vaultkeeper 0.7.1 → 0.8.0

package/README.md

@@ -480,7 +480,11 @@ consecutive required-presence operations each demand their own distinct fresh ac
 > intrinsic to the cryptographic operation.
 
 Real-hardware confirmation for each backend is documented as a manual verification test in
-[`docs/manual-tests/presence-per-use.md`](../../docs/manual-tests/presence-per-use.md).
+[`docs/manual-tests/presence-per-use.md`](../../docs/manual-tests/presence-per-use.md). The
+release-process-referenced register of what manual residue remains per backend once its paired
+in-memory double runs the shared conformance corpus in CI — and the cadence/cost of running that
+corpus against the real adapter — lives in
+[`docs/manual-tests/manual-residue-register.md`](../../docs/manual-tests/manual-residue-register.md).
 
 ## Doctor / preflight checks
 

package/dist/index.cjs

@@ -473,6 +473,21 @@ var RotationInProgressError = class extends VaultError {
     this.name = "RotationInProgressError";
   }
 };
+var TestDoubleMisuseError = class extends VaultError {
+  /** The name of the test double class that refused to construct. */
+  doubleName;
+  /**
+   * The environment value (e.g. `process.env.NODE_ENV`) that triggered the
+   * refusal.
+   */
+  detectedEnvironment;
+  constructor(message, doubleName, detectedEnvironment) {
+    super(message);
+    this.name = "TestDoubleMisuseError";
+    this.doubleName = doubleName;
+    this.detectedEnvironment = detectedEnvironment;
+  }
+};
 
 // src/backend/registry.ts
 var BackendRegistry = class {
@@ -1460,6 +1475,9 @@ var DpapiBackend = class {
 // src/backend/secret-tool-backend.ts
 var ATTRIBUTE_KEY = "vaultkeeper-id";
 var LABEL_PREFIX = "vaultkeeper: ";
+function stripSecretToolTrailingNewline(stdout) {
+  return stdout.endsWith("\n") ? stdout.slice(0, -1) : stdout;
+}
 var SecretToolBackend = class {
   type = "secret-tool";
   displayName = "Linux Secret Service (secret-tool)";
@@ -1476,29 +1494,29 @@ var SecretToolBackend = class {
   }
   async store(id, secret) {
     const label = `${LABEL_PREFIX}${id}`;
-    await execCommand("secret-tool", ["store", "--label", label, ATTRIBUTE_KEY, id], {
+    await execCommand("secret-tool", ["store", "--label", label, "--", ATTRIBUTE_KEY, id], {
       stdin: secret
     });
   }
   async retrieve(id) {
-    const result = await execCommandFull("secret-tool", ["lookup", ATTRIBUTE_KEY, id]);
-    if (result.exitCode !== 0 || result.stdout.trim() === "") {
+    const result = await execCommandFull("secret-tool", ["lookup", "--", ATTRIBUTE_KEY, id]);
+    if (result.exitCode !== 0) {
       throw new SecretNotFoundError(`Secret not found in Secret Service: ${id}`);
     }
-    return result.stdout.trim();
+    return stripSecretToolTrailingNewline(result.stdout);
   }
   async delete(id) {
-    const result = await execCommandFull("secret-tool", ["clear", ATTRIBUTE_KEY, id]);
+    const result = await execCommandFull("secret-tool", ["clear", "--", ATTRIBUTE_KEY, id]);
     if (result.exitCode !== 0) {
       throw new SecretNotFoundError(`Secret not found in Secret Service: ${id}`);
     }
   }
   async exists(id) {
-    const result = await execCommandFull("secret-tool", ["lookup", ATTRIBUTE_KEY, id]);
-    return result.exitCode === 0 && result.stdout.trim() !== "";
+    const result = await execCommandFull("secret-tool", ["lookup", "--", ATTRIBUTE_KEY, id]);
+    return result.exitCode === 0;
   }
   async list() {
-    const result = await execCommandFull("secret-tool", ["search", ATTRIBUTE_KEY, ""]);
+    const result = await execCommandFull("secret-tool", ["search", "--", ATTRIBUTE_KEY, ""]);
     if (result.exitCode !== 0) {
       return [];
     }
@@ -4716,6 +4734,7 @@ exports.SetupError = SetupError;
 exports.SigningKeyAlreadyExistsError = SigningKeyAlreadyExistsError;
 exports.SigningKeyNotFoundError = SigningKeyNotFoundError;
 exports.SigningNotSupportedError = SigningNotSupportedError;
+exports.TestDoubleMisuseError = TestDoubleMisuseError;
 exports.TokenExpiredError = TokenExpiredError;
 exports.TokenRevokedError = TokenRevokedError;
 exports.UnknownBackendTypeError = UnknownBackendTypeError;