@centient/secrets 0.9.0 → 0.11.0

package/dist/vault/vault-onepassword.js

@@ -0,0 +1,271 @@
+/**
+ * Vault backend — 1Password credential storage (ADR-004).
+ *
+ * Stores credential **values** in a dedicated 1Password vault via the `op` CLI.
+ * This is a different layer from ADR-001's `OnePasswordProvider`, which stores
+ * the vault *encryption key*: an operator may keep the key in the Keychain and
+ * the credentials in 1Password, or the reverse. The two carry separate config
+ * blocks for exactly that reason (ADR-004 §1).
+ *
+ * ## Two properties this backend exists to hold
+ *
+ * 1. **Never auto-selected.** `op` being installed must not silently route
+ *    credentials into someone's personal vault — surprising secret placement is
+ *    a security defect (P15/P2). Selection is explicit opt-in, and
+ *    {@link OnePasswordVault.detect} refuses without it.
+ * 2. **Secret values never touch argv.** Writes build the item JSON in-process
+ *    and pipe it to `op item create -`, so nothing readable in `ps` ever carries
+ *    a secret. This is the pattern issue #102 retrofitted to the key provider,
+ *    which now writes through the same `op item create -` stdin seam. Its
+ *    replace ordering differs — create first, delete the superseded item last —
+ *    because losing the vault *master key* between two calls would be
+ *    unrecoverable, where a credential value can be re-fetched from its source.
+ */
+import { assertValidKey } from "./vault-utils.js";
+import { detectOpCli, runOp, OpCliError, OP_READ_TIMEOUT_MS, OP_WRITE_TIMEOUT_MS, } from "../key-providers/op-cli.js";
+// =============================================================================
+// Constants
+// =============================================================================
+/** Default tag applied to every item this backend writes. */
+export const DEFAULT_OP_TAG = "centient";
+/** The 1Password field a credential value lives in. */
+const FIELD_NAME = "password";
+/**
+ * List-cache TTL, mirroring `KEYCHAIN_LIST_CACHE_TTL_MS` (ADR-004 §8).
+ *
+ * Only key **names** are cached, never values: a cached value would both extend
+ * how long plaintext sits in the heap and serve a rotated or revoked credential
+ * until expiry. 1Password stays the source of truth for values.
+ */
+export const OP_LIST_CACHE_TTL_MS = 5_000;
+// =============================================================================
+// Implementation
+// =============================================================================
+export class OnePasswordVault {
+    name = "1password";
+    vault;
+    tag;
+    now;
+    listCache = null;
+    warned = false;
+    /**
+     * @param config - must carry a `vault`; there is deliberately no default
+     *   (ADR-004 §1 — guessing a vault name risks writing credentials somewhere
+     *   the operator did not intend).
+     * @throws {Error} when `vault` is missing or blank.
+     */
+    constructor(config) {
+        const vault = config.vault?.trim();
+        if (!vault) {
+            throw new Error('secrets.onePasswordBackend.vault is required when backend is "1password" ' +
+                "(or set CENTIENT_OP_VAULT). There is no default vault — see ADR-004 §1.");
+        }
+        this.vault = vault;
+        this.tag = config.tag?.trim() || DEFAULT_OP_TAG;
+        this.now = config.now ?? Date.now;
+    }
+    /**
+     * Whether this backend may be used.
+     *
+     * Requires **both** an explicit opt-in and a usable `op`. The opt-in half is
+     * what keeps 1Password out of the auto-cascade: without it this returns false
+     * even on a machine where `op` is installed and signed in.
+     *
+     * @param optedIn - true when config or env explicitly selected this backend.
+     */
+    static detect(optedIn) {
+        if (!optedIn)
+            return false;
+        return detectOpCli();
+    }
+    /**
+     * Write a credential. The value travels on stdin and never appears in argv.
+     *
+     * Update is modeled as replace (delete-then-create) so create and update share
+     * one argv-safe path rather than needing a separate `op item edit` form.
+     */
+    store(key, value) {
+        assertValidKey(key, "write");
+        const item = {
+            title: key,
+            category: "PASSWORD",
+            vault: { name: this.vault },
+            tags: [this.tag],
+            fields: [{ id: FIELD_NAME, type: "CONCEALED", value }],
+        };
+        try {
+            // Replace semantics: drop any existing item first so `create` is always
+            // the write path. delete() is idempotent, so a missing item is fine.
+            this.deleteItem(key);
+            runOp(["item", "create", "--format=json", "-"], {
+                input: JSON.stringify(item),
+                timeoutMs: OP_WRITE_TIMEOUT_MS,
+            });
+            this.invalidateListCache();
+            return true;
+        }
+        catch (err) {
+            this.warnOnce("store", key, err);
+            return false;
+        }
+    }
+    /**
+     * Read a credential value. Returns null when absent or on failure.
+     *
+     * @throws {InvalidCredentialKeyError} for a key this backend could never
+     *   have written — building an `op://` reference from it is exactly the
+     *   misparse the key grammar exists to prevent, and `null` would report the
+     *   impossible key as a merely absent one.
+     */
+    retrieve(key) {
+        assertValidKey(key, "read");
+        try {
+            const value = runOp(["read", `op://${this.vault}/${key}/${FIELD_NAME}`], { timeoutMs: OP_WRITE_TIMEOUT_MS });
+            return value === "" ? null : value;
+        }
+        catch (err) {
+            this.warnOnce("retrieve", key, err);
+            return null;
+        }
+    }
+    /**
+     * Delete a credential. Idempotent — a missing item is success.
+     *
+     * @throws {InvalidCredentialKeyError} — deliberately NOT folded into the
+     *   idempotent-success path. "Missing" and "impossible" are different
+     *   answers: such a key was never storable here, so reporting success would
+     *   assert something about a key this backend does not accept.
+     */
+    delete(key) {
+        assertValidKey(key, "delete");
+        try {
+            this.deleteItem(key);
+            this.invalidateListCache();
+            return true;
+        }
+        catch (err) {
+            this.warnOnce("delete", key, err);
+            return false;
+        }
+    }
+    /**
+     * Enumerate credential keys, optionally prefix-filtered.
+     *
+     * Per the {@link VaultBackend} contract this returns `[]` for a genuinely
+     * empty vault but **throws** on a transient failure, so a caller can tell
+     * "nothing stored" from "1Password did not answer" and retry the latter.
+     * The `--tags` filter keeps unrelated items in a shared vault out of the
+     * result; no secret values appear in `op item list` output.
+     */
+    async listKeys(prefix) {
+        const cached = this.readListCache();
+        const keys = cached ?? this.fetchKeys();
+        if (cached === null) {
+            this.listCache = {
+                keys,
+                expiresAt: this.now() + OP_LIST_CACHE_TTL_MS,
+            };
+        }
+        return prefix === undefined ? [...keys] : keys.filter((k) => k.startsWith(prefix));
+    }
+    // ---------------------------------------------------------------------------
+    // Private helpers
+    // ---------------------------------------------------------------------------
+    fetchKeys() {
+        let raw;
+        try {
+            raw = runOp(["item", "list", "--vault", this.vault, "--tags", this.tag, "--format=json"], { timeoutMs: OP_READ_TIMEOUT_MS });
+        }
+        catch (err) {
+            // A missing/empty vault is an empty enumeration; anything else is
+            // transient and must surface so the caller can retry (contract, §7).
+            if (err instanceof OpCliError && err.isNotFound)
+                return [];
+            this.warnOnce("listKeys", null, err);
+            throw err;
+        }
+        if (raw === "")
+            return [];
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch (err) {
+            this.warnOnce("listKeys", null, err);
+            throw new Error(`op item list returned unparseable JSON: ${String(err)}`);
+        }
+        if (!Array.isArray(parsed))
+            return [];
+        return parsed
+            .map((item) => typeof item === "object" && item !== null
+            ? item.title
+            : undefined)
+            .filter((title) => typeof title === "string" && title.length > 0);
+    }
+    // Key validation lives in `assertValidKey` (vault-utils), not in a private
+    // `acceptKey` here.
+    //
+    // #167 had to enforce locally and quietly. This was the first backend where
+    // the `op://<vault>/<key>/password` reference made the invariant
+    // load-bearing — a key containing `/` stores fine (a 1Password title is just
+    // a string) and then re-parses on read into a different item and field — but
+    // the shared path enforced nothing, so a loud refusal here would have been
+    // this backend alone diverging from the others. The compromise was a
+    // warn-once that returned false/null.
+    //
+    // #168 removed the reason for it. `vault.ts` now rejects a non-conforming
+    // key before any backend is reached, and every backend asserts the same
+    // grammar with the same typed error. Keeping the warn-once as well would
+    // leave two layers enforcing one rule with two different outcomes — a throw
+    // from the cascade, a quiet `false`/`null` here — which is the divergence
+    // #168 exists to remove. The stderr warning is redundant too:
+    // `InvalidCredentialKeyError` names the key, the operation and the reason,
+    // and unlike a warning it cannot be missed.
+    deleteItem(key) {
+        try {
+            runOp(["item", "delete", key, "--vault", this.vault], {
+                timeoutMs: OP_WRITE_TIMEOUT_MS,
+            });
+        }
+        catch (err) {
+            // Idempotent: the item not being there is the desired end state.
+            if (err instanceof OpCliError && err.isNotFound)
+                return;
+            throw err;
+        }
+    }
+    readListCache() {
+        if (this.listCache === null)
+            return null;
+        if (this.now() >= this.listCache.expiresAt) {
+            this.listCache = null;
+            return null;
+        }
+        return this.listCache.keys;
+    }
+    invalidateListCache() {
+        this.listCache = null;
+    }
+    /**
+     * Surface an unexpected `op` failure once per instance (ADR-004 §7, the
+     * libsecret lesson from #121).
+     *
+     * A not-found is normal and stays quiet. Anything else means we are
+     * authenticated but the call still failed — a misconfiguration the operator
+     * needs to see, since the non-throwing backend contract would otherwise
+     * swallow it entirely. Once per instance keeps a hot loop from flooding
+     * stderr while still making the first occurrence visible.
+     */
+    warnOnce(op, key, err) {
+        if (err instanceof OpCliError && err.isNotFound)
+            return;
+        if (this.warned)
+            return;
+        this.warned = true;
+        const target = key === null ? `vault ${this.vault}` : `${this.vault}/${key}`;
+        const detail = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`[secrets] WARNING: 1Password backend ${op} failed on ${target}: ${detail}\n` +
+            `[secrets] Further 1Password warnings from this instance are suppressed.\n`);
+    }
+}
+//# sourceMappingURL=vault-onepassword.js.map

package/dist/vault/vault-onepassword.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-onepassword.js","sourceRoot":"","sources":["../../src/vault/vault-onepassword.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,OAAO,EACL,WAAW,EACX,KAAK,EACL,UAAU,EACV,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AAEpC,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC;AAEzC,uDAAuD;AACvD,MAAM,UAAU,GAAG,UAAU,CAAC;AAE9B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAe1C,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,MAAM,OAAO,gBAAgB;IAClB,IAAI,GAAG,WAAW,CAAC;IAEX,KAAK,CAAS;IACd,GAAG,CAAS;IACZ,GAAG,CAAe;IAE3B,SAAS,GAAiD,IAAI,CAAC;IAC/D,MAAM,GAAG,KAAK,CAAC;IAEvB;;;;;OAKG;IACH,YAAY,MAA+B;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,2EAA2E;gBACzE,yEAAyE,CAC5E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC;QAChD,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,MAAM,CAAC,OAAgB;QAC5B,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,OAAO,WAAW,EAAE,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,GAAW,EAAE,KAAa;QAC9B,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAE7B,MAAM,IAAI,GAAG;YACX,KAAK,EAAE,GAAG;YACV,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE;YAC3B,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;YAChB,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;SACvD,CAAC;QAEF,IAAI,CAAC;YACH,wEAAwE;YACxE,qEAAqE;YACrE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACrB,KAAK,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,CAAC,EAAE;gBAC9C,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC3B,SAAS,EAAE,mBAAmB;aAC/B,CAAC,CAAC;YACH,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,QAAQ,CAAC,GAAW;QAClB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAE5B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CACjB,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,KAAK,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC,EACnD,EAAE,SAAS,EAAE,mBAAmB,EAAE,CACnC,CAAC;YACF,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,GAAW;QAChB,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAE9B,IAAI,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACrB,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,QAAQ,CAAC,MAAe;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACxC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,IAAI,CAAC,SAAS,GAAG;gBACf,IAAI;gBACJ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB;aAC7C,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAEtE,SAAS;QACf,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,KAAK,CACT,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAC5E,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAClC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kEAAkE;YAClE,qEAAqE;YACrE,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,UAAU;gBAAE,OAAO,EAAE,CAAC;YAC3D,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACrC,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QAC1B,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QAEtC,OAAO,MAAM;aACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACZ,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YACvC,CAAC,CAAE,IAA4B,CAAC,KAAK;YACrC,CAAC,CAAC,SAAS,CACd;aACA,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvF,CAAC;IAED,2EAA2E;IAC3E,oBAAoB;IACpB,EAAE;IACF,4EAA4E;IAC5E,iEAAiE;IACjE,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,qEAAqE;IACrE,sCAAsC;IACtC,EAAE;IACF,0EAA0E;IAC1E,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,8DAA8D;IAC9D,2EAA2E;IAC3E,4CAA4C;IAEpC,UAAU,CAAC,GAAW;QAC5B,IAAI,CAAC;YACH,KAAK,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;gBACpD,SAAS,EAAE,mBAAmB;aAC/B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,iEAAiE;YACjE,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,UAAU;gBAAE,OAAO;YACxD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACzC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YAC3C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC7B,CAAC;IAEO,mBAAmB;QACzB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;IAED;;;;;;;;;OASG;IACK,QAAQ,CAAC,EAAU,EAAE,GAAkB,EAAE,GAAY;QAC3D,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,UAAU;YAAE,OAAO;QACxD,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC;QAC7E,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wCAAwC,EAAE,cAAc,MAAM,KAAK,MAAM,IAAI;YAC3E,2EAA2E,CAC9E,CAAC;IACJ,CAAC;CACF"}

package/dist/vault/vault-utils.d.ts

@@ -2,6 +2,14 @@
  * Auth Vault — Shared Utilities
  *
  * Shared validation and helper functions used across all vault backends.
+ *
+ * The key grammar is a **package-wide invariant**, not a per-backend
+ * preference: `vault.ts` enforces it once at the cascade before any backend
+ * is dispatched to (#168), and each backend re-asserts it so that a directly
+ * constructed backend cannot bypass the rule. Several backends place keys in
+ * subprocess argv or an `op://` reference path; the grammar keeps that shared
+ * namespace portable and is defense in depth, never the subprocess injection
+ * boundary.
  */
 /**
  * Returns true if the given credential key name is valid.
@@ -14,9 +22,35 @@
  * Hyphens and dots are both permitted as namespace separators so callers
  * can choose whichever convention reads best (`soma-anthropic-token1`,
  * `soma.anthropic.token1`). Underscores, uppercase, whitespace, and
- * shell metacharacters are deliberately rejected so keys can safely be
- * interpolated into subprocess argv positions without additional
- * escaping.
+ * shell metacharacters are deliberately rejected to keep the cross-backend
+ * namespace portable. Subprocess callers must still use structural argv/stdin
+ * separation rather than treating this grammar as an injection boundary.
  */
 export declare function isValidKey(key: string): boolean;
+/**
+ * Returns true if `prefix` could be the leading substring of a valid key.
+ *
+ * The empty string is accepted: `listCredentials("")` selects everything,
+ * exactly as omitting the argument does.
+ *
+ * The length bound is one shorter for a prefix ending in a separator. A key
+ * must end alphanumeric and is capped at 64, so a 64-character prefix ending
+ * in `.` or `-` could only ever be extended into a 65-character key — no valid
+ * key starts with it. Accepting it would dispatch an unsatisfiable filter to
+ * the backend and return an empty list, which reads as "no such credentials"
+ * rather than the `InvalidCredentialKeyError` every other malformed prefix
+ * raises — the same not-found/malformed collapse this module exists to end.
+ */
+export declare function isValidKeyPrefix(prefix: string): boolean;
+/** Operations a key can be rejected for — mirrors `SecretsOperation["type"]`. */
+export type KeyOperation = "read" | "write" | "delete" | "enumerate";
+/**
+ * Throw `InvalidCredentialKeyError` unless `key` matches the key grammar.
+ *
+ * Backends call this instead of returning `false`/`null`, so a malformed key
+ * is never mistaken for a failed write or an absent credential (#168, P2).
+ */
+export declare function assertValidKey(key: string, operation: KeyOperation): void;
+/** Throw `InvalidCredentialKeyError` unless `prefix` is a valid key prefix. */
+export declare function assertValidKeyPrefix(prefix: string, operation: KeyOperation): void;
 //# sourceMappingURL=vault-utils.d.ts.map

package/dist/vault/vault-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vault-utils.d.ts","sourceRoot":"","sources":["../../src/vault/vault-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAYH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE/C"}
+{"version":3,"file":"vault-utils.d.ts","sourceRoot":"","sources":["../../src/vault/vault-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAcH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE/C;AAgBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAMxD;AAED,iFAAiF;AACjF,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC;AAErE;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,GAAG,IAAI,CAGzE;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,GAAG,IAAI,CAGlF"}

package/dist/vault/vault-utils.js

@@ -2,7 +2,16 @@
  * Auth Vault — Shared Utilities
  *
  * Shared validation and helper functions used across all vault backends.
+ *
+ * The key grammar is a **package-wide invariant**, not a per-backend
+ * preference: `vault.ts` enforces it once at the cascade before any backend
+ * is dispatched to (#168), and each backend re-asserts it so that a directly
+ * constructed backend cannot bypass the rule. Several backends place keys in
+ * subprocess argv or an `op://` reference path; the grammar keeps that shared
+ * namespace portable and is defense in depth, never the subprocess injection
+ * boundary.
  */
+import { InvalidCredentialKeyError } from "./session-vault-errors.js";
 /**
  * Allowed key name pattern — lowercase alphanumeric plus hyphen and dot,
  * 2-64 characters. The inner class permits hyphens and dots so that
@@ -23,11 +32,64 @@ const VALID_KEY_RE = /^[a-z0-9][a-z0-9.-]*[a-z0-9]$/;
  * Hyphens and dots are both permitted as namespace separators so callers
  * can choose whichever convention reads best (`soma-anthropic-token1`,
  * `soma.anthropic.token1`). Underscores, uppercase, whitespace, and
- * shell metacharacters are deliberately rejected so keys can safely be
- * interpolated into subprocess argv positions without additional
- * escaping.
+ * shell metacharacters are deliberately rejected to keep the cross-backend
+ * namespace portable. Subprocess callers must still use structural argv/stdin
+ * separation rather than treating this grammar as an injection boundary.
  */
 export function isValidKey(key) {
     return VALID_KEY_RE.test(key) && key.length <= 64;
 }
+/**
+ * Allowed key-*prefix* pattern — every proper prefix of a valid key, plus the
+ * valid keys themselves.
+ *
+ * `listCredentials(prefix)` filters by string prefix, so the natural way to
+ * scope an enumeration to a namespace is to pass the separator too:
+ * `listCredentials("soma.anthropic.")`. That is not a valid *key* (it ends in
+ * a separator), so validating a prefix with `isValidKey` would reject the
+ * documented usage. A prefix therefore relaxes exactly one rule — the trailing
+ * character may be a separator — and keeps the rest, since a prefix reaches
+ * the same subprocess argv / `op://` positions a key does.
+ */
+const VALID_KEY_PREFIX_RE = /^[a-z0-9][a-z0-9.-]*$/;
+/**
+ * Returns true if `prefix` could be the leading substring of a valid key.
+ *
+ * The empty string is accepted: `listCredentials("")` selects everything,
+ * exactly as omitting the argument does.
+ *
+ * The length bound is one shorter for a prefix ending in a separator. A key
+ * must end alphanumeric and is capped at 64, so a 64-character prefix ending
+ * in `.` or `-` could only ever be extended into a 65-character key — no valid
+ * key starts with it. Accepting it would dispatch an unsatisfiable filter to
+ * the backend and return an empty list, which reads as "no such credentials"
+ * rather than the `InvalidCredentialKeyError` every other malformed prefix
+ * raises — the same not-found/malformed collapse this module exists to end.
+ */
+export function isValidKeyPrefix(prefix) {
+    if (prefix === "")
+        return true;
+    if (!VALID_KEY_PREFIX_RE.test(prefix))
+        return false;
+    // A trailing separator needs at least one more alphanumeric to become a key.
+    const max = /[.-]$/.test(prefix) ? 63 : 64;
+    return prefix.length <= max;
+}
+/**
+ * Throw `InvalidCredentialKeyError` unless `key` matches the key grammar.
+ *
+ * Backends call this instead of returning `false`/`null`, so a malformed key
+ * is never mistaken for a failed write or an absent credential (#168, P2).
+ */
+export function assertValidKey(key, operation) {
+    if (isValidKey(key))
+        return;
+    throw new InvalidCredentialKeyError(key, operation, "key");
+}
+/** Throw `InvalidCredentialKeyError` unless `prefix` is a valid key prefix. */
+export function assertValidKeyPrefix(prefix, operation) {
+    if (isValidKeyPrefix(prefix))
+        return;
+    throw new InvalidCredentialKeyError(prefix, operation, "prefix");
+}
 //# sourceMappingURL=vault-utils.js.map

package/dist/vault/vault-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"vault-utils.js","sourceRoot":"","sources":["../../src/vault/vault-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;GAOG;AACH,MAAM,YAAY,GAAG,+BAA+B,CAAC;AAErD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;AACpD,CAAC"}
+{"version":3,"file":"vault-utils.js","sourceRoot":"","sources":["../../src/vault/vault-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEtE;;;;;;;GAOG;AACH,MAAM,YAAY,GAAG,+BAA+B,CAAC;AAErD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAEpD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,6EAA6E;IAC7E,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,OAAO,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC;AAC9B,CAAC;AAKD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,SAAuB;IACjE,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO;IAC5B,MAAM,IAAI,yBAAyB,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,SAAuB;IAC1E,IAAI,gBAAgB,CAAC,MAAM,CAAC;QAAE,OAAO;IACrC,MAAM,IAAI,yBAAyB,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AACnE,CAAC"}

package/dist/vault/vault-windows.d.ts

@@ -12,7 +12,11 @@
  * Storage: credentials are stored in the Windows Credential Manager under the
  * resource name "centient", with the logical key as the username.
  *
- * Error handling: all methods return false/null on failure — never throw.
+ * Error handling: a storage failure returns false/null — this backend never
+ * throws for that. A credential key that violates the shared key grammar is
+ * NOT a storage failure and throws `InvalidCredentialKeyError` (#168): such a
+ * key is unaddressable here, and reporting it as a failed write or an absent
+ * credential would be indistinguishable from the ordinary miss.
  */
 import type { VaultBackend } from "./types.js";
 /**
@@ -29,6 +33,7 @@ import type { VaultBackend } from "./types.js";
  *   }
  */
 export declare class WindowsVault implements VaultBackend {
+    readonly name = "windows";
     /**
      * Returns true if running inside a WSL environment where powershell.exe is
      * accessible.
@@ -49,7 +54,7 @@ export declare class WindowsVault implements VaultBackend {
      * as the username and `value` as the password.
      *
      * @param key   - Logical key name (e.g. 'auth-token', 'refresh-token')
-     * @param value - The credential value to store
+     * @param value - The credential value to store (UTF-8/base64 over stdin)
      * @returns true on success, false if storage fails
      */
     store(key: string, value: string): boolean;

package/dist/vault/vault-windows.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vault-windows.d.ts","sourceRoot":"","sources":["../../src/vault/vault-windows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA+C/C;;;;;;;;;;;;GAYG;AACH,qBAAa,YAAa,YAAW,YAAY;IAC/C;;;;;;;OAOG;IACH,MAAM,CAAC,MAAM,IAAI,OAAO;IAoBxB;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,qBAAqB;IAWpC;;;;;;;;;OASG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAmB1C;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAoBpC;;;;;OAKG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAsB5B;;;;;;;;;;;;OAYG;IACG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CA2BnD"}
+{"version":3,"file":"vault-windows.d.ts","sourceRoot":"","sources":["../../src/vault/vault-windows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAgD/C;;;;;;;;;;;;GAYG;AACH,qBAAa,YAAa,YAAW,YAAY;IAC/C,QAAQ,CAAC,IAAI,aAAa;IAE1B;;;;;;;OAOG;IACH,MAAM,CAAC,MAAM,IAAI,OAAO;IAoBxB;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,qBAAqB;IAWpC;;;;;;;;;OASG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAqB1C;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAoBpC;;;;;OAKG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAsB5B;;;;;;;;;;;;OAYG;IACG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CA2BnD"}

package/dist/vault/vault-windows.js

@@ -12,11 +12,15 @@
  * Storage: credentials are stored in the Windows Credential Manager under the
  * resource name "centient", with the logical key as the username.
  *
- * Error handling: all methods return false/null on failure — never throw.
+ * Error handling: a storage failure returns false/null — this backend never
+ * throws for that. A credential key that violates the shared key grammar is
+ * NOT a storage failure and throws `InvalidCredentialKeyError` (#168): such a
+ * key is unaddressable here, and reporting it as a failed write or an absent
+ * credential would be indistinguishable from the ordinary miss.
  */
 import { spawnSync } from "child_process";
 import { readFileSync } from "fs";
-import { isValidKey } from "./vault-utils.js";
+import { assertValidKey } from "./vault-utils.js";
 // =============================================================================
 // Constants
 // =============================================================================
@@ -36,12 +40,13 @@ function escapePsValue(value) {
  * Executes a PowerShell command via powershell.exe with no profile and
  * non-interactive mode. Returns stdout trimmed, or null on error.
  *
- * Uses spawnSync to bypass the shell entirely, preventing shell injection
- * via credential values that contain double-quotes or shell metacharacters.
+ * Uses spawnSync to bypass the OS shell. Credential values are UTF-8/base64
+ * encoded on stdin and decoded by a fixed PowerShell fragment, so arbitrary
+ * value bytes never enter the interpreter command string.
  */
-function runPowershell(command) {
+function runPowershell(command, input) {
     try {
-        const result = spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", command], { encoding: "utf8" });
+        const result = spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", command], { encoding: "utf8", input });
         if (result.error || result.status !== 0)
             return null;
         return result.stdout.trim();
@@ -67,6 +72,7 @@ function runPowershell(command) {
  *   }
  */
 export class WindowsVault {
+    name = "windows";
     /**
      * Returns true if running inside a WSL environment where powershell.exe is
      * accessible.
@@ -114,23 +120,24 @@ export class WindowsVault {
      * as the username and `value` as the password.
      *
      * @param key   - Logical key name (e.g. 'auth-token', 'refresh-token')
-     * @param value - The credential value to store
+     * @param value - The credential value to store (UTF-8/base64 over stdin)
      * @returns true on success, false if storage fails
      */
     store(key, value) {
-        if (!isValidKey(key))
-            return false;
+        assertValidKey(key, "write");
         const escapedKey = escapePsValue(key);
-        const escapedValue = escapePsValue(value);
+        const encodedValue = Buffer.from(value, "utf8").toString("base64");
         const command = [
             "& {",
             "[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime];",
+            "$passwordBytes = [System.Convert]::FromBase64String([Console]::In.ReadToEnd());",
+            "$password = [System.Text.Encoding]::UTF8.GetString($passwordBytes);",
             "$vault = New-Object Windows.Security.Credentials.PasswordVault;",
-            `$cred = New-Object Windows.Security.Credentials.PasswordCredential('${escapePsValue(RESOURCE_NAME)}', '${escapedKey}', '${escapedValue}');`,
+            `$cred = New-Object Windows.Security.Credentials.PasswordCredential('${escapePsValue(RESOURCE_NAME)}', '${escapedKey}', $password);`,
             "$vault.Add($cred)",
             "}",
         ].join(" ");
-        const result = runPowershell(command);
+        const result = runPowershell(command, encodedValue);
         return result !== null;
     }
     /**
@@ -140,8 +147,7 @@ export class WindowsVault {
      * @returns The stored password, or null if not found / retrieval fails
      */
     retrieve(key) {
-        if (!isValidKey(key))
-            return null;
+        assertValidKey(key, "read");
         const escapedKey = escapePsValue(key);
         const command = [
             "& {",
@@ -164,8 +170,7 @@ export class WindowsVault {
      * @returns true on success (including "not found"), false on unexpected error
      */
     delete(key) {
-        if (!isValidKey(key))
-            return false;
+        assertValidKey(key, "delete");
         const escapedKey = escapePsValue(key);
         const command = [
             "& {",

package/dist/vault/vault-windows.js.map

@@ -1 +1 @@
-{"version":3,"file":"vault-windows.js","sourceRoot":"","sources":["../../src/vault/vault-windows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAElC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,kFAAkF;AAClF,MAAM,aAAa,GAAG,UAAU,CAAC;AAEjC,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CACtB,gBAAgB,EAChB,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,CAAC,EACtD,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrB,CAAC;QACF,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,OAAQ,MAAM,CAAC,MAAiB,CAAC,IAAI,EAAE,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,YAAY;IACvB;;;;;;;OAOG;IACH,MAAM,CAAC,MAAM;QACX,6CAA6C;QAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,OAAO,YAAY,CAAC,qBAAqB,EAAE,CAAC;QAC9C,CAAC;QAED,6CAA6C;QAC7C,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAC1D,IAAI,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnC,OAAO,YAAY,CAAC,qBAAqB,EAAE,CAAC;YAC9C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;QAC7D,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,qBAAqB;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE;gBACpD,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,GAAW,EAAE,KAAa;QAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAEnC,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAE1C,MAAM,OAAO,GAAG;YACd,KAAK;YACL,6GAA6G;YAC7G,iEAAiE;YACjE,uEAAuE,aAAa,CAAC,aAAa,CAAC,OAAO,UAAU,OAAO,YAAY,KAAK;YAC5I,mBAAmB;YACnB,GAAG;SACJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO,MAAM,KAAK,IAAI,CAAC;IACzB,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,GAAW;QAClB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAElC,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAEtC,MAAM,OAAO,GAAG;YACd,KAAK;YACL,6GAA6G;YAC7G,iEAAiE;YACjE,4BAA4B,aAAa,CAAC,aAAa,CAAC,OAAO,UAAU,KAAK;YAC9E,2BAA2B;YAC3B,gBAAgB;YAChB,GAAG;SACJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,GAAW;QAChB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAEnC,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAEtC,MAAM,OAAO,GAAG;YACd,KAAK;YACL,6GAA6G;YAC7G,iEAAiE;YACjE,OAAO;YACP,4BAA4B,aAAa,CAAC,aAAa,CAAC,OAAO,UAAU,KAAK;YAC9E,sBAAsB;YACtB,YAAY;YACZ,GAAG;SACJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,yEAAyE;QACzE,6EAA6E;QAC7E,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO,MAAM,KAAK,IAAI,CAAC;IACzB,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,QAAQ,CAAC,MAAe;QAC5B,MAAM,OAAO,GAAG;YACd,KAAK;YACL,6GAA6G;YAC7G,iEAAiE;YACjE,OAAO;YACP,sCAAsC,aAAa,CAAC,aAAa,CAAC,KAAK;YACvE,yCAAyC;YACzC,YAAY;YACZ,GAAG;SACJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAEnC,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAC/B,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC9D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"vault-windows.js","sourceRoot":"","sources":["../../src/vault/vault-windows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,kFAAkF;AAClF,MAAM,aAAa,GAAG,UAAU,CAAC;AAEjC,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,OAAe,EAAE,KAAc;IACpD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CACtB,gBAAgB,EAChB,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,CAAC,EACtD,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAC5B,CAAC;QACF,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,OAAQ,MAAM,CAAC,MAAiB,CAAC,IAAI,EAAE,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,YAAY;IACd,IAAI,GAAG,SAAS,CAAC;IAE1B;;;;;;;OAOG;IACH,MAAM,CAAC,MAAM;QACX,6CAA6C;QAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,OAAO,YAAY,CAAC,qBAAqB,EAAE,CAAC;QAC9C,CAAC;QAED,6CAA6C;QAC7C,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAC1D,IAAI,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnC,OAAO,YAAY,CAAC,qBAAqB,EAAE,CAAC;YAC9C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;QAC7D,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,qBAAqB;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE;gBACpD,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,GAAW,EAAE,KAAa;QAC9B,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAE7B,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEnE,MAAM,OAAO,GAAG;YACd,KAAK;YACL,6GAA6G;YAC7G,iFAAiF;YACjF,qEAAqE;YACrE,iEAAiE;YACjE,uEAAuE,aAAa,CAAC,aAAa,CAAC,OAAO,UAAU,gBAAgB;YACpI,mBAAmB;YACnB,GAAG;SACJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACpD,OAAO,MAAM,KAAK,IAAI,CAAC;IACzB,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,GAAW;QAClB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAE5B,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAEtC,MAAM,OAAO,GAAG;YACd,KAAK;YACL,6GAA6G;YAC7G,iEAAiE;YACjE,4BAA4B,aAAa,CAAC,aAAa,CAAC,OAAO,UAAU,KAAK;YAC9E,2BAA2B;YAC3B,gBAAgB;YAChB,GAAG;SACJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,GAAW;QAChB,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAE9B,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAEtC,MAAM,OAAO,GAAG;YACd,KAAK;YACL,6GAA6G;YAC7G,iEAAiE;YACjE,OAAO;YACP,4BAA4B,aAAa,CAAC,aAAa,CAAC,OAAO,UAAU,KAAK;YAC9E,sBAAsB;YACtB,YAAY;YACZ,GAAG;SACJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,yEAAyE;QACzE,6EAA6E;QAC7E,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO,MAAM,KAAK,IAAI,CAAC;IACzB,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,QAAQ,CAAC,MAAe;QAC5B,MAAM,OAAO,GAAG;YACd,KAAK;YACL,6GAA6G;YAC7G,iEAAiE;YACjE,OAAO;YACP,sCAAsC,aAAa,CAAC,aAAa,CAAC,KAAK;YACvE,yCAAyC;YACzC,YAAY;YACZ,GAAG;SACJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAEnC,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAC/B,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC9D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}