,EAAE,SAAS,MAAM,EAAE;IACvC,oEAAoE;aACpD,MAAM,EAAE,MAAM;IAC9B,4EAA4E;aACnD,KAAK,EAAE,OAAO;;IALvC,oEAAoE;IACpD,IAAI,EAAE,SAAS,MAAM,EAAE;IACvC,oEAAoE;IACpD,MAAM,EAAE,MAAM;IAC9B,4EAA4E;IACnD,KAAK,EAAE,OAAO;IASzC;;;;;;;;OAQG;IACH,IAAI,UAAU,IAAI,OAAO,CAIxB;CACF;AAED;;;;;;GAMG;AACH,wBAAgB,KAAK,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,GAAE,YAAiB,GAAG,MAAM,CAY9E;AAeD;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,IAAI,OAAO,CAkBrC"}