secretless-ai 0.9.2 → 0.10.1

package/README.md

@@ -1,10 +1,12 @@
-> **[OpenA2A](https://github.com/opena2a-org/opena2a)**: [HackMyAgent](https://github.com/opena2a-org/hackmyagent) · [ABG](https://github.com/opena2a-org/AI-BrowserGuard) · [AIM](https://github.com/opena2a-org/agent-identity-management) · [OASB](https://github.com/opena2a-org/oasb) · [ARP](https://github.com/opena2a-org/arp) · [DVAA](https://github.com/opena2a-org/damn-vulnerable-ai-agent)
+> **[OpenA2A](https://github.com/opena2a-org)**: [CLI](https://github.com/opena2a-org/opena2a) · [HackMyAgent](https://github.com/opena2a-org/hackmyagent) · [AIM](https://github.com/opena2a-org/agent-identity-management) · [Browser Guard](https://github.com/opena2a-org/AI-BrowserGuard) · [DVAA](https://github.com/opena2a-org/damn-vulnerable-ai-agent) · [Registry](https://registry.opena2a.org)
 
 # Secretless AI
 
 [![npm version](https://img.shields.io/npm/v/secretless-ai.svg)](https://www.npmjs.com/package/secretless-ai)
 [![License: Apache-2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
 
+Every AI coding assistant in your terminal can read `~/.aws/credentials`, `echo $OPENAI_API_KEY`, and access any secret on your machine. Secretless makes secrets invisible to AI context without changing your workflow.
+
 One command to keep secrets out of AI LLMs. Works with Claude Code, Cursor, Copilot, Windsurf, Cline, and Aider.
 
 ```bash
@@ -24,6 +26,7 @@ Secretless stores secrets in your choice of backend. Secrets are never in enviro
 | `local` | AES-256-GCM encrypted file | None (single machine) | Filesystem | Quick start, simple setups |
 | `keychain` | macOS Keychain / Linux Secret Service | Device-local | OS login | Native OS integration |
 | `1password` | 1Password vault | Cross-device | Biometric (Touch ID) / Service Account | Teams, CI/CD, multi-device |
+| `vault` | HashiCorp Vault KV v2 | Cross-device / cluster | Vault token | Enterprise, self-hosted, team secrets |
 
 ```bash
 npx secretless-ai backend                     # Show available backends
@@ -51,6 +54,56 @@ npx secretless-ai backend set 1password       # Switch backend
 
 **CI/CD:** Set `OP_SERVICE_ACCOUNT_TOKEN` — same secrets, no code changes. No desktop app needed.
 
+### HashiCorp Vault Backend
+
+Stores secrets in a Vault KV v2 engine using the HTTP API. Zero SDK dependency — raw `fetch` calls.
+
+**Setup:**
+
+```bash
+brew install vault                            # Install Vault CLI
+vault server -dev                             # Start dev server (for testing)
+```
+
+```bash
+export VAULT_ADDR=http://127.0.0.1:8200
+export VAULT_TOKEN=<your-token>
+npx secretless-ai backend set vault           # Switch backend
+npx secretless-ai secret set DB_PASSWORD=...  # Stored in Vault KV v2
+```
+
+Supports custom mount paths via backend config. Default mount: `secret`.
+
+## Credential Scope Discovery
+
+Credentials are not static — their effective permissions change when platforms evolve. Secretless detects when a credential's scope expands beyond its baseline, catching privilege escalation before it becomes a breach.
+
+```bash
+npx secretless-ai scope discover MY_CREDENTIAL   # Discover current permissions, save baseline
+npx secretless-ai scope check MY_CREDENTIAL      # Compare to baseline, report drift
+npx secretless-ai scope list                      # Show all baselines
+npx secretless-ai scope reset MY_CREDENTIAL      # Clear baseline
+```
+
+### Supported Providers
+
+| Provider | Detection | API Used | Permissions Needed |
+|----------|-----------|----------|-------------------|
+| **GCP** | Service account key JSON | `testIamPermissions` (Cloud Resource Manager) | None (self-inspection) |
+| **Vault** | Token prefix (`hvs.`, `s.`) | `capabilities-self` (Sys) | None (self-inspection) |
+| **AWS** | Access key prefix (`AKIA`) | Planned | — |
+
+### How It Works
+
+1. Auto-detects the provider from credential format
+2. Calls the provider's self-inspection API to discover current permissions
+3. Compares against the stored baseline (`~/.secretless-ai/scope-baselines.json`)
+4. Reports added/removed permissions and flags scope expansion
+
+### Broker Integration
+
+Add `scopeCheck: true` to any broker policy rule. The broker will block credential access if the credential's scope has expanded beyond its baseline.
+
 ## Secret Management
 
 Store, list, and inject secrets without exposing them to AI tools.
@@ -289,10 +342,21 @@ npx secretless-ai hook uninstall     # Remove pre-commit hook
 | `mcp-unprotect` | Restore original MCP configs |
 | **Backend Management** | |
 | `backend` | Show current backend status |
-| `backend set <TYPE>` | Set backend (local, keychain, 1password) |
+| `backend set <TYPE>` | Set backend (local, keychain, 1password, vault) |
 | `backend list` | List all stored entries |
 | `backend purge [--prefix] [--yes]` | Delete entries from backend |
 | `migrate --from TYPE --to TYPE` | Migrate secrets between backends |
+| **Scope Discovery** | |
+| `scope discover <NAME>` | Discover credential permissions and save baseline |
+| `scope check <NAME>` | Compare current permissions to baseline |
+| `scope list` | Show all scope baselines |
+| `scope reset <NAME>` | Clear a scope baseline |
+| **Shell Integration** | |
+| `env [--only K1,K2]` | Output export statements for stored secrets (use with `eval`) |
+| `scan-staged` | Scan git staged files for secrets (used by pre-commit hook) |
+| **Cache Management** | |
+| `cache clear` | Clear the encrypted secret cache |
+| `cache ttl [DURATION]` | Show or set cache TTL (e.g., `5m`, `1h`, `off`) |
 
 ## Usage via OpenA2A CLI
 
@@ -316,6 +380,44 @@ opena2a broker start       # Start the credential broker daemon
 opena2a broker status      # Check broker daemon status and connected agents
 ```
 
+**Policy example** -- define rules in `~/.secretless-ai/broker-policies.json`:
+
+```json
+{
+  "rules": [
+    {
+      "id": "scan-agents-read-github",
+      "agentSelector": "scan-*",
+      "credentialSelector": "GITHUB_*",
+      "effect": "allow",
+      "constraints": {
+        "minTrustScore": 0.7,
+        "rateLimit": { "maxPerMinute": 10 },
+        "scopeCheck": true
+      }
+    },
+    {
+      "id": "deny-all-production-keys",
+      "agentSelector": "*",
+      "credentialSelector": "PROD_*",
+      "effect": "deny",
+      "constraints": {}
+    }
+  ]
+}
+```
+
+The policy engine is default-deny: deny rules are evaluated first, then allow rules. All constraints must pass for an allow rule to grant access. Supported constraints include `minTrustScore` (AIM trust score), `rateLimit`, `timeWindow`, `requireCapability`, and `scopeCheck` (blocks access if a credential's scope has expanded beyond its baseline).
+
+**Request flow:**
+
+1. `opena2a broker start` -- starts the broker daemon on a local socket
+2. An agent requests a credential (e.g., `GITHUB_TOKEN`)
+3. The broker verifies the agent's AIM identity token
+4. The policy engine evaluates the request against loaded rules
+5. If allowed, the broker resolves the secret from the configured backend and returns it
+6. If denied, the broker returns an error and logs the attempt to the audit log
+
 ### Data Loss Prevention (DLP)
 
 DLP commands scan AI tool transcripts (conversation logs, shell history, tool output) for accidentally leaked credentials. If an API key, token, or connection string appears in a transcript, DLP flags it so you can rotate the exposed credential.
@@ -325,6 +427,41 @@ opena2a dlp scan           # Scan AI tool transcripts for leaked credentials
 opena2a dlp report         # Generate a DLP report with findings and remediation steps
 ```
 
+**Example output from `opena2a dlp scan`:**
+
+```
+  DLP Transcript Scan
+
+  Scanning 3 transcript(s)...
+
+  ! claude-code/2026-03-01-project-setup.jsonl
+      Line 142: AWS Access Key (AKIA...) — AKIA2EXAMPLE7XRQWZ
+      Line 307: Stripe Secret Key (sk_live_...) — sk_live_51J3Example
+
+  ! cursor/composer-history.json
+      Line 89: GitHub PAT (ghp_...) — ghp_A1b2C3ExampleToken
+
+  3 leaked credential(s) found in 2 transcript(s).
+
+  Rotate these credentials immediately — they have been sent to
+  an external API as part of the AI conversation context.
+```
+
+Each finding shows the transcript file, line number, credential type, and a truncated value preview. The `opena2a dlp report` command generates a structured report with remediation steps for each finding.
+
+### Cross-Product Integration
+
+Secretless connects to the wider OpenA2A ecosystem at multiple levels:
+
+| Entry Point | Command | What It Does |
+|-------------|---------|--------------|
+| Standalone | `npx secretless-ai init` | Protect AI tool context, manage secrets, encrypt MCP configs |
+| Credential drift | `opena2a protect` | Detect when credential scopes expand beyond their baselines |
+| Credential brokering | `opena2a broker start` | Identity-aware secret injection for AI agents via AIM tokens |
+| Leak detection | `opena2a dlp scan` | Scan transcripts and shell history for exposed credentials |
+
+Each layer builds on the previous one. Start with `secretless-ai init` for immediate protection, then add drift detection, brokering, and DLP as your agent deployment grows.
+
 ### When to Use Which Interface
 
 | Use Case | Command |
@@ -356,7 +493,7 @@ For Claude Code, Secretless installs a PreToolUse hook that intercepts every `Re
 
 ```bash
 npm run build      # Compile TypeScript to dist/
-npm test           # Run tests (vitest, 461 tests)
+npm test           # Run tests (vitest, 638 tests)
 npm run dev        # Watch mode — recompile on file changes
 npm run clean      # Remove dist/ directory
 ```
@@ -376,11 +513,12 @@ Secretless has zero runtime dependencies.
 
 | Project | Description | Install |
 |---------|-------------|---------|
-| [**AIM**](https://github.com/opena2a-org/agent-identity-management) | Agent Identity Management -- identity and access control for AI agents | `pip install aim-sdk` |
-| [**HackMyAgent**](https://github.com/opena2a-org/hackmyagent) | Security scanner -- 147 checks, attack mode, auto-fix | `npx hackmyagent secure` |
-| [**OASB**](https://github.com/opena2a-org/oasb) | Open Agent Security Benchmark -- 182 attack scenarios | `npm install @opena2a/oasb` |
-| [**ARP**](https://github.com/opena2a-org/arp) | Agent Runtime Protection -- process, network, filesystem monitoring | `npm install @opena2a/arp` |
-| [**DVAA**](https://github.com/opena2a-org/damn-vulnerable-ai-agent) | Damn Vulnerable AI Agent -- security training and red-teaming | `docker pull opena2a/dvaa` |
+| [**OpenA2A CLI**](https://github.com/opena2a-org/opena2a) | Unified security CLI -- orchestrates all OpenA2A tools | `npx opena2a` |
+| [**HackMyAgent**](https://github.com/opena2a-org/hackmyagent) | Security scanner and red-team toolkit -- checks, attack mode, benchmarks, runtime protection | `npx hackmyagent secure` |
+| [**AIM**](https://github.com/opena2a-org/agent-identity-management) | Agent Identity Management -- identity, access control, and trust scoring for AI agents | Self-hosted |
+| [**AI Browser Guard**](https://github.com/opena2a-org/AI-BrowserGuard) | Browser agent detection and control -- 4-layer detection, delegation engine | Chrome Web Store |
+| [**DVAA**](https://github.com/opena2a-org/damn-vulnerable-ai-agent) | Damn Vulnerable AI Agent -- security training target | `docker pull opena2a/dvaa` |
+| [**Registry**](https://registry.opena2a.org) | Trust registry -- agent discovery, trust scores, supply chain verification | `registry.opena2a.org` |
 
 ## License
 

package/dist/backends/config.d.ts

@@ -5,7 +5,7 @@
  * Resolution priority: explicit CLI flag > config file > default ('local').
  */
 /** Writable backend types that can be selected by the user. */
-export type SelectableBackendType = 'local' | 'keychain' | '1password';
+export type SelectableBackendType = 'local' | 'keychain' | '1password' | 'vault';
 /** Default cache TTL: 5 minutes (in seconds). */
 export declare const DEFAULT_CACHE_TTL_SECONDS = 300;
 /** Read the current backend configuration. Returns undefined if no config file exists. */

package/dist/backends/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/backends/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,+DAA+D;AAC/D,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,UAAU,GAAG,WAAW,CAAC;AAKvE,iDAAiD;AACjD,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAiB7C,0FAA0F;AAC1F,wBAAgB,iBAAiB,IAAI,qBAAqB,GAAG,SAAS,CAWrE;AAED,uDAAuD;AACvD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAiBvE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,qBAAqB,CAK/E;AAED,+EAA+E;AAC/E,wBAAgB,YAAY,IAAI,MAAM,CAWrC;AAED,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAiBtD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAmBnD;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAMjD"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/backends/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,+DAA+D;AAC/D,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,UAAU,GAAG,WAAW,GAAG,OAAO,CAAC;AAKjF,iDAAiD;AACjD,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAiB7C,0FAA0F;AAC1F,wBAAgB,iBAAiB,IAAI,qBAAqB,GAAG,SAAS,CAWrE;AAED,uDAAuD;AACvD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAiBvE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,qBAAqB,CAK/E;AAED,+EAA+E;AAC/E,wBAAgB,YAAY,IAAI,MAAM,CAWrC;AAED,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAiBtD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAmBnD;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAMjD"}

package/dist/backends/config.js

@@ -65,7 +65,7 @@ function readBackendConfig() {
     try {
         const raw = fs.readFileSync(configPath(), 'utf-8');
         const config = JSON.parse(raw);
-        if (config.backend === 'local' || config.backend === 'keychain' || config.backend === '1password') {
+        if (config.backend === 'local' || config.backend === 'keychain' || config.backend === '1password' || config.backend === 'vault') {
             return config.backend;
         }
         return undefined;
@@ -98,7 +98,7 @@ function writeBackendConfig(backend) {
  * Priority: explicit flag > config file > default ('local').
  */
 function resolveBackendType(explicitFlag) {
-    if (explicitFlag === 'local' || explicitFlag === 'keychain' || explicitFlag === '1password') {
+    if (explicitFlag === 'local' || explicitFlag === 'keychain' || explicitFlag === '1password' || explicitFlag === 'vault') {
         return explicitFlag;
     }
     return readBackendConfig() ?? DEFAULT_BACKEND;

package/dist/backends/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/backends/config.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BH,8CAWC;AAGD,gDAiBC;AAOD,gDAKC;AAGD,oCAWC;AAGD,sCAiBC;AAOD,sCAmBC;AAKD,8BAMC;AA/ID,uCAAyB;AACzB,2CAA6B;AAM7B,MAAM,eAAe,GAAG,aAAa,CAAC;AACtC,MAAM,eAAe,GAA0B,OAAO,CAAC;AAEvD,iDAAiD;AACpC,QAAA,yBAAyB,GAAG,GAAG,CAAC;AAQ7C,SAAS,SAAS;IAChB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,MAAM,CAAC;IACnE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,eAAe,CAAC,CAAC;AACjD,CAAC;AAED,0FAA0F;AAC1F,SAAgB,iBAAiB;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;QACnD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,UAAU,IAAI,MAAM,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;YAClG,OAAO,MAAM,CAAC,OAAO,CAAC;QACxB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,uDAAuD;AACvD,SAAgB,kBAAkB,CAAC,OAA8B;IAC/D,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEpD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,IAAI,MAAM,GAAqB,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACzC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;IACrD,CAAC;IAED,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,CAAC;IAC5B,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,YAAqB;IACtD,IAAI,YAAY,KAAK,OAAO,IAAI,YAAY,KAAK,UAAU,IAAI,YAAY,KAAK,WAAW,EAAE,CAAC;QAC5F,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,OAAO,iBAAiB,EAAE,IAAI,eAAe,CAAC;AAChD,CAAC;AAED,+EAA+E;AAC/E,SAAgB,YAAY;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;QACnD,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC;YAChE,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QACD,OAAO,iCAAyB,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,iCAAyB,CAAC;IACnC,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,SAAgB,aAAa,CAAC,UAAkB;IAC9C,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEpD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,IAAI,MAAM,GAAqB,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACzC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;IACrD,CAAC;IAED,MAAM,CAAC,QAAQ,GAAG,UAAU,CAAC;IAC7B,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,CAAC;IAC5B,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,KAAa;IACzC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,CAAC,CAAC;IAEnD,wBAAwB;IACxB,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAExD,gBAAgB;IAChB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,CAAC;IAEtB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACtC,QAAQ,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACjB,KAAK,GAAG,CAAC,CAAC,OAAO,MAAM,CAAC;QACxB,KAAK,GAAG,CAAC,CAAC,OAAO,MAAM,GAAG,EAAE,CAAC;QAC7B,KAAK,GAAG,CAAC,CAAC,OAAO,MAAM,GAAG,IAAI,CAAC;QAC/B,KAAK,GAAG,CAAC,CAAC,OAAO,MAAM,GAAG,KAAK,CAAC;QAChC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,SAAS,CAAC,OAAe;IACvC,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,OAAO,GAAG,EAAE;QAAE,OAAO,GAAG,OAAO,GAAG,CAAC;IACvC,IAAI,OAAO,GAAG,IAAI;QAAE,OAAO,GAAG,OAAO,GAAG,EAAE,GAAG,CAAC;IAC9C,IAAI,OAAO,GAAG,KAAK;QAAE,OAAO,GAAG,OAAO,GAAG,IAAI,GAAG,CAAC;IACjD,OAAO,GAAG,OAAO,GAAG,KAAK,GAAG,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/backends/config.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BH,8CAWC;AAGD,gDAiBC;AAOD,gDAKC;AAGD,oCAWC;AAGD,sCAiBC;AAOD,sCAmBC;AAKD,8BAMC;AA/ID,uCAAyB;AACzB,2CAA6B;AAM7B,MAAM,eAAe,GAAG,aAAa,CAAC;AACtC,MAAM,eAAe,GAA0B,OAAO,CAAC;AAEvD,iDAAiD;AACpC,QAAA,yBAAyB,GAAG,GAAG,CAAC;AAQ7C,SAAS,SAAS;IAChB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,MAAM,CAAC;IACnE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,eAAe,CAAC,CAAC;AACjD,CAAC;AAED,0FAA0F;AAC1F,SAAgB,iBAAiB;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;QACnD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,UAAU,IAAI,MAAM,CAAC,OAAO,KAAK,WAAW,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YAChI,OAAO,MAAM,CAAC,OAAO,CAAC;QACxB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,uDAAuD;AACvD,SAAgB,kBAAkB,CAAC,OAA8B;IAC/D,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEpD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,IAAI,MAAM,GAAqB,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACzC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;IACrD,CAAC;IAED,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,CAAC;IAC5B,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,YAAqB;IACtD,IAAI,YAAY,KAAK,OAAO,IAAI,YAAY,KAAK,UAAU,IAAI,YAAY,KAAK,WAAW,IAAI,YAAY,KAAK,OAAO,EAAE,CAAC;QACxH,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,OAAO,iBAAiB,EAAE,IAAI,eAAe,CAAC;AAChD,CAAC;AAED,+EAA+E;AAC/E,SAAgB,YAAY;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;QACnD,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC;YAChE,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QACD,OAAO,iCAAyB,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,iCAAyB,CAAC;IACnC,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,SAAgB,aAAa,CAAC,UAAkB;IAC9C,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEpD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,IAAI,MAAM,GAAqB,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACzC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;IACrD,CAAC;IAED,MAAM,CAAC,QAAQ,GAAG,UAAU,CAAC;IAC7B,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,CAAC;IAC5B,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,KAAa;IACzC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,CAAC,CAAC;IAEnD,wBAAwB;IACxB,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAExD,gBAAgB;IAChB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,CAAC;IAEtB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACtC,QAAQ,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACjB,KAAK,GAAG,CAAC,CAAC,OAAO,MAAM,CAAC;QACxB,KAAK,GAAG,CAAC,CAAC,OAAO,MAAM,GAAG,EAAE,CAAC;QAC7B,KAAK,GAAG,CAAC,CAAC,OAAO,MAAM,GAAG,IAAI,CAAC;QAC/B,KAAK,GAAG,CAAC,CAAC,OAAO,MAAM,GAAG,KAAK,CAAC;QAChC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,SAAS,CAAC,OAAe;IACvC,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,OAAO,GAAG,EAAE;QAAE,OAAO,GAAG,OAAO,GAAG,CAAC;IACvC,IAAI,OAAO,GAAG,IAAI;QAAE,OAAO,GAAG,OAAO,GAAG,EAAE,GAAG,CAAC;IAC9C,IAAI,OAAO,GAAG,KAAK;QAAE,OAAO,GAAG,OAAO,GAAG,IAAI,GAAG,CAAC;IACjD,OAAO,GAAG,OAAO,GAAG,KAAK,GAAG,CAAC;AAC/B,CAAC"}

package/dist/backends/factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../src/backends/factory.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAEtD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,qBAAqB,EAC3B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,qBAAqB,CAwBvB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAgC/F;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAwBhF"}
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../src/backends/factory.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAEtD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,qBAAqB,EAC3B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,qBAAqB,CA4BvB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAgC/F;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAwBhF"}

package/dist/backends/factory.js

@@ -14,6 +14,7 @@ const local_1 = require("./local");
 const keychain_macos_1 = require("./keychain-macos");
 const keychain_linux_1 = require("./keychain-linux");
 const onepassword_1 = require("./onepassword");
+const vault_1 = require("./vault");
 const cache_1 = require("./cache");
 const config_1 = require("./config");
 /**
@@ -31,6 +32,9 @@ function createBackend(type, config) {
         case '1password':
             backend = new onepassword_1.OnePasswordBackend(config);
             break;
+        case 'vault':
+            backend = new vault_1.VaultBackend(config);
+            break;
         case 'local':
         default:
             // Local backend uses file-based encryption — no OS prompts, no cache needed

package/dist/backends/factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"factory.js","sourceRoot":"","sources":["../../src/backends/factory.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAiBH,sCA2BC;AAMD,kDAgCC;AAMD,wDAwBC;AA9GD,mCAAuC;AACvC,qDAAwD;AACxD,qDAAwD;AACxD,+CAAmD;AACnD,mCAAwC;AACxC,qCAAwC;AAIxC;;;;;GAKG;AACH,SAAgB,aAAa,CAC3B,IAA2B,EAC3B,MAAgC;IAEhC,IAAI,OAA8B,CAAC;IAEnC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU;YACb,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM;QAER,KAAK,WAAW;YACd,OAAO,GAAG,IAAI,gCAAkB,CAAC,MAAM,CAAC,CAAC;YACzC,MAAM;QAER,KAAK,OAAO,CAAC;QACb;YACE,4EAA4E;YAC5E,OAAO,IAAI,oBAAY,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,kFAAkF;IAClF,MAAM,UAAU,GAAG,IAAA,qBAAY,GAAE,CAAC;IAClC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,IAAI,qBAAa,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAElC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;YAClD,YAAY,CAAC,UAAU,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAClE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;QACxF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC;QAC9F,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;YAClD,YAAY,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1D,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC;QAC5G,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,4FAA4F;aACtG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,mCAAmC,QAAQ,kCAAkC;KACvF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,sBAAsB;IACpC,IAAI,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;QAClD,YAAY,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,qFAAqF;SAC/F,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;QAClD,YAAY,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9E,OAAO;YACL,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,2CAA2C;SACrD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,6FAA6F;SACvG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAgC;IAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAElC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,IAAI,qCAAoB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,IAAI,qCAAoB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,2DAA2D;IAC3D,OAAO,CAAC,KAAK,CACX,4CAA4C,QAAQ,4CAA4C,CACjG,CAAC;IACF,OAAO,IAAI,oBAAY,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC"}
+{"version":3,"file":"factory.js","sourceRoot":"","sources":["../../src/backends/factory.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAkBH,sCA+BC;AAMD,kDAgCC;AAMD,wDAwBC;AAnHD,mCAAuC;AACvC,qDAAwD;AACxD,qDAAwD;AACxD,+CAAmD;AACnD,mCAAuC;AACvC,mCAAwC;AACxC,qCAAwC;AAIxC;;;;;GAKG;AACH,SAAgB,aAAa,CAC3B,IAA2B,EAC3B,MAAgC;IAEhC,IAAI,OAA8B,CAAC;IAEnC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU;YACb,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM;QAER,KAAK,WAAW;YACd,OAAO,GAAG,IAAI,gCAAkB,CAAC,MAAM,CAAC,CAAC;YACzC,MAAM;QAER,KAAK,OAAO;YACV,OAAO,GAAG,IAAI,oBAAY,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM;QAER,KAAK,OAAO,CAAC;QACb;YACE,4EAA4E;YAC5E,OAAO,IAAI,oBAAY,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,kFAAkF;IAClF,MAAM,UAAU,GAAG,IAAA,qBAAY,GAAE,CAAC;IAClC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,IAAI,qBAAa,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAElC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;YAClD,YAAY,CAAC,UAAU,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAClE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;QACxF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC;QAC9F,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;YAClD,YAAY,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1D,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC;QAC5G,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,4FAA4F;aACtG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,mCAAmC,QAAQ,kCAAkC;KACvF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,sBAAsB;IACpC,IAAI,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;QAClD,YAAY,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,qFAAqF;SAC/F,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;QAClD,YAAY,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9E,OAAO;YACL,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,2CAA2C;SACrD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,6FAA6F;SACvG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAgC;IAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAElC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,IAAI,qCAAoB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,IAAI,qCAAoB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,2DAA2D;IAC3D,OAAO,CAAC,KAAK,CACX,4CAA4C,QAAQ,4CAA4C,CACjG,CAAC;IACF,OAAO,IAAI,oBAAY,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC"}

package/dist/backends/index.d.ts

@@ -2,6 +2,7 @@ export type { SecretBackend, WritableSecretBackend, BackendHealth, BackendConfig
 export { LocalBackend } from './local';
 export { MacOSKeychainBackend } from './keychain-macos';
 export { LinuxKeychainBackend } from './keychain-linux';
+export { VaultBackend, type VaultBackendConfig } from './vault';
 export { createBackend, isKeychainAvailable } from './factory';
 export { readBackendConfig, writeBackendConfig, resolveBackendType, readCacheTtl, writeCacheTtl, parseDuration, formatTtl, DEFAULT_CACHE_TTL_SECONDS, type SelectableBackendType } from './config';
 export { CachedBackend, clearCacheFile } from './cache';

package/dist/backends/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/backends/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AACjI,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,yBAAyB,EAAE,KAAK,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACnM,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,KAAK,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/backends/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AACjI,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,KAAK,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,yBAAyB,EAAE,KAAK,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACnM,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,KAAK,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC"}

package/dist/backends/index.js

@@ -1,12 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.migrateSecrets = exports.clearCacheFile = exports.CachedBackend = exports.DEFAULT_CACHE_TTL_SECONDS = exports.formatTtl = exports.parseDuration = exports.writeCacheTtl = exports.readCacheTtl = exports.resolveBackendType = exports.writeBackendConfig = exports.readBackendConfig = exports.isKeychainAvailable = exports.createBackend = exports.LinuxKeychainBackend = exports.MacOSKeychainBackend = exports.LocalBackend = void 0;
+exports.migrateSecrets = exports.clearCacheFile = exports.CachedBackend = exports.DEFAULT_CACHE_TTL_SECONDS = exports.formatTtl = exports.parseDuration = exports.writeCacheTtl = exports.readCacheTtl = exports.resolveBackendType = exports.writeBackendConfig = exports.readBackendConfig = exports.isKeychainAvailable = exports.createBackend = exports.VaultBackend = exports.LinuxKeychainBackend = exports.MacOSKeychainBackend = exports.LocalBackend = void 0;
 var local_1 = require("./local");
 Object.defineProperty(exports, "LocalBackend", { enumerable: true, get: function () { return local_1.LocalBackend; } });
 var keychain_macos_1 = require("./keychain-macos");
 Object.defineProperty(exports, "MacOSKeychainBackend", { enumerable: true, get: function () { return keychain_macos_1.MacOSKeychainBackend; } });
 var keychain_linux_1 = require("./keychain-linux");
 Object.defineProperty(exports, "LinuxKeychainBackend", { enumerable: true, get: function () { return keychain_linux_1.LinuxKeychainBackend; } });
+var vault_1 = require("./vault");
+Object.defineProperty(exports, "VaultBackend", { enumerable: true, get: function () { return vault_1.VaultBackend; } });
 var factory_1 = require("./factory");
 Object.defineProperty(exports, "createBackend", { enumerable: true, get: function () { return factory_1.createBackend; } });
 Object.defineProperty(exports, "isKeychainAvailable", { enumerable: true, get: function () { return factory_1.isKeychainAvailable; } });

package/dist/backends/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/backends/index.ts"],"names":[],"mappings":";;;AACA,iCAAuC;AAA9B,qGAAA,YAAY,OAAA;AACrB,mDAAwD;AAA/C,sHAAA,oBAAoB,OAAA;AAC7B,mDAAwD;AAA/C,sHAAA,oBAAoB,OAAA;AAC7B,qCAA+D;AAAtD,wGAAA,aAAa,OAAA;AAAE,8GAAA,mBAAmB,OAAA;AAC3C,mCAAmM;AAA1L,2GAAA,iBAAiB,OAAA;AAAE,4GAAA,kBAAkB,OAAA;AAAE,4GAAA,kBAAkB,OAAA;AAAE,sGAAA,YAAY,OAAA;AAAE,uGAAA,aAAa,OAAA;AAAE,uGAAA,aAAa,OAAA;AAAE,mGAAA,SAAS,OAAA;AAAE,mHAAA,yBAAyB,OAAA;AACpJ,iCAAwD;AAA/C,sGAAA,aAAa,OAAA;AAAE,uGAAA,cAAc,OAAA;AACtC,qCAAoF;AAA3E,yGAAA,cAAc,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/backends/index.ts"],"names":[],"mappings":";;;AACA,iCAAuC;AAA9B,qGAAA,YAAY,OAAA;AACrB,mDAAwD;AAA/C,sHAAA,oBAAoB,OAAA;AAC7B,mDAAwD;AAA/C,sHAAA,oBAAoB,OAAA;AAC7B,iCAAgE;AAAvD,qGAAA,YAAY,OAAA;AACrB,qCAA+D;AAAtD,wGAAA,aAAa,OAAA;AAAE,8GAAA,mBAAmB,OAAA;AAC3C,mCAAmM;AAA1L,2GAAA,iBAAiB,OAAA;AAAE,4GAAA,kBAAkB,OAAA;AAAE,4GAAA,kBAAkB,OAAA;AAAE,sGAAA,YAAY,OAAA;AAAE,uGAAA,aAAa,OAAA;AAAE,uGAAA,aAAa,OAAA;AAAE,mGAAA,SAAS,OAAA;AAAE,mHAAA,yBAAyB,OAAA;AACpJ,iCAAwD;AAA/C,sGAAA,aAAa,OAAA;AAAE,uGAAA,cAAc,OAAA;AACtC,qCAAoF;AAA3E,yGAAA,cAAc,OAAA"}

package/dist/backends/keychain-linux.d.ts

@@ -21,6 +21,7 @@ export declare class LinuxKeychainBackend implements WritableSecretBackend {
     resolve(secretPath: string): Promise<Record<string, string>>;
     delete(key: string): Promise<boolean>;
     healthCheck(): Promise<BackendHealth>;
+    private lookupSecret;
     private readIndex;
     private writeIndex;
 }

package/dist/backends/keychain-linux.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keychain-linux.d.ts","sourceRoot":"","sources":["../../src/backends/keychain-linux.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAKpE,qBAAa,oBAAqB,YAAW,qBAAqB;IAChE,QAAQ,CAAC,IAAI,oBAAoB;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAOtC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBhD,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAwB5D,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAmBrC,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC;IAkB3C,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,UAAU;CAKnB"}
+{"version":3,"file":"keychain-linux.d.ts","sourceRoot":"","sources":["../../src/backends/keychain-linux.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAcpE,qBAAa,oBAAqB,YAAW,qBAAqB;IAChE,QAAQ,CAAC,IAAI,oBAAoB;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAOtC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiChD,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAkB5D,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoCrC,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC;IAkB3C,OAAO,CAAC,YAAY;IAapB,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,UAAU;CAKnB"}

package/dist/backends/keychain-linux.js

@@ -51,8 +51,16 @@ exports.LinuxKeychainBackend = void 0;
 const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-const SERVICE_NAME = 'secretless';
+const LEGACY_SERVICE_NAME = 'secretless';
 const INDEX_FILENAME = 'keychain-index.json';
+/**
+ * Derive a per-key service name so password managers show a descriptive
+ * name instead of "secretless" for every entry.
+ */
+function serviceNameFor(key) {
+    const lastSegment = key.split('/').pop() ?? key;
+    return `Secretless: ${lastSegment}`;
+}
 class LinuxKeychainBackend {
     constructor(config) {
         this.name = 'keychain-linux';
@@ -62,11 +70,23 @@ class LinuxKeychainBackend {
         this.indexPath = path.join(storeDir, INDEX_FILENAME);
     }
     async store(key, value) {
+        const svc = serviceNameFor(key);
+        // Delete legacy entry to prevent duplicates
+        try {
+            (0, child_process_1.execFileSync)('secret-tool', [
+                'clear',
+                'service', LEGACY_SERVICE_NAME,
+                'account', key,
+            ], { stdio: 'pipe' });
+        }
+        catch {
+            // No legacy entry — that's fine
+        }
         // secret-tool store reads the value from stdin
         (0, child_process_1.execFileSync)('secret-tool', [
             'store',
-            '--label=secretless',
-            'service', SERVICE_NAME,
+            `--label=Secretless: ${key}`,
+            'service', svc,
             'account', key,
         ], {
             input: value,
@@ -84,38 +104,47 @@ class LinuxKeychainBackend {
         const matchingKeys = index.filter(k => k === secretPath || k.startsWith(secretPath + '/'));
         const results = {};
         for (const key of matchingKeys) {
-            try {
-                const value = (0, child_process_1.execFileSync)('secret-tool', [
-                    'lookup',
-                    'service', SERVICE_NAME,
-                    'account', key,
-                ], { stdio: ['pipe', 'pipe', 'pipe'], encoding: 'utf-8' }).trimEnd();
-                if (value) {
-                    results[key] = value;
-                }
-            }
-            catch {
-                // Key was in index but not in keyring — skip
+            // Try new per-key service name first, fall back to legacy
+            const value = this.lookupSecret(serviceNameFor(key), key)
+                ?? this.lookupSecret(LEGACY_SERVICE_NAME, key);
+            if (value) {
+                results[key] = value;
             }
         }
         return results;
     }
     async delete(key) {
+        let deleted = false;
+        // Delete new-format entry
+        try {
+            (0, child_process_1.execFileSync)('secret-tool', [
+                'clear',
+                'service', serviceNameFor(key),
+                'account', key,
+            ], { stdio: 'pipe' });
+            deleted = true;
+        }
+        catch {
+            // Not found with new service name
+        }
+        // Also delete legacy entry if it exists
         try {
             (0, child_process_1.execFileSync)('secret-tool', [
                 'clear',
-                'service', SERVICE_NAME,
+                'service', LEGACY_SERVICE_NAME,
                 'account', key,
             ], { stdio: 'pipe' });
-            // Remove from index
+            deleted = true;
+        }
+        catch {
+            // No legacy entry
+        }
+        if (deleted) {
             const index = this.readIndex();
             const filtered = index.filter(k => k !== key);
             this.writeIndex(filtered);
-            return true;
-        }
-        catch {
-            return false;
         }
+        return deleted;
     }
     async healthCheck() {
         const start = Date.now();
@@ -135,6 +164,19 @@ class LinuxKeychainBackend {
             };
         }
     }
+    lookupSecret(service, account) {
+        try {
+            const value = (0, child_process_1.execFileSync)('secret-tool', [
+                'lookup',
+                'service', service,
+                'account', account,
+            ], { stdio: ['pipe', 'pipe', 'pipe'], encoding: 'utf-8' }).trimEnd();
+            return value || null;
+        }
+        catch {
+            return null;
+        }
+    }
     readIndex() {
         try {
             const raw = fs.readFileSync(this.indexPath, 'utf-8');

package/dist/backends/keychain-linux.js.map

@@ -1 +1 @@
-{"version":3,"file":"keychain-linux.js","sourceRoot":"","sources":["../../src/backends/keychain-linux.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,iDAA6C;AAC7C,uCAAyB;AACzB,2CAA6B;AAG7B,MAAM,YAAY,GAAG,YAAY,CAAC;AAClC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAE7C,MAAa,oBAAoB;IAI/B,YAAY,MAAgC;QAHnC,SAAI,GAAG,gBAAgB,CAAC;QAI/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC;QACxC,MAAM,QAAQ,GAAI,MAAM,EAAE,QAAmB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC5F,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,KAAa;QACpC,+CAA+C;QAC/C,IAAA,4BAAY,EAAC,aAAa,EAAE;YAC1B,OAAO;YACP,oBAAoB;YACpB,SAAS,EAAE,YAAY;YACvB,SAAS,EAAE,GAAG;SACf,EAAE;YACD,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,eAAe;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,UAAkB;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,GAAG,GAAG,CAAC,CACxD,CAAC;QAEF,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAA,4BAAY,EAAC,aAAa,EAAE;oBACxC,QAAQ;oBACR,SAAS,EAAE,YAAY;oBACvB,SAAS,EAAE,GAAG;iBACf,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;gBACrE,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBACvB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,6CAA6C;YAC/C,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC;YACH,IAAA,4BAAY,EAAC,aAAa,EAAE;gBAC1B,OAAO;gBACP,SAAS,EAAE,YAAY;gBACvB,SAAS,EAAE,GAAG;aACf,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAEtB,oBAAoB;YACpB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAE1B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,IAAA,4BAAY,EAAC,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1D,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC7B,OAAO,EAAE,8CAA8C;aACxD,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC7B,OAAO,EAAE,4FAA4F;aACtG,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,SAAS;QACf,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,IAAc;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;QACxC,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;CACF;AA3GD,oDA2GC"}
+{"version":3,"file":"keychain-linux.js","sourceRoot":"","sources":["../../src/backends/keychain-linux.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,iDAA6C;AAC7C,uCAAyB;AACzB,2CAA6B;AAG7B,MAAM,mBAAmB,GAAG,YAAY,CAAC;AACzC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAE7C;;;GAGG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC;IAChD,OAAO,eAAe,WAAW,EAAE,CAAC;AACtC,CAAC;AAED,MAAa,oBAAoB;IAI/B,YAAY,MAAgC;QAHnC,SAAI,GAAG,gBAAgB,CAAC;QAI/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC;QACxC,MAAM,QAAQ,GAAI,MAAM,EAAE,QAAmB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC5F,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,KAAa;QACpC,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAEhC,4CAA4C;QAC5C,IAAI,CAAC;YACH,IAAA,4BAAY,EAAC,aAAa,EAAE;gBAC1B,OAAO;gBACP,SAAS,EAAE,mBAAmB;gBAC9B,SAAS,EAAE,GAAG;aACf,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QAED,+CAA+C;QAC/C,IAAA,4BAAY,EAAC,aAAa,EAAE;YAC1B,OAAO;YACP,uBAAuB,GAAG,EAAE;YAC5B,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf,EAAE;YACD,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,eAAe;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,UAAkB;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,GAAG,GAAG,CAAC,CACxD,CAAC;QAEF,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,0DAA0D;YAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC;mBACpD,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;YACjD,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACvB,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,0BAA0B;QAC1B,IAAI,CAAC;YACH,IAAA,4BAAY,EAAC,aAAa,EAAE;gBAC1B,OAAO;gBACP,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC;gBAC9B,SAAS,EAAE,GAAG;aACf,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACtB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC;YACH,IAAA,4BAAY,EAAC,aAAa,EAAE;gBAC1B,OAAO;gBACP,SAAS,EAAE,mBAAmB;gBAC9B,SAAS,EAAE,GAAG;aACf,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACtB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,IAAA,4BAAY,EAAC,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1D,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC7B,OAAO,EAAE,8CAA8C;aACxD,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC7B,OAAO,EAAE,4FAA4F;aACtG,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,OAAe,EAAE,OAAe;QACnD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAA,4BAAY,EAAC,aAAa,EAAE;gBACxC,QAAQ;gBACR,SAAS,EAAE,OAAO;gBAClB,SAAS,EAAE,OAAO;aACnB,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACrE,OAAO,KAAK,IAAI,IAAI,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,SAAS;QACf,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,IAAc;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;QACxC,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;CACF;AAhJD,oDAgJC"}

package/dist/backends/keychain-macos.d.ts

@@ -19,6 +19,7 @@ export declare class MacOSKeychainBackend implements WritableSecretBackend {
     resolve(secretPath: string): Promise<Record<string, string>>;
     delete(key: string): Promise<boolean>;
     healthCheck(): Promise<BackendHealth>;
+    private findPassword;
     private readIndex;
     private writeIndex;
 }

package/dist/backends/keychain-macos.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keychain-macos.d.ts","sourceRoot":"","sources":["../../src/backends/keychain-macos.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,KAAK,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AA0BpE,qBAAa,oBAAqB,YAAW,qBAAqB;IAChE,QAAQ,CAAC,IAAI,oBAAoB;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAOtC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA6BhD,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAuB5D,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAmBrC,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC;IAkB3C,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,UAAU;CAKnB"}
+{"version":3,"file":"keychain-macos.d.ts","sourceRoot":"","sources":["../../src/backends/keychain-macos.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,KAAK,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAuCpE,qBAAa,oBAAqB,YAAW,qBAAqB;IAChE,QAAQ,CAAC,IAAI,oBAAoB;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAOtC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA0ChD,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAkB5D,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoCrC,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC;IAkB3C,OAAO,CAAC,YAAY;IAapB,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,UAAU;CAKnB"}