@centient/secrets 0.9.0 → 0.10.0

package/dist/vault/vault-windows.js

@@ -12,11 +12,15 @@
  * Storage: credentials are stored in the Windows Credential Manager under the
  * resource name "centient", with the logical key as the username.
  *
- * Error handling: all methods return false/null on failure — never throw.
+ * Error handling: a storage failure returns false/null — this backend never
+ * throws for that. A credential key that violates the shared key grammar is
+ * NOT a storage failure and throws `InvalidCredentialKeyError` (#168): such a
+ * key is unaddressable here, and reporting it as a failed write or an absent
+ * credential would be indistinguishable from the ordinary miss.
  */
 import { spawnSync } from "child_process";
 import { readFileSync } from "fs";
-import { isValidKey } from "./vault-utils.js";
+import { assertValidKey } from "./vault-utils.js";
 // =============================================================================
 // Constants
 // =============================================================================
@@ -118,8 +122,7 @@ export class WindowsVault {
      * @returns true on success, false if storage fails
      */
     store(key, value) {
-        if (!isValidKey(key))
-            return false;
+        assertValidKey(key, "write");
         const escapedKey = escapePsValue(key);
         const escapedValue = escapePsValue(value);
         const command = [
@@ -140,8 +143,7 @@ export class WindowsVault {
      * @returns The stored password, or null if not found / retrieval fails
      */
     retrieve(key) {
-        if (!isValidKey(key))
-            return null;
+        assertValidKey(key, "read");
         const escapedKey = escapePsValue(key);
         const command = [
             "& {",
@@ -164,8 +166,7 @@ export class WindowsVault {
      * @returns true on success (including "not found"), false on unexpected error
      */
     delete(key) {
-        if (!isValidKey(key))
-            return false;
+        assertValidKey(key, "delete");
         const escapedKey = escapePsValue(key);
         const command = [
             "& {",

package/dist/vault/vault-windows.js.map

@@ -1 +1 @@
-{"version":3,"file":"vault-windows.js","sourceRoot":"","sources":["../../src/vault/vault-windows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAElC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,kFAAkF;AAClF,MAAM,aAAa,GAAG,UAAU,CAAC;AAEjC,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CACtB,gBAAgB,EAChB,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,CAAC,EACtD,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrB,CAAC;QACF,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,OAAQ,MAAM,CAAC,MAAiB,CAAC,IAAI,EAAE,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,YAAY;IACvB;;;;;;;OAOG;IACH,MAAM,CAAC,MAAM;QACX,6CAA6C;QAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,OAAO,YAAY,CAAC,qBAAqB,EAAE,CAAC;QAC9C,CAAC;QAED,6CAA6C;QAC7C,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAC1D,IAAI,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnC,OAAO,YAAY,CAAC,qBAAqB,EAAE,CAAC;YAC9C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;QAC7D,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,qBAAqB;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE;gBACpD,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,GAAW,EAAE,KAAa;QAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAEnC,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAE1C,MAAM,OAAO,GAAG;YACd,KAAK;YACL,6GAA6G;YAC7G,iEAAiE;YACjE,uEAAuE,aAAa,CAAC,aAAa,CAAC,OAAO,UAAU,OAAO,YAAY,KAAK;YAC5I,mBAAmB;YACnB,GAAG;SACJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO,MAAM,KAAK,IAAI,CAAC;IACzB,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,GAAW;QAClB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAElC,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAEtC,MAAM,OAAO,GAAG;YACd,KAAK;YACL,6GAA6G;YAC7G,iEAAiE;YACjE,4BAA4B,aAAa,CAAC,aAAa,CAAC,OAAO,UAAU,KAAK;YAC9E,2BAA2B;YAC3B,gBAAgB;YAChB,GAAG;SACJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,GAAW;QAChB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAEnC,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAEtC,MAAM,OAAO,GAAG;YACd,KAAK;YACL,6GAA6G;YAC7G,iEAAiE;YACjE,OAAO;YACP,4BAA4B,aAAa,CAAC,aAAa,CAAC,OAAO,UAAU,KAAK;YAC9E,sBAAsB;YACtB,YAAY;YACZ,GAAG;SACJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,yEAAyE;QACzE,6EAA6E;QAC7E,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO,MAAM,KAAK,IAAI,CAAC;IACzB,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,QAAQ,CAAC,MAAe;QAC5B,MAAM,OAAO,GAAG;YACd,KAAK;YACL,6GAA6G;YAC7G,iEAAiE;YACjE,OAAO;YACP,sCAAsC,aAAa,CAAC,aAAa,CAAC,KAAK;YACvE,yCAAyC;YACzC,YAAY;YACZ,GAAG;SACJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAEnC,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAC/B,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC9D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"vault-windows.js","sourceRoot":"","sources":["../../src/vault/vault-windows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,kFAAkF;AAClF,MAAM,aAAa,GAAG,UAAU,CAAC;AAEjC,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CACtB,gBAAgB,EAChB,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,CAAC,EACtD,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrB,CAAC;QACF,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,OAAQ,MAAM,CAAC,MAAiB,CAAC,IAAI,EAAE,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,YAAY;IACvB;;;;;;;OAOG;IACH,MAAM,CAAC,MAAM;QACX,6CAA6C;QAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,OAAO,YAAY,CAAC,qBAAqB,EAAE,CAAC;QAC9C,CAAC;QAED,6CAA6C;QAC7C,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAC1D,IAAI,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnC,OAAO,YAAY,CAAC,qBAAqB,EAAE,CAAC;YAC9C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;QAC7D,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,qBAAqB;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE;gBACpD,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,GAAW,EAAE,KAAa;QAC9B,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAE7B,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAE1C,MAAM,OAAO,GAAG;YACd,KAAK;YACL,6GAA6G;YAC7G,iEAAiE;YACjE,uEAAuE,aAAa,CAAC,aAAa,CAAC,OAAO,UAAU,OAAO,YAAY,KAAK;YAC5I,mBAAmB;YACnB,GAAG;SACJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO,MAAM,KAAK,IAAI,CAAC;IACzB,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,GAAW;QAClB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAE5B,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAEtC,MAAM,OAAO,GAAG;YACd,KAAK;YACL,6GAA6G;YAC7G,iEAAiE;YACjE,4BAA4B,aAAa,CAAC,aAAa,CAAC,OAAO,UAAU,KAAK;YAC9E,2BAA2B;YAC3B,gBAAgB;YAChB,GAAG;SACJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,GAAW;QAChB,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAE9B,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAEtC,MAAM,OAAO,GAAG;YACd,KAAK;YACL,6GAA6G;YAC7G,iEAAiE;YACjE,OAAO;YACP,4BAA4B,aAAa,CAAC,aAAa,CAAC,OAAO,UAAU,KAAK;YAC9E,sBAAsB;YACtB,YAAY;YACZ,GAAG;SACJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,yEAAyE;QACzE,6EAA6E;QAC7E,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO,MAAM,KAAK,IAAI,CAAC;IACzB,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,QAAQ,CAAC,MAAe;QAC5B,MAAM,OAAO,GAAG;YACd,KAAK;YACL,6GAA6G;YAC7G,iEAAiE;YACjE,OAAO;YACP,sCAAsC,aAAa,CAAC,aAAa,CAAC,KAAK;YACvE,yCAAyC;YACzC,YAAY;YACZ,GAAG;SACJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAEnC,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAC/B,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC9D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/vault/vault.d.ts

@@ -11,11 +11,69 @@
  * The active backend is selected once at module load by calling each backend's
  * static `detect()` method in order and choosing the first one that returns true.
  *
+ * **Explicit selection (ADR-004) sits in front of that cascade.** `secrets.backend`
+ * (or `CENTIENT_SECRETS_BACKEND`) names a backend directly and fails closed if it
+ * is unusable — it is never silently substituted. `OnePasswordVault` is reachable
+ * *only* this way: having `op` installed is not consent to route credentials into
+ * someone's 1Password vault.
+ *
  * Session TTL: 4 hours from the last successful read/write.
  *
- * Error handling: all functions return null/false on failure — never throw.
+ * Error handling: a *storage* failure is reported as `null`/`false` — the
+ * backend contract is non-throwing. Three things do throw, because they are
+ * not storage outcomes: a policy `before` hook rejecting the operation
+ * (ADR-002 §1.0.0), a backend surfacing an unexpected transport failure from
+ * `retrieve`/`listKeys`, and a malformed credential key
+ * (`InvalidCredentialKeyError`, see the key-validation section below).
+ */
+import type { KeychainDeps } from "../crypto/darwin-keychain.js";
+import type { SecretState } from "../secret-state.js";
+import type { VaultBackend, VaultType } from "./types.js";
+/**
+ * The keychain service every credential VALUE lives under. Exported because
+ * the migration helper (`migrateLoginCredentialToSystem`) and operator
+ * tooling have to name the same service — a second literal somewhere else is
+ * how a migration silently moves nothing.
  */
-import type { VaultType } from "./types.js";
+export declare const AUTH_KEYCHAIN_SERVICE = "centient-auth";
+/**
+ * Wraps the macOS Keychain helper functions as a VaultBackend.
+ *
+ * Every method routes through `crypto/darwin-keychain.ts` (#188), so credential
+ * values inherit explicit System-keychain reads in a sessionless context,
+ * `-U` replace-in-place writes and `-T /usr/bin/security` reader
+ * preauthorization — the same posture the KeyProvider layer gets for the vault
+ * master key.
+ *
+ * Only available on macOS (darwin).
+ */
+export declare class KeychainVault implements VaultBackend {
+    private readonly deps;
+    /**
+     * @param deps - Injection seam for the `security` CLI and the
+     *   platform/environment that decide the read path. Omitted in production;
+     *   supplied by tests so the exact argv is assertable.
+     */
+    constructor(deps?: Partial<KeychainDeps>);
+    static detect(): boolean;
+    store(key: string, value: string): boolean;
+    retrieve(key: string): string | null;
+    delete(key: string): boolean;
+    listKeys(prefix?: string): Promise<string[]>;
+    /**
+     * The credential state probe: runs the SAME read {@link retrieve} would run
+     * in this context — same path, same explicit target — then discards the
+     * value and returns only the value-free {@link SecretState}.
+     *
+     * A metadata-only lookup would be cheaper and would leave the secret on
+     * disk, but it can only report presence: an item whose ACL does not
+     * preauthorize the reader, or that sits in a locked keychain, is present and
+     * unreadable, and calling that `found` hands a caller trusted state that is
+     * wrong in exactly the direction #188 exists to fix. `found` here means the
+     * reader will get bytes.
+     */
+    probe(key: string): SecretState;
+}
 /**
  * Returns true if the in-process session is still within the TTL window.
  * This does NOT validate the token itself — use validateToken() for that.
@@ -31,9 +89,12 @@ export declare function getActiveVaultType(): VaultType;
 /**
  * Store a credential in the active vault backend.
  *
- * @param key     - Logical key name (e.g. 'auth-token', 'refresh-token')
+ * @param key     - Logical key name (e.g. 'auth-token', 'refresh-token').
+ *                  Must match the key grammar — see "Key validation" above.
  * @param value   - The credential value to store
  * @returns true on success, false if the backend write fails
+ * @throws {InvalidCredentialKeyError} if `key` does not match the grammar.
+ *   Nothing is written and no backend is contacted.
  */
 export declare function storeCredential(key: string, value: string): Promise<boolean>;
 /**
@@ -41,6 +102,10 @@ export declare function storeCredential(key: string, value: string): Promise<boo
  *
  * @param key - Logical key name (e.g. 'auth-token')
  * @returns The stored value, or null if not found / backend unavailable
+ * @throws {InvalidCredentialKeyError} if `key` does not match the grammar.
+ *   Deliberately not `null`: "malformed" and "not stored" are different
+ *   answers, and returning the not-found shape for the first is the silent
+ *   degradation this path used to have.
  */
 export declare function getCredential(key: string): Promise<string | null>;
 /**
@@ -48,6 +113,9 @@ export declare function getCredential(key: string): Promise<string | null>;
  *
  * @param key - Logical key name (e.g. 'auth-token')
  * @returns true on success (including "already deleted"), false on unexpected error
+ * @throws {InvalidCredentialKeyError} if `key` does not match the grammar.
+ *   Not reported as an idempotent success: such a key was never storable, so
+ *   "already deleted" would be a claim the vault cannot make.
  */
 export declare function deleteCredential(key: string): Promise<boolean>;
 /**
@@ -64,7 +132,15 @@ export declare function deleteCredential(key: string): Promise<boolean>;
  * Note: credential keys must match `isValidKey` — lowercase alphanumeric
  * plus hyphen and dot, first and last character alphanumeric, <=64 chars.
  * Both `-` and `.` work as namespace separators; pick whichever convention
- * reads best.
+ * reads best. **This is enforced, not merely documented** (#168): every
+ * function on this path rejects a non-conforming key before dispatching.
+ *
+ * A `prefix` is checked against `isValidKeyPrefix` rather than `isValidKey`,
+ * so it may end on a separator — `"soma.anthropic."` is the intended way to
+ * scope an enumeration to a namespace, and is not itself a valid key.
+ *
+ * @throws {InvalidCredentialKeyError} if `prefix` could not be the leading
+ *   substring of any valid key.
  *
  * @example
  *   // Enumerate all soma-owned Anthropic credentials
@@ -75,4 +151,40 @@ export declare function deleteCredential(key: string): Promise<boolean>;
  *   }
  */
 export declare function listCredentials(prefix?: string): Promise<string[]>;
+/** A value-free answer about one credential in one backend. */
+export interface BackendStateProbe {
+    /** Always `"value"` — distinguishes this from the key-layer probe. */
+    layer: "value";
+    /** Which backend answered. */
+    backend: VaultType;
+    state: SecretState;
+}
+/**
+ * Probe one credential's state in a specific backend.
+ *
+ * Backends that implement `probe()` answer directly. For the rest this falls
+ * back to a `retrieve()`-based mapping — the value is discarded immediately
+ * and never returned — which yields `found`/`absent` honestly and `failed`
+ * when the backend threw. It never invents `locked`, because a backend that
+ * did not report one cannot be assumed to have one, and it never converts a
+ * throw into `absent`.
+ *
+ * Both paths answer readability, not mere presence: the fallback runs the real
+ * `retrieve()`, and an implementing backend is required to exercise the same
+ * access path it would for a read (see `VaultBackend.probe`). `found`
+ * therefore means the reader will get bytes.
+ *
+ * @throws {InvalidCredentialKeyError} if `key` does not match the grammar —
+ *   the same rule every other vault entry point enforces (#168). Policy hooks
+ *   are deliberately NOT run: a probe reads no value, so there is nothing for
+ *   an access-control hook to allow or deny.
+ */
+export declare function probeVaultBackendState(backend: VaultBackend, type: VaultType, key: string): Promise<BackendStateProbe>;
+/**
+ * Probe one credential's state in the backend this process actually uses.
+ *
+ * The value-layer half of the two-layer probe; see `probeKeyProviderState()`
+ * for the vault master key.
+ */
+export declare function probeBackendState(key: string): Promise<BackendStateProbe>;
 //# sourceMappingURL=vault.d.ts.map

package/dist/vault/vault.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../src/vault/vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAYH,OAAO,KAAK,EAAgB,SAAS,EAAE,MAAM,YAAY,CAAC;AAiE1D;;;GAGG;AACH,wBAAgB,cAAc,IAAI,OAAO,CAGxC;AAiBD;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,SAAS,CAE9C;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAoBlB;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiCvE;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAmBpE;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAkCxE"}
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../src/vault/vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AASH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAMtD,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAe1D;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,kBAAkB,CAAC;AAOrD;;;;;;;;;;GAUG;AACH,qBAAa,aAAc,YAAW,YAAY;IAMpC,OAAO,CAAC,QAAQ,CAAC,IAAI;IALjC;;;;OAIG;gBAC0B,IAAI,GAAE,OAAO,CAAC,YAAY,CAAM;IAE7D,MAAM,CAAC,MAAM,IAAI,OAAO;IAIxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAI1C,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAIpC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAItB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAIlD;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW;CAGhC;AAmFD;;;GAGG;AACH,wBAAgB,cAAc,IAAI,OAAO,CAGxC;AAoFD;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,SAAS,CAE9C;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAqBlB;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAkCvE;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAoBpE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAmCxE;AAuBD,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,KAAK,EAAE,OAAO,CAAC;IACf,8BAA8B;IAC9B,OAAO,EAAE,SAAS,CAAC;IACnB,KAAK,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE,SAAS,EACf,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,iBAAiB,CAAC,CAiC5B;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAE/E"}

package/dist/vault/vault.js

@@ -11,53 +11,152 @@
  * The active backend is selected once at module load by calling each backend's
  * static `detect()` method in order and choosing the first one that returns true.
  *
+ * **Explicit selection (ADR-004) sits in front of that cascade.** `secrets.backend`
+ * (or `CENTIENT_SECRETS_BACKEND`) names a backend directly and fails closed if it
+ * is unusable — it is never silently substituted. `OnePasswordVault` is reachable
+ * *only* this way: having `op` installed is not consent to route credentials into
+ * someone's 1Password vault.
+ *
  * Session TTL: 4 hours from the last successful read/write.
  *
- * Error handling: all functions return null/false on failure — never throw.
+ * Error handling: a *storage* failure is reported as `null`/`false` — the
+ * backend contract is non-throwing. Three things do throw, because they are
+ * not storage outcomes: a policy `before` hook rejecting the operation
+ * (ADR-002 §1.0.0), a backend surfacing an unexpected transport failure from
+ * `retrieve`/`listKeys`, and a malformed credential key
+ * (`InvalidCredentialKeyError`, see the key-validation section below).
  */
 import { storeStringInKeychain, getStringFromKeychain, deleteFromKeychain, listAccountsInKeychain, } from "../crypto/vault-common.js";
+import { probeKeychainCredentialState } from "../crypto/darwin-keychain.js";
 import { WindowsVault } from "./vault-windows.js";
 import { LibsecretVault } from "./vault-libsecret.js";
 import { GpgVault } from "./vault-gpg.js";
 import { EnvVault } from "./vault-env.js";
-import { runBeforeHooks, runAfterHooks } from "./policy.js";
+import { OnePasswordVault } from "./vault-onepassword.js";
+import { loadConfig } from "../key-providers/resolve.js";
+import { runBeforeHooks, runAfterHooks, rejectedEventType } from "./policy.js";
+import { assertValidKey, isValidKey, isValidKeyPrefix } from "./vault-utils.js";
+import { InvalidCredentialKeyError } from "./session-vault-errors.js";
 // =============================================================================
 // Constants
 // =============================================================================
-const AUTH_KEYCHAIN_SERVICE = "centient-auth";
+/**
+ * The keychain service every credential VALUE lives under. Exported because
+ * the migration helper (`migrateLoginCredentialToSystem`) and operator
+ * tooling have to name the same service — a second literal somewhere else is
+ * how a migration silently moves nothing.
+ */
+export const AUTH_KEYCHAIN_SERVICE = "centient-auth";
 const SESSION_TTL_MS = 4 * 60 * 60 * 1000; // 4 hours
 // =============================================================================
 // KeychainVault wrapper
 // =============================================================================
 /**
- * Wraps the existing macOS Keychain helper functions as a VaultBackend.
+ * Wraps the macOS Keychain helper functions as a VaultBackend.
+ *
+ * Every method routes through `crypto/darwin-keychain.ts` (#188), so credential
+ * values inherit explicit System-keychain reads in a sessionless context,
+ * `-U` replace-in-place writes and `-T /usr/bin/security` reader
+ * preauthorization — the same posture the KeyProvider layer gets for the vault
+ * master key.
+ *
  * Only available on macOS (darwin).
  */
-class KeychainVault {
+export class KeychainVault {
+    deps;
+    /**
+     * @param deps - Injection seam for the `security` CLI and the
+     *   platform/environment that decide the read path. Omitted in production;
+     *   supplied by tests so the exact argv is assertable.
+     */
+    constructor(deps = {}) {
+        this.deps = deps;
+    }
     static detect() {
         return process.platform === "darwin";
     }
     store(key, value) {
-        return storeStringInKeychain(AUTH_KEYCHAIN_SERVICE, key, value);
+        return storeStringInKeychain(AUTH_KEYCHAIN_SERVICE, key, value, this.deps);
     }
     retrieve(key) {
-        return getStringFromKeychain(AUTH_KEYCHAIN_SERVICE, key);
+        return getStringFromKeychain(AUTH_KEYCHAIN_SERVICE, key, this.deps);
     }
     delete(key) {
-        return deleteFromKeychain(AUTH_KEYCHAIN_SERVICE, key);
+        return deleteFromKeychain(AUTH_KEYCHAIN_SERVICE, key, this.deps);
     }
     async listKeys(prefix) {
-        return listAccountsInKeychain(AUTH_KEYCHAIN_SERVICE, prefix);
+        return listAccountsInKeychain(AUTH_KEYCHAIN_SERVICE, prefix, this.deps);
+    }
+    /**
+     * The credential state probe: runs the SAME read {@link retrieve} would run
+     * in this context — same path, same explicit target — then discards the
+     * value and returns only the value-free {@link SecretState}.
+     *
+     * A metadata-only lookup would be cheaper and would leave the secret on
+     * disk, but it can only report presence: an item whose ACL does not
+     * preauthorize the reader, or that sits in a locked keychain, is present and
+     * unreadable, and calling that `found` hands a caller trusted state that is
+     * wrong in exactly the direction #188 exists to fix. `found` here means the
+     * reader will get bytes.
+     */
+    probe(key) {
+        return probeKeychainCredentialState(AUTH_KEYCHAIN_SERVICE, key, this.deps);
     }
 }
 // =============================================================================
 // Cascade initialization
 // =============================================================================
 /**
- * Selects the first available vault backend in priority order:
+ * Read the explicitly-selected backend, env taking precedence over config —
+ * the same env > config order the key layer uses (ADR-001).
+ *
+ * Returns null when nothing is explicitly selected, which is the signal to run
+ * the auto-cascade unchanged.
+ */
+function resolveExplicitBackend() {
+    const envBackend = process.env.CENTIENT_SECRETS_BACKEND?.trim();
+    const config = loadConfig().secrets ?? {};
+    const selected = envBackend || config.backend;
+    if (!selected)
+        return null;
+    if (selected !== "1password") {
+        throw new Error(`Unknown secrets backend "${selected}". Supported explicit backends: 1password.`);
+    }
+    const envVault = process.env.CENTIENT_OP_VAULT?.trim();
+    const onePasswordBackend = {
+        ...config.onePasswordBackend,
+        ...(envVault ? { vault: envVault } : {}),
+    };
+    return { type: selected, onePasswordBackend };
+}
+/**
+ * Selects the credential-storage backend.
+ *
+ * **Explicit selection wins and fails closed** (ADR-004 §1): if config or env
+ * names a backend that then turns out to be unusable — no vault configured, `op`
+ * missing or unauthenticated — this throws rather than quietly continuing down
+ * the auto-cascade. Falling through would silently store credentials somewhere
+ * other than where the operator said, which is the whole class of surprise the
+ * opt-in model exists to prevent (P2).
+ *
+ * With no explicit selection, the historical auto-cascade runs unchanged:
  *   Keychain -> Windows -> Libsecret -> GPG -> Env
+ * 1Password is **never** auto-selected — `op` being installed is not consent to
+ * route credentials into it.
  */
 function initVaultBackend() {
+    const explicit = resolveExplicitBackend();
+    if (explicit !== null) {
+        // Constructor throws on a missing vault name — the fail-closed half of §1.
+        const backend = new OnePasswordVault(explicit.onePasswordBackend);
+        if (!OnePasswordVault.detect(true)) {
+            throw new Error('secrets backend "1password" was explicitly selected, but the 1Password CLI ' +
+                "(`op`) is unavailable or not authenticated. Install `op` and sign in, or set " +
+                "OP_SERVICE_ACCOUNT_TOKEN. Refusing to fall back to another backend — an " +
+                "explicit backend choice is never silently substituted.");
+        }
+        return { backend, type: "1password" };
+    }
     if (KeychainVault.detect())
         return { backend: new KeychainVault(), type: "keychain" };
     if (WindowsVault.detect())
@@ -88,6 +187,59 @@ function touchSession() {
     lastAccessAt = Date.now();
 }
 // =============================================================================
+// Key validation (#168)
+//
+// The key grammar is enforced HERE, once, for every backend — not per backend.
+// Before #168 it was documented on `listCredentials` and enforced nowhere on
+// the shared path: `KeychainVault` (cascade position 1, and therefore the
+// active backend on every Mac) and `EnvVault` (position 5, the always-available
+// fallback) accepted anything, while GPG/libsecret/Windows/1Password refused
+// it. A key such as `Auth_Token` consequently stored fine on darwin and was
+// unreadable on every other backend — the silent write/read asymmetry the
+// invariant exists to prevent. One rule enforced once at the boundary is the
+// only shape in which that stays true as backends are added (P6/P2).
+//
+// Validation runs BEFORE the policy `before` hooks. A malformed key is a
+// caller-contract violation, not a policy decision — there is no well-formed
+// operation for a policy to allow or deny, and an access-control hook should
+// never be handed a key the storage layer has already ruled out. The rejection
+// is still audited: the `after` hooks fire with the same `*_rejected` event a
+// policy denial produces, so a refused operation is never invisible to the
+// audit trail. Unlike a policy denial, every policy's `after` hook fires —
+// none was entered, so there is no partially-entered stack to respect.
+// =============================================================================
+/**
+ * Audit the rejection of `op` and hand `err` back for the caller to throw.
+ *
+ * Split out so the four public functions reject identically. It returns the
+ * error rather than throwing it so the call site reads `throw rejectKey(...)`
+ * — the `throw` stays visible where control flow actually leaves.
+ */
+function rejectKey(op, err, start) {
+    runAfterHooks({
+        type: rejectedEventType(op),
+        timestamp: new Date().toISOString(),
+        backend: activeVaultType,
+        ...(op.key !== undefined ? { key: op.key } : {}),
+        ...(op.prefix !== undefined ? { prefix: op.prefix } : {}),
+        error: err.message,
+        durationMs: performance.now() - start,
+    });
+    return err;
+}
+/** Reject a malformed key for a keyed operation, auditing the rejection. */
+function guardKey(key, type, start) {
+    if (isValidKey(key))
+        return;
+    throw rejectKey({ type, key }, new InvalidCredentialKeyError(key, type, "key"), start);
+}
+/** Reject a malformed enumeration prefix, auditing the rejection. */
+function guardPrefix(prefix, start) {
+    if (prefix === undefined || isValidKeyPrefix(prefix))
+        return;
+    throw rejectKey({ type: "enumerate", prefix }, new InvalidCredentialKeyError(prefix, "enumerate", "prefix"), start);
+}
+// =============================================================================
 // Public API
 //
 // Policy-rejected operations are audited: when a `before` hook throws,
@@ -108,12 +260,16 @@ export function getActiveVaultType() {
 /**
  * Store a credential in the active vault backend.
  *
- * @param key     - Logical key name (e.g. 'auth-token', 'refresh-token')
+ * @param key     - Logical key name (e.g. 'auth-token', 'refresh-token').
+ *                  Must match the key grammar — see "Key validation" above.
  * @param value   - The credential value to store
  * @returns true on success, false if the backend write fails
+ * @throws {InvalidCredentialKeyError} if `key` does not match the grammar.
+ *   Nothing is written and no backend is contacted.
  */
 export async function storeCredential(key, value) {
     const start = performance.now();
+    guardKey(key, "write", start);
     await runBeforeHooks({ type: "write", key }, (error) => ({
         type: "credential_write_rejected",
         timestamp: new Date().toISOString(),
@@ -139,9 +295,14 @@ export async function storeCredential(key, value) {
  *
  * @param key - Logical key name (e.g. 'auth-token')
  * @returns The stored value, or null if not found / backend unavailable
+ * @throws {InvalidCredentialKeyError} if `key` does not match the grammar.
+ *   Deliberately not `null`: "malformed" and "not stored" are different
+ *   answers, and returning the not-found shape for the first is the silent
+ *   degradation this path used to have.
  */
 export async function getCredential(key) {
     const start = performance.now();
+    guardKey(key, "read", start);
     await runBeforeHooks({ type: "read", key }, (error) => ({
         type: "credential_read_rejected",
         timestamp: new Date().toISOString(),
@@ -181,9 +342,13 @@ export async function getCredential(key) {
  *
  * @param key - Logical key name (e.g. 'auth-token')
  * @returns true on success (including "already deleted"), false on unexpected error
+ * @throws {InvalidCredentialKeyError} if `key` does not match the grammar.
+ *   Not reported as an idempotent success: such a key was never storable, so
+ *   "already deleted" would be a claim the vault cannot make.
  */
 export async function deleteCredential(key) {
     const start = performance.now();
+    guardKey(key, "delete", start);
     await runBeforeHooks({ type: "delete", key }, (error) => ({
         type: "credential_delete_rejected",
         timestamp: new Date().toISOString(),
@@ -216,7 +381,15 @@ export async function deleteCredential(key) {
  * Note: credential keys must match `isValidKey` — lowercase alphanumeric
  * plus hyphen and dot, first and last character alphanumeric, <=64 chars.
  * Both `-` and `.` work as namespace separators; pick whichever convention
- * reads best.
+ * reads best. **This is enforced, not merely documented** (#168): every
+ * function on this path rejects a non-conforming key before dispatching.
+ *
+ * A `prefix` is checked against `isValidKeyPrefix` rather than `isValidKey`,
+ * so it may end on a separator — `"soma.anthropic."` is the intended way to
+ * scope an enumeration to a namespace, and is not itself a valid key.
+ *
+ * @throws {InvalidCredentialKeyError} if `prefix` could not be the leading
+ *   substring of any valid key.
  *
  * @example
  *   // Enumerate all soma-owned Anthropic credentials
@@ -228,6 +401,7 @@ export async function deleteCredential(key) {
  */
 export async function listCredentials(prefix) {
     const start = performance.now();
+    guardPrefix(prefix, start);
     await runBeforeHooks({ type: "enumerate", prefix }, (error) => ({
         type: "credential_enumerate_rejected",
         timestamp: new Date().toISOString(),
@@ -263,4 +437,69 @@ export async function listCredentials(prefix) {
     });
     return keys;
 }
+/**
+ * Probe one credential's state in a specific backend.
+ *
+ * Backends that implement `probe()` answer directly. For the rest this falls
+ * back to a `retrieve()`-based mapping — the value is discarded immediately
+ * and never returned — which yields `found`/`absent` honestly and `failed`
+ * when the backend threw. It never invents `locked`, because a backend that
+ * did not report one cannot be assumed to have one, and it never converts a
+ * throw into `absent`.
+ *
+ * Both paths answer readability, not mere presence: the fallback runs the real
+ * `retrieve()`, and an implementing backend is required to exercise the same
+ * access path it would for a read (see `VaultBackend.probe`). `found`
+ * therefore means the reader will get bytes.
+ *
+ * @throws {InvalidCredentialKeyError} if `key` does not match the grammar —
+ *   the same rule every other vault entry point enforces (#168). Policy hooks
+ *   are deliberately NOT run: a probe reads no value, so there is nothing for
+ *   an access-control hook to allow or deny.
+ */
+export async function probeVaultBackendState(backend, type, key) {
+    assertValidKey(key, "read");
+    if (typeof backend.probe === "function") {
+        try {
+            return { layer: "value", backend: type, state: await backend.probe(key) };
+        }
+        catch (err) {
+            return {
+                layer: "value",
+                backend: type,
+                state: {
+                    kind: "failed",
+                    detail: err instanceof Error ? err.message : String(err),
+                },
+            };
+        }
+    }
+    try {
+        const value = backend.retrieve(key);
+        return {
+            layer: "value",
+            backend: type,
+            state: value !== null ? { kind: "found" } : { kind: "absent" },
+        };
+    }
+    catch (err) {
+        return {
+            layer: "value",
+            backend: type,
+            state: {
+                kind: "failed",
+                detail: err instanceof Error ? err.message : String(err),
+            },
+        };
+    }
+}
+/**
+ * Probe one credential's state in the backend this process actually uses.
+ *
+ * The value-layer half of the two-layer probe; see `probeKeyProviderState()`
+ * for the vault master key.
+ */
+export async function probeBackendState(key) {
+    return probeVaultBackendState(activeBackend, activeVaultType, key);
+}
 //# sourceMappingURL=vault.js.map

package/dist/vault/vault.js.map

@@ -1 +1 @@
-{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../src/vault/vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5D,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAC9C,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AAErD,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,aAAa;IACjB,MAAM,CAAC,MAAM;QACX,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,GAAW,EAAE,KAAa;QAC9B,OAAO,qBAAqB,CAAC,qBAAqB,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAClE,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,qBAAqB,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,OAAO,kBAAkB,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAe;QAC5B,OAAO,sBAAsB,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC;CACF;AAED,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF;;;GAGG;AACH,SAAS,gBAAgB;IACvB,IAAI,aAAa,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,aAAa,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACtF,IAAI,YAAY,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACnF,IAAI,cAAc,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACzF,IAAI,QAAQ,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACvE,OAAO,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,gBAAgB,EAAE,CAAC;AAE7E,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF,yDAAyD;AACzD,IAAI,YAAY,GAAkB,IAAI,CAAC;AAEvC;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,cAAc,CAAC;AACpD,CAAC;AAED,qDAAqD;AACrD,SAAS,YAAY;IACnB,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAC5B,CAAC;AAED,gFAAgF;AAChF,aAAa;AACb,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,+DAA+D;AAC/D,iEAAiE;AACjE,gDAAgD;AAChD,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAW,EACX,KAAa;IAEb,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACvD,IAAI,EAAE,2BAA2B;QACjC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,KAAK;QACL,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,OAAO;QAAE,YAAY,EAAE,CAAC;IAC5B,aAAa,CAAC;QACZ,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,yBAAyB;QAChE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtD,IAAI,EAAE,0BAA0B;QAChC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,KAAK;QACL,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC,CAAC;IACJ,IAAI,KAAoB,CAAC;IACzB,IAAI,CAAC;QACH,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,aAAa,CAAC;YACZ,IAAI,EAAE,wBAAwB;YAC9B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,eAAe;YACxB,GAAG;YACH,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACvD,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;SACtC,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,KAAK,KAAK,IAAI;QAAE,YAAY,EAAE,CAAC;IACnC,aAAa,CAAC;QACZ,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,yBAAyB;QACpE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI,EAAE,4BAA4B;QAClC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,KAAK;QACL,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1C,aAAa,CAAC;QACZ,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,0BAA0B;QACjE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAe;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9D,IAAI,EAAE,+BAA+B;QACrC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,MAAM;QACN,KAAK;QACL,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC,CAAC;IACJ,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,aAAa,CAAC;YACZ,IAAI,EAAE,6BAA6B;YACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,eAAe;YACxB,MAAM;YACN,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACvD,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;SACtC,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,YAAY,EAAE,CAAC;IACpC,aAAa,CAAC;QACZ,IAAI,EAAE,uBAAuB;QAC7B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,MAAM;QACN,QAAQ,EAAE,IAAI,CAAC,MAAM;QACrB,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../src/vault/vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAG5E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAKzD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAE/E,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEtE,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AACrD,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AAErD,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF;;;;;;;;;;GAUG;AACH,MAAM,OAAO,aAAa;IAMK;IAL7B;;;;OAIG;IACH,YAA6B,OAA8B,EAAE;QAAhC,SAAI,GAAJ,IAAI,CAA4B;IAAG,CAAC;IAEjE,MAAM,CAAC,MAAM;QACX,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,GAAW,EAAE,KAAa;QAC9B,OAAO,qBAAqB,CAAC,qBAAqB,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,qBAAqB,CAAC,qBAAqB,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,OAAO,kBAAkB,CAAC,qBAAqB,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAe;QAC5B,OAAO,sBAAsB,CAAC,qBAAqB,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,GAAW;QACf,OAAO,4BAA4B,CAAC,qBAAqB,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,CAAC;CACF;AAED,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF;;;;;;GAMG;AACH,SAAS,sBAAsB;IAI7B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAC;IAChE,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,UAAU,IAAI,MAAM,CAAC,OAAO,CAAC;IAC9C,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,4BAA4B,QAAQ,4CAA4C,CACjF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACvD,MAAM,kBAAkB,GAA6B;QACnD,GAAG,MAAM,CAAC,kBAAkB;QAC5B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzC,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,gBAAgB;IACvB,MAAM,QAAQ,GAAG,sBAAsB,EAAE,CAAC;IAC1C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,2EAA2E;QAC3E,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QAClE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,6EAA6E;gBAC3E,+EAA+E;gBAC/E,0EAA0E;gBAC1E,wDAAwD,CAC3D,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACxC,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,aAAa,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACtF,IAAI,YAAY,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACnF,IAAI,cAAc,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACzF,IAAI,QAAQ,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACvE,OAAO,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,gBAAgB,EAAE,CAAC;AAE7E,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF,yDAAyD;AACzD,IAAI,YAAY,GAAkB,IAAI,CAAC;AAEvC;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,cAAc,CAAC;AACpD,CAAC;AAED,qDAAqD;AACrD,SAAS,YAAY;IACnB,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAC5B,CAAC;AAED,gFAAgF;AAChF,wBAAwB;AACxB,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,0EAA0E;AAC1E,gFAAgF;AAChF,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,6EAA6E;AAC7E,qEAAqE;AACrE,EAAE;AACF,yEAAyE;AACzE,6EAA6E;AAC7E,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,2EAA2E;AAC3E,2EAA2E;AAC3E,uEAAuE;AACvE,gFAAgF;AAEhF;;;;;;GAMG;AACH,SAAS,SAAS,CAChB,EAAoB,EACpB,GAA8B,EAC9B,KAAa;IAEb,aAAa,CAAC;QACZ,IAAI,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAC3B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,KAAK,EAAE,GAAG,CAAC,OAAO;QAClB,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAC5E,SAAS,QAAQ,CACf,GAAW,EACX,IAAiC,EACjC,KAAa;IAEb,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO;IAC5B,MAAM,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,yBAAyB,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;AACzF,CAAC;AAED,qEAAqE;AACrE,SAAS,WAAW,CAAC,MAA0B,EAAE,KAAa;IAC5D,IAAI,MAAM,KAAK,SAAS,IAAI,gBAAgB,CAAC,MAAM,CAAC;QAAE,OAAO;IAC7D,MAAM,SAAS,CACb,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAC7B,IAAI,yBAAyB,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,EAC5D,KAAK,CACN,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,aAAa;AACb,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,+DAA+D;AAC/D,iEAAiE;AACjE,gDAAgD;AAChD,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAW,EACX,KAAa;IAEb,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9B,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACvD,IAAI,EAAE,2BAA2B;QACjC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,KAAK;QACL,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,OAAO;QAAE,YAAY,EAAE,CAAC;IAC5B,aAAa,CAAC;QACZ,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,yBAAyB;QAChE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7B,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtD,IAAI,EAAE,0BAA0B;QAChC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,KAAK;QACL,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC,CAAC;IACJ,IAAI,KAAoB,CAAC;IACzB,IAAI,CAAC;QACH,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,aAAa,CAAC;YACZ,IAAI,EAAE,wBAAwB;YAC9B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,eAAe;YACxB,GAAG;YACH,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACvD,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;SACtC,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,KAAK,KAAK,IAAI;QAAE,YAAY,EAAE,CAAC;IACnC,aAAa,CAAC;QACZ,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,yBAAyB;QACpE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/B,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI,EAAE,4BAA4B;QAClC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,KAAK;QACL,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1C,aAAa,CAAC;QACZ,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,0BAA0B;QACjE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAe;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3B,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9D,IAAI,EAAE,+BAA+B;QACrC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,MAAM;QACN,KAAK;QACL,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC,CAAC;IACJ,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,aAAa,CAAC;YACZ,IAAI,EAAE,6BAA6B;YACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,eAAe;YACxB,MAAM;YACN,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACvD,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;SACtC,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,YAAY,EAAE,CAAC;IACpC,aAAa,CAAC;QACZ,IAAI,EAAE,uBAAuB;QAC7B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,eAAe;QACxB,MAAM;QACN,QAAQ,EAAE,IAAI,CAAC,MAAM;QACrB,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAgCD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAqB,EACrB,IAAe,EACf,GAAW;IAEX,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5B,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACzD;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpC,OAAO;YACL,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC/D,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,IAAI;YACb,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACzD;SACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAW;IACjD,OAAO,sBAAsB,CAAC,aAAa,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC;AACrE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@centient/secrets",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Cross-platform secrets vault with AES-256-GCM encryption and platform-native key storage",
   "repository": {
     "type": "git",