vaultkeeper 0.7.0 → 0.8.0

package/dist/index.d.cts

@@ -527,6 +527,34 @@ declare class FilesystemError extends VaultError {
 declare class RotationInProgressError extends VaultError {
     constructor(message: string);
 }
+/**
+ * Thrown when a test-only double — a class built purely to fabricate a
+ * vaultkeeper-internal signal (e.g. a granted presence check, an unlocked
+ * backend) for driving negative test cases — refuses to construct because it
+ * detected it is running outside a test environment.
+ *
+ * @remarks
+ * A fabricated signal is, by construction, exactly the thing a real
+ * deployment must never be able to forge. A loud, typed refusal at
+ * construction time is the last of several stacked guards keeping such a
+ * double unreachable from production — see, for example,
+ * `PresenceSimulatorBackend` in `@vaultkeeper/test-helpers`. Inspect
+ * {@link TestDoubleMisuseError.doubleName} for which class refused to
+ * construct and {@link TestDoubleMisuseError.detectedEnvironment} for the
+ * environment value that triggered the refusal.
+ *
+ * @public
+ */
+declare class TestDoubleMisuseError extends VaultError {
+    /** The name of the test double class that refused to construct. */
+    readonly doubleName: string;
+    /**
+     * The environment value (e.g. `process.env.NODE_ENV`) that triggered the
+     * refusal.
+     */
+    readonly detectedEnvironment: string;
+    constructor(message: string, doubleName: string, detectedEnvironment: string);
+}
 
 /**
  * Shared types and interfaces for vaultkeeper.
@@ -2128,4 +2156,4 @@ declare function platformNativeBackendType(): string;
  */
 declare function loadConfig(configDir?: string): Promise<VaultConfig>;
 
-export { AccessorConsumedError, AuthorizationDeniedError, type BackendCapabilities, type BackendConfig, type BackendFactory, BackendLockedError, BackendRegistry, type BackendSetupFactory, BackendUnavailableError, CapabilityToken, ConfigParseError, ConfigValidationError, DecryptionError, DeviceNotPresentError, ExecError, type ExecRequest, type ExecResult, ExecutableTrustRequiredError, type ExecutableTrustStatus, FetchError, type FetchRequest, FilesystemError, IdentityMismatchError, InvalidAlgorithmError, InvalidKeyMaterialError, InvalidTokenError, KeyRevokedError, KeyRotatedError, type KeyStatus, type ListableBackend, NotCapableError, type Platform, PluginNotFoundError, type PreflightCheck, type PreflightCheckError, type PreflightCheckErrorKind, type PreflightCheckStatus, type PreflightResult, type PresenceCapableBackend, PresenceDeclinedError, type PresenceOperation, type PresenceRequirementOptions, PresenceTimeoutError, REDACTED, RotationInProgressError, type RunDoctorOptions, type ScopedPreflightCheck, type SecretAccessor, type SecretBackend, SecretNotFoundError, type SecretTokenMap, type SetupChoice, SetupError, type SetupOptions, type SetupOptionsBase, type SetupQuestion, type SetupResult, type SignRequest, type SignResult, type SigningAlgorithm, type SigningBackend, SigningKeyAlreadyExistsError, SigningKeyNotFoundError, SigningNotSupportedError, type SigningPublicKey, TokenExpiredError, TokenRevokedError, type TrustTier, UnknownBackendTypeError, UsageLimitExceededError, type VaultConfig, VaultError, VaultKeeper, type VaultKeeperOptions, type VaultResponse, type VerifyRequest, defaultBackendType, getBackendCapabilities, getDefaultConfigDir, getPlatformDefaultConfigDir, isListableBackend, isPresenceCapableBackend, isSigningBackend, loadConfig, platformNativeBackendType, redactSecrets, runDoctor };
+export { AccessorConsumedError, AuthorizationDeniedError, type BackendCapabilities, type BackendConfig, type BackendFactory, BackendLockedError, BackendRegistry, type BackendSetupFactory, BackendUnavailableError, CapabilityToken, ConfigParseError, ConfigValidationError, DecryptionError, DeviceNotPresentError, ExecError, type ExecRequest, type ExecResult, ExecutableTrustRequiredError, type ExecutableTrustStatus, FetchError, type FetchRequest, FilesystemError, IdentityMismatchError, InvalidAlgorithmError, InvalidKeyMaterialError, InvalidTokenError, KeyRevokedError, KeyRotatedError, type KeyStatus, type ListableBackend, NotCapableError, type Platform, PluginNotFoundError, type PreflightCheck, type PreflightCheckError, type PreflightCheckErrorKind, type PreflightCheckStatus, type PreflightResult, type PresenceCapableBackend, PresenceDeclinedError, type PresenceOperation, type PresenceRequirementOptions, PresenceTimeoutError, REDACTED, RotationInProgressError, type RunDoctorOptions, type ScopedPreflightCheck, type SecretAccessor, type SecretBackend, SecretNotFoundError, type SecretTokenMap, type SetupChoice, SetupError, type SetupOptions, type SetupOptionsBase, type SetupQuestion, type SetupResult, type SignRequest, type SignResult, type SigningAlgorithm, type SigningBackend, SigningKeyAlreadyExistsError, SigningKeyNotFoundError, SigningNotSupportedError, type SigningPublicKey, TestDoubleMisuseError, TokenExpiredError, TokenRevokedError, type TrustTier, UnknownBackendTypeError, UsageLimitExceededError, type VaultConfig, VaultError, VaultKeeper, type VaultKeeperOptions, type VaultResponse, type VerifyRequest, defaultBackendType, getBackendCapabilities, getDefaultConfigDir, getPlatformDefaultConfigDir, isListableBackend, isPresenceCapableBackend, isSigningBackend, loadConfig, platformNativeBackendType, redactSecrets, runDoctor };

package/dist/index.d.ts

@@ -527,6 +527,34 @@ declare class FilesystemError extends VaultError {
 declare class RotationInProgressError extends VaultError {
     constructor(message: string);
 }
+/**
+ * Thrown when a test-only double — a class built purely to fabricate a
+ * vaultkeeper-internal signal (e.g. a granted presence check, an unlocked
+ * backend) for driving negative test cases — refuses to construct because it
+ * detected it is running outside a test environment.
+ *
+ * @remarks
+ * A fabricated signal is, by construction, exactly the thing a real
+ * deployment must never be able to forge. A loud, typed refusal at
+ * construction time is the last of several stacked guards keeping such a
+ * double unreachable from production — see, for example,
+ * `PresenceSimulatorBackend` in `@vaultkeeper/test-helpers`. Inspect
+ * {@link TestDoubleMisuseError.doubleName} for which class refused to
+ * construct and {@link TestDoubleMisuseError.detectedEnvironment} for the
+ * environment value that triggered the refusal.
+ *
+ * @public
+ */
+declare class TestDoubleMisuseError extends VaultError {
+    /** The name of the test double class that refused to construct. */
+    readonly doubleName: string;
+    /**
+     * The environment value (e.g. `process.env.NODE_ENV`) that triggered the
+     * refusal.
+     */
+    readonly detectedEnvironment: string;
+    constructor(message: string, doubleName: string, detectedEnvironment: string);
+}
 
 /**
  * Shared types and interfaces for vaultkeeper.
@@ -2128,4 +2156,4 @@ declare function platformNativeBackendType(): string;
  */
 declare function loadConfig(configDir?: string): Promise<VaultConfig>;
 
-export { AccessorConsumedError, AuthorizationDeniedError, type BackendCapabilities, type BackendConfig, type BackendFactory, BackendLockedError, BackendRegistry, type BackendSetupFactory, BackendUnavailableError, CapabilityToken, ConfigParseError, ConfigValidationError, DecryptionError, DeviceNotPresentError, ExecError, type ExecRequest, type ExecResult, ExecutableTrustRequiredError, type ExecutableTrustStatus, FetchError, type FetchRequest, FilesystemError, IdentityMismatchError, InvalidAlgorithmError, InvalidKeyMaterialError, InvalidTokenError, KeyRevokedError, KeyRotatedError, type KeyStatus, type ListableBackend, NotCapableError, type Platform, PluginNotFoundError, type PreflightCheck, type PreflightCheckError, type PreflightCheckErrorKind, type PreflightCheckStatus, type PreflightResult, type PresenceCapableBackend, PresenceDeclinedError, type PresenceOperation, type PresenceRequirementOptions, PresenceTimeoutError, REDACTED, RotationInProgressError, type RunDoctorOptions, type ScopedPreflightCheck, type SecretAccessor, type SecretBackend, SecretNotFoundError, type SecretTokenMap, type SetupChoice, SetupError, type SetupOptions, type SetupOptionsBase, type SetupQuestion, type SetupResult, type SignRequest, type SignResult, type SigningAlgorithm, type SigningBackend, SigningKeyAlreadyExistsError, SigningKeyNotFoundError, SigningNotSupportedError, type SigningPublicKey, TokenExpiredError, TokenRevokedError, type TrustTier, UnknownBackendTypeError, UsageLimitExceededError, type VaultConfig, VaultError, VaultKeeper, type VaultKeeperOptions, type VaultResponse, type VerifyRequest, defaultBackendType, getBackendCapabilities, getDefaultConfigDir, getPlatformDefaultConfigDir, isListableBackend, isPresenceCapableBackend, isSigningBackend, loadConfig, platformNativeBackendType, redactSecrets, runDoctor };
+export { AccessorConsumedError, AuthorizationDeniedError, type BackendCapabilities, type BackendConfig, type BackendFactory, BackendLockedError, BackendRegistry, type BackendSetupFactory, BackendUnavailableError, CapabilityToken, ConfigParseError, ConfigValidationError, DecryptionError, DeviceNotPresentError, ExecError, type ExecRequest, type ExecResult, ExecutableTrustRequiredError, type ExecutableTrustStatus, FetchError, type FetchRequest, FilesystemError, IdentityMismatchError, InvalidAlgorithmError, InvalidKeyMaterialError, InvalidTokenError, KeyRevokedError, KeyRotatedError, type KeyStatus, type ListableBackend, NotCapableError, type Platform, PluginNotFoundError, type PreflightCheck, type PreflightCheckError, type PreflightCheckErrorKind, type PreflightCheckStatus, type PreflightResult, type PresenceCapableBackend, PresenceDeclinedError, type PresenceOperation, type PresenceRequirementOptions, PresenceTimeoutError, REDACTED, RotationInProgressError, type RunDoctorOptions, type ScopedPreflightCheck, type SecretAccessor, type SecretBackend, SecretNotFoundError, type SecretTokenMap, type SetupChoice, SetupError, type SetupOptions, type SetupOptionsBase, type SetupQuestion, type SetupResult, type SignRequest, type SignResult, type SigningAlgorithm, type SigningBackend, SigningKeyAlreadyExistsError, SigningKeyNotFoundError, SigningNotSupportedError, type SigningPublicKey, TestDoubleMisuseError, TokenExpiredError, TokenRevokedError, type TrustTier, UnknownBackendTypeError, UsageLimitExceededError, type VaultConfig, VaultError, VaultKeeper, type VaultKeeperOptions, type VaultResponse, type VerifyRequest, defaultBackendType, getBackendCapabilities, getDefaultConfigDir, getPlatformDefaultConfigDir, isListableBackend, isPresenceCapableBackend, isSigningBackend, loadConfig, platformNativeBackendType, redactSecrets, runDoctor };

package/dist/index.js

@@ -448,6 +448,21 @@ var RotationInProgressError = class extends VaultError {
     this.name = "RotationInProgressError";
   }
 };
+var TestDoubleMisuseError = class extends VaultError {
+  /** The name of the test double class that refused to construct. */
+  doubleName;
+  /**
+   * The environment value (e.g. `process.env.NODE_ENV`) that triggered the
+   * refusal.
+   */
+  detectedEnvironment;
+  constructor(message, doubleName, detectedEnvironment) {
+    super(message);
+    this.name = "TestDoubleMisuseError";
+    this.doubleName = doubleName;
+    this.detectedEnvironment = detectedEnvironment;
+  }
+};
 
 // src/backend/registry.ts
 var BackendRegistry = class {
@@ -1366,13 +1381,19 @@ var DpapiBackend = class {
     const entryPath = getEntryPath2(storageDir, id);
     const script = [
       "Add-Type -AssemblyName System.Security",
-      `$bytes = [System.Text.Encoding]::UTF8.GetBytes(${JSON.stringify(secret)})`,
+      "$b64 = [Console]::In.ReadToEnd()",
+      "$bytes = [System.Convert]::FromBase64String($b64.Trim())",
       "$entropy = $null",
       "$scope = [System.Security.Cryptography.DataProtectionScope]::CurrentUser",
       "$encrypted = [System.Security.Cryptography.ProtectedData]::Protect($bytes, $entropy, $scope)",
       `[System.IO.File]::WriteAllBytes(${JSON.stringify(entryPath)}, $encrypted)`
     ].join("; ");
-    await execCommand("powershell", ["-NoProfile", "-Command", script]);
+    const secretBuf = Buffer.from(secret, "utf8");
+    const stdinPayload = secretBuf.toString("base64");
+    secretBuf.fill(0);
+    await execCommand("powershell", ["-NoProfile", "-Command", script], {
+      stdin: stdinPayload
+    });
   }
   async retrieve(id) {
     const storageDir = this.#storageDir;
@@ -1429,6 +1450,9 @@ var DpapiBackend = class {
 // src/backend/secret-tool-backend.ts
 var ATTRIBUTE_KEY = "vaultkeeper-id";
 var LABEL_PREFIX = "vaultkeeper: ";
+function stripSecretToolTrailingNewline(stdout) {
+  return stdout.endsWith("\n") ? stdout.slice(0, -1) : stdout;
+}
 var SecretToolBackend = class {
   type = "secret-tool";
   displayName = "Linux Secret Service (secret-tool)";
@@ -1445,29 +1469,29 @@ var SecretToolBackend = class {
   }
   async store(id, secret) {
     const label = `${LABEL_PREFIX}${id}`;
-    await execCommand("secret-tool", ["store", "--label", label, ATTRIBUTE_KEY, id], {
+    await execCommand("secret-tool", ["store", "--label", label, "--", ATTRIBUTE_KEY, id], {
       stdin: secret
     });
   }
   async retrieve(id) {
-    const result = await execCommandFull("secret-tool", ["lookup", ATTRIBUTE_KEY, id]);
-    if (result.exitCode !== 0 || result.stdout.trim() === "") {
+    const result = await execCommandFull("secret-tool", ["lookup", "--", ATTRIBUTE_KEY, id]);
+    if (result.exitCode !== 0) {
       throw new SecretNotFoundError(`Secret not found in Secret Service: ${id}`);
     }
-    return result.stdout.trim();
+    return stripSecretToolTrailingNewline(result.stdout);
   }
   async delete(id) {
-    const result = await execCommandFull("secret-tool", ["clear", ATTRIBUTE_KEY, id]);
+    const result = await execCommandFull("secret-tool", ["clear", "--", ATTRIBUTE_KEY, id]);
     if (result.exitCode !== 0) {
       throw new SecretNotFoundError(`Secret not found in Secret Service: ${id}`);
     }
   }
   async exists(id) {
-    const result = await execCommandFull("secret-tool", ["lookup", ATTRIBUTE_KEY, id]);
-    return result.exitCode === 0 && result.stdout.trim() !== "";
+    const result = await execCommandFull("secret-tool", ["lookup", "--", ATTRIBUTE_KEY, id]);
+    return result.exitCode === 0;
   }
   async list() {
-    const result = await execCommandFull("secret-tool", ["search", ATTRIBUTE_KEY, ""]);
+    const result = await execCommandFull("secret-tool", ["search", "--", ATTRIBUTE_KEY, ""]);
     if (result.exitCode !== 0) {
       return [];
     }
@@ -2925,11 +2949,16 @@ async function createToken(key, claims, options) {
 function isObject2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function isLeasePresence(value) {
+  if (!isObject2(value)) return false;
+  const { op, at, method, backend } = value;
+  return typeof op === "string" && typeof at === "number" && typeof method === "string" && typeof backend === "string";
+}
 function parseVaultClaims(raw) {
   if (!isObject2(raw)) {
     return void 0;
   }
-  const { jti, exp, iat, sub, exe, use, tid, bkd, val, ref } = raw;
+  const { jti, exp, iat, sub, exe, use, tid, bkd, val, ref, kty, kid, kgen, pres } = raw;
   if (typeof jti !== "string") return void 0;
   if (typeof exp !== "number") return void 0;
   if (typeof iat !== "number") return void 0;
@@ -2937,10 +2966,29 @@ function parseVaultClaims(raw) {
   if (typeof exe !== "string") return void 0;
   if (use !== null && typeof use !== "number") return void 0;
   if (tid !== 1 && tid !== 2 && tid !== 3) return void 0;
-  if (typeof bkd !== "string") return void 0;
-  if (typeof val !== "string") return void 0;
+  if (bkd !== void 0 && typeof bkd !== "string") return void 0;
+  if (val !== void 0 && typeof val !== "string") return void 0;
   if (typeof ref !== "string") return void 0;
-  return { jti, exp, iat, sub, exe, use: use ?? null, tid, bkd, val, ref };
+  if (kty !== void 0 && kty !== "secret" && kty !== "signing-key") return void 0;
+  if (kid !== void 0 && typeof kid !== "string") return void 0;
+  if (kgen !== void 0 && typeof kgen !== "number") return void 0;
+  if (pres !== void 0 && !isLeasePresence(pres)) return void 0;
+  return {
+    jti,
+    exp,
+    iat,
+    sub,
+    exe,
+    use: use ?? null,
+    tid,
+    bkd,
+    val,
+    ref,
+    kty,
+    kid,
+    kgen,
+    pres
+  };
 }
 async function decryptToken(key, jwe) {
   let plaintext;
@@ -3021,15 +3069,44 @@ function validateClaims(claims, usedCount = 0) {
   if (claims.exe.trim() === "") {
     throw new VaultError("Invalid token: exe must not be empty");
   }
-  if (claims.bkd.trim() === "") {
-    throw new VaultError("Invalid token: bkd must not be empty");
-  }
-  if (claims.val.trim() === "") {
-    throw new VaultError("Invalid token: val must not be empty");
-  }
   if (claims.ref.trim() === "") {
     throw new VaultError("Invalid token: ref must not be empty");
   }
+  switch (claims.kty) {
+    case "signing-key": {
+      if (claims.val !== void 0) {
+        throw new VaultError("Invalid token: signing lease must not carry a val");
+      }
+      if (claims.kid === void 0 || claims.kid.trim() === "") {
+        throw new VaultError("Invalid token: kid must not be empty");
+      }
+      if (claims.kgen === void 0) {
+        throw new VaultError("Invalid token: kgen is required for a signing lease");
+      }
+      if (!Number.isSafeInteger(claims.kgen) || claims.kgen < 0) {
+        throw new VaultError("Invalid token: kgen must be a non-negative integer");
+      }
+      break;
+    }
+    case "secret":
+    case void 0: {
+      if (claims.bkd === void 0 || claims.bkd.trim() === "") {
+        throw new VaultError("Invalid token: bkd must not be empty");
+      }
+      if (claims.val === void 0 || claims.val.trim() === "") {
+        throw new VaultError("Invalid token: val must not be empty");
+      }
+      if (claims.kid !== void 0 || claims.kgen !== void 0 || claims.pres !== void 0) {
+        throw new VaultError(
+          "Invalid token: secret claim must not carry signing-lease fields (kid/kgen/pres)"
+        );
+      }
+      break;
+    }
+    default: {
+      throw new VaultError(`Invalid token: unrecognized claim kind kty=${String(claims.kty)}`);
+    }
+  }
   if (claims.iat > claims.exp) {
     throw new VaultError("Invalid token: iat must not be after exp");
   }
@@ -4044,6 +4121,16 @@ var VaultKeeper = class _VaultKeeper {
         "This capability token authorizes a signing key, not a secret \u2014 it cannot be read with getSecret(). Use sign() instead."
       );
     }
+    if (claims.kty === "signing-key") {
+      throw new AuthorizationDeniedError(
+        "This capability token authorizes a signing key, not a secret \u2014 it cannot be read with getSecret(). Use sign() instead."
+      );
+    }
+    if (claims.val === void 0) {
+      throw new AuthorizationDeniedError(
+        "This capability token does not carry a secret value \u2014 it is malformed or was not minted as a secret token."
+      );
+    }
     return createSecretAccessor(claims.val);
   }
   /**
@@ -4386,7 +4473,7 @@ var VaultKeeper = class _VaultKeeper {
   // ---------------------------------------------------------------------------
   static #resolveSecrets(token) {
     if (token instanceof CapabilityToken) {
-      return _VaultKeeper.#requireSecretClaims(token).val;
+      return _VaultKeeper.#requireSecretValue(token);
     }
     const result = {};
     for (const [name, t] of Object.entries(token)) {
@@ -4395,7 +4482,7 @@ var VaultKeeper = class _VaultKeeper {
           `Invalid capability token for secret "${name}" \u2014 expected a CapabilityToken from authorize()`
         );
       }
-      result[name] = _VaultKeeper.#requireSecretClaims(t).val;
+      result[name] = _VaultKeeper.#requireSecretValue(t);
     }
     return result;
   }
@@ -4403,7 +4490,10 @@ var VaultKeeper = class _VaultKeeper {
    * Resolve a token to its secret claims, rejecting a signing-key token.
    *
    * Defense in depth: a signing-key capability must never be injectable as a
-   * secret through `fetch()`/`exec()`.
+   * secret through `fetch()`/`exec()`. This rejects both the in-memory
+   * signing-key token (`isSigningClaims`) and a JWE-based signing-key lease
+   * (`kty: 'signing-key'`) — the two capability shapes are discriminated
+   * differently but neither ever carries a secret value.
    */
   static #requireSecretClaims(token) {
     const claims = validateCapabilityToken(token);
@@ -4412,8 +4502,21 @@ var VaultKeeper = class _VaultKeeper {
         "This capability token authorizes a signing key, not a secret \u2014 it cannot be injected into fetch() or exec()."
       );
     }
+    if (claims.kty === "signing-key") {
+      throw new AuthorizationDeniedError(
+        "This capability token authorizes a signing-key lease, not a secret \u2014 it cannot be injected into fetch() or exec()."
+      );
+    }
     return claims;
   }
+  /** Resolve a token to its secret value, rejecting a claims shape with no `val`. */
+  static #requireSecretValue(token) {
+    const claims = _VaultKeeper.#requireSecretClaims(token);
+    if (claims.val === void 0 || claims.val.trim() === "") {
+      throw new AuthorizationDeniedError("This capability token does not authorize a secret value.");
+    }
+    return claims.val;
+  }
   /**
    * Validate a caller-supplied resource name. `kind` names the resource in the
    * error so a signing-key caller is not told about a "secret".
@@ -4575,6 +4678,6 @@ var VaultKeeper = class _VaultKeeper {
   }
 };
 
-export { AccessorConsumedError, AuthorizationDeniedError, BackendLockedError, BackendRegistry, BackendUnavailableError, CapabilityToken, ConfigParseError, ConfigValidationError, DecryptionError, DeviceNotPresentError, ExecError, ExecutableTrustRequiredError, FetchError, FilesystemError, IdentityMismatchError, InvalidAlgorithmError, InvalidKeyMaterialError, InvalidTokenError, KeyRevokedError, KeyRotatedError, NotCapableError, PluginNotFoundError, PresenceDeclinedError, PresenceTimeoutError, REDACTED, RotationInProgressError, SecretNotFoundError, SetupError, SigningKeyAlreadyExistsError, SigningKeyNotFoundError, SigningNotSupportedError, TokenExpiredError, TokenRevokedError, UnknownBackendTypeError, UsageLimitExceededError, VaultError, VaultKeeper, defaultBackendType, getBackendCapabilities, getDefaultConfigDir, getPlatformDefaultConfigDir, isListableBackend, isPresenceCapableBackend, isSigningBackend, loadConfig, platformNativeBackendType, redactSecrets, runDoctor };
+export { AccessorConsumedError, AuthorizationDeniedError, BackendLockedError, BackendRegistry, BackendUnavailableError, CapabilityToken, ConfigParseError, ConfigValidationError, DecryptionError, DeviceNotPresentError, ExecError, ExecutableTrustRequiredError, FetchError, FilesystemError, IdentityMismatchError, InvalidAlgorithmError, InvalidKeyMaterialError, InvalidTokenError, KeyRevokedError, KeyRotatedError, NotCapableError, PluginNotFoundError, PresenceDeclinedError, PresenceTimeoutError, REDACTED, RotationInProgressError, SecretNotFoundError, SetupError, SigningKeyAlreadyExistsError, SigningKeyNotFoundError, SigningNotSupportedError, TestDoubleMisuseError, TokenExpiredError, TokenRevokedError, UnknownBackendTypeError, UsageLimitExceededError, VaultError, VaultKeeper, defaultBackendType, getBackendCapabilities, getDefaultConfigDir, getPlatformDefaultConfigDir, isListableBackend, isPresenceCapableBackend, isSigningBackend, loadConfig, platformNativeBackendType, redactSecrets, runDoctor };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map