vaultkeeper 0.5.2 → 0.5.3

package/dist/index.d.cts

@@ -647,7 +647,13 @@ declare class VaultKeeper {
      * Runs doctor checks (unless skipped), loads config, and sets up the key manager.
      */
     static init(options?: VaultKeeperOptions): Promise<VaultKeeper>;
-    /** Run doctor checks without full initialization. */
+    /**
+     * Run doctor checks without full initialization.
+     *
+     * Uses conservative platform defaults — all platform-native dependency
+     * checks are treated as required regardless of any backend configuration.
+     * For config-aware scoping, call `runDoctor({ backends })` directly.
+     */
     static doctor(): Promise<PreflightResult>;
     /**
      * Retrieve a secret from the backend and return a JWE token that encapsulates it.
@@ -813,6 +819,18 @@ type Platform = 'darwin' | 'win32' | 'linux';
 interface RunDoctorOptions {
     /** Override the platform detection (useful for testing). */
     platform?: Platform;
+    /**
+     * When provided, doctor checks are scoped to the given backends.
+     * Platform-native dependency checks (e.g. `secret-tool`, `security`,
+     * `powershell`) are demoted from required to optional when the
+     * corresponding backend is not enabled. Plugin tool checks (`op`,
+     * `ykman`) are promoted from optional to required when their backend
+     * (`1password`, `yubikey`) is explicitly enabled.
+     *
+     * When omitted, all platform-default checks are treated as required
+     * (backward-compatible behavior).
+     */
+    backends?: BackendConfig[];
 }
 /**
  * Run all platform-appropriate preflight checks and aggregate the results.

package/dist/index.d.ts

@@ -647,7 +647,13 @@ declare class VaultKeeper {
      * Runs doctor checks (unless skipped), loads config, and sets up the key manager.
      */
     static init(options?: VaultKeeperOptions): Promise<VaultKeeper>;
-    /** Run doctor checks without full initialization. */
+    /**
+     * Run doctor checks without full initialization.
+     *
+     * Uses conservative platform defaults — all platform-native dependency
+     * checks are treated as required regardless of any backend configuration.
+     * For config-aware scoping, call `runDoctor({ backends })` directly.
+     */
     static doctor(): Promise<PreflightResult>;
     /**
      * Retrieve a secret from the backend and return a JWE token that encapsulates it.
@@ -813,6 +819,18 @@ type Platform = 'darwin' | 'win32' | 'linux';
 interface RunDoctorOptions {
     /** Override the platform detection (useful for testing). */
     platform?: Platform;
+    /**
+     * When provided, doctor checks are scoped to the given backends.
+     * Platform-native dependency checks (e.g. `secret-tool`, `security`,
+     * `powershell`) are demoted from required to optional when the
+     * corresponding backend is not enabled. Plugin tool checks (`op`,
+     * `ykman`) are promoted from optional to required when their backend
+     * (`1password`, `yubikey`) is explicitly enabled.
+     *
+     * When omitted, all platform-default checks are treated as required
+     * (backward-compatible behavior).
+     */
+    backends?: BackendConfig[];
 }
 /**
  * Run all platform-appropriate preflight checks and aggregate the results.

package/dist/index.js

@@ -2261,7 +2261,8 @@ async function runDoctor(options) {
       nextSteps: ["Unsupported platform. vaultkeeper supports macOS, Linux, and Windows."]
     };
   }
-  const entries = buildCheckList(platform);
+  const enabledTypes = enabledBackendTypes(options?.backends);
+  const entries = buildCheckList(platform, enabledTypes);
   const resolved = await Promise.all(
     entries.map(async ({ check, required }) => {
       const result = await check();
@@ -2295,19 +2296,42 @@ async function runDoctor(options) {
   const checks = resolved.map(({ result }) => result);
   return { checks, ready, warnings, nextSteps };
 }
-function buildCheckList(platform) {
+function enabledBackendTypes(backends) {
+  if (backends === void 0) return null;
+  const types = /* @__PURE__ */ new Set();
+  for (const b of backends) {
+    if (b.enabled) types.add(b.type);
+  }
+  return types;
+}
+function buildCheckList(platform, enabledTypes) {
   const entries = [{ check: checkOpenssl, required: true }];
   if (platform === "darwin") {
-    entries.push({ check: checkSecurity, required: true });
+    entries.push({
+      check: checkSecurity,
+      required: enabledTypes === null || enabledTypes.has("keychain")
+    });
     entries.push({ check: checkBash, required: false });
   } else if (platform === "win32") {
-    entries.push({ check: checkPowershell, required: true });
+    entries.push({
+      check: checkPowershell,
+      required: enabledTypes === null || enabledTypes.has("dpapi")
+    });
   } else {
     entries.push({ check: checkBash, required: true });
-    entries.push({ check: checkSecretTool, required: true });
+    entries.push({
+      check: checkSecretTool,
+      required: enabledTypes === null || enabledTypes.has("secret-tool")
+    });
   }
-  entries.push({ check: checkOp, required: false });
-  entries.push({ check: checkYkman, required: false });
+  entries.push({
+    check: checkOp,
+    required: enabledTypes?.has("1password") ?? false
+  });
+  entries.push({
+    check: checkYkman,
+    required: enabledTypes?.has("yubikey") ?? false
+  });
   return entries;
 }
 
@@ -2329,23 +2353,29 @@ var VaultKeeper = class _VaultKeeper {
    * Runs doctor checks (unless skipped), loads config, and sets up the key manager.
    */
   static async init(options) {
+    const configDir = options?.configDir ?? getDefaultConfigDir();
+    const config = options?.config ?? await loadConfig(configDir);
     if (options?.skipDoctor !== true) {
-      const doctorResult = await runDoctor();
+      const doctorResult = await runDoctor({ backends: config.backends });
       if (!doctorResult.ready) {
         throw new VaultError(
           `System not ready: ${doctorResult.nextSteps.join("; ")}`
         );
       }
     }
-    const configDir = options?.configDir ?? getDefaultConfigDir();
-    const config = options?.config ?? await loadConfig(configDir);
     const keyManager = new KeyManager();
     await keyManager.init();
     const vault = new _VaultKeeper(config, keyManager, configDir);
     vault.#backend = vault.#resolveBackend();
     return vault;
   }
-  /** Run doctor checks without full initialization. */
+  /**
+   * Run doctor checks without full initialization.
+   *
+   * Uses conservative platform defaults — all platform-native dependency
+   * checks are treated as required regardless of any backend configuration.
+   * For config-aware scoping, call `runDoctor({ backends })` directly.
+   */
   static async doctor() {
     return runDoctor();
   }