@centient/secrets 0.9.0 → 0.10.0

package/dist/platform/session-context.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Session-context detection (#188).
+ *
+ * ## Why this is not platform detection
+ *
+ * The keychain accessors in this package used to branch on nothing at all:
+ * one code path, which implicitly assumed an interactive GUI session. That
+ * assumption is wrong in exactly the contexts a credential store matters most
+ * — a launchd system-domain daemon and an SSH login both run **without a
+ * security session** attached to the user's login keychain:
+ *
+ *   - no consent UI can render, so an item whose ACL is not preauthorized at
+ *     write time is unreadable and there is nothing to click;
+ *   - the keychain **search list** cannot be trusted, because it leads with
+ *     the (locked) login keychain, whose copy of an item shadows a perfectly
+ *     readable System-keychain copy.
+ *
+ * `process.platform === "darwin"` answers neither question — a Mac is a Mac in
+ * all three contexts. So the branch that matters is *session vs sessionless*,
+ * and that is what this module reports.
+ *
+ * ## The signals, and their limits
+ *
+ * There is no supported API that says "you are in the launchd system domain",
+ * so this is a heuristic and is documented as one. It is deliberately
+ * conservative, and the read path is built so that a misclassification is
+ * harmless rather than fatal: a sessionless read consults the System keychain
+ * *first* and only then falls back to the search list, so classifying an
+ * interactive session as sessionless can never lose a credential that was
+ * previously readable (see `readKeychainCredential` in
+ * `../crypto/darwin-keychain.ts`).
+ *
+ * The override exists for the case the heuristic cannot see — a daemon whose
+ * environment is scrubbed, or a test rig — and it wins over every signal.
+ */
+/** Environment variable that forces the answer. `sessionless` | `interactive`. */
+export declare const SESSION_CONTEXT_OVERRIDE_ENV = "CENTIENT_SECRETS_SESSION_CONTEXT";
+/** Injectable seam. Both fields default to the live process. */
+export interface SessionContextDeps {
+    platform: NodeJS.Platform;
+    env: NodeJS.ProcessEnv;
+}
+/**
+ * Why a context was classified the way it was. Carried so a diagnostic can
+ * explain the read path it is about to take instead of asserting it.
+ */
+export type SessionContext = {
+    kind: "sessionless";
+    /**
+     * - `ssh` — an SSH login: `SSH_CONNECTION`/`SSH_TTY`/`SSH_CLIENT` set.
+     * - `launchd-daemon` — a launchd-managed job with no controlling
+     *   terminal (`XPC_SERVICE_NAME` set to a real job label, `TERM` unset).
+     * - `forced` — the override said so.
+     */
+    reason: "ssh" | "launchd-daemon" | "forced";
+} | {
+    kind: "interactive";
+    /**
+     * - `session` — no sessionless signal was present.
+     * - `not-darwin` — the distinction is macOS-specific; elsewhere there is
+     *   no keychain search list to mistrust.
+     * - `forced` — the override said so.
+     */
+    reason: "session" | "not-darwin" | "forced";
+};
+/**
+ * Classify the current execution context.
+ *
+ * Order of precedence: explicit override, then SSH, then launchd-without-a-tty,
+ * then interactive. Off darwin the answer is always `interactive` with reason
+ * `not-darwin` — the search-list shadowing problem is a macOS keychain problem,
+ * and other backends have no equivalent notion.
+ */
+export declare function detectSessionContext(deps?: Partial<SessionContextDeps>): SessionContext;
+/** Convenience predicate over {@link detectSessionContext}. */
+export declare function isSessionlessContext(deps?: Partial<SessionContextDeps>): boolean;
+//# sourceMappingURL=session-context.d.ts.map

package/dist/platform/session-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-context.d.ts","sourceRoot":"","sources":["../../src/platform/session-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,kFAAkF;AAClF,eAAO,MAAM,4BAA4B,qCAAqC,CAAC;AAE/E,gEAAgE;AAChE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GACtB;IACE,IAAI,EAAE,aAAa,CAAC;IACpB;;;;;OAKG;IACH,MAAM,EAAE,KAAK,GAAG,gBAAgB,GAAG,QAAQ,CAAC;CAC7C,GACD;IACE,IAAI,EAAE,aAAa,CAAC;IACpB;;;;;OAKG;IACH,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,CAAC;CAC7C,CAAC;AAaN;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,GAAE,OAAO,CAAC,kBAAkB,CAAM,GACrC,cAAc,CAyBhB;AAED,+DAA+D;AAC/D,wBAAgB,oBAAoB,CAClC,IAAI,GAAE,OAAO,CAAC,kBAAkB,CAAM,GACrC,OAAO,CAET"}

package/dist/platform/session-context.js

@@ -0,0 +1,83 @@
+/**
+ * Session-context detection (#188).
+ *
+ * ## Why this is not platform detection
+ *
+ * The keychain accessors in this package used to branch on nothing at all:
+ * one code path, which implicitly assumed an interactive GUI session. That
+ * assumption is wrong in exactly the contexts a credential store matters most
+ * — a launchd system-domain daemon and an SSH login both run **without a
+ * security session** attached to the user's login keychain:
+ *
+ *   - no consent UI can render, so an item whose ACL is not preauthorized at
+ *     write time is unreadable and there is nothing to click;
+ *   - the keychain **search list** cannot be trusted, because it leads with
+ *     the (locked) login keychain, whose copy of an item shadows a perfectly
+ *     readable System-keychain copy.
+ *
+ * `process.platform === "darwin"` answers neither question — a Mac is a Mac in
+ * all three contexts. So the branch that matters is *session vs sessionless*,
+ * and that is what this module reports.
+ *
+ * ## The signals, and their limits
+ *
+ * There is no supported API that says "you are in the launchd system domain",
+ * so this is a heuristic and is documented as one. It is deliberately
+ * conservative, and the read path is built so that a misclassification is
+ * harmless rather than fatal: a sessionless read consults the System keychain
+ * *first* and only then falls back to the search list, so classifying an
+ * interactive session as sessionless can never lose a credential that was
+ * previously readable (see `readKeychainCredential` in
+ * `../crypto/darwin-keychain.ts`).
+ *
+ * The override exists for the case the heuristic cannot see — a daemon whose
+ * environment is scrubbed, or a test rig — and it wins over every signal.
+ */
+/** Environment variable that forces the answer. `sessionless` | `interactive`. */
+export const SESSION_CONTEXT_OVERRIDE_ENV = "CENTIENT_SECRETS_SESSION_CONTEXT";
+function resolve(deps) {
+    return {
+        platform: deps.platform ?? process.platform,
+        env: deps.env ?? process.env,
+    };
+}
+function isSet(value) {
+    return typeof value === "string" && value.trim().length > 0;
+}
+/**
+ * Classify the current execution context.
+ *
+ * Order of precedence: explicit override, then SSH, then launchd-without-a-tty,
+ * then interactive. Off darwin the answer is always `interactive` with reason
+ * `not-darwin` — the search-list shadowing problem is a macOS keychain problem,
+ * and other backends have no equivalent notion.
+ */
+export function detectSessionContext(deps = {}) {
+    const { platform, env } = resolve(deps);
+    const override = env[SESSION_CONTEXT_OVERRIDE_ENV]?.trim();
+    if (override === "sessionless")
+        return { kind: "sessionless", reason: "forced" };
+    if (override === "interactive")
+        return { kind: "interactive", reason: "forced" };
+    if (platform !== "darwin")
+        return { kind: "interactive", reason: "not-darwin" };
+    if (isSet(env["SSH_CONNECTION"]) || isSet(env["SSH_TTY"]) || isSet(env["SSH_CLIENT"])) {
+        return { kind: "sessionless", reason: "ssh" };
+    }
+    // launchd exports `XPC_SERVICE_NAME` as the job label for a managed job; a
+    // process started from a shell either has it unset or set to the literal
+    // `"0"`. A managed job that also has no `TERM` has no controlling terminal
+    // and therefore no way to render a consent prompt. Both halves are required:
+    // a GUI application is also a launchd job, and demoting one of those to
+    // "sessionless" would be a needless change of read path.
+    const xpc = env["XPC_SERVICE_NAME"];
+    if (isSet(xpc) && xpc?.trim() !== "0" && !isSet(env["TERM"])) {
+        return { kind: "sessionless", reason: "launchd-daemon" };
+    }
+    return { kind: "interactive", reason: "session" };
+}
+/** Convenience predicate over {@link detectSessionContext}. */
+export function isSessionlessContext(deps = {}) {
+    return detectSessionContext(deps).kind === "sessionless";
+}
+//# sourceMappingURL=session-context.js.map

package/dist/platform/session-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-context.js","sourceRoot":"","sources":["../../src/platform/session-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,4BAA4B,GAAG,kCAAkC,CAAC;AAkC/E,SAAS,OAAO,CAAC,IAAiC;IAChD,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ;QAC3C,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,KAAyB;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAoC,EAAE;IAEtC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAExC,MAAM,QAAQ,GAAG,GAAG,CAAC,4BAA4B,CAAC,EAAE,IAAI,EAAE,CAAC;IAC3D,IAAI,QAAQ,KAAK,aAAa;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACjF,IAAI,QAAQ,KAAK,aAAa;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAEjF,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAEhF,IAAI,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QACtF,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAChD,CAAC;IAED,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,wEAAwE;IACxE,yDAAyD;IACzD,MAAM,GAAG,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC7D,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3D,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACpD,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,oBAAoB,CAClC,OAAoC,EAAE;IAEtC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC;AAC3D,CAAC"}

package/dist/secret-state.d.ts

@@ -0,0 +1,54 @@
+/**
+ * The five-way credential state (#188).
+ *
+ * Every probe in this package answers with this shape, at both credential
+ * layers — the `KeyProvider` layer (the vault master key) and the
+ * `VaultBackend` cascade (credential values).
+ *
+ * ## Why five kinds and not a boolean
+ *
+ * The defect this type exists to kill is the collapse of "there is no such
+ * credential" into "I could not read the credential". They have opposite
+ * remedies — one says *store it*, the other says *unlock the store / fix the
+ * ACL / run me in a context that has a session* — and a caller handed a single
+ * `null` cannot tell them apart. A backend that reports `absent` for an item
+ * it simply could not open turns a context change into a silent outage: the
+ * reader logs "none configured" and everything downstream behaves as though
+ * the operator never set it up.
+ *
+ * So the kinds are deliberately irreducible:
+ *
+ * - `found` — the credential is there. **Value-free**: a probe never carries
+ *   secret material, so this variant has no `value` field. Reading the bytes
+ *   is a separate, explicit call.
+ * - `absent` — the store answered, and there is no such item.
+ * - `locked` — the item exists but this execution context cannot open it
+ *   (locked keychain, an ACL that does not preauthorize the reader, no
+ *   session in which a consent prompt could render).
+ * - `not-applicable` — this store cannot exist here at all (a macOS Keychain
+ *   probe on Linux). Distinct from `failed`: nothing went wrong.
+ * - `failed` — the store was contacted and did not give a usable answer.
+ *   Includes the corrupt case where a successful read yields zero bytes: an
+ *   empty credential is never reported as `found`.
+ *
+ * `not-applicable` and `failed` carry a value-free human-readable string for
+ * diagnostics. No variant ever carries a credential.
+ *
+ * See issue #188, ADR-005, and `docs/threat-model.md`.
+ */
+export type SecretState = {
+    kind: "found";
+} | {
+    kind: "absent";
+} | {
+    kind: "locked";
+} | {
+    kind: "not-applicable";
+    reason: string;
+} | {
+    kind: "failed";
+    detail: string;
+};
+/** The discriminant of {@link SecretState}, for exhaustive switches. */
+export type SecretStateKind = SecretState["kind"];
+//# sourceMappingURL=secret-state.d.ts.map

package/dist/secret-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-state.d.ts","sourceRoot":"","sources":["../src/secret-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,wEAAwE;AACxE,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC"}

package/dist/secret-state.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=secret-state.js.map

package/dist/secret-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-state.js","sourceRoot":"","sources":["../src/secret-state.ts"],"names":[],"mappings":""}

package/dist/vault/session-vault-errors.d.ts

@@ -1,14 +1,23 @@
 /**
- * SessionVault error classes — extracted so helper modules (file-lock,
- * sidecar) can throw them without creating an import cycle back into
- * session-vault.ts.
+ * Vault error taxonomy — the package's one `VaultError` hierarchy, extracted
+ * so helper modules (file-lock, sidecar, vault-utils) can throw these without
+ * creating an import cycle back into session-vault.ts.
+ *
+ * Most members are SessionVault-specific; `InvalidCredentialKeyError` is
+ * raised by the credential cascade (`vault.ts`) and its backends. They share a
+ * base class deliberately — a caller wrapping vault work in
+ * `catch (e) { if (e instanceof VaultError) … }` should not have to know which
+ * storage path produced the failure.
+ *
+ * This module has no imports on purpose; keep it that way so any vault module
+ * can depend on it.
  *
  * Each subclass restores the prototype chain with `Object.setPrototypeOf`
  * so `instanceof VaultError` etc. remains robust when the class is consumed
  * across an ES transpile boundary (L2 — matches the EngramError pattern in
  * `packages/sdk/src/errors.ts`).
  */
-/** Base class for SessionVault errors. */
+/** Base class for vault errors. */
 export declare class VaultError extends Error {
     readonly code: string;
     constructor(code: string, message: string);
@@ -31,6 +40,65 @@ export declare class VaultRollbackError extends VaultError {
 export declare class VaultClosedError extends VaultError {
     constructor();
 }
+/**
+ * Thrown when a rekey's external commit failed AND restoring the prior
+ * ciphertext then failed too.
+ *
+ * This is the one indeterminate state the rekey path can reach: the vault file
+ * may still hold the ciphertext written under the NEW key, so neither key can
+ * be assumed to be the right one — and, critically, **no key material for
+ * either may be discarded**. Callers that clean up on failure (e.g. deleting
+ * freshly written passphrase metadata) must special-case this error; deleting
+ * the new key's material here can leave the vault permanently unopenable.
+ */
+export declare class VaultRestoreError extends VaultError {
+    /** Absolute path of the vault whose state is indeterminate. */
+    readonly path: string;
+    /** Version the new ciphertext carries, if it is the one on disk. */
+    readonly attemptedVersion: number;
+    /** The `commit` failure that triggered the rollback attempt. */
+    readonly commitCause: unknown;
+    /** The failure of the rollback write itself. */
+    readonly restoreCause: unknown;
+    constructor(
+    /** Absolute path of the vault whose state is indeterminate. */
+    path: string, 
+    /** Version the new ciphertext carries, if it is the one on disk. */
+    attemptedVersion: number, 
+    /** The `commit` failure that triggered the rollback attempt. */
+    commitCause: unknown, 
+    /** The failure of the rollback write itself. */
+    restoreCause: unknown);
+}
+/**
+ * Thrown when a credential key (or a `listCredentials` prefix) does not match
+ * the key grammar every vault backend is required to accept.
+ *
+ * **Why this throws rather than returning a falsy value (#168).** The backends
+ * disagree about non-conforming keys: macOS Keychain and the env fallback
+ * store anything, while the 1Password, GPG, libsecret and Windows backends
+ * cannot address such a key at all. A key that violates the grammar therefore
+ * writes successfully on a Mac and is unreadable everywhere else — a silent
+ * write/read asymmetry (P2). Returning `false`/`null` would express that as
+ * "the write failed" or, worse on the read path, as "no such credential",
+ * which is indistinguishable from a genuine miss. The key is malformed, not
+ * missing, and only a distinguishable failure says so.
+ */
+export declare class InvalidCredentialKeyError extends VaultError {
+    /** The offending key or prefix. A key name, never credential material. */
+    readonly key: string;
+    /** The operation that was refused — "read", "write", "delete", "enumerate". */
+    readonly operation: string;
+    /** Whether `key` was supplied as a full key or as a `listCredentials` prefix. */
+    readonly kind: "key" | "prefix";
+    constructor(
+    /** The offending key or prefix. A key name, never credential material. */
+    key: string, 
+    /** The operation that was refused — "read", "write", "delete", "enumerate". */
+    operation: string, 
+    /** Whether `key` was supplied as a full key or as a `listCredentials` prefix. */
+    kind?: "key" | "prefix");
+}
 /** Thrown when the write-path file lock can't be acquired within the timeout. */
 export declare class VaultLockError extends VaultError {
     constructor(message: string);

package/dist/vault/session-vault-errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-vault-errors.d.ts","sourceRoot":"","sources":["../../src/vault/session-vault-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,0CAA0C;AAC1C,qBAAa,UAAW,SAAQ,KAAK;aACP,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1D;AAED,kFAAkF;AAClF,qBAAa,gBAAiB,SAAQ,UAAU;gBAClC,OAAO,EAAE,MAAM;CAK5B;AAED,iFAAiF;AACjF,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,OAAO,EAAE,MAAM;CAK5B;AAED,oEAAoE;AACpE,qBAAa,kBAAmB,SAAQ,UAAU;aAE9B,QAAQ,EAAE,MAAM;aAChB,MAAM,EAAE,MAAM;gBADd,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM;CAWjC;AAED,8DAA8D;AAC9D,qBAAa,gBAAiB,SAAQ,UAAU;;CAM/C;AAED,iFAAiF;AACjF,qBAAa,cAAe,SAAQ,UAAU;gBAChC,OAAO,EAAE,MAAM;CAK5B"}
+{"version":3,"file":"session-vault-errors.d.ts","sourceRoot":"","sources":["../../src/vault/session-vault-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,mCAAmC;AACnC,qBAAa,UAAW,SAAQ,KAAK;aACP,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1D;AAED,kFAAkF;AAClF,qBAAa,gBAAiB,SAAQ,UAAU;gBAClC,OAAO,EAAE,MAAM;CAK5B;AAED,iFAAiF;AACjF,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,OAAO,EAAE,MAAM;CAK5B;AAED,oEAAoE;AACpE,qBAAa,kBAAmB,SAAQ,UAAU;aAE9B,QAAQ,EAAE,MAAM;aAChB,MAAM,EAAE,MAAM;gBADd,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM;CAWjC;AAED,8DAA8D;AAC9D,qBAAa,gBAAiB,SAAQ,UAAU;;CAM/C;AAED;;;;;;;;;;GAUG;AACH,qBAAa,iBAAkB,SAAQ,UAAU;IAE7C,+DAA+D;aAC/C,IAAI,EAAE,MAAM;IAC5B,oEAAoE;aACpD,gBAAgB,EAAE,MAAM;IACxC,gEAAgE;aAChD,WAAW,EAAE,OAAO;IACpC,gDAAgD;aAChC,YAAY,EAAE,OAAO;;IAPrC,+DAA+D;IAC/C,IAAI,EAAE,MAAM;IAC5B,oEAAoE;IACpD,gBAAgB,EAAE,MAAM;IACxC,gEAAgE;IAChD,WAAW,EAAE,OAAO;IACpC,gDAAgD;IAChC,YAAY,EAAE,OAAO;CAexC;AAMD;;;;;;;;;;;;;GAaG;AACH,qBAAa,yBAA0B,SAAQ,UAAU;IAErD,0EAA0E;aAC1D,GAAG,EAAE,MAAM;IAC3B,+EAA+E;aAC/D,SAAS,EAAE,MAAM;IACjC,iFAAiF;aACjE,IAAI,EAAE,KAAK,GAAG,QAAQ;;IALtC,0EAA0E;IAC1D,GAAG,EAAE,MAAM;IAC3B,+EAA+E;IAC/D,SAAS,EAAE,MAAM;IACjC,iFAAiF;IACjE,IAAI,GAAE,KAAK,GAAG,QAAgB;CAejD;AAED,iFAAiF;AACjF,qBAAa,cAAe,SAAQ,UAAU;gBAChC,OAAO,EAAE,MAAM;CAK5B"}

package/dist/vault/session-vault-errors.js

@@ -1,14 +1,23 @@
 /**
- * SessionVault error classes — extracted so helper modules (file-lock,
- * sidecar) can throw them without creating an import cycle back into
- * session-vault.ts.
+ * Vault error taxonomy — the package's one `VaultError` hierarchy, extracted
+ * so helper modules (file-lock, sidecar, vault-utils) can throw these without
+ * creating an import cycle back into session-vault.ts.
+ *
+ * Most members are SessionVault-specific; `InvalidCredentialKeyError` is
+ * raised by the credential cascade (`vault.ts`) and its backends. They share a
+ * base class deliberately — a caller wrapping vault work in
+ * `catch (e) { if (e instanceof VaultError) … }` should not have to know which
+ * storage path produced the failure.
+ *
+ * This module has no imports on purpose; keep it that way so any vault module
+ * can depend on it.
  *
  * Each subclass restores the prototype chain with `Object.setPrototypeOf`
  * so `instanceof VaultError` etc. remains robust when the class is consumed
  * across an ES transpile boundary (L2 — matches the EngramError pattern in
  * `packages/sdk/src/errors.ts`).
  */
-/** Base class for SessionVault errors. */
+/** Base class for vault errors. */
 export class VaultError extends Error {
     code;
     constructor(code, message) {
@@ -56,6 +65,88 @@ export class VaultClosedError extends VaultError {
         Object.setPrototypeOf(this, new.target.prototype);
     }
 }
+/**
+ * Thrown when a rekey's external commit failed AND restoring the prior
+ * ciphertext then failed too.
+ *
+ * This is the one indeterminate state the rekey path can reach: the vault file
+ * may still hold the ciphertext written under the NEW key, so neither key can
+ * be assumed to be the right one — and, critically, **no key material for
+ * either may be discarded**. Callers that clean up on failure (e.g. deleting
+ * freshly written passphrase metadata) must special-case this error; deleting
+ * the new key's material here can leave the vault permanently unopenable.
+ */
+export class VaultRestoreError extends VaultError {
+    path;
+    attemptedVersion;
+    commitCause;
+    restoreCause;
+    constructor(
+    /** Absolute path of the vault whose state is indeterminate. */
+    path, 
+    /** Version the new ciphertext carries, if it is the one on disk. */
+    attemptedVersion, 
+    /** The `commit` failure that triggered the rollback attempt. */
+    commitCause, 
+    /** The failure of the rollback write itself. */
+    restoreCause) {
+        super("VAULT_RESTORE_FAILED", `Rekey of ${path} could not be completed OR undone. The caller's commit ` +
+            `failed (${describeCause(commitCause)}) and restoring the prior ` +
+            `ciphertext then failed (${describeCause(restoreCause)}). The vault ` +
+            `file may still hold the ciphertext written under the NEW key at ` +
+            `version ${attemptedVersion}. Do NOT discard either key: try the new ` +
+            `key first, then the old one. If neither opens it, restore a backup of ` +
+            `the vault file and its sidecar.`);
+        this.path = path;
+        this.attemptedVersion = attemptedVersion;
+        this.commitCause = commitCause;
+        this.restoreCause = restoreCause;
+        this.name = "VaultRestoreError";
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+function describeCause(cause) {
+    return cause instanceof Error ? cause.message : String(cause);
+}
+/**
+ * Thrown when a credential key (or a `listCredentials` prefix) does not match
+ * the key grammar every vault backend is required to accept.
+ *
+ * **Why this throws rather than returning a falsy value (#168).** The backends
+ * disagree about non-conforming keys: macOS Keychain and the env fallback
+ * store anything, while the 1Password, GPG, libsecret and Windows backends
+ * cannot address such a key at all. A key that violates the grammar therefore
+ * writes successfully on a Mac and is unreadable everywhere else — a silent
+ * write/read asymmetry (P2). Returning `false`/`null` would express that as
+ * "the write failed" or, worse on the read path, as "no such credential",
+ * which is indistinguishable from a genuine miss. The key is malformed, not
+ * missing, and only a distinguishable failure says so.
+ */
+export class InvalidCredentialKeyError extends VaultError {
+    key;
+    operation;
+    kind;
+    constructor(
+    /** The offending key or prefix. A key name, never credential material. */
+    key, 
+    /** The operation that was refused — "read", "write", "delete", "enumerate". */
+    operation, 
+    /** Whether `key` was supplied as a full key or as a `listCredentials` prefix. */
+    kind = "key") {
+        super("VAULT_INVALID_CREDENTIAL_KEY", `Vault ${operation} refused: credential ${kind} ${JSON.stringify(key)} ` +
+            `does not match the required key grammar. Keys must be 2-64 characters ` +
+            `of lowercase alphanumerics with '-' or '.' as separators, beginning ` +
+            `and ending with an alphanumeric` +
+            (kind === "prefix" ? " (a prefix may end with a separator)" : "") +
+            `. Non-conforming keys store on some backends and are unaddressable on ` +
+            `others, so the value would be written and never read back.`);
+        this.key = key;
+        this.operation = operation;
+        this.kind = kind;
+        this.name = "InvalidCredentialKeyError";
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
 /** Thrown when the write-path file lock can't be acquired within the timeout. */
 export class VaultLockError extends VaultError {
     constructor(message) {

package/dist/vault/session-vault-errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-vault-errors.js","sourceRoot":"","sources":["../../src/vault/session-vault-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,0CAA0C;AAC1C,MAAM,OAAO,UAAW,SAAQ,KAAK;IACP;IAA5B,YAA4B,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QADW,SAAI,GAAJ,IAAI,CAAQ;QAEtC,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,oEAAoE;AACpE,MAAM,OAAO,kBAAmB,SAAQ,UAAU;IAE9B;IACA;IAFlB,YACkB,QAAgB,EAChB,MAAc;QAE9B,KAAK,CACH,iCAAiC,EACjC,+DAA+D,QAAQ,IAAI;YACzE,kCAAkC,MAAM,8BAA8B;YACtE,wDAAwD,CAC3D,CAAC;QARc,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;QAQ9B,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,8DAA8D;AAC9D,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAC9C;QACE,KAAK,CAAC,cAAc,EAAE,6DAA6D,CAAC,CAAC;QACrF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,OAAO,cAAe,SAAQ,UAAU;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF"}
+{"version":3,"file":"session-vault-errors.js","sourceRoot":"","sources":["../../src/vault/session-vault-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,mCAAmC;AACnC,MAAM,OAAO,UAAW,SAAQ,KAAK;IACP;IAA5B,YAA4B,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QADW,SAAI,GAAJ,IAAI,CAAQ;QAEtC,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,oEAAoE;AACpE,MAAM,OAAO,kBAAmB,SAAQ,UAAU;IAE9B;IACA;IAFlB,YACkB,QAAgB,EAChB,MAAc;QAE9B,KAAK,CACH,iCAAiC,EACjC,+DAA+D,QAAQ,IAAI;YACzE,kCAAkC,MAAM,8BAA8B;YACtE,wDAAwD,CAC3D,CAAC;QARc,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;QAQ9B,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,8DAA8D;AAC9D,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAC9C;QACE,KAAK,CAAC,cAAc,EAAE,6DAA6D,CAAC,CAAC;QACrF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAG7B;IAEA;IAEA;IAEA;IARlB;IACE,+DAA+D;IAC/C,IAAY;IAC5B,oEAAoE;IACpD,gBAAwB;IACxC,gEAAgE;IAChD,WAAoB;IACpC,gDAAgD;IAChC,YAAqB;QAErC,KAAK,CACH,sBAAsB,EACtB,YAAY,IAAI,yDAAyD;YACvE,WAAW,aAAa,CAAC,WAAW,CAAC,4BAA4B;YACjE,2BAA2B,aAAa,CAAC,YAAY,CAAC,eAAe;YACrE,kEAAkE;YAClE,WAAW,gBAAgB,2CAA2C;YACtE,wEAAwE;YACxE,iCAAiC,CACpC,CAAC;QAjBc,SAAI,GAAJ,IAAI,CAAQ;QAEZ,qBAAgB,GAAhB,gBAAgB,CAAQ;QAExB,gBAAW,GAAX,WAAW,CAAS;QAEpB,iBAAY,GAAZ,YAAY,CAAS;QAYrC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,yBAA0B,SAAQ,UAAU;IAGrC;IAEA;IAEA;IANlB;IACE,0EAA0E;IAC1D,GAAW;IAC3B,+EAA+E;IAC/D,SAAiB;IACjC,iFAAiF;IACjE,OAAyB,KAAK;QAE9C,KAAK,CACH,8BAA8B,EAC9B,SAAS,SAAS,wBAAwB,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG;YACtE,wEAAwE;YACxE,sEAAsE;YACtE,iCAAiC;YACjC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,wEAAwE;YACxE,4DAA4D,CAC/D,CAAC;QAfc,QAAG,GAAH,GAAG,CAAQ;QAEX,cAAS,GAAT,SAAS,CAAQ;QAEjB,SAAI,GAAJ,IAAI,CAA0B;QAY9C,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,OAAO,cAAe,SAAQ,UAAU;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF"}

package/dist/vault/session-vault.d.ts

@@ -39,8 +39,8 @@
  */
 import type { KeychainProviderOptions } from "../key-providers/keychain-provider.js";
 import type { KeyProvider, KeyProviderType } from "../key-providers/types.js";
-import { VaultError, VaultUnlockError, VaultDecryptError, VaultRollbackError, VaultClosedError, VaultLockError } from "./session-vault-errors.js";
-export { VaultError, VaultUnlockError, VaultDecryptError, VaultRollbackError, VaultClosedError, VaultLockError, };
+import { VaultError, VaultUnlockError, VaultDecryptError, VaultRollbackError, VaultClosedError, VaultLockError, VaultRestoreError, InvalidCredentialKeyError } from "./session-vault-errors.js";
+export { VaultError, VaultUnlockError, VaultDecryptError, VaultRollbackError, VaultClosedError, VaultLockError, VaultRestoreError, InvalidCredentialKeyError, };
 /** Current payload schema version — bump requires a compat migration. */
 export declare const VAULT_SCHEMA_VERSION = 1;
 /** Default vault file location — same path the CLI uses, so they share state. */
@@ -174,4 +174,104 @@ export interface SessionVault {
  * ```
  */
 export declare function openVault(opts?: OpenVaultOptions): Promise<SessionVault>;
+/** Options for {@link rekeyVault}. */
+export interface RekeyVaultOptions {
+    /** Vault file path. Defaults to the same path the CLI uses. */
+    path?: string;
+    /** Sidecar path. Defaults to vault directory + `vault.seen-version`. */
+    sidecarPath?: string;
+    /** The key the vault is currently encrypted under. */
+    currentKey: Buffer;
+    /** The key the vault should be re-encrypted under. */
+    nextKey: Buffer;
+    /**
+     * Opt-in acceptance of a detected rollback (sidecar version > vault
+     * version), mirroring {@link OpenVaultOptions.acceptRollback}. Unlike
+     * `openVault`, the sidecar is never lowered to match — the rekeyed vault
+     * lands above the recorded high-water mark either way, so accepting a
+     * rollback here does not also discard the mark.
+     */
+    acceptRollback?: boolean;
+    /**
+     * Opt-in acceptance of a missing sidecar, mirroring
+     * {@link OpenVaultOptions.acceptMissingSidecar}. Legacy (pre-`openVault`,
+     * AAD-less) vaults never had a sidecar by construction and are exempt.
+     */
+    acceptMissingSidecar?: boolean;
+    /**
+     * Invoked once the re-encrypted vault has landed on disk, while the write
+     * lock is still held and before the sidecar high-water mark is published.
+     *
+     * This is the seam that makes an *external* commitment part of the same
+     * all-or-nothing step. `migrate --to passphrase` uses it to write
+     * `secrets.provider` — a config that names a provider which cannot open the
+     * vault (or a vault no configured provider can open) is exactly the
+     * half-migrated state this exists to prevent. Throwing restores the prior
+     * ciphertext byte-for-byte and rethrows; the sidecar is never advanced on
+     * that path, so the restored vault opens cleanly.
+     */
+    commit?: () => void | Promise<void>;
+}
+/** Outcome of a successful {@link rekeyVault}. */
+export interface RekeyVaultResult {
+    /** Number of secrets carried across to the new ciphertext. */
+    secretCount: number;
+    /** The vault version after the rekey. */
+    vaultVersion: number;
+    /** True when the source vault was in the pre-`openVault` AAD-less shape. */
+    upgradedFromLegacy: boolean;
+    /**
+     * False when the rekey committed but the sidecar version bump could not be
+     * written (warned on stderr). The rekey still succeeded — see the note on
+     * the sidecar write in {@link rekeyVault} — but rollback protection is
+     * degraded until the next successful vault write catches the sidecar up.
+     */
+    sidecarPublished: boolean;
+}
+/**
+ * Re-encrypt a vault in place under a different master key.
+ *
+ * Needed whenever the new key cannot be *chosen* — a `PassphraseProvider`
+ * derives its key from what the operator types and cannot store a
+ * caller-supplied one, so moving a vault to it means rewriting the ciphertext
+ * rather than copying the key to a new home. Provider-to-provider moves that
+ * only relocate the same key do not need this.
+ *
+ * The AAD binds the vault's resolved real path and schema, not the key, so the
+ * rekeyed ciphertext stays bound to the same file identity. Legacy AAD-less
+ * vaults are upgraded to schema 1 in the same step. The new version is one
+ * above both the payload's version and the sidecar's high-water mark, so a
+ * rekeyed vault can never land below a version already seen.
+ *
+ * Any process holding this vault open under the old key will fail its next
+ * decrypt with {@link VaultDecryptError} — an honest failure, by design: the
+ * old key genuinely no longer opens this vault.
+ *
+ * **Post-commit guarantee.** With one named exception, a throw means `commit`
+ * did not succeed and the prior ciphertext is back in place — nothing after a
+ * successful `commit` can throw, because the only step that follows it (the
+ * sidecar bump) is reported via {@link RekeyVaultResult.sidecarPublished}
+ * rather than thrown. Callers may therefore treat a throw as "nothing was
+ * committed" and clean up accordingly; that is what makes it safe for the CLI
+ * to delete freshly written passphrase metadata on failure.
+ *
+ * **The exception: {@link VaultRestoreError}.** If `commit` throws *and* the
+ * rollback write then fails, the file on disk may still be the new ciphertext.
+ * That state is neither committed nor undone, so it gets its own error type —
+ * callers MUST special-case it and must NOT discard key material for either
+ * key. Every other throw keeps the plain guarantee.
+ *
+ * @param opts - {@link RekeyVaultOptions}. `currentKey`/`nextKey` are required;
+ *   both remain owned by the caller and are never zeroed here.
+ * @returns {@link RekeyVaultResult}.
+ * @throws {@link VaultError} `VAULT_NOT_FOUND` when the vault file is absent.
+ * @throws {@link VaultDecryptError} when `currentKey` does not open the vault.
+ * @throws {@link VaultError} `VAULT_SIDECAR_MISSING` when the sidecar is absent
+ *   and neither `acceptMissingSidecar` nor the legacy exemption applies.
+ * @throws {@link VaultRollbackError} when the vault version trails the sidecar
+ *   and `acceptRollback` is not set.
+ * @throws {@link VaultError} `VAULT_ENCRYPT_FAILED` when re-encryption fails.
+ * @throws Whatever `commit` throws, after restoring the prior ciphertext.
+ */
+export declare function rekeyVault(opts: RekeyVaultOptions): Promise<RekeyVaultResult>;
 //# sourceMappingURL=session-vault.d.ts.map

package/dist/vault/session-vault.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-vault.d.ts","sourceRoot":"","sources":["../../src/vault/session-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAkBH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAgB9E,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACf,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,GACf,CAAC;AAMF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,iFAAiF;AACjF,eAAO,MAAM,kBAAkB,QAAuD,CAAC;AAEvF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,QAKhC,CAAC;AAKF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,2BAA2B,CAAC;AA2BzD;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,aAAa,GAAG,QAAQ,GAAG,aAAa,CAAC;AAEzE,8DAA8D;AAC9D,MAAM,WAAW,gBAAgB;IAC/B,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;OAeG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,0EAA0E;IAC1E,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1C,2EAA2E;IAC3E,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,uEAAuE;IACvE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,yEAAyE;IACzE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,4EAA4E;IAC5E,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,4EAA4E;IAC5E,KAAK,IAAI,IAAI,CAAC;IACd,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AA2ED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,SAAS,CAAC,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,YAAY,CAAC,CAmKlF"}
+{"version":3,"file":"session-vault.d.ts","sourceRoot":"","sources":["../../src/vault/session-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAkBH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAgB9E,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,yBAAyB,EAC1B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EAGjB,yBAAyB,GAC1B,CAAC;AAMF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,iFAAiF;AACjF,eAAO,MAAM,kBAAkB,QAAuD,CAAC;AAEvF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,QAKhC,CAAC;AAKF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,2BAA2B,CAAC;AA2BzD;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,aAAa,GAAG,QAAQ,GAAG,aAAa,CAAC;AAEzE,8DAA8D;AAC9D,MAAM,WAAW,gBAAgB;IAC/B,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;OAeG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,0EAA0E;IAC1E,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1C,2EAA2E;IAC3E,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,uEAAuE;IACvE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,yEAAyE;IACzE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,4EAA4E;IAC5E,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,4EAA4E;IAC5E,KAAK,IAAI,IAAI,CAAC;IACd,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AA2ED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,SAAS,CAAC,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,YAAY,CAAC,CAuIlF;AAMD,sCAAsC;AACtC,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC;AAED,kDAAkD;AAClD,MAAM,WAAW,gBAAgB;IAC/B,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,4EAA4E;IAC5E,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,gBAAgB,CAAC,CAwJ3B"}