vaultkeeper 0.7.1 → 0.8.0

package/dist/index.d.cts

@@ -527,6 +527,34 @@ declare class FilesystemError extends VaultError {
 declare class RotationInProgressError extends VaultError {
     constructor(message: string);
 }
+/**
+ * Thrown when a test-only double — a class built purely to fabricate a
+ * vaultkeeper-internal signal (e.g. a granted presence check, an unlocked
+ * backend) for driving negative test cases — refuses to construct because it
+ * detected it is running outside a test environment.
+ *
+ * @remarks
+ * A fabricated signal is, by construction, exactly the thing a real
+ * deployment must never be able to forge. A loud, typed refusal at
+ * construction time is the last of several stacked guards keeping such a
+ * double unreachable from production — see, for example,
+ * `PresenceSimulatorBackend` in `@vaultkeeper/test-helpers`. Inspect
+ * {@link TestDoubleMisuseError.doubleName} for which class refused to
+ * construct and {@link TestDoubleMisuseError.detectedEnvironment} for the
+ * environment value that triggered the refusal.
+ *
+ * @public
+ */
+declare class TestDoubleMisuseError extends VaultError {
+    /** The name of the test double class that refused to construct. */
+    readonly doubleName: string;
+    /**
+     * The environment value (e.g. `process.env.NODE_ENV`) that triggered the
+     * refusal.
+     */
+    readonly detectedEnvironment: string;
+    constructor(message: string, doubleName: string, detectedEnvironment: string);
+}
 
 /**
  * Shared types and interfaces for vaultkeeper.
@@ -2128,4 +2156,4 @@ declare function platformNativeBackendType(): string;
  */
 declare function loadConfig(configDir?: string): Promise<VaultConfig>;
 
-export { AccessorConsumedError, AuthorizationDeniedError, type BackendCapabilities, type BackendConfig, type BackendFactory, BackendLockedError, BackendRegistry, type BackendSetupFactory, BackendUnavailableError, CapabilityToken, ConfigParseError, ConfigValidationError, DecryptionError, DeviceNotPresentError, ExecError, type ExecRequest, type ExecResult, ExecutableTrustRequiredError, type ExecutableTrustStatus, FetchError, type FetchRequest, FilesystemError, IdentityMismatchError, InvalidAlgorithmError, InvalidKeyMaterialError, InvalidTokenError, KeyRevokedError, KeyRotatedError, type KeyStatus, type ListableBackend, NotCapableError, type Platform, PluginNotFoundError, type PreflightCheck, type PreflightCheckError, type PreflightCheckErrorKind, type PreflightCheckStatus, type PreflightResult, type PresenceCapableBackend, PresenceDeclinedError, type PresenceOperation, type PresenceRequirementOptions, PresenceTimeoutError, REDACTED, RotationInProgressError, type RunDoctorOptions, type ScopedPreflightCheck, type SecretAccessor, type SecretBackend, SecretNotFoundError, type SecretTokenMap, type SetupChoice, SetupError, type SetupOptions, type SetupOptionsBase, type SetupQuestion, type SetupResult, type SignRequest, type SignResult, type SigningAlgorithm, type SigningBackend, SigningKeyAlreadyExistsError, SigningKeyNotFoundError, SigningNotSupportedError, type SigningPublicKey, TokenExpiredError, TokenRevokedError, type TrustTier, UnknownBackendTypeError, UsageLimitExceededError, type VaultConfig, VaultError, VaultKeeper, type VaultKeeperOptions, type VaultResponse, type VerifyRequest, defaultBackendType, getBackendCapabilities, getDefaultConfigDir, getPlatformDefaultConfigDir, isListableBackend, isPresenceCapableBackend, isSigningBackend, loadConfig, platformNativeBackendType, redactSecrets, runDoctor };
+export { AccessorConsumedError, AuthorizationDeniedError, type BackendCapabilities, type BackendConfig, type BackendFactory, BackendLockedError, BackendRegistry, type BackendSetupFactory, BackendUnavailableError, CapabilityToken, ConfigParseError, ConfigValidationError, DecryptionError, DeviceNotPresentError, ExecError, type ExecRequest, type ExecResult, ExecutableTrustRequiredError, type ExecutableTrustStatus, FetchError, type FetchRequest, FilesystemError, IdentityMismatchError, InvalidAlgorithmError, InvalidKeyMaterialError, InvalidTokenError, KeyRevokedError, KeyRotatedError, type KeyStatus, type ListableBackend, NotCapableError, type Platform, PluginNotFoundError, type PreflightCheck, type PreflightCheckError, type PreflightCheckErrorKind, type PreflightCheckStatus, type PreflightResult, type PresenceCapableBackend, PresenceDeclinedError, type PresenceOperation, type PresenceRequirementOptions, PresenceTimeoutError, REDACTED, RotationInProgressError, type RunDoctorOptions, type ScopedPreflightCheck, type SecretAccessor, type SecretBackend, SecretNotFoundError, type SecretTokenMap, type SetupChoice, SetupError, type SetupOptions, type SetupOptionsBase, type SetupQuestion, type SetupResult, type SignRequest, type SignResult, type SigningAlgorithm, type SigningBackend, SigningKeyAlreadyExistsError, SigningKeyNotFoundError, SigningNotSupportedError, type SigningPublicKey, TestDoubleMisuseError, TokenExpiredError, TokenRevokedError, type TrustTier, UnknownBackendTypeError, UsageLimitExceededError, type VaultConfig, VaultError, VaultKeeper, type VaultKeeperOptions, type VaultResponse, type VerifyRequest, defaultBackendType, getBackendCapabilities, getDefaultConfigDir, getPlatformDefaultConfigDir, isListableBackend, isPresenceCapableBackend, isSigningBackend, loadConfig, platformNativeBackendType, redactSecrets, runDoctor };

package/dist/index.d.ts

@@ -527,6 +527,34 @@ declare class FilesystemError extends VaultError {
 declare class RotationInProgressError extends VaultError {
     constructor(message: string);
 }
+/**
+ * Thrown when a test-only double — a class built purely to fabricate a
+ * vaultkeeper-internal signal (e.g. a granted presence check, an unlocked
+ * backend) for driving negative test cases — refuses to construct because it
+ * detected it is running outside a test environment.
+ *
+ * @remarks
+ * A fabricated signal is, by construction, exactly the thing a real
+ * deployment must never be able to forge. A loud, typed refusal at
+ * construction time is the last of several stacked guards keeping such a
+ * double unreachable from production — see, for example,
+ * `PresenceSimulatorBackend` in `@vaultkeeper/test-helpers`. Inspect
+ * {@link TestDoubleMisuseError.doubleName} for which class refused to
+ * construct and {@link TestDoubleMisuseError.detectedEnvironment} for the
+ * environment value that triggered the refusal.
+ *
+ * @public
+ */
+declare class TestDoubleMisuseError extends VaultError {
+    /** The name of the test double class that refused to construct. */
+    readonly doubleName: string;
+    /**
+     * The environment value (e.g. `process.env.NODE_ENV`) that triggered the
+     * refusal.
+     */
+    readonly detectedEnvironment: string;
+    constructor(message: string, doubleName: string, detectedEnvironment: string);
+}
 
 /**
  * Shared types and interfaces for vaultkeeper.
@@ -2128,4 +2156,4 @@ declare function platformNativeBackendType(): string;
  */
 declare function loadConfig(configDir?: string): Promise<VaultConfig>;
 
-export { AccessorConsumedError, AuthorizationDeniedError, type BackendCapabilities, type BackendConfig, type BackendFactory, BackendLockedError, BackendRegistry, type BackendSetupFactory, BackendUnavailableError, CapabilityToken, ConfigParseError, ConfigValidationError, DecryptionError, DeviceNotPresentError, ExecError, type ExecRequest, type ExecResult, ExecutableTrustRequiredError, type ExecutableTrustStatus, FetchError, type FetchRequest, FilesystemError, IdentityMismatchError, InvalidAlgorithmError, InvalidKeyMaterialError, InvalidTokenError, KeyRevokedError, KeyRotatedError, type KeyStatus, type ListableBackend, NotCapableError, type Platform, PluginNotFoundError, type PreflightCheck, type PreflightCheckError, type PreflightCheckErrorKind, type PreflightCheckStatus, type PreflightResult, type PresenceCapableBackend, PresenceDeclinedError, type PresenceOperation, type PresenceRequirementOptions, PresenceTimeoutError, REDACTED, RotationInProgressError, type RunDoctorOptions, type ScopedPreflightCheck, type SecretAccessor, type SecretBackend, SecretNotFoundError, type SecretTokenMap, type SetupChoice, SetupError, type SetupOptions, type SetupOptionsBase, type SetupQuestion, type SetupResult, type SignRequest, type SignResult, type SigningAlgorithm, type SigningBackend, SigningKeyAlreadyExistsError, SigningKeyNotFoundError, SigningNotSupportedError, type SigningPublicKey, TokenExpiredError, TokenRevokedError, type TrustTier, UnknownBackendTypeError, UsageLimitExceededError, type VaultConfig, VaultError, VaultKeeper, type VaultKeeperOptions, type VaultResponse, type VerifyRequest, defaultBackendType, getBackendCapabilities, getDefaultConfigDir, getPlatformDefaultConfigDir, isListableBackend, isPresenceCapableBackend, isSigningBackend, loadConfig, platformNativeBackendType, redactSecrets, runDoctor };
+export { AccessorConsumedError, AuthorizationDeniedError, type BackendCapabilities, type BackendConfig, type BackendFactory, BackendLockedError, BackendRegistry, type BackendSetupFactory, BackendUnavailableError, CapabilityToken, ConfigParseError, ConfigValidationError, DecryptionError, DeviceNotPresentError, ExecError, type ExecRequest, type ExecResult, ExecutableTrustRequiredError, type ExecutableTrustStatus, FetchError, type FetchRequest, FilesystemError, IdentityMismatchError, InvalidAlgorithmError, InvalidKeyMaterialError, InvalidTokenError, KeyRevokedError, KeyRotatedError, type KeyStatus, type ListableBackend, NotCapableError, type Platform, PluginNotFoundError, type PreflightCheck, type PreflightCheckError, type PreflightCheckErrorKind, type PreflightCheckStatus, type PreflightResult, type PresenceCapableBackend, PresenceDeclinedError, type PresenceOperation, type PresenceRequirementOptions, PresenceTimeoutError, REDACTED, RotationInProgressError, type RunDoctorOptions, type ScopedPreflightCheck, type SecretAccessor, type SecretBackend, SecretNotFoundError, type SecretTokenMap, type SetupChoice, SetupError, type SetupOptions, type SetupOptionsBase, type SetupQuestion, type SetupResult, type SignRequest, type SignResult, type SigningAlgorithm, type SigningBackend, SigningKeyAlreadyExistsError, SigningKeyNotFoundError, SigningNotSupportedError, type SigningPublicKey, TestDoubleMisuseError, TokenExpiredError, TokenRevokedError, type TrustTier, UnknownBackendTypeError, UsageLimitExceededError, type VaultConfig, VaultError, VaultKeeper, type VaultKeeperOptions, type VaultResponse, type VerifyRequest, defaultBackendType, getBackendCapabilities, getDefaultConfigDir, getPlatformDefaultConfigDir, isListableBackend, isPresenceCapableBackend, isSigningBackend, loadConfig, platformNativeBackendType, redactSecrets, runDoctor };

package/dist/index.js

@@ -448,6 +448,21 @@ var RotationInProgressError = class extends VaultError {
     this.name = "RotationInProgressError";
   }
 };
+var TestDoubleMisuseError = class extends VaultError {
+  /** The name of the test double class that refused to construct. */
+  doubleName;
+  /**
+   * The environment value (e.g. `process.env.NODE_ENV`) that triggered the
+   * refusal.
+   */
+  detectedEnvironment;
+  constructor(message, doubleName, detectedEnvironment) {
+    super(message);
+    this.name = "TestDoubleMisuseError";
+    this.doubleName = doubleName;
+    this.detectedEnvironment = detectedEnvironment;
+  }
+};
 
 // src/backend/registry.ts
 var BackendRegistry = class {
@@ -1435,6 +1450,9 @@ var DpapiBackend = class {
 // src/backend/secret-tool-backend.ts
 var ATTRIBUTE_KEY = "vaultkeeper-id";
 var LABEL_PREFIX = "vaultkeeper: ";
+function stripSecretToolTrailingNewline(stdout) {
+  return stdout.endsWith("\n") ? stdout.slice(0, -1) : stdout;
+}
 var SecretToolBackend = class {
   type = "secret-tool";
   displayName = "Linux Secret Service (secret-tool)";
@@ -1451,29 +1469,29 @@ var SecretToolBackend = class {
   }
   async store(id, secret) {
     const label = `${LABEL_PREFIX}${id}`;
-    await execCommand("secret-tool", ["store", "--label", label, ATTRIBUTE_KEY, id], {
+    await execCommand("secret-tool", ["store", "--label", label, "--", ATTRIBUTE_KEY, id], {
       stdin: secret
     });
   }
   async retrieve(id) {
-    const result = await execCommandFull("secret-tool", ["lookup", ATTRIBUTE_KEY, id]);
-    if (result.exitCode !== 0 || result.stdout.trim() === "") {
+    const result = await execCommandFull("secret-tool", ["lookup", "--", ATTRIBUTE_KEY, id]);
+    if (result.exitCode !== 0) {
       throw new SecretNotFoundError(`Secret not found in Secret Service: ${id}`);
     }
-    return result.stdout.trim();
+    return stripSecretToolTrailingNewline(result.stdout);
   }
   async delete(id) {
-    const result = await execCommandFull("secret-tool", ["clear", ATTRIBUTE_KEY, id]);
+    const result = await execCommandFull("secret-tool", ["clear", "--", ATTRIBUTE_KEY, id]);
     if (result.exitCode !== 0) {
       throw new SecretNotFoundError(`Secret not found in Secret Service: ${id}`);
     }
   }
   async exists(id) {
-    const result = await execCommandFull("secret-tool", ["lookup", ATTRIBUTE_KEY, id]);
-    return result.exitCode === 0 && result.stdout.trim() !== "";
+    const result = await execCommandFull("secret-tool", ["lookup", "--", ATTRIBUTE_KEY, id]);
+    return result.exitCode === 0;
   }
   async list() {
-    const result = await execCommandFull("secret-tool", ["search", ATTRIBUTE_KEY, ""]);
+    const result = await execCommandFull("secret-tool", ["search", "--", ATTRIBUTE_KEY, ""]);
     if (result.exitCode !== 0) {
       return [];
     }
@@ -4660,6 +4678,6 @@ var VaultKeeper = class _VaultKeeper {
   }
 };
 
-export { AccessorConsumedError, AuthorizationDeniedError, BackendLockedError, BackendRegistry, BackendUnavailableError, CapabilityToken, ConfigParseError, ConfigValidationError, DecryptionError, DeviceNotPresentError, ExecError, ExecutableTrustRequiredError, FetchError, FilesystemError, IdentityMismatchError, InvalidAlgorithmError, InvalidKeyMaterialError, InvalidTokenError, KeyRevokedError, KeyRotatedError, NotCapableError, PluginNotFoundError, PresenceDeclinedError, PresenceTimeoutError, REDACTED, RotationInProgressError, SecretNotFoundError, SetupError, SigningKeyAlreadyExistsError, SigningKeyNotFoundError, SigningNotSupportedError, TokenExpiredError, TokenRevokedError, UnknownBackendTypeError, UsageLimitExceededError, VaultError, VaultKeeper, defaultBackendType, getBackendCapabilities, getDefaultConfigDir, getPlatformDefaultConfigDir, isListableBackend, isPresenceCapableBackend, isSigningBackend, loadConfig, platformNativeBackendType, redactSecrets, runDoctor };
+export { AccessorConsumedError, AuthorizationDeniedError, BackendLockedError, BackendRegistry, BackendUnavailableError, CapabilityToken, ConfigParseError, ConfigValidationError, DecryptionError, DeviceNotPresentError, ExecError, ExecutableTrustRequiredError, FetchError, FilesystemError, IdentityMismatchError, InvalidAlgorithmError, InvalidKeyMaterialError, InvalidTokenError, KeyRevokedError, KeyRotatedError, NotCapableError, PluginNotFoundError, PresenceDeclinedError, PresenceTimeoutError, REDACTED, RotationInProgressError, SecretNotFoundError, SetupError, SigningKeyAlreadyExistsError, SigningKeyNotFoundError, SigningNotSupportedError, TestDoubleMisuseError, TokenExpiredError, TokenRevokedError, UnknownBackendTypeError, UsageLimitExceededError, VaultError, VaultKeeper, defaultBackendType, getBackendCapabilities, getDefaultConfigDir, getPlatformDefaultConfigDir, isListableBackend, isPresenceCapableBackend, isSigningBackend, loadConfig, platformNativeBackendType, redactSecrets, runDoctor };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map