Adds AES-256-GCM + PBKDF2-SHA256 (200,000 iterations) encryption for the
consolidated chipnet keystore. Loader auto-detects the encrypted format
(`chipnet-keystore/2-encrypted`) and prompts for the master password on
first use — or reads CHIPNET_KEYSTORE_PASSWORD env for scripted/CI runs.
Password cached in-process only.
- scripts/chipnet-keystore-encrypt.mjs — one-shot encrypt in place;
backs up plaintext to Keys/chipnet-keystore.plain.bak (also gitignored)
- scripts/chipnet-keystore-decrypt.mjs — --check, --in-place, --stdout,
--out=<path> modes for verification and one-time exports (bulk import
into a wallet UI, migration, key rotation)
- scripts/lib/chipnet-keystore.mjs — adds loadAllAsync(),
getEntryAsync(), ensureKeystoreUnlocked(); sync API still works on
plain keystores and throws a clear "call *Async instead" on encrypted
ones until unlocked once at boot
Test coverage: round-trip encrypt+verify+load-async validated end-to-end;
plain-keystore path still loads all 12 wallets unchanged.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
a623aae040