@centient/secrets 0.9.0 → 0.10.0

package/dist/key-providers/op-cli.js

@@ -0,0 +1,123 @@
+/**
+ * Shared 1Password `op` CLI helper (ADR-004 §6).
+ *
+ * Two independent layers call `op` for different purposes — `OnePasswordProvider`
+ * for the vault *encryption key* (ADR-001) and `OnePasswordVault` for credential
+ * *values* (ADR-004) — and before this module each carried its own copy of the
+ * availability probe and its own `execFileSync` invocation. One source of truth
+ * for how `op` is invoked, how long it may take, and what "available and
+ * authenticated" means (P6).
+ *
+ * No dependency on `@1password/sdk` — `execFileSync` only, matching ADR-001's
+ * zero-new-runtime-deps position.
+ */
+import { execFileSync } from "node:child_process";
+// =============================================================================
+// Timeouts
+// =============================================================================
+/** Probe calls (`--version`, `account list`) — fast or the CLI is unusable. */
+export const OP_PROBE_TIMEOUT_MS = 5_000;
+/** Metadata reads (`item get`, `item list`) — a network round-trip. */
+export const OP_READ_TIMEOUT_MS = 15_000;
+/** Mutations and secret reads — desktop-app approval may sit in front of these. */
+export const OP_WRITE_TIMEOUT_MS = 30_000;
+/** A failed `op` invocation, with whatever the CLI wrote to stderr. */
+export class OpCliError extends Error {
+    args;
+    stderr;
+    cause;
+    constructor(
+    /** The argv `op` was called with — never contains secret values. */
+    args, 
+    /** `op`'s stderr, trimmed; empty when the process produced none. */
+    stderr, 
+    /** The underlying spawn/exit error. Narrows `Error.cause` to this value. */
+    cause) {
+        super(`op ${args.join(" ")} failed${stderr ? `: ${stderr}` : ""}`);
+        this.args = args;
+        this.stderr = stderr;
+        this.cause = cause;
+        this.name = "OpCliError";
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+    /**
+     * True when the failure is 1Password reporting the item simply is not there,
+     * as opposed to an auth, network, or configuration problem.
+     *
+     * The distinction is load-bearing for ADR-004 §7: a not-found is a normal
+     * `null`/`false` return, while an unexpected failure additionally warrants a
+     * one-time stderr warning so a misconfiguration cannot stay silent (P2).
+     * `op` has no stable exit code for this, so the message is the only signal.
+     */
+    get isNotFound() {
+        return /(?:not found|isn't an item|no item matching|doesn't exist|item not found)/i.test(this.stderr);
+    }
+}
+/**
+ * Invoke `op` and return its stdout, trimmed.
+ *
+ * @param args - argv after the binary. **Never** put a secret value here — pass
+ *   it via {@link RunOpOptions.input} instead (ADR-004 §4).
+ * @throws {@link OpCliError} on spawn failure, non-zero exit, or timeout.
+ */
+export function runOp(args, opts = {}) {
+    try {
+        const out = execFileSync("op", [...args], {
+            encoding: "utf8",
+            stdio: ["pipe", "pipe", "pipe"],
+            timeout: opts.timeoutMs ?? OP_READ_TIMEOUT_MS,
+            ...(opts.input !== undefined ? { input: opts.input } : {}),
+        });
+        return typeof out === "string" ? out.trim() : "";
+    }
+    catch (err) {
+        throw new OpCliError(args, extractStderr(err), err);
+    }
+}
+/** Pull stderr off an `execFileSync` failure without assuming its shape. */
+function extractStderr(err) {
+    if (typeof err !== "object" || err === null)
+        return "";
+    const stderr = err.stderr;
+    if (typeof stderr === "string")
+        return stderr.trim();
+    if (Buffer.isBuffer(stderr))
+        return stderr.toString("utf8").trim();
+    return "";
+}
+// =============================================================================
+// Availability
+// =============================================================================
+/**
+ * Whether the `op` CLI is present **and** authenticated.
+ *
+ * True when the binary is on `PATH` and either `OP_SERVICE_ACCOUNT_TOKEN` is
+ * set (headless/CI mode, which needs no further check) or at least one account
+ * is configured (desktop app or a prior `op signin`).
+ *
+ * This answers only "can we talk to 1Password?" — it says nothing about whether
+ * a caller *should*. ADR-004's credential backend is opt-in precisely because
+ * `op` being installed must never by itself route secrets into 1Password (§1);
+ * that selection decision belongs to the caller, not here.
+ */
+export function detectOpCli() {
+    try {
+        runOp(["--version"], { timeoutMs: OP_PROBE_TIMEOUT_MS });
+    }
+    catch {
+        return false;
+    }
+    if (process.env.OP_SERVICE_ACCOUNT_TOKEN)
+        return true;
+    try {
+        const output = runOp(["account", "list", "--format=json"], {
+            timeoutMs: OP_PROBE_TIMEOUT_MS,
+        });
+        // `op` prints "[]" when no accounts are configured.
+        return output !== "[]" && output.length > 2;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=op-cli.js.map

package/dist/key-providers/op-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"op-cli.js","sourceRoot":"","sources":["../../src/key-providers/op-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,gFAAgF;AAChF,WAAW;AACX,gFAAgF;AAEhF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAEzC,uEAAuE;AACvE,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAEzC,mFAAmF;AACnF,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAkB1C,uEAAuE;AACvE,MAAM,OAAO,UAAW,SAAQ,KAAK;IAGjB;IAEA;IAES;IAN3B;IACE,oEAAoE;IACpD,IAAuB;IACvC,oEAAoE;IACpD,MAAc;IAC9B,4EAA4E;IACnD,KAAc;QAEvC,KAAK,CACH,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5D,CAAC;QARc,SAAI,GAAJ,IAAI,CAAmB;QAEvB,WAAM,GAAN,MAAM,CAAQ;QAEL,UAAK,GAAL,KAAK,CAAS;QAKvC,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;;OAQG;IACH,IAAI,UAAU;QACZ,OAAO,4EAA4E,CAAC,IAAI,CACtF,IAAI,CAAC,MAAM,CACZ,CAAC;IACJ,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,KAAK,CAAC,IAAuB,EAAE,OAAqB,EAAE;IACpE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;YACxC,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,OAAO,EAAE,IAAI,CAAC,SAAS,IAAI,kBAAkB;YAC7C,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC,CAAC;QACH,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,SAAS,aAAa,CAAC,GAAY;IACjC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACvD,MAAM,MAAM,GAAI,GAA4B,CAAC,MAAM,CAAC;IACpD,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACrD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACnE,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW;IACzB,IAAI,CAAC;QACH,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB;QAAE,OAAO,IAAI,CAAC;IAEtD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE;YACzD,SAAS,EAAE,mBAAmB;SAC/B,CAAC,CAAC;QACH,oDAAoD;QACpD,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/key-providers/passphrase-provider.d.ts

@@ -5,6 +5,7 @@
  * per-vault salt. The passphrase and derived key are never persisted; only
  * non-secret KDF metadata plus a verifier are written beside the vault.
  */
+import type { SecretState } from "../secret-state.js";
 import type { KeyProvider, KeyProviderError, KeyProviderType } from "./types.js";
 export declare const PASSPHRASE_METADATA_VERSION = 1;
 export declare const PASSPHRASE_KDF: "scrypt";
@@ -70,6 +71,25 @@ export declare class PassphraseProvider implements KeyProvider {
      */
     setupKey(): Buffer | null;
     deleteKey(): boolean;
+    /**
+     * The five-way state of the vault master key (#188), value-free.
+     *
+     * A passphrase-derived key is not stored anywhere, so what this can honestly
+     * answer about is the KDF metadata that makes it derivable at all:
+     *
+     * - metadata missing → `absent` (nothing to unlock; run `secrets init`);
+     * - metadata present and this process has a TTY → `found`, the key is
+     *   derivable here;
+     * - metadata present and there is no TTY → `locked` — present, and this
+     *   context cannot unlock it because no passphrase prompt can render. That
+     *   is the same distinction the Keychain backend draws, for the same reason:
+     *   reporting `absent` to a daemon would say "not configured" about a vault
+     *   that is configured and merely unreachable from there.
+     *
+     * Deliberately does not prompt, does not derive, and does not touch
+     * `getLastError()` — a probe is a read-only diagnostic.
+     */
+    probeKey(): SecretState;
     private readMetadata;
     private promptForPassphrase;
     private clearLastError;

package/dist/key-providers/passphrase-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"passphrase-provider.d.ts","sourceRoot":"","sources":["../../src/key-providers/passphrase-provider.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAYH,OAAO,KAAK,EACV,WAAW,EACX,gBAAgB,EAChB,eAAe,EAChB,MAAM,YAAY,CAAC;AAMpB,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAC7C,eAAO,MAAM,cAAc,EAAG,QAAiB,CAAC;AAChD,eAAO,MAAM,6BAA6B,EAAG,aAAsB,CAAC;AACpE,eAAO,MAAM,2BAA2B,mCAAmC,CAAC;AAC5E,eAAO,MAAM,sBAAsB,KAAK,CAAC;AACzC,eAAO,MAAM,6BAA6B,QAKzC,CAAC;AAEF,eAAO,MAAM,6BAA6B,EAAE,mBAM3C,CAAC;AAMF,MAAM,WAAW,mBAAmB;IAClC,wCAAwC;IACxC,CAAC,EAAE,MAAM,CAAC;IACV,mCAAmC;IACnC,CAAC,EAAE,MAAM,CAAC;IACV,wCAAwC;IACxC,CAAC,EAAE,MAAM,CAAC;IACV,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,2BAA2B,CAAC;IAC5C,GAAG,EAAE,OAAO,cAAc,CAAC;IAC3B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE;QACR,SAAS,EAAE,OAAO,6BAA6B,CAAC;QAChD,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;AAElE,MAAM,WAAW,yBAAyB;IACxC,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,wEAAwE;IACxE,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B;AAMD,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAMxE;AAMD,qBAAa,kBAAmB,YAAW,WAAW;IACpD,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAgB;IAE9C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsB;IAClD,OAAO,CAAC,SAAS,CAAiC;gBAEtC,OAAO,GAAE,yBAA8B;IAQnD,yEAAyE;IACzE,MAAM,CAAC,MAAM,IAAI,OAAO;IAIxB,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,YAAY,IAAI,gBAAgB,GAAG,IAAI;IAIvC,MAAM,IAAI,MAAM,GAAG,IAAI;IAmCvB;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAQ/B;;;OAGG;IACH,QAAQ,IAAI,MAAM,GAAG,IAAI;IA8DzB,SAAS,IAAI,OAAO;IAcpB,OAAO,CAAC,YAAY;IA2BpB,OAAO,CAAC,mBAAmB;IAiB3B,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,YAAY;CAGrB;AAMD,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,mBAAmD,GAC1D,MAAM,CAOR"}
+{"version":3,"file":"passphrase-provider.d.ts","sourceRoot":"","sources":["../../src/key-providers/passphrase-provider.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAYH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EACV,WAAW,EACX,gBAAgB,EAChB,eAAe,EAChB,MAAM,YAAY,CAAC;AAMpB,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAC7C,eAAO,MAAM,cAAc,EAAG,QAAiB,CAAC;AAChD,eAAO,MAAM,6BAA6B,EAAG,aAAsB,CAAC;AACpE,eAAO,MAAM,2BAA2B,mCAAmC,CAAC;AAC5E,eAAO,MAAM,sBAAsB,KAAK,CAAC;AACzC,eAAO,MAAM,6BAA6B,QAKzC,CAAC;AAEF,eAAO,MAAM,6BAA6B,EAAE,mBAM3C,CAAC;AAMF,MAAM,WAAW,mBAAmB;IAClC,wCAAwC;IACxC,CAAC,EAAE,MAAM,CAAC;IACV,mCAAmC;IACnC,CAAC,EAAE,MAAM,CAAC;IACV,wCAAwC;IACxC,CAAC,EAAE,MAAM,CAAC;IACV,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,2BAA2B,CAAC;IAC5C,GAAG,EAAE,OAAO,cAAc,CAAC;IAC3B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE;QACR,SAAS,EAAE,OAAO,6BAA6B,CAAC;QAChD,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;AAElE,MAAM,WAAW,yBAAyB;IACxC,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,wEAAwE;IACxE,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B;AAMD,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAMxE;AAMD,qBAAa,kBAAmB,YAAW,WAAW;IACpD,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAgB;IAE9C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsB;IAClD,OAAO,CAAC,SAAS,CAAiC;gBAEtC,OAAO,GAAE,yBAA8B;IAQnD,yEAAyE;IACzE,MAAM,CAAC,MAAM,IAAI,OAAO;IAIxB,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,YAAY,IAAI,gBAAgB,GAAG,IAAI;IAIvC,MAAM,IAAI,MAAM,GAAG,IAAI;IAmCvB;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAQ/B;;;OAGG;IACH,QAAQ,IAAI,MAAM,GAAG,IAAI;IA8DzB,SAAS,IAAI,OAAO;IAcpB;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,IAAI,WAAW;IA6BvB,OAAO,CAAC,YAAY;IA2BpB,OAAO,CAAC,mBAAmB;IAiB3B,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,YAAY;CAGrB;AAMD,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,mBAAmD,GAC1D,MAAM,CAOR"}

package/dist/key-providers/passphrase-provider.js

@@ -156,6 +156,55 @@ export class PassphraseProvider {
             return false;
         }
     }
+    /**
+     * The five-way state of the vault master key (#188), value-free.
+     *
+     * A passphrase-derived key is not stored anywhere, so what this can honestly
+     * answer about is the KDF metadata that makes it derivable at all:
+     *
+     * - metadata missing → `absent` (nothing to unlock; run `secrets init`);
+     * - metadata present and this process has a TTY → `found`, the key is
+     *   derivable here;
+     * - metadata present and there is no TTY → `locked` — present, and this
+     *   context cannot unlock it because no passphrase prompt can render. That
+     *   is the same distinction the Keychain backend draws, for the same reason:
+     *   reporting `absent` to a daemon would say "not configured" about a vault
+     *   that is configured and merely unreachable from there.
+     *
+     * Deliberately does not prompt, does not derive, and does not touch
+     * `getLastError()` — a probe is a read-only diagnostic.
+     */
+    probeKey() {
+        let raw;
+        try {
+            raw = readFileSync(this.metadataPath, "utf8");
+        }
+        catch (err) {
+            if (isNotFoundError(err))
+                return { kind: "absent" };
+            return {
+                kind: "failed",
+                detail: `Failed to read passphrase metadata at ${this.metadataPath}: ${err instanceof Error ? err.message : String(err)}`,
+            };
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            return {
+                kind: "failed",
+                detail: `Passphrase metadata at ${this.metadataPath} is not valid JSON.`,
+            };
+        }
+        if (validateMetadata(parsed) === null) {
+            return {
+                kind: "failed",
+                detail: `Passphrase metadata at ${this.metadataPath} is invalid or unsupported.`,
+            };
+        }
+        return process.stdin.isTTY === true ? { kind: "found" } : { kind: "locked" };
+    }
     readMetadata() {
         let parsed;
         try {

package/dist/key-providers/passphrase-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"passphrase-provider.js","sourceRoot":"","sources":["../../src/key-providers/passphrase-provider.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,SAAS,EACT,YAAY,EACZ,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAO3D,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAC7C,MAAM,CAAC,MAAM,cAAc,GAAG,QAAiB,CAAC;AAChD,MAAM,CAAC,MAAM,6BAA6B,GAAG,aAAsB,CAAC;AACpE,MAAM,CAAC,MAAM,2BAA2B,GAAG,gCAAgC,CAAC;AAC5E,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AACzC,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAC/C,OAAO,EAAE,EACT,WAAW,EACX,SAAS,EACT,WAAW,CACZ,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAwB;IAChE,CAAC,EAAE,CAAC,IAAI,EAAE;IACV,CAAC,EAAE,CAAC;IACJ,CAAC,EAAE,CAAC;IACJ,SAAS,EAAE,EAAE;IACb,MAAM,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;CAC1B,CAAC;AA2CF,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF,MAAM,UAAU,8BAA8B,CAAC,SAAiB;IAC9D,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACxC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB;QACpD,CAAC,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC,CAAC;AAChD,CAAC;AAED,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,MAAM,OAAO,kBAAkB;IACpB,IAAI,GAAoB,YAAY,CAAC;IAE7B,YAAY,CAAS;IACrB,MAAM,CAAmB;IACzB,WAAW,CAAsB;IAC1C,SAAS,GAA4B,IAAI,CAAC;IAElD,YAAY,UAAqC,EAAE;QACjD,IAAI,CAAC,YAAY;YACf,OAAO,CAAC,YAAY;gBACpB,8BAA8B,CAAC,OAAO,CAAC,SAAS,IAAI,6BAA6B,CAAC,CAAC;QACrF,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,gBAAgB,CAAC;QACjD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,MAAM,IAAI,6BAA6B,CAAC;IACrE,CAAC;IAED,yEAAyE;IACzE,MAAM,CAAC,MAAM;QACX,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC;IACtC,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,MAAM;QACJ,IAAI,CAAC,cAAc,EAAE,CAAC;QAEtB,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAEnC,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;QAClE,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAErC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAClD,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAExE,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,YAAY,CACf,YAAY,EACZ,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACvF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,YAAY,CACf,gCAAgC,EAChC,oFAAoF,CACrF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,IAAY;QACnB,IAAI,CAAC,YAAY,CACf,uBAAuB,EACvB,uJAAuJ,CACxJ,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,QAAQ;QACN,IAAI,CAAC,cAAc,EAAE,CAAC;QAEtB,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,2BAA2B,CAAC,CAAC;QACzE,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,6BAA6B,CAAC,CAAC;YACrE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC5E,IAAI,YAAY,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;YAChC,IAAI,CAAC,YAAY,CACf,qBAAqB,EACrB,iEAAiE,CAClE,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,sBAAsB,CAAC,CAAC;QACjD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,YAAY,CACf,YAAY,EACZ,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACvF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAuB;YACnC,OAAO,EAAE,2BAA2B;YACpC,GAAG,EAAE,cAAc;YACnB,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE;YAC/B,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC7B,QAAQ,EAAE;gBACR,SAAS,EAAE,6BAA6B;gBACxC,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;aAC9C;SACF,CAAC;QAEF,IAAI,CAAC;YACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACxE,aAAa,CACX,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EACxC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAClC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,YAAY,CACf,uBAAuB,EACvB,0CAA0C,IAAI,CAAC,YAAY,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnH,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,SAAS;QACP,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,YAAY,CACf,wBAAwB,EACxB,2CAA2C,IAAI,CAAC,YAAY,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACpH,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,CAAC,YAAY,CACf,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,sBAAsB,EACxD,QAAQ;gBACN,CAAC,CAAC,2JAA2J;gBAC7J,CAAC,CAAC,yCAAyC,IAAI,CAAC,YAAY,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACtH,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,YAAY,CACf,kBAAkB,EAClB,0BAA0B,IAAI,CAAC,YAAY,6BAA6B,CACzE,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,mBAAmB,CAAC,OAAe;QACzC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,IAAI,CAAC,YAAY,CAAC,wBAAwB,EAAE,mCAAmC,CAAC,CAAC;gBACjF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,YAAY,CACf,0BAA0B,EAC1B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,cAAc;QACpB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;IAEO,YAAY,CAAC,IAAY,EAAE,OAAe;QAChD,IAAI,CAAC,SAAS,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACrC,CAAC;CACF;AAED,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,MAAM,UAAU,mBAAmB,CACjC,UAAkB,EAClB,IAAY,EACZ,SAA8B,6BAA6B;IAE3D,OAAO,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE;QACpD,CAAC,EAAE,MAAM,CAAC,CAAC;QACX,CAAC,EAAE,MAAM,CAAC,CAAC;QACX,CAAC,EAAE,MAAM,CAAC,CAAC;QACX,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC;SAC7B,MAAM,CAAC,2BAA2B,EAAE,MAAM,CAAC;SAC3C,MAAM,EAAE,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,gBAAwB;IACtD,MAAM,cAAc,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,OAAO,CACL,cAAc,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM;YACjD,eAAe,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAClD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IACE,MAAM,CAAC,OAAO,KAAK,2BAA2B;QAC9C,MAAM,CAAC,GAAG,KAAK,cAAc;QAC7B,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAC/B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEjC,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC;IACpC,IACE,OAAO,WAAW,KAAK,QAAQ;QAC/B,WAAW,KAAK,IAAI;QACpB,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,WAAsC,CAAC;IACxD,IACE,QAAQ,CAAC,SAAS,KAAK,6BAA6B;QACpD,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,EAClC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,aAAa,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAEjE,OAAO;QACL,OAAO,EAAE,2BAA2B;QACpC,GAAG,EAAE,cAAc;QACnB,MAAM;QACN,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE;YACR,SAAS,EAAE,6BAA6B;YACxC,KAAK,EAAE,QAAQ,CAAC,KAAK;SACtB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,MAAM,GAAwB;QAClC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACnB,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACnB,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;QACnC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;KAC9B,CAAC;IAEF,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/B,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/B,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/B,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC;QACvC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC;QACpC,MAAM,CAAC,CAAC,IAAI,CAAC;QACb,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;QACvB,MAAM,CAAC,CAAC,IAAI,CAAC;QACb,MAAM,CAAC,CAAC,IAAI,CAAC;QACb,MAAM,CAAC,SAAS,KAAK,EAAE;QACvB,MAAM,CAAC,MAAM,IAAI,CAAC,EAClB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,OAAO,CACL,GAAG,YAAY,KAAK;QACnB,GAA6B,CAAC,IAAI,KAAK,QAAQ,CACjD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"passphrase-provider.js","sourceRoot":"","sources":["../../src/key-providers/passphrase-provider.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,SAAS,EACT,YAAY,EACZ,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAQ3D,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAC7C,MAAM,CAAC,MAAM,cAAc,GAAG,QAAiB,CAAC;AAChD,MAAM,CAAC,MAAM,6BAA6B,GAAG,aAAsB,CAAC;AACpE,MAAM,CAAC,MAAM,2BAA2B,GAAG,gCAAgC,CAAC;AAC5E,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AACzC,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAC/C,OAAO,EAAE,EACT,WAAW,EACX,SAAS,EACT,WAAW,CACZ,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAwB;IAChE,CAAC,EAAE,CAAC,IAAI,EAAE;IACV,CAAC,EAAE,CAAC;IACJ,CAAC,EAAE,CAAC;IACJ,SAAS,EAAE,EAAE;IACb,MAAM,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;CAC1B,CAAC;AA2CF,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF,MAAM,UAAU,8BAA8B,CAAC,SAAiB;IAC9D,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACxC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB;QACpD,CAAC,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC,CAAC;AAChD,CAAC;AAED,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,MAAM,OAAO,kBAAkB;IACpB,IAAI,GAAoB,YAAY,CAAC;IAE7B,YAAY,CAAS;IACrB,MAAM,CAAmB;IACzB,WAAW,CAAsB;IAC1C,SAAS,GAA4B,IAAI,CAAC;IAElD,YAAY,UAAqC,EAAE;QACjD,IAAI,CAAC,YAAY;YACf,OAAO,CAAC,YAAY;gBACpB,8BAA8B,CAAC,OAAO,CAAC,SAAS,IAAI,6BAA6B,CAAC,CAAC;QACrF,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,gBAAgB,CAAC;QACjD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,MAAM,IAAI,6BAA6B,CAAC;IACrE,CAAC;IAED,yEAAyE;IACzE,MAAM,CAAC,MAAM;QACX,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC;IACtC,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,MAAM;QACJ,IAAI,CAAC,cAAc,EAAE,CAAC;QAEtB,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAEnC,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;QAClE,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAErC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAClD,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAExE,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,YAAY,CACf,YAAY,EACZ,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACvF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,YAAY,CACf,gCAAgC,EAChC,oFAAoF,CACrF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,IAAY;QACnB,IAAI,CAAC,YAAY,CACf,uBAAuB,EACvB,uJAAuJ,CACxJ,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,QAAQ;QACN,IAAI,CAAC,cAAc,EAAE,CAAC;QAEtB,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,2BAA2B,CAAC,CAAC;QACzE,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,6BAA6B,CAAC,CAAC;YACrE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC5E,IAAI,YAAY,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;YAChC,IAAI,CAAC,YAAY,CACf,qBAAqB,EACrB,iEAAiE,CAClE,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,sBAAsB,CAAC,CAAC;QACjD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,YAAY,CACf,YAAY,EACZ,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACvF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAuB;YACnC,OAAO,EAAE,2BAA2B;YACpC,GAAG,EAAE,cAAc;YACnB,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE;YAC/B,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC7B,QAAQ,EAAE;gBACR,SAAS,EAAE,6BAA6B;gBACxC,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;aAC9C;SACF,CAAC;QAEF,IAAI,CAAC;YACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACxE,aAAa,CACX,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EACxC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAClC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,YAAY,CACf,uBAAuB,EACvB,0CAA0C,IAAI,CAAC,YAAY,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnH,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,SAAS;QACP,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,YAAY,CACf,wBAAwB,EACxB,2CAA2C,IAAI,CAAC,YAAY,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACpH,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ;QACN,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,eAAe,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YACpD,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,yCAAyC,IAAI,CAAC,YAAY,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aAC1H,CAAC;QACJ,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,0BAA0B,IAAI,CAAC,YAAY,qBAAqB;aACzE,CAAC;QACJ,CAAC;QACD,IAAI,gBAAgB,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;YACtC,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,0BAA0B,IAAI,CAAC,YAAY,6BAA6B;aACjF,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC/E,CAAC;IAEO,YAAY;QAClB,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,CAAC,YAAY,CACf,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,sBAAsB,EACxD,QAAQ;gBACN,CAAC,CAAC,2JAA2J;gBAC7J,CAAC,CAAC,yCAAyC,IAAI,CAAC,YAAY,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACtH,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,YAAY,CACf,kBAAkB,EAClB,0BAA0B,IAAI,CAAC,YAAY,6BAA6B,CACzE,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,mBAAmB,CAAC,OAAe;QACzC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,IAAI,CAAC,YAAY,CAAC,wBAAwB,EAAE,mCAAmC,CAAC,CAAC;gBACjF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,YAAY,CACf,0BAA0B,EAC1B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,cAAc;QACpB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;IAEO,YAAY,CAAC,IAAY,EAAE,OAAe;QAChD,IAAI,CAAC,SAAS,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACrC,CAAC;CACF;AAED,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,MAAM,UAAU,mBAAmB,CACjC,UAAkB,EAClB,IAAY,EACZ,SAA8B,6BAA6B;IAE3D,OAAO,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE;QACpD,CAAC,EAAE,MAAM,CAAC,CAAC;QACX,CAAC,EAAE,MAAM,CAAC,CAAC;QACX,CAAC,EAAE,MAAM,CAAC,CAAC;QACX,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC;SAC7B,MAAM,CAAC,2BAA2B,EAAE,MAAM,CAAC;SAC3C,MAAM,EAAE,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,gBAAwB;IACtD,MAAM,cAAc,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,OAAO,CACL,cAAc,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM;YACjD,eAAe,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAClD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IACE,MAAM,CAAC,OAAO,KAAK,2BAA2B;QAC9C,MAAM,CAAC,GAAG,KAAK,cAAc;QAC7B,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAC/B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEjC,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC;IACpC,IACE,OAAO,WAAW,KAAK,QAAQ;QAC/B,WAAW,KAAK,IAAI;QACpB,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,WAAsC,CAAC;IACxD,IACE,QAAQ,CAAC,SAAS,KAAK,6BAA6B;QACpD,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,EAClC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,aAAa,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAEjE,OAAO;QACL,OAAO,EAAE,2BAA2B;QACpC,GAAG,EAAE,cAAc;QACnB,MAAM;QACN,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE;YACR,SAAS,EAAE,6BAA6B;YACxC,KAAK,EAAE,QAAQ,CAAC,KAAK;SACtB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,MAAM,GAAwB;QAClC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACnB,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACnB,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;QACnC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;KAC9B,CAAC;IAEF,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/B,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/B,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/B,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC;QACvC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC;QACpC,MAAM,CAAC,CAAC,IAAI,CAAC;QACb,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;QACvB,MAAM,CAAC,CAAC,IAAI,CAAC;QACb,MAAM,CAAC,CAAC,IAAI,CAAC;QACb,MAAM,CAAC,SAAS,KAAK,EAAE;QACvB,MAAM,CAAC,MAAM,IAAI,CAAC,EAClB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,OAAO,CACL,GAAG,YAAY,KAAK;QACnB,GAA6B,CAAC,IAAI,KAAK,QAAQ,CACjD,CAAC;AACJ,CAAC"}

package/dist/key-providers/probe.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Key-layer state probe (#188).
+ *
+ * The companion to `probeBackendState()` in `../vault/vault.ts`. That one
+ * answers for a credential VALUE in the active `VaultBackend`; this one
+ * answers for the vault MASTER KEY in the active `KeyProvider`.
+ *
+ * Both layers are here because fixing one is half a fix: a credential value
+ * that becomes readable from a sessionless context is worthless if the key
+ * that decrypts the vault around it is not, and a diagnostic that can only see
+ * one layer will confidently report a healthy store while the other layer is
+ * dark. ADR-005's amendment to ADR-002 forbids the one-layer fix for exactly
+ * this reason.
+ *
+ * The result is value-free: no variant carries key material.
+ */
+import type { SecretState } from "../secret-state.js";
+import type { ResolveKeyProviderOptions } from "./resolve.js";
+import type { KeyProvider, KeyProviderType } from "./types.js";
+/** A value-free answer about the vault master key. */
+export interface KeyStateProbe {
+    /** Always `"key"` — distinguishes this from the value-layer probe. */
+    layer: "key";
+    /** Which provider answered, or null when none could be resolved. */
+    provider: KeyProviderType | null;
+    state: SecretState;
+}
+/**
+ * Probe a specific provider's master-key state.
+ *
+ * A provider that does not implement `probeKey()` yields `not-applicable` with
+ * the provider name in its reason — never a guess, and never `absent`.
+ * Guessing `absent` for a provider that simply cannot answer is the exact
+ * collapse this ticket exists to kill: it would report "no key configured"
+ * for a key that is present and merely unreachable from here.
+ */
+export declare function probeKeyProvider(provider: KeyProvider): KeyStateProbe;
+/**
+ * Probe the master key of the provider this process would actually use.
+ *
+ * When no provider can be resolved at all the state is `failed` carrying the
+ * resolver's own message — deliberately not `absent`, which would claim the
+ * key is not stored when the truth is that nothing was asked.
+ */
+export declare function probeKeyProviderState(options?: ResolveKeyProviderOptions): KeyStateProbe;
+//# sourceMappingURL=probe.d.ts.map

package/dist/key-providers/probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.d.ts","sourceRoot":"","sources":["../../src/key-providers/probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE/D,sDAAsD;AACtD,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,KAAK,EAAE,KAAK,CAAC;IACb,oEAAoE;IACpE,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;IACjC,KAAK,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,WAAW,GAAG,aAAa,CAuBrE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,GAAE,yBAA8B,GACtC,aAAa,CAUf"}

package/dist/key-providers/probe.js

@@ -0,0 +1,70 @@
+/**
+ * Key-layer state probe (#188).
+ *
+ * The companion to `probeBackendState()` in `../vault/vault.ts`. That one
+ * answers for a credential VALUE in the active `VaultBackend`; this one
+ * answers for the vault MASTER KEY in the active `KeyProvider`.
+ *
+ * Both layers are here because fixing one is half a fix: a credential value
+ * that becomes readable from a sessionless context is worthless if the key
+ * that decrypts the vault around it is not, and a diagnostic that can only see
+ * one layer will confidently report a healthy store while the other layer is
+ * dark. ADR-005's amendment to ADR-002 forbids the one-layer fix for exactly
+ * this reason.
+ *
+ * The result is value-free: no variant carries key material.
+ */
+import { resolveKeyProvider } from "./resolve.js";
+/**
+ * Probe a specific provider's master-key state.
+ *
+ * A provider that does not implement `probeKey()` yields `not-applicable` with
+ * the provider name in its reason — never a guess, and never `absent`.
+ * Guessing `absent` for a provider that simply cannot answer is the exact
+ * collapse this ticket exists to kill: it would report "no key configured"
+ * for a key that is present and merely unreachable from here.
+ */
+export function probeKeyProvider(provider) {
+    if (typeof provider.probeKey !== "function") {
+        return {
+            layer: "key",
+            provider: provider.name,
+            state: {
+                kind: "not-applicable",
+                reason: `key provider "${provider.name}" cannot report key state without unlocking it`,
+            },
+        };
+    }
+    try {
+        return { layer: "key", provider: provider.name, state: provider.probeKey() };
+    }
+    catch (err) {
+        return {
+            layer: "key",
+            provider: provider.name,
+            state: {
+                kind: "failed",
+                detail: err instanceof Error ? err.message : String(err),
+            },
+        };
+    }
+}
+/**
+ * Probe the master key of the provider this process would actually use.
+ *
+ * When no provider can be resolved at all the state is `failed` carrying the
+ * resolver's own message — deliberately not `absent`, which would claim the
+ * key is not stored when the truth is that nothing was asked.
+ */
+export function probeKeyProviderState(options = {}) {
+    const resolution = resolveKeyProvider(options);
+    if (!resolution.ok) {
+        return {
+            layer: "key",
+            provider: null,
+            state: { kind: "failed", detail: resolution.error.message },
+        };
+    }
+    return probeKeyProvider(resolution.provider);
+}
+//# sourceMappingURL=probe.js.map

package/dist/key-providers/probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.js","sourceRoot":"","sources":["../../src/key-providers/probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAalD;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAqB;IACpD,IAAI,OAAO,QAAQ,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,KAAK,EAAE;gBACL,IAAI,EAAE,gBAAgB;gBACtB,MAAM,EAAE,iBAAiB,QAAQ,CAAC,IAAI,gDAAgD;aACvF;SACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC/E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACzD;SACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAqC,EAAE;IAEvC,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE;SAC5D,CAAC;IACJ,CAAC;IACD,OAAO,gBAAgB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC/C,CAAC"}

package/dist/key-providers/types.d.ts

@@ -8,6 +8,7 @@
  * All methods return null/false on failure — never throw (consistent
  * with vault-common.ts conventions).
  */
+import type { SecretState } from "../secret-state.js";
 /** Supported key provider backends. */
 export type KeyProviderType = "keychain" | "1password" | "passphrase";
 /** Optional diagnostic exposed after a provider returns null/false. */
@@ -58,6 +59,25 @@ export interface KeyProvider {
      * to surface clear auth failures such as wrong passphrase or non-TTY prompt.
      */
     getLastError?(): KeyProviderError | null;
+    /**
+     * Optional value-free probe of the master key's state (#188).
+     *
+     * `getKey()` returns `null` for "no key stored" and for "the key is there
+     * and this context cannot open it" alike; that collapse is what turns a
+     * change of execution context into a silent outage. This answers the two
+     * apart, without being able to return any key material.
+     *
+     * **`found` means `getKey()` would succeed**, not merely that an entry
+     * exists somewhere. Presence is not readability, so an implementation must
+     * exercise the same access path `getKey()` would and discard what it read.
+     *
+     * Optional because not every provider can answer honestly: a provider that
+     * would have to prompt for a passphrase, or authenticate to a remote vault,
+     * should report `not-applicable` (or omit the method) rather than guess.
+     * `probeKeyProviderState()` maps an absent implementation to a
+     * `not-applicable` with the provider name in its reason.
+     */
+    probeKey?(): SecretState;
 }
 /** 1Password-specific configuration. */
 export interface OnePasswordConfig {
@@ -66,12 +86,42 @@ export interface OnePasswordConfig {
     /** 1Password item name (default: "centient-vault-key"). */
     item?: string;
 }
+/**
+ * 1Password configuration for the **credential-value** backend (ADR-004).
+ *
+ * Deliberately separate from {@link OnePasswordConfig}, which names the item
+ * holding the vault *encryption key* (ADR-001). The two are independent layers:
+ * an operator may keep the key in `Private` while credentials live in a shared
+ * vault, or use 1Password for one and the Keychain for the other. Overloading a
+ * single `vault` field would conflate them.
+ */
+export interface OnePasswordBackendConfig {
+    /**
+     * 1Password vault holding credential values. **Required — no default.**
+     *
+     * Unlike the key block (which defaults to `"Private"`), guessing here could
+     * write credentials into a personal vault the operator never intended, so an
+     * unset value under an explicit `backend: "1password"` fails closed.
+     */
+    vault?: string;
+    /** Tag applied to items, and filtered on when listing. Default `"centient"`. */
+    tag?: string;
+}
+/** Explicit credential-storage backend selection. */
+export type SecretsBackendType = "1password";
 /** Global secrets configuration from ~/.centient/config.json. */
 export interface SecretsConfig {
     /** Explicit provider choice. Omit for auto-detection. */
     provider?: KeyProviderType;
-    /** 1Password-specific settings. */
+    /** 1Password-specific settings for the vault-encryption KEY (ADR-001). */
     onePassword?: OnePasswordConfig;
+    /**
+     * Explicit credential-storage backend (ADR-004). Omit for the auto-cascade;
+     * 1Password is never auto-selected.
+     */
+    backend?: SecretsBackendType;
+    /** Settings for the 1Password credential-VALUE backend (ADR-004). */
+    onePasswordBackend?: OnePasswordBackendConfig;
 }
 /** Top-level structure of ~/.centient/config.json. */
 export interface CentientConfig {

package/dist/key-providers/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/key-providers/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,uCAAuC;AACvC,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,WAAW,GAAG,YAAY,CAAC;AAEtE,uEAAuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAE/B;;;;OAIG;IACH,MAAM,IAAI,MAAM,GAAG,IAAI,CAAC;IAExB;;;;;;;OAOG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAE/B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,MAAM,GAAG,IAAI,CAAC;IAE3B;;;;OAIG;IACH,SAAS,IAAI,OAAO,CAAC;IAErB;;;;;OAKG;IACH,YAAY,CAAC,IAAI,gBAAgB,GAAG,IAAI,CAAC;CAC1C;AAMD,wCAAwC;AACxC,MAAM,WAAW,iBAAiB;IAChC,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,iEAAiE;AACjE,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,mCAAmC;IACnC,WAAW,CAAC,EAAE,iBAAiB,CAAC;CACjC;AAED,sDAAsD;AACtD,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/key-providers/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAMtD,uCAAuC;AACvC,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,WAAW,GAAG,YAAY,CAAC;AAEtE,uEAAuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAE/B;;;;OAIG;IACH,MAAM,IAAI,MAAM,GAAG,IAAI,CAAC;IAExB;;;;;;;OAOG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAE/B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,MAAM,GAAG,IAAI,CAAC;IAE3B;;;;OAIG;IACH,SAAS,IAAI,OAAO,CAAC;IAErB;;;;;OAKG;IACH,YAAY,CAAC,IAAI,gBAAgB,GAAG,IAAI,CAAC;IAEzC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,IAAI,WAAW,CAAC;CAC1B;AAMD,wCAAwC;AACxC,MAAM,WAAW,iBAAiB;IAChC,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,qDAAqD;AACrD,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAE7C,iEAAiE;AACjE,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,0EAA0E;IAC1E,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC;;;OAGG;IACH,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,qEAAqE;IACrE,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;CAC/C;AAED,sDAAsD;AACtD,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB"}

package/dist/platform/agent-detect.d.ts

@@ -2,14 +2,50 @@
  * Agent Environment Detection
  *
  * Detects whether the process is running inside an AI agent session
- * (Claude Code, MCP context, etc.). Auth commands that require human
- * interaction are blocked in these environments.
+ * (Claude Code, MCP subprocess, etc.) by testing the environment markers such
+ * a session sets.
  *
- * Shared by: vault.ts, cli, secrets-cli.ts
+ * **What this gates (the whole list).** This is the single implementation; the
+ * only call sites are:
+ *
+ * - `cli/secrets-cli.ts` — `runSecrets()` refuses every `centient secrets`
+ *   subcommand when it returns true, and
+ * - `environment/EnvironmentManager.ts` — the environment mutation commands
+ *   (create / switch / delete-style auth operations).
+ *
+ * It does **not** gate the programmatic API: `openVault()`, `getCredential()`,
+ * `storeCredential()`, and `SessionVault.get()` contain no agent check, and
+ * `vault.ts` does not call this function. (An earlier version of this comment
+ * claimed it was "shared by vault.ts" — it never was.)
+ *
+ * **This is a UX guardrail, not a security boundary.** It reads environment
+ * variables the calling process itself controls, so any agent can clear them
+ * (`env -u CLAUDECODE …`) and walk straight through. Its job is to stop an
+ * agent from *accidentally* driving the operator CLI, nothing more. See
+ * `docs/threat-model.md` §4.4 and ADR-005 §3, which demotes this check
+ * explicitly; repairing the marker names (#189) does not re-promote it.
+ *
+ * **Marker accuracy matters** precisely because the check is cheap: before
+ * #189 it tested `CLAUDE_CODE_ENTRY_POINT` (a misspelling of the real
+ * `CLAUDE_CODE_ENTRYPOINT`) and leaned on `CLAUDE_PROJECT_DIR`, which
+ * hook-spawned subprocesses get but live interactive sessions do not — so the
+ * gate never fired for the sessions it was written for. `tests/agent-detect.test.ts`
+ * pins each marker individually so a rename cannot silently disable it again.
  */
+/**
+ * Environment variables whose presence marks an AI agent session.
+ *
+ * Package-internal (not re-exported from `index.ts`) — exported so tests and
+ * the CLI test harnesses clear exactly this set rather than a hand-copied one
+ * that can drift.
+ */
+export declare const AGENT_ENV_MARKERS: readonly ["CLAUDECODE", "CLAUDE_CODE_ENTRYPOINT", "CLAUDE_PROJECT_DIR", "CLAUDE_CODE_SESSION", "MCP_CONTEXT", "MCP_SERVER_NAME", "ANTHROPIC_API_KEY_SOURCE"];
 /**
  * Returns true if the current process appears to be running inside an
  * AI agent environment (Claude Code, MCP subprocess, etc.).
+ *
+ * Advisory only — see the module docstring. A false result does not mean "a
+ * human is at the keyboard", it means "no marker was found".
  */
 export declare function isAgentEnvironment(): boolean;
 //# sourceMappingURL=agent-detect.d.ts.map

package/dist/platform/agent-detect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-detect.d.ts","sourceRoot":"","sources":["../../src/platform/agent-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAS5C"}
+{"version":3,"file":"agent-detect.d.ts","sourceRoot":"","sources":["../../src/platform/agent-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,8JAepB,CAAC;AAEX;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C"}

package/dist/platform/agent-detect.js

@@ -2,21 +2,67 @@
  * Agent Environment Detection
  *
  * Detects whether the process is running inside an AI agent session
- * (Claude Code, MCP context, etc.). Auth commands that require human
- * interaction are blocked in these environments.
+ * (Claude Code, MCP subprocess, etc.) by testing the environment markers such
+ * a session sets.
  *
- * Shared by: vault.ts, cli, secrets-cli.ts
+ * **What this gates (the whole list).** This is the single implementation; the
+ * only call sites are:
+ *
+ * - `cli/secrets-cli.ts` — `runSecrets()` refuses every `centient secrets`
+ *   subcommand when it returns true, and
+ * - `environment/EnvironmentManager.ts` — the environment mutation commands
+ *   (create / switch / delete-style auth operations).
+ *
+ * It does **not** gate the programmatic API: `openVault()`, `getCredential()`,
+ * `storeCredential()`, and `SessionVault.get()` contain no agent check, and
+ * `vault.ts` does not call this function. (An earlier version of this comment
+ * claimed it was "shared by vault.ts" — it never was.)
+ *
+ * **This is a UX guardrail, not a security boundary.** It reads environment
+ * variables the calling process itself controls, so any agent can clear them
+ * (`env -u CLAUDECODE …`) and walk straight through. Its job is to stop an
+ * agent from *accidentally* driving the operator CLI, nothing more. See
+ * `docs/threat-model.md` §4.4 and ADR-005 §3, which demotes this check
+ * explicitly; repairing the marker names (#189) does not re-promote it.
+ *
+ * **Marker accuracy matters** precisely because the check is cheap: before
+ * #189 it tested `CLAUDE_CODE_ENTRY_POINT` (a misspelling of the real
+ * `CLAUDE_CODE_ENTRYPOINT`) and leaned on `CLAUDE_PROJECT_DIR`, which
+ * hook-spawned subprocesses get but live interactive sessions do not — so the
+ * gate never fired for the sessions it was written for. `tests/agent-detect.test.ts`
+ * pins each marker individually so a rename cannot silently disable it again.
  */
+/**
+ * Environment variables whose presence marks an AI agent session.
+ *
+ * Package-internal (not re-exported from `index.ts`) — exported so tests and
+ * the CLI test harnesses clear exactly this set rather than a hand-copied one
+ * that can drift.
+ */
+export const AGENT_ENV_MARKERS = [
+    /** Set by every live Claude Code session (interactive and headless). */
+    "CLAUDECODE",
+    /** Set by Claude Code to name how the session was launched (cli, vscode, …). */
+    "CLAUDE_CODE_ENTRYPOINT",
+    /** Set in Claude Code hook-spawned subprocesses; absent in live sessions. */
+    "CLAUDE_PROJECT_DIR",
+    /** Session identifier exposed by some Claude Code integrations. */
+    "CLAUDE_CODE_SESSION",
+    /** Set by MCP hosts for servers running under a model context. */
+    "MCP_CONTEXT",
+    /** Set by MCP hosts to name the server being run. */
+    "MCP_SERVER_NAME",
+    /** Legacy marker retained from the pre-#189 set; harmless if unset. */
+    "ANTHROPIC_API_KEY_SOURCE",
+];
 /**
  * Returns true if the current process appears to be running inside an
  * AI agent environment (Claude Code, MCP subprocess, etc.).
+ *
+ * Advisory only — see the module docstring. A false result does not mean "a
+ * human is at the keyboard", it means "no marker was found".
  */
 export function isAgentEnvironment() {
-    return !!(process.env["CLAUDE_PROJECT_DIR"] ||
-        process.env["MCP_CONTEXT"] ||
-        process.env["CLAUDE_CODE_SESSION"] ||
-        process.env["CLAUDE_CODE_ENTRY_POINT"] ||
-        process.env["ANTHROPIC_API_KEY_SOURCE"] ||
-        process.env["MCP_SERVER_NAME"]);
+    return AGENT_ENV_MARKERS.some((name) => !!process.env[name]);
 }
 //# sourceMappingURL=agent-detect.js.map

package/dist/platform/agent-detect.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-detect.js","sourceRoot":"","sources":["../../src/platform/agent-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,CAAC,CAAC,CACP,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAC/B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"agent-detect.js","sourceRoot":"","sources":["../../src/platform/agent-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,wEAAwE;IACxE,YAAY;IACZ,gFAAgF;IAChF,wBAAwB;IACxB,6EAA6E;IAC7E,oBAAoB;IACpB,mEAAmE;IACnE,qBAAqB;IACrB,kEAAkE;IAClE,aAAa;IACb,qDAAqD;IACrD,iBAAiB;IACjB,uEAAuE;IACvE,0BAA0B;CAClB,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC"}