@vess-id/vess 0.0.0-dev-20260917031855 → 0.0.0-dev-20261006110812

package/dist/cli/reset.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reset.d.ts","sourceRoot":"","sources":["../../src/cli/reset.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAI3C,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,kDAAkD;IAClD,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAMD,wBAAsB,QAAQ,CAAC,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuDxE"}
+{"version":3,"file":"reset.d.ts","sourceRoot":"","sources":["../../src/cli/reset.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAI3C,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,kDAAkD;IAClD,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAMD,wBAAsB,QAAQ,CAAC,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyDxE"}

package/dist/cli/reset.js

@@ -53,6 +53,7 @@ async function runReset(options = {}) {
         log('   - Daemon OS service (auto-start)');
         log(`   - Config, policy, wallet: ${paths.baseDir}`);
         log('   - Root key & session token from OS Keychain');
+        log(`   - Telemetry API key (OS Keychain, or ${paths.secretsDir} on Linux)`);
         log('');
         const confirmed = await promptConfirm('Are you sure? (y/N) ');
         if (!confirmed) {
@@ -76,10 +77,11 @@ async function runReset(options = {}) {
         await service_manager_1.ServiceManager.uninstall();
     }
     // 3. Delete keys from OS Keychain
-    log('Cleaning Keychain entries...');
-    const km = new key_manager_1.KeyManager();
+    log('Cleaning Keychain entries (and the telemetry API key file)...');
+    const km = new key_manager_1.KeyManager({ secretsDir: paths.secretsDir });
     km.deleteRootKey();
     km.deleteSessionToken();
+    km.deleteTelemetryApiKey();
     // 4. Delete agent keys listed in wallet.db (best-effort)
     deleteAgentKeysFromDb(paths, km);
     // 5. Remove ~/.vess directory
@@ -98,6 +100,7 @@ function deleteAgentKeysFromDb(paths, km) {
         return;
     try {
         // Dynamic import to avoid hard failure if db is corrupt
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
         const Database = require('better-sqlite3');
         const db = new Database(paths.walletDb, { readonly: true });
         const rows = db
@@ -116,7 +119,7 @@ function deleteAgentKeysFromDb(paths, km) {
     }
 }
 function promptConfirm(message) {
-    return new Promise((resolve) => {
+    return new Promise(resolve => {
         if (!process.stdin.isTTY) {
             resolve(false);
             return;

package/dist/cli/reset.js.map

@@ -1 +1 @@
-{"version":3,"file":"reset.js","sourceRoot":"","sources":["../../src/cli/reset.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgBA,4BAuDC;AAvED,uCAAwB;AACxB,yDAAoD;AACpD,2CAA2C;AAC3C,+DAA0D;AAC1D,2CAA0C;AAQ1C,SAAS,GAAG,CAAC,GAAW;IACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAA;AAClC,CAAC;AAEM,KAAK,UAAU,QAAQ,CAAC,UAAwB,EAAE;IACvD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,iBAAS,EAAE,CAAA;IAC9C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,KAAK,CAAA;IAEhD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,qCAAqC;QACrC,GAAG,CAAC,EAAE,CAAC,CAAA;QACP,GAAG,CAAC,yCAAyC,CAAC,CAAA;QAC9C,GAAG,CAAC,+CAA+C,CAAC,CAAA;QACpD,GAAG,CAAC,qCAAqC,CAAC,CAAA;QAC1C,GAAG,CAAC,gCAAgC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;QACpD,GAAG,CAAC,gDAAgD,CAAC,CAAA;QACrD,GAAG,CAAC,EAAE,CAAC,CAAA;QACP,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,sBAAsB,CAAC,CAAA;QAC7D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,GAAG,CAAC,UAAU,CAAC,CAAA;YACf,OAAM;QACR,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,GAAG,CAAC,qCAAqC,CAAC,CAAA;IAC1C,IAAI,CAAC;QACH,+EAA+E;QAC/E,mFAAmF;QACnF,MAAM,IAAA,wBAAY,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;IAED,oEAAoE;IACpE,IAAI,gCAAc,CAAC,WAAW,EAAE,EAAE,CAAC;QACjC,GAAG,CAAC,+BAA+B,CAAC,CAAA;QACpC,MAAM,gCAAc,CAAC,SAAS,EAAE,CAAA;IAClC,CAAC;IAED,kCAAkC;IAClC,GAAG,CAAC,8BAA8B,CAAC,CAAA;IACnC,MAAM,EAAE,GAAG,IAAI,wBAAU,EAAE,CAAA;IAC3B,EAAE,CAAC,aAAa,EAAE,CAAA;IAClB,EAAE,CAAC,kBAAkB,EAAE,CAAA;IAEvB,yDAAyD;IACzD,qBAAqB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAEhC,8BAA8B;IAC9B,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,YAAY,KAAK,CAAC,OAAO,KAAK,CAAC,CAAA;QACnC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC5D,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAA;IACnD,CAAC;IAED,GAAG,CAAC,EAAE,CAAC,CAAA;IACP,GAAG,CAAC,wEAAwE,CAAC,CAAA;AAC/E,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAgB,EAAE,EAAc;IAC7D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAM;IAC1C,IAAI,CAAC;QACH,wDAAwD;QACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;QAC1C,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3D,MAAM,IAAI,GAAG,EAAE;aACZ,OAAO,CACN,0HAA0H,CAC3H;aACA,GAAG,EAAwD,CAAA;QAC9D,EAAE,CAAC,KAAK,EAAE,CAAA;QAEV,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,WAAW,CAAC,CAAA;QACpD,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,GAAG,CAAC,aAAa,IAAI,CAAC,MAAM,8BAA8B,CAAC,CAAA;QAC7D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACzB,OAAO,CAAC,KAAK,CAAC,CAAA;YACd,OAAM;QACR,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;QAC3B,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC1B,KAAK,CAAC,MAAM,EAAE,CAAA;QACd,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;YAClC,KAAK,CAAC,KAAK,EAAE,CAAA;YACb,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAA;QAC5C,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE;YACrB,OAAO,CAAC,KAAK,CAAC,CAAA;QAChB,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"reset.js","sourceRoot":"","sources":["../../src/cli/reset.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgBA,4BAyDC;AAzED,uCAAwB;AACxB,yDAAoD;AACpD,2CAA2C;AAC3C,+DAA0D;AAC1D,2CAA0C;AAQ1C,SAAS,GAAG,CAAC,GAAW;IACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAA;AAClC,CAAC;AAEM,KAAK,UAAU,QAAQ,CAAC,UAAwB,EAAE;IACvD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,iBAAS,EAAE,CAAA;IAC9C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,KAAK,CAAA;IAEhD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,qCAAqC;QACrC,GAAG,CAAC,EAAE,CAAC,CAAA;QACP,GAAG,CAAC,yCAAyC,CAAC,CAAA;QAC9C,GAAG,CAAC,+CAA+C,CAAC,CAAA;QACpD,GAAG,CAAC,qCAAqC,CAAC,CAAA;QAC1C,GAAG,CAAC,gCAAgC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;QACpD,GAAG,CAAC,gDAAgD,CAAC,CAAA;QACrD,GAAG,CAAC,2CAA2C,KAAK,CAAC,UAAU,YAAY,CAAC,CAAA;QAC5E,GAAG,CAAC,EAAE,CAAC,CAAA;QACP,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,sBAAsB,CAAC,CAAA;QAC7D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,GAAG,CAAC,UAAU,CAAC,CAAA;YACf,OAAM;QACR,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,GAAG,CAAC,qCAAqC,CAAC,CAAA;IAC1C,IAAI,CAAC;QACH,+EAA+E;QAC/E,mFAAmF;QACnF,MAAM,IAAA,wBAAY,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;IAED,oEAAoE;IACpE,IAAI,gCAAc,CAAC,WAAW,EAAE,EAAE,CAAC;QACjC,GAAG,CAAC,+BAA+B,CAAC,CAAA;QACpC,MAAM,gCAAc,CAAC,SAAS,EAAE,CAAA;IAClC,CAAC;IAED,kCAAkC;IAClC,GAAG,CAAC,+DAA+D,CAAC,CAAA;IACpE,MAAM,EAAE,GAAG,IAAI,wBAAU,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAA;IAC3D,EAAE,CAAC,aAAa,EAAE,CAAA;IAClB,EAAE,CAAC,kBAAkB,EAAE,CAAA;IACvB,EAAE,CAAC,qBAAqB,EAAE,CAAA;IAE1B,yDAAyD;IACzD,qBAAqB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAEhC,8BAA8B;IAC9B,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,YAAY,KAAK,CAAC,OAAO,KAAK,CAAC,CAAA;QACnC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC5D,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAA;IACnD,CAAC;IAED,GAAG,CAAC,EAAE,CAAC,CAAA;IACP,GAAG,CAAC,wEAAwE,CAAC,CAAA;AAC/E,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAgB,EAAE,EAAc;IAC7D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAM;IAC1C,IAAI,CAAC;QACH,wDAAwD;QACxD,8DAA8D;QAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;QAC1C,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3D,MAAM,IAAI,GAAG,EAAE;aACZ,OAAO,CACN,0HAA0H,CAC3H;aACA,GAAG,EAAwD,CAAA;QAC9D,EAAE,CAAC,KAAK,EAAE,CAAA;QAEV,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,WAAW,CAAC,CAAA;QACpD,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,GAAG,CAAC,aAAa,IAAI,CAAC,MAAM,8BAA8B,CAAC,CAAA;QAC7D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACzB,OAAO,CAAC,KAAK,CAAC,CAAA;YACd,OAAM;QACR,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;QAC3B,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC1B,KAAK,CAAC,MAAM,EAAE,CAAA;QACd,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;YAClC,KAAK,CAAC,KAAK,EAAE,CAAA;YACb,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAA;QAC5C,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE;YACrB,OAAO,CAAC,KAAK,CAAC,CAAA;QAChB,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/cli/telemetry-setup.d.ts

@@ -1,8 +1,8 @@
 export interface TelemetrySetupOptions {
     /**
-     * 発行された送信専用の API キー。キーチェーンに保存する。
+     * 発行された送信専用の API キー。Linux は 0600 のファイル、それ以外はキーチェーンに保存する。
      *
-     * 省略すると、環境変数 → キーチェーンの順で保存済みの鍵を探す。設定を作り直す
+     * 省略すると、環境変数 → 保存済みの鍵の順で探す。設定を作り直す
      * だけの再実行で、キーを発行し直させないため。**空文字を渡した場合は
      * 探しに行かない** — 打ち間違いなので、黙って別の鍵を使うと何が使われたのかが
      * 分からなくなる。

package/dist/cli/telemetry-setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"telemetry-setup.d.ts","sourceRoot":"","sources":["../../src/cli/telemetry-setup.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,qBAAqB;IACpC;;;;;;;OAOG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,gDAAgD;IAChD,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,wBAAwB;IACxB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,kDAAkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,yDAAyD;IACzD,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqDrF"}
+{"version":3,"file":"telemetry-setup.d.ts","sourceRoot":"","sources":["../../src/cli/telemetry-setup.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,qBAAqB;IACpC;;;;;;;OAOG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,gDAAgD;IAChD,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,wBAAwB;IACxB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,kDAAkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,yDAAyD;IACzD,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6DrF"}

package/dist/cli/telemetry-setup.js

@@ -72,10 +72,16 @@ async function runTelemetrySetup(options) {
     // 鍵の保存を先に済ませる。設定だけ書けて鍵が入らないと、送信は始まるのに
     // 401 で落ち続ける状態になり、原因が見えにくい。
     //
-    // キーチェーンから読んだときだけ書き戻さない。**環境変数の鍵は保存する** —
-    // あれはこの 1 回しか存在しないので、保存しないとまさに上の状態になる
-    if (resolved.source !== 'keychain') {
-        new key_manager_1.KeyManager().storeTelemetryApiKey(resolved.key);
+    // 保存済みの鍵を読んだときは書き戻さない。ただし保存形式が古い場合は保存し直す。
+    // 環境変数 AIDENTITY_TELEMETRY_API_KEY で渡された鍵は保存する。環境変数はこの実行の
+    // シェルにしか無いので、保存しないと次のセッションから送信が 401 で失敗し続ける
+    const keyManager = new key_manager_1.KeyManager();
+    if (resolved.source !== 'stored' || keyManager.telemetryApiKeyNeedsRestore()) {
+        keyManager.storeTelemetryApiKey(resolved.key);
+        // 保存し直しても古い形式のままなら、より安全な形で保存できなかったということ
+        if (keyManager.telemetryApiKeyNeedsRestore()) {
+            process.stderr.write('警告: API キーを暗号化して保存できなかったため、平文 (権限 600) で保存しました。\n');
+        }
     }
     if (fs.existsSync(settingsPath)) {
         backup(settingsPath);
@@ -116,9 +122,9 @@ function resolveKey(argument) {
     const fromEnv = process.env[otel_headers_1.TELEMETRY_API_KEY_ENV]?.trim();
     if (fromEnv)
         return { key: fromEnv, source: 'env' };
-    const fromKeychain = new key_manager_1.KeyManager().getTelemetryApiKey()?.trim();
-    if (fromKeychain)
-        return { key: fromKeychain, source: 'keychain' };
+    const stored = new key_manager_1.KeyManager().getTelemetryApiKey()?.trim();
+    if (stored)
+        return { key: stored, source: 'stored' };
     throw new Error('No API key found on this machine.\n' +
         'Issue one in the aidentity console (AI 利用状況 → 端末の接続 → キーを発行),\n' +
         'then run: vess usage connect --key <key>');
@@ -199,15 +205,16 @@ function writeSettings(settingsPath, settings) {
 }
 function report(options) {
     const { settingsPath, endpoint, replaced, keySource, inheritedEndpoint } = options;
+    const keyLocation = new key_manager_1.KeyManager().telemetryApiKeyLocation();
     const lines = [
         'テレメトリの送信設定を書き込みました。',
         `  設定ファイル: ${settingsPath}`,
         // 黙って送信先が変わるのが一番危ない。引き継いだのかどうかを見せる
         `  送信先:       ${endpoint}${inheritedEndpoint ? ' (いまの設定から引き継ぎ)' : ''}`,
         // 🔴 有効性は確かめていない。失効した鍵でも設定は書ける
-        keySource === 'keychain'
-            ? '  API キー:     保存済みのものを使いました (有効かどうかは確かめていません)'
-            : '  API キー:     OS のキーチェーンに保存しました',
+        keySource === 'stored'
+            ? `  API キー:     保存済みのものを使いました (${keyLocation}。有効かどうかは確かめていません)`
+            : `  API キー:     ${keyLocation} に保存しました`,
     ];
     if (replaced) {
         lines.push(`  切り替え前:   ${replaced} (退避ファイルに残しています)`);

package/dist/cli/telemetry-setup.js.map

@@ -1 +1 @@
-{"version":3,"file":"telemetry-setup.js","sourceRoot":"","sources":["../../src/cli/telemetry-setup.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,8CAqDC;AAxGD,uCAAwB;AACxB,2CAA4B;AAE5B,yDAAoD;AACpD,4DAAiE;AACjE,kEAMqC;AA6BrC;;;;;;;;;;GAUG;AACI,KAAK,UAAU,iBAAiB,CAAC,OAA8B;IACpE,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAA,2CAAyB,GAAE,CAAA;IACxE,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,oBAAoB,EAAE,CAAA;IAErE,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;IAE3C,sCAAsC;IACtC,mBAAmB;IACnB,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAExC,MAAM,SAAS,GAAG,IAAA,wCAAsB,EAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IACtD,0CAA0C;IAC1C,2BAA2B;IAC3B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,IAAI,SAAS,IAAI,OAAO,CAAC,eAAe,CAAC,CAAA;IAC5F,MAAM,iBAAiB,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,SAAS,KAAK,IAAI,CAAA;IAEjE,MAAM,QAAQ,GAAG,IAAA,wCAAsB,EAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IAC/D,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,kDAAkD;YAChD,KAAK,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,OAAO,MAAM;YAC3C,wFAAwF;YACxF,yFAAyF,CAC5F,CAAA;IACH,CAAC;IAED,sCAAsC;IACtC,4BAA4B;IAC5B,EAAE;IACF,0CAA0C;IAC1C,sCAAsC;IACtC,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACnC,IAAI,wBAAU,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IACrD,CAAC;IAED,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,YAAY,CAAC,CAAA;IACtB,CAAC;IAED,MAAM,IAAI,GAAG,IAAA,wCAAsB,EAAC,QAAQ,EAAE;QAC5C,QAAQ;QACR,aAAa;QACb,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,kBAAkB,EAAE;KACzD,CAAC,CAAA;IACF,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,CAAA;IAEjC,MAAM,CAAC;QACL,YAAY;QACZ,QAAQ;QACR,QAAQ,EAAE,QAAQ,EAAE,OAAO;QAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM;QAC1B,iBAAiB;KAClB,CAAC,CAAA;AACJ,CAAC;AAWD;;;;;;;;GAQG;AACH,SAAS,UAAU,CAAC,QAA4B;IAC9C,0CAA0C;IAC1C,6BAA6B;IAC7B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;QAC3E,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IACpC,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,oCAAqB,CAAC,EAAE,IAAI,EAAE,CAAA;IAC1D,IAAI,OAAO;QAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IAEnD,MAAM,YAAY,GAAG,IAAI,wBAAU,EAAE,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,CAAA;IAClE,IAAI,YAAY;QAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAElE,MAAM,IAAI,KAAK,CACb,qCAAqC;QACnC,iEAAiE;QACjE,0CAA0C,CAC7C,CAAA;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAuB;IAChD,MAAM,KAAK,GAAG,GAAG,EAAE,IAAI,EAAE,CAAA;IACzB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;IACjF,CAAC;IAED,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gCAAgC,KAAK,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,EAAE,CAAC,CAAA;IACvD,CAAC;IAED,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AAClC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB;IAC3B,gDAAgD;IAChD,sCAAsC;IACtC,OAAO,QAAQ,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC,eAAe,CAAA;AAC/D,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,QAAQ,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC,aAAa,CAAA;AAC7D,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACxB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,YAAoB;IACxC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,EAAE,CAAA;IAE3C,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAA;QAClC,CAAC;QACD,OAAO,MAAwB,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,gCAAgC;QAChC,MAAM,IAAI,KAAK,CACb,gEAAgE,YAAY,IAAI;YAC9E,oDAAoD,CACvD,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,YAAoB;IAClC,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAC5D,MAAM,MAAM,GAAG,GAAG,YAAY,QAAQ,KAAK,EAAE,CAAA;IAC7C,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;IACrC,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,aAAa,CAAC,YAAoB,EAAE,QAAwB;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IACtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACxC,CAAC;IACD,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;AAC1E,CAAC;AAED,SAAS,MAAM,CAAC,OAMf;IACC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAA;IAElF,MAAM,KAAK,GAAG;QACZ,qBAAqB;QACrB,aAAa,YAAY,EAAE;QAC3B,mCAAmC;QACnC,gBAAgB,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE;QACtE,+BAA+B;QAC/B,SAAS,KAAK,UAAU;YACtB,CAAC,CAAC,+CAA+C;YACjD,CAAC,CAAC,iCAAiC;KACtC,CAAA;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,cAAc,QAAQ,kBAAkB,CAAC,CAAA;IACtD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,0CAA0C,CAAC,CAAA;IAE1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAA;AAC/C,CAAC"}
+{"version":3,"file":"telemetry-setup.js","sourceRoot":"","sources":["../../src/cli/telemetry-setup.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,8CA6DC;AAhHD,uCAAwB;AACxB,2CAA4B;AAE5B,yDAAoD;AACpD,4DAAiE;AACjE,kEAMqC;AA6BrC;;;;;;;;;;GAUG;AACI,KAAK,UAAU,iBAAiB,CAAC,OAA8B;IACpE,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAA,2CAAyB,GAAE,CAAA;IACxE,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,oBAAoB,EAAE,CAAA;IAErE,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;IAE3C,sCAAsC;IACtC,mBAAmB;IACnB,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAExC,MAAM,SAAS,GAAG,IAAA,wCAAsB,EAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IACtD,0CAA0C;IAC1C,2BAA2B;IAC3B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,IAAI,SAAS,IAAI,OAAO,CAAC,eAAe,CAAC,CAAA;IAC5F,MAAM,iBAAiB,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,SAAS,KAAK,IAAI,CAAA;IAEjE,MAAM,QAAQ,GAAG,IAAA,wCAAsB,EAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IAC/D,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,kDAAkD;YAChD,KAAK,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,OAAO,MAAM;YAC3C,wFAAwF;YACxF,yFAAyF,CAC5F,CAAA;IACH,CAAC;IAED,sCAAsC;IACtC,4BAA4B;IAC5B,EAAE;IACF,0CAA0C;IAC1C,0DAA0D;IAC1D,4CAA4C;IAC5C,MAAM,UAAU,GAAG,IAAI,wBAAU,EAAE,CAAA;IACnC,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,IAAI,UAAU,CAAC,2BAA2B,EAAE,EAAE,CAAC;QAC7E,UAAU,CAAC,oBAAoB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;QAC7C,wCAAwC;QACxC,IAAI,UAAU,CAAC,2BAA2B,EAAE,EAAE,CAAC;YAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mDAAmD,CACpD,CAAA;QACH,CAAC;IACH,CAAC;IAED,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,YAAY,CAAC,CAAA;IACtB,CAAC;IAED,MAAM,IAAI,GAAG,IAAA,wCAAsB,EAAC,QAAQ,EAAE;QAC5C,QAAQ;QACR,aAAa;QACb,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,kBAAkB,EAAE;KACzD,CAAC,CAAA;IACF,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,CAAA;IAEjC,MAAM,CAAC;QACL,YAAY;QACZ,QAAQ;QACR,QAAQ,EAAE,QAAQ,EAAE,OAAO;QAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM;QAC1B,iBAAiB;KAClB,CAAC,CAAA;AACJ,CAAC;AAWD;;;;;;;;GAQG;AACH,SAAS,UAAU,CAAC,QAA4B;IAC9C,0CAA0C;IAC1C,6BAA6B;IAC7B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;QAC3E,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IACpC,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,oCAAqB,CAAC,EAAE,IAAI,EAAE,CAAA;IAC1D,IAAI,OAAO;QAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IAEnD,MAAM,MAAM,GAAG,IAAI,wBAAU,EAAE,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,CAAA;IAC5D,IAAI,MAAM;QAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAEpD,MAAM,IAAI,KAAK,CACb,qCAAqC;QACnC,iEAAiE;QACjE,0CAA0C,CAC7C,CAAA;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAuB;IAChD,MAAM,KAAK,GAAG,GAAG,EAAE,IAAI,EAAE,CAAA;IACzB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;IACjF,CAAC;IAED,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gCAAgC,KAAK,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,EAAE,CAAC,CAAA;IACvD,CAAC;IAED,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AAClC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB;IAC3B,gDAAgD;IAChD,sCAAsC;IACtC,OAAO,QAAQ,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC,eAAe,CAAA;AAC/D,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,QAAQ,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC,aAAa,CAAA;AAC7D,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACxB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,YAAoB;IACxC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,EAAE,CAAA;IAE3C,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAA;QAClC,CAAC;QACD,OAAO,MAAwB,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,gCAAgC;QAChC,MAAM,IAAI,KAAK,CACb,gEAAgE,YAAY,IAAI;YAC9E,oDAAoD,CACvD,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,YAAoB;IAClC,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAC5D,MAAM,MAAM,GAAG,GAAG,YAAY,QAAQ,KAAK,EAAE,CAAA;IAC7C,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;IACrC,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,aAAa,CAAC,YAAoB,EAAE,QAAwB;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IACtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACxC,CAAC;IACD,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;AAC1E,CAAC;AAED,SAAS,MAAM,CAAC,OAMf;IACC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAA;IAClF,MAAM,WAAW,GAAG,IAAI,wBAAU,EAAE,CAAC,uBAAuB,EAAE,CAAA;IAE9D,MAAM,KAAK,GAAG;QACZ,qBAAqB;QACrB,aAAa,YAAY,EAAE;QAC3B,mCAAmC;QACnC,gBAAgB,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE;QACtE,+BAA+B;QAC/B,SAAS,KAAK,QAAQ;YACpB,CAAC,CAAC,gCAAgC,WAAW,mBAAmB;YAChE,CAAC,CAAC,iBAAiB,WAAW,UAAU;KAC3C,CAAA;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,cAAc,QAAQ,kBAAkB,CAAC,CAAA;IACtD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,0CAA0C,CAAC,CAAA;IAE1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAA;AAC/C,CAAC"}

package/dist/config/paths.d.ts

@@ -4,6 +4,7 @@ export declare class VessPaths {
     get configFile(): string;
     get policyFile(): string;
     get walletDb(): string;
+    get secretsDir(): string;
     get auditLogDir(): string;
 }
 //# sourceMappingURL=paths.d.ts.map

package/dist/config/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/config/paths.ts"],"names":[],"mappings":"AAGA,qBAAa,SAAS;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;gBAEZ,OAAO,CAAC,EAAE,MAAM;IAI5B,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;CACF"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/config/paths.ts"],"names":[],"mappings":"AAGA,qBAAa,SAAS;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;gBAEZ,OAAO,CAAC,EAAE,MAAM;IAI5B,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;CACF"}

package/dist/config/paths.js

@@ -50,6 +50,9 @@ class VessPaths {
     get walletDb() {
         return path.join(this.baseDir, 'wallet.db');
     }
+    get secretsDir() {
+        return path.join(this.baseDir, 'secrets');
+    }
     get auditLogDir() {
         return path.join(this.baseDir, 'logs');
     }

package/dist/config/paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/config/paths.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA4B;AAC5B,uCAAwB;AAExB,MAAa,SAAS;IACX,OAAO,CAAQ;IAExB,YAAY,OAAgB;QAC1B,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAA;IAC5D,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAC/C,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAC/C,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IAC7C,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACxC,CAAC;CACF;AAtBD,8BAsBC"}
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/config/paths.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA4B;AAC5B,uCAAwB;AAExB,MAAa,SAAS;IACX,OAAO,CAAQ;IAExB,YAAY,OAAgB;QAC1B,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAA;IAC5D,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAC/C,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAC/C,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IAC7C,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IAC3C,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACxC,CAAC;CACF;AA1BD,8BA0BC"}

package/dist/identity/dpapi.d.ts

@@ -0,0 +1,18 @@
+/** DPAPI の操作。入力も出力も base64。失敗したら null。 */
+export type DpapiRunner = (operation: 'Protect' | 'Unprotect', inputBase64: string) => string | null;
+/** WSL で Windows のプログラムを起動できるか。連携が無効ならこのファイルが無い。 */
+export declare function isWslWithInterop(): boolean;
+/** 値を Windows ユーザーに結びついた DPAPI で暗号化し、`dpapi:v1:<base64>` の形で扱う。 */
+export declare class DpapiCodec {
+    private readonly run;
+    constructor(run: DpapiRunner);
+    isEncoded(stored: string): boolean;
+    encode(value: string): string | null;
+    decode(stored: string): string | null;
+}
+/**
+ * WSL から Windows PowerShell 5.1 で DPAPI を呼ぶ。
+ * 秘密は標準入力 (base64) で渡し、コマンドラインに載せない。標準入力の BOM 等は base64 以外として捨てる。
+ */
+export declare const runPowershellDpapi: DpapiRunner;
+//# sourceMappingURL=dpapi.d.ts.map

package/dist/identity/dpapi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dpapi.d.ts","sourceRoot":"","sources":["../../src/identity/dpapi.ts"],"names":[],"mappings":"AAGA,0CAA0C;AAC1C,MAAM,MAAM,WAAW,GAAG,CAAC,SAAS,EAAE,SAAS,GAAG,WAAW,EAAE,WAAW,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAA;AAQpG,oDAAoD;AACpD,wBAAgB,gBAAgB,IAAI,OAAO,CAI1C;AAED,mEAAmE;AACnE,qBAAa,UAAU;IACT,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,WAAW;IAE7C,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAIlC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAKpC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;CAItC;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,WA2BhC,CAAA"}

package/dist/identity/dpapi.js

@@ -0,0 +1,97 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runPowershellDpapi = exports.DpapiCodec = void 0;
+exports.isWslWithInterop = isWslWithInterop;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const DPAPI_PREFIX = 'dpapi:v1:';
+const BASE64 = /^[A-Za-z0-9+/]+=*$/;
+// 他のアプリが DPAPI で暗号化した値と取り違えないための固定値
+const ENTROPY = 'com.vess.telemetry-api-key';
+const POWERSHELL_FALLBACK = '/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe';
+/** WSL で Windows のプログラムを起動できるか。連携が無効ならこのファイルが無い。 */
+function isWslWithInterop() {
+    return ['/proc/sys/fs/binfmt_misc/WSLInterop', '/proc/sys/fs/binfmt_misc/WSLInterop-late'].some(p => fs.existsSync(p));
+}
+/** 値を Windows ユーザーに結びついた DPAPI で暗号化し、`dpapi:v1:<base64>` の形で扱う。 */
+class DpapiCodec {
+    run;
+    constructor(run) {
+        this.run = run;
+    }
+    isEncoded(stored) {
+        return stored.startsWith(DPAPI_PREFIX);
+    }
+    encode(value) {
+        const out = this.run('Protect', Buffer.from(value, 'utf-8').toString('base64'));
+        return out ? DPAPI_PREFIX + out : null;
+    }
+    decode(stored) {
+        const out = this.run('Unprotect', stored.slice(DPAPI_PREFIX.length));
+        return out ? Buffer.from(out, 'base64').toString('utf-8') : null;
+    }
+}
+exports.DpapiCodec = DpapiCodec;
+/**
+ * WSL から Windows PowerShell 5.1 で DPAPI を呼ぶ。
+ * 秘密は標準入力 (base64) で渡し、コマンドラインに載せない。標準入力の BOM 等は base64 以外として捨てる。
+ */
+const runPowershellDpapi = (operation, inputBase64) => {
+    const script = "$ErrorActionPreference='Stop';Add-Type -AssemblyName System.Security;" +
+        `$e=[Text.Encoding]::UTF8.GetBytes('${ENTROPY}');` +
+        "$i=[Convert]::FromBase64String(([Console]::In.ReadToEnd() -replace '[^A-Za-z0-9+/=]',''));" +
+        `$o=[Security.Cryptography.ProtectedData]::${operation}($i,$e,'CurrentUser');` +
+        '[Console]::Out.Write([Convert]::ToBase64String($o))';
+    for (const exe of ['powershell.exe', POWERSHELL_FALLBACK]) {
+        const result = (0, child_process_1.spawnSync)(exe, ['-NoLogo', '-NoProfile', '-NonInteractive', '-Command', script], {
+            input: inputBase64,
+            encoding: 'utf-8',
+            timeout: 10_000,
+            windowsHide: true,
+            // 9P 越しの作業ディレクトリは遅く、消えていると起動に失敗する
+            cwd: fs.existsSync('/mnt/c') ? '/mnt/c' : undefined,
+        });
+        if (result.error?.code === 'ENOENT')
+            continue;
+        if (result.error || result.status !== 0)
+            return null;
+        const out = (result.stdout ?? '').trim();
+        return BASE64.test(out) ? out : null;
+    }
+    return null;
+};
+exports.runPowershellDpapi = runPowershellDpapi;
+//# sourceMappingURL=dpapi.js.map

package/dist/identity/dpapi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dpapi.js","sourceRoot":"","sources":["../../src/identity/dpapi.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAaA,4CAIC;AAjBD,iDAAyC;AACzC,uCAAwB;AAKxB,MAAM,YAAY,GAAG,WAAW,CAAA;AAChC,MAAM,MAAM,GAAG,oBAAoB,CAAA;AACnC,oCAAoC;AACpC,MAAM,OAAO,GAAG,4BAA4B,CAAA;AAC5C,MAAM,mBAAmB,GAAG,+DAA+D,CAAA;AAE3F,oDAAoD;AACpD,SAAgB,gBAAgB;IAC9B,OAAO,CAAC,qCAAqC,EAAE,0CAA0C,CAAC,CAAC,IAAI,CAC7F,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CACtB,CAAA;AACH,CAAC;AAED,mEAAmE;AACnE,MAAa,UAAU;IACQ;IAA7B,YAA6B,GAAgB;QAAhB,QAAG,GAAH,GAAG,CAAa;IAAG,CAAC;IAEjD,SAAS,CAAC,MAAc;QACtB,OAAO,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;IACxC,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC/E,OAAO,GAAG,CAAC,CAAC,CAAC,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;IACxC,CAAC;IAED,MAAM,CAAC,MAAc;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAA;QACpE,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAClE,CAAC;CACF;AAhBD,gCAgBC;AAED;;;GAGG;AACI,MAAM,kBAAkB,GAAgB,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE;IACxE,MAAM,MAAM,GACV,uEAAuE;QACvE,sCAAsC,OAAO,KAAK;QAClD,4FAA4F;QAC5F,6CAA6C,SAAS,wBAAwB;QAC9E,qDAAqD,CAAA;IAEvD,KAAK,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,IAAA,yBAAS,EACtB,GAAG,EACH,CAAC,SAAS,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,CAAC,EAChE;YACE,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,IAAI;YACjB,kCAAkC;YAClC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;SACpD,CACF,CAAA;QACD,IAAK,MAAM,CAAC,KAA2C,EAAE,IAAI,KAAK,QAAQ;YAAE,SAAQ;QACpF,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QACpD,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QACxC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;IACtC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AA3BY,QAAA,kBAAkB,sBA2B9B"}

package/dist/identity/key-manager.d.ts

@@ -1,6 +1,22 @@
+import { type DpapiRunner } from './dpapi';
+export interface KeyManagerOptions {
+    /** 既定は process.platform。 */
+    platform?: NodeJS.Platform;
+    /** ファイルに置く秘密の値のディレクトリ。既定は ~/.vess/secrets。 */
+    secretsDir?: string;
+    /** WSL で Windows 連携が使えるか。既定は実環境から判定する。 */
+    wsl?: boolean;
+    /** DPAPI の呼び出し。既定は powershell.exe。 */
+    dpapi?: DpapiRunner;
+}
 export declare class KeyManager {
+    private readonly platform;
+    private readonly keychain;
+    private readonly files;
+    private readonly wsl;
+    private readonly dpapi;
+    constructor(options?: KeyManagerOptions);
     static getKeychainRef(keyType: 'root' | 'agent', projectId?: string, clientName?: string): string;
-    private createEntry;
     storeRootKey(privateKeyJwk: string): void;
     getRootKey(): string | null;
     deleteRootKey(): void;
@@ -13,6 +29,12 @@ export declare class KeyManager {
     storeTelemetryApiKey(apiKey: string): void;
     getTelemetryApiKey(): string | null;
     deleteTelemetryApiKey(): void;
+    /** 保存済みの鍵を storeTelemetryApiKey で保存し直すと、より安全な形になるとき true。 */
+    telemetryApiKeyNeedsRestore(): boolean;
+    /** 送信用 API キーの保存先。利用者への表示用。 */
+    telemetryApiKeyLocation(): string;
+    /** WSL で、平文のファイル、またはキーチェーンにだけ鍵があるとき true。 */
+    private isUnencryptedOnWsl;
     private envAccount;
     storeEnvSecret(profile: string, key: string, value: string): void;
     getEnvSecret(profile: string, key: string): string | null;

package/dist/identity/key-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"key-manager.d.ts","sourceRoot":"","sources":["../../src/identity/key-manager.ts"],"names":[],"mappings":"AAIA,qBAAa,UAAU;IACrB,MAAM,CAAC,cAAc,CACnB,OAAO,EAAE,MAAM,GAAG,OAAO,EACzB,SAAS,CAAC,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB,MAAM;IAOT,OAAO,CAAC,WAAW;IAInB,YAAY,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI;IAIzC,UAAU,IAAI,MAAM,GAAG,IAAI;IAQ3B,aAAa,IAAI,IAAI;IAQrB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI;IAKjF,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IASjE,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAS3D,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAItC,eAAe,IAAI,MAAM,GAAG,IAAI;IAQhC,kBAAkB,IAAI,IAAI;IAe1B,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAI1C,kBAAkB,IAAI,MAAM,GAAG,IAAI;IAQnC,qBAAqB,IAAI,IAAI;IAU7B,OAAO,CAAC,UAAU;IAIlB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAIjE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAQzD,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI;CAOpD"}
+{"version":3,"file":"key-manager.d.ts","sourceRoot":"","sources":["../../src/identity/key-manager.ts"],"names":[],"mappings":"AACA,OAAO,EAAoD,KAAK,WAAW,EAAE,MAAM,SAAS,CAAA;AAM5F,MAAM,WAAW,iBAAiB;IAChC,4BAA4B;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;IAC1B,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,0CAA0C;IAC1C,GAAG,CAAC,EAAE,OAAO,CAAA;IACb,sCAAsC;IACtC,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkC;IAC3D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;gBAEtB,OAAO,GAAE,iBAAsB;IAO3C,MAAM,CAAC,cAAc,CACnB,OAAO,EAAE,MAAM,GAAG,OAAO,EACzB,SAAS,CAAC,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB,MAAM;IAOT,YAAY,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI;IAIzC,UAAU,IAAI,MAAM,GAAG,IAAI;IAI3B,aAAa,IAAI,IAAI;IAIrB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI;IAIjF,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAIjE,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAI3D,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAItC,eAAe,IAAI,MAAM,GAAG,IAAI;IAIhC,kBAAkB,IAAI,IAAI;IAa1B,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAY1C,kBAAkB,IAAI,MAAM,GAAG,IAAI;IA4BnC,qBAAqB,IAAI,IAAI;IAO7B,6DAA6D;IAC7D,2BAA2B,IAAI,OAAO;IAItC,+BAA+B;IAC/B,uBAAuB,IAAI,MAAM;IASjC,6CAA6C;IAC7C,OAAO,CAAC,kBAAkB;IAS1B,OAAO,CAAC,UAAU;IAIlB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAIjE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAIzD,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI;CAGpD"}

package/dist/identity/key-manager.js

@@ -1,77 +1,55 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.KeyManager = void 0;
-const keyring_1 = require("@napi-rs/keyring");
+const paths_1 = require("../config/paths");
+const dpapi_1 = require("./dpapi");
+const secret_store_1 = require("./secret-store");
 const SERVICE_NAME = 'com.vess';
+const TELEMETRY_API_KEY_ACCOUNT = 'telemetry-api-key';
 class KeyManager {
+    platform;
+    keychain = new secret_store_1.KeychainStore(SERVICE_NAME);
+    files;
+    wsl;
+    dpapi;
+    constructor(options = {}) {
+        this.platform = options.platform ?? process.platform;
+        this.files = new secret_store_1.FileStore(options.secretsDir ?? new paths_1.VessPaths().secretsDir);
+        this.wsl = this.platform === 'linux' && (options.wsl ?? (0, dpapi_1.isWslWithInterop)());
+        this.dpapi = new dpapi_1.DpapiCodec(options.dpapi ?? dpapi_1.runPowershellDpapi);
+    }
     static getKeychainRef(keyType, projectId, clientName) {
         if (keyType === 'root') {
             return `${SERVICE_NAME}.root-key`;
         }
         return `${SERVICE_NAME}.agent.${projectId}.${clientName}`;
     }
-    createEntry(account) {
-        return new keyring_1.Entry(SERVICE_NAME, account);
-    }
     storeRootKey(privateKeyJwk) {
-        this.createEntry('root-key').setPassword(privateKeyJwk);
+        this.keychain.set('root-key', privateKeyJwk);
     }
     getRootKey() {
-        try {
-            return this.createEntry('root-key').getPassword();
-        }
-        catch {
-            return null;
-        }
+        return this.keychain.get('root-key');
     }
     deleteRootKey() {
-        try {
-            this.createEntry('root-key').deletePassword();
-        }
-        catch {
-            // Key doesn't exist, ignore
-        }
+        this.keychain.delete('root-key');
     }
     storeAgentKey(projectId, clientName, privateKeyJwk) {
-        const account = `agent.${projectId}.${clientName}`;
-        this.createEntry(account).setPassword(privateKeyJwk);
+        this.keychain.set(`agent.${projectId}.${clientName}`, privateKeyJwk);
     }
     getAgentKey(projectId, clientName) {
-        try {
-            const account = `agent.${projectId}.${clientName}`;
-            return this.createEntry(account).getPassword();
-        }
-        catch {
-            return null;
-        }
+        return this.keychain.get(`agent.${projectId}.${clientName}`);
     }
     deleteAgentKey(projectId, clientName) {
-        try {
-            const account = `agent.${projectId}.${clientName}`;
-            this.createEntry(account).deletePassword();
-        }
-        catch {
-            // Key doesn't exist, ignore
-        }
+        this.keychain.delete(`agent.${projectId}.${clientName}`);
     }
     storeSessionToken(token) {
-        this.createEntry('session-token').setPassword(token);
+        this.keychain.set('session-token', token);
     }
     getSessionToken() {
-        try {
-            return this.createEntry('session-token').getPassword();
-        }
-        catch {
-            return null;
-        }
+        return this.keychain.get('session-token');
     }
     deleteSessionToken() {
-        try {
-            this.createEntry('session-token').deletePassword();
-        }
-        catch {
-            // Token doesn't exist, ignore
-        }
+        this.keychain.delete('session-token');
     }
     // ── Telemetry API key ──
     //
@@ -79,47 +57,90 @@ class KeyManager {
     // key has to be readable by `vess otel-headers` on every export. Keeping it
     // here rather than in each agent's settings file is the point: those files are
     // plaintext and show up in the agents' own config dumps.
+    // Linux は Secret Service が無いとキーチェーンが再起動で消えるため 0600 ファイルに置く。
+    // WSL では Windows の DPAPI で暗号化してから置く。暗号化は保存時だけ行い、読み出しでは復号だけする。
     storeTelemetryApiKey(apiKey) {
-        this.createEntry('telemetry-api-key').setPassword(apiKey);
+        if (this.platform === 'linux') {
+            const encoded = this.wsl ? this.dpapi.encode(apiKey) : null;
+            // 暗号化できなければ平文で置く。送信を止めないことを優先する
+            this.files.set(TELEMETRY_API_KEY_ACCOUNT, encoded ?? apiKey);
+            // 古い鍵を残すと、並行する読み出しの移行処理が新しい鍵を上書きしうる
+            this.keychain.delete(TELEMETRY_API_KEY_ACCOUNT);
+        }
+        else {
+            this.keychain.set(TELEMETRY_API_KEY_ACCOUNT, apiKey);
+        }
     }
     getTelemetryApiKey() {
+        if (this.platform !== 'linux') {
+            return this.keychain.get(TELEMETRY_API_KEY_ACCOUNT);
+        }
+        // 手で編集されたファイルの末尾改行をヘッダーに混ぜない
+        const fromFile = this.files.get(TELEMETRY_API_KEY_ACCOUNT)?.trim();
+        if (fromFile) {
+            if (!this.dpapi.isEncoded(fromFile))
+                return fromFile;
+            const decoded = this.dpapi.decode(fromFile);
+            if (decoded === null) {
+                process.stderr.write('警告: DPAPI での復号に失敗しました。vess usage connect を再実行してください。\n');
+            }
+            return decoded;
+        }
+        // ファイル保存より前にキーチェーンへ入れた端末。消える前にファイルへ移す
+        const legacy = this.keychain.get(TELEMETRY_API_KEY_ACCOUNT);
+        if (legacy === null)
+            return null;
         try {
-            return this.createEntry('telemetry-api-key').getPassword();
+            this.files.set(TELEMETRY_API_KEY_ACCOUNT, legacy);
+            this.keychain.delete(TELEMETRY_API_KEY_ACCOUNT);
         }
         catch {
-            return null;
+            // 移せなくても今回の読み出しは返す。次の読み出しでまた試す
         }
+        return legacy;
     }
     deleteTelemetryApiKey() {
-        try {
-            this.createEntry('telemetry-api-key').deletePassword();
-        }
-        catch {
-            // Key doesn't exist, ignore
-        }
+        if (this.platform === 'linux') {
+            this.files.delete(TELEMETRY_API_KEY_ACCOUNT);
+        }
+        this.keychain.delete(TELEMETRY_API_KEY_ACCOUNT);
+    }
+    /** 保存済みの鍵を storeTelemetryApiKey で保存し直すと、より安全な形になるとき true。 */
+    telemetryApiKeyNeedsRestore() {
+        return this.isUnencryptedOnWsl();
+    }
+    /** 送信用 API キーの保存先。利用者への表示用。 */
+    telemetryApiKeyLocation() {
+        if (this.platform !== 'linux')
+            return 'OS のキーチェーン';
+        const location = this.files.pathOf(TELEMETRY_API_KEY_ACCOUNT);
+        if (!this.wsl)
+            return location;
+        return this.isUnencryptedOnWsl()
+            ? `${location} (暗号化なし)`
+            : `${location} (Windows の DPAPI で暗号化)`;
+    }
+    /** WSL で、平文のファイル、またはキーチェーンにだけ鍵があるとき true。 */
+    isUnencryptedOnWsl() {
+        if (this.platform !== 'linux' || !this.wsl)
+            return false;
+        const fromFile = this.files.get(TELEMETRY_API_KEY_ACCOUNT)?.trim();
+        if (fromFile)
+            return !this.dpapi.isEncoded(fromFile);
+        return this.keychain.get(TELEMETRY_API_KEY_ACCOUNT) !== null;
     }
     // ── Env secret storage (vess://env/<profile>/<key>) ──
     envAccount(profile, key) {
         return `env.${profile}.${key}`;
     }
     storeEnvSecret(profile, key, value) {
-        this.createEntry(this.envAccount(profile, key)).setPassword(value);
+        this.keychain.set(this.envAccount(profile, key), value);
     }
     getEnvSecret(profile, key) {
-        try {
-            return this.createEntry(this.envAccount(profile, key)).getPassword();
-        }
-        catch {
-            return null;
-        }
+        return this.keychain.get(this.envAccount(profile, key));
     }
     deleteEnvSecret(profile, key) {
-        try {
-            this.createEntry(this.envAccount(profile, key)).deletePassword();
-        }
-        catch {
-            // Secret doesn't exist, ignore
-        }
+        this.keychain.delete(this.envAccount(profile, key));
     }
 }
 exports.KeyManager = KeyManager;

package/dist/identity/key-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"key-manager.js","sourceRoot":"","sources":["../../src/identity/key-manager.ts"],"names":[],"mappings":";;;AAAA,8CAAwC;AAExC,MAAM,YAAY,GAAG,UAAU,CAAA;AAE/B,MAAa,UAAU;IACrB,MAAM,CAAC,cAAc,CACnB,OAAyB,EACzB,SAAkB,EAClB,UAAmB;QAEnB,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,OAAO,GAAG,YAAY,WAAW,CAAA;QACnC,CAAC;QACD,OAAO,GAAG,YAAY,UAAU,SAAS,IAAI,UAAU,EAAE,CAAA;IAC3D,CAAC;IAEO,WAAW,CAAC,OAAe;QACjC,OAAO,IAAI,eAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;IACzC,CAAC;IAED,YAAY,CAAC,aAAqB;QAChC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAA;IACzD,CAAC;IAED,UAAU;QACR,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAA;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,aAAa;QACX,IAAI,CAAC;YACH,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,cAAc,EAAE,CAAA;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;IACH,CAAC;IAED,aAAa,CAAC,SAAiB,EAAE,UAAkB,EAAE,aAAqB;QACxE,MAAM,OAAO,GAAG,SAAS,SAAS,IAAI,UAAU,EAAE,CAAA;QAClD,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAA;IACtD,CAAC;IAED,WAAW,CAAC,SAAiB,EAAE,UAAkB;QAC/C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,SAAS,SAAS,IAAI,UAAU,EAAE,CAAA;YAClD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAA;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,cAAc,CAAC,SAAiB,EAAE,UAAkB;QAClD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,SAAS,SAAS,IAAI,UAAU,EAAE,CAAA;YAClD,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,CAAA;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;IACH,CAAC;IAED,iBAAiB,CAAC,KAAa;QAC7B,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;IACtD,CAAC;IAED,eAAe;QACb,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAA;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,kBAAkB;QAChB,IAAI,CAAC;YACH,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,cAAc,EAAE,CAAA;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,8BAA8B;QAChC,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,EAAE;IACF,6EAA6E;IAC7E,4EAA4E;IAC5E,+EAA+E;IAC/E,yDAAyD;IAEzD,oBAAoB,CAAC,MAAc;QACjC,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3D,CAAC;IAED,kBAAkB;QAChB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC,WAAW,EAAE,CAAA;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,qBAAqB;QACnB,IAAI,CAAC;YACH,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC,cAAc,EAAE,CAAA;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;IACH,CAAC;IAED,wDAAwD;IAEhD,UAAU,CAAC,OAAe,EAAE,GAAW;QAC7C,OAAO,OAAO,OAAO,IAAI,GAAG,EAAE,CAAA;IAChC,CAAC;IAED,cAAc,CAAC,OAAe,EAAE,GAAW,EAAE,KAAa;QACxD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;IACpE,CAAC;IAED,YAAY,CAAC,OAAe,EAAE,GAAW;QACvC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,eAAe,CAAC,OAAe,EAAE,GAAW;QAC1C,IAAI,CAAC;YACH,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,cAAc,EAAE,CAAA;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;IACH,CAAC;CACF;AAnID,gCAmIC"}
+{"version":3,"file":"key-manager.js","sourceRoot":"","sources":["../../src/identity/key-manager.ts"],"names":[],"mappings":";;;AAAA,2CAA2C;AAC3C,mCAA4F;AAC5F,iDAAyD;AAEzD,MAAM,YAAY,GAAG,UAAU,CAAA;AAC/B,MAAM,yBAAyB,GAAG,mBAAmB,CAAA;AAarD,MAAa,UAAU;IACJ,QAAQ,CAAiB;IACzB,QAAQ,GAAG,IAAI,4BAAa,CAAC,YAAY,CAAC,CAAA;IAC1C,KAAK,CAAW;IAChB,GAAG,CAAS;IACZ,KAAK,CAAY;IAElC,YAAY,UAA6B,EAAE;QACzC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAA;QACpD,IAAI,CAAC,KAAK,GAAG,IAAI,wBAAS,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,iBAAS,EAAE,CAAC,UAAU,CAAC,CAAA;QAC5E,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,IAAA,wBAAgB,GAAE,CAAC,CAAA;QAC3E,IAAI,CAAC,KAAK,GAAG,IAAI,kBAAU,CAAC,OAAO,CAAC,KAAK,IAAI,0BAAkB,CAAC,CAAA;IAClE,CAAC;IAED,MAAM,CAAC,cAAc,CACnB,OAAyB,EACzB,SAAkB,EAClB,UAAmB;QAEnB,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,OAAO,GAAG,YAAY,WAAW,CAAA;QACnC,CAAC;QACD,OAAO,GAAG,YAAY,UAAU,SAAS,IAAI,UAAU,EAAE,CAAA;IAC3D,CAAC;IAED,YAAY,CAAC,aAAqB;QAChC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;IAC9C,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IACtC,CAAC;IAED,aAAa;QACX,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IAClC,CAAC;IAED,aAAa,CAAC,SAAiB,EAAE,UAAkB,EAAE,aAAqB;QACxE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,SAAS,IAAI,UAAU,EAAE,EAAE,aAAa,CAAC,CAAA;IACtE,CAAC;IAED,WAAW,CAAC,SAAiB,EAAE,UAAkB;QAC/C,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,SAAS,IAAI,UAAU,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,cAAc,CAAC,SAAiB,EAAE,UAAkB;QAClD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,SAAS,IAAI,UAAU,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED,iBAAiB,CAAC,KAAa;QAC7B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,CAAA;IAC3C,CAAC;IAED,eAAe;QACb,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IAC3C,CAAC;IAED,kBAAkB;QAChB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;IACvC,CAAC;IAED,0BAA0B;IAC1B,EAAE;IACF,6EAA6E;IAC7E,4EAA4E;IAC5E,+EAA+E;IAC/E,yDAAyD;IACzD,4DAA4D;IAC5D,8DAA8D;IAE9D,oBAAoB,CAAC,MAAc;QACjC,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YAC3D,gCAAgC;YAChC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,EAAE,OAAO,IAAI,MAAM,CAAC,CAAA;YAC5D,oCAAoC;YACpC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAA;QACjD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,yBAAyB,EAAE,MAAM,CAAC,CAAA;QACtD,CAAC;IACH,CAAC;IAED,kBAAkB;QAChB,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAA;QACrD,CAAC;QAED,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,CAAC,EAAE,IAAI,EAAE,CAAA;QAClE,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC;gBAAE,OAAO,QAAQ,CAAA;YACpD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC3C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAA;YAChF,CAAC;YACD,OAAO,OAAO,CAAA;QAChB,CAAC;QAED,sCAAsC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAA;QAC3D,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAChC,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,EAAE,MAAM,CAAC,CAAA;YACjD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAA;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,qBAAqB;QACnB,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAA;QAC9C,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAA;IACjD,CAAC;IAED,6DAA6D;IAC7D,2BAA2B;QACzB,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAA;IAClC,CAAC;IAED,+BAA+B;IAC/B,uBAAuB;QACrB,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,YAAY,CAAA;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAA;QAC7D,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,OAAO,QAAQ,CAAA;QAC9B,OAAO,IAAI,CAAC,kBAAkB,EAAE;YAC9B,CAAC,CAAC,GAAG,QAAQ,UAAU;YACvB,CAAC,CAAC,GAAG,QAAQ,yBAAyB,CAAA;IAC1C,CAAC;IAED,6CAA6C;IACrC,kBAAkB;QACxB,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAA;QACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,CAAC,EAAE,IAAI,EAAE,CAAA;QAClE,IAAI,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QACpD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,yBAAyB,CAAC,KAAK,IAAI,CAAA;IAC9D,CAAC;IAED,wDAAwD;IAEhD,UAAU,CAAC,OAAe,EAAE,GAAW;QAC7C,OAAO,OAAO,OAAO,IAAI,GAAG,EAAE,CAAA;IAChC,CAAC;IAED,cAAc,CAAC,OAAe,EAAE,GAAW,EAAE,KAAa;QACxD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAA;IACzD,CAAC;IAED,YAAY,CAAC,OAAe,EAAE,GAAW;QACvC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;IACzD,CAAC;IAED,eAAe,CAAC,OAAe,EAAE,GAAW;QAC1C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;IACrD,CAAC;CACF;AA7JD,gCA6JC"}

package/dist/identity/secret-store.d.ts

@@ -0,0 +1,27 @@
+/** 秘密の値の保存先。account は保存先の中での名前。 */
+export interface SecretStore {
+    get(account: string): string | null;
+    set(account: string, value: string): void;
+    delete(account: string): void;
+}
+/**
+ * OS のキーチェーン (macOS Keychain / Windows 資格情報マネージャー / Linux Secret Service)。
+ * 🔴 Linux で Secret Service が無いとカーネルのメモリ (keyutils) に黙って切り替わり、再起動で消える。
+ */
+export declare class KeychainStore implements SecretStore {
+    private readonly service;
+    constructor(service: string);
+    get(account: string): string | null;
+    set(account: string, value: string): void;
+    delete(account: string): void;
+}
+/** `<dir>/<account>` に平文で置く。ディレクトリは 0700、ファイルは 0600。 */
+export declare class FileStore implements SecretStore {
+    private readonly dir;
+    constructor(dir: string);
+    pathOf(account: string): string;
+    get(account: string): string | null;
+    set(account: string, value: string): void;
+    delete(account: string): void;
+}
+//# sourceMappingURL=secret-store.d.ts.map

package/dist/identity/secret-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store.d.ts","sourceRoot":"","sources":["../../src/identity/secret-store.ts"],"names":[],"mappings":"AAKA,mCAAmC;AACnC,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IACnC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACzC,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B;AAED;;;GAGG;AACH,qBAAa,aAAc,YAAW,WAAW;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,MAAM;IAE5C,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAQnC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAIzC,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;CAO9B;AAID,wDAAwD;AACxD,qBAAa,SAAU,YAAW,WAAW;IAC/B,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,MAAM;IAExC,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAO/B,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAQnC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAiBzC,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;CAG9B"}

package/dist/identity/secret-store.js

@@ -0,0 +1,113 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FileStore = exports.KeychainStore = void 0;
+const crypto_1 = require("crypto");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const keyring_1 = require("@napi-rs/keyring");
+/**
+ * OS のキーチェーン (macOS Keychain / Windows 資格情報マネージャー / Linux Secret Service)。
+ * 🔴 Linux で Secret Service が無いとカーネルのメモリ (keyutils) に黙って切り替わり、再起動で消える。
+ */
+class KeychainStore {
+    service;
+    constructor(service) {
+        this.service = service;
+    }
+    get(account) {
+        try {
+            return new keyring_1.Entry(this.service, account).getPassword();
+        }
+        catch {
+            return null;
+        }
+    }
+    set(account, value) {
+        new keyring_1.Entry(this.service, account).setPassword(value);
+    }
+    delete(account) {
+        try {
+            new keyring_1.Entry(this.service, account).deletePassword();
+        }
+        catch {
+            // Doesn't exist, ignore
+        }
+    }
+}
+exports.KeychainStore = KeychainStore;
+const ACCOUNT_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+/** `<dir>/<account>` に平文で置く。ディレクトリは 0700、ファイルは 0600。 */
+class FileStore {
+    dir;
+    constructor(dir) {
+        this.dir = dir;
+    }
+    pathOf(account) {
+        if (!ACCOUNT_PATTERN.test(account)) {
+            throw new Error(`Invalid secret name: "${account}"`);
+        }
+        return path.join(this.dir, account);
+    }
+    get(account) {
+        try {
+            return fs.readFileSync(this.pathOf(account), 'utf-8');
+        }
+        catch {
+            return null;
+        }
+    }
+    set(account, value) {
+        const target = this.pathOf(account);
+        fs.mkdirSync(this.dir, { recursive: true, mode: 0o700 });
+        // mkdir の mode は umask を受け、既存ディレクトリには効かない
+        fs.chmodSync(this.dir, 0o700);
+        // 一時ファイルは毎回新規に作る (wx)。既存ファイルやリンクを経由すると 0600 が効かない
+        const tmp = `${target}.${process.pid}.${(0, crypto_1.randomBytes)(6).toString('hex')}.tmp`;
+        try {
+            fs.writeFileSync(tmp, value, { encoding: 'utf-8', mode: 0o600, flag: 'wx' });
+            fs.renameSync(tmp, target);
+        }
+        catch (err) {
+            fs.rmSync(tmp, { force: true });
+            throw err;
+        }
+    }
+    delete(account) {
+        fs.rmSync(this.pathOf(account), { force: true });
+    }
+}
+exports.FileStore = FileStore;
+//# sourceMappingURL=secret-store.js.map

package/dist/identity/secret-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store.js","sourceRoot":"","sources":["../../src/identity/secret-store.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,mCAAoC;AACpC,uCAAwB;AACxB,2CAA4B;AAC5B,8CAAwC;AASxC;;;GAGG;AACH,MAAa,aAAa;IACK;IAA7B,YAA6B,OAAe;QAAf,YAAO,GAAP,OAAO,CAAQ;IAAG,CAAC;IAEhD,GAAG,CAAC,OAAe;QACjB,IAAI,CAAC;YACH,OAAO,IAAI,eAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAA;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,GAAG,CAAC,OAAe,EAAE,KAAa;QAChC,IAAI,eAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;IACrD,CAAC;IAED,MAAM,CAAC,OAAe;QACpB,IAAI,CAAC;YACH,IAAI,eAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,cAAc,EAAE,CAAA;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;CACF;AAtBD,sCAsBC;AAED,MAAM,eAAe,GAAG,8BAA8B,CAAA;AAEtD,wDAAwD;AACxD,MAAa,SAAS;IACS;IAA7B,YAA6B,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;IAAG,CAAC;IAE5C,MAAM,CAAC,OAAe;QACpB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,GAAG,CAAC,CAAA;QACtD,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IACrC,CAAC;IAED,GAAG,CAAC,OAAe;QACjB,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAA;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,GAAG,CAAC,OAAe,EAAE,KAAa;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACnC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACxD,0CAA0C;QAC1C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAE7B,kDAAkD;QAClD,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,OAAO,CAAC,GAAG,IAAI,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAA;QAC5E,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YAC5E,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YAC/B,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED,MAAM,CAAC,OAAe;QACpB,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAClD,CAAC;CACF;AAtCD,8BAsCC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vess-id/vess",
-  "version": "0.0.0-dev-20260917031855",
+  "version": "0.0.0-dev-20261006110812",
   "description": "VESS local AI agent runtime — manages agent identity, permissions, and execution boundaries",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -15,7 +15,7 @@
     "better-sqlite3": "^11.10.0",
     "commander": "^12.1.0",
     "zod": "^3.25.76",
-    "@vess-id/ai-identity": "0.0.0-dev-20260917031855"
+    "@vess-id/ai-identity": "0.0.0-dev-20261006110812"
   },
   "optionalDependencies": {
     "node-mac-auth": "^1.1.0"