@agentproto/secrets 0.1.0-alpha.0 → 0.2.0

package/LICENSE

@@ -1,21 +1,202 @@
-MIT License
-
-Copyright (c) 2026 agentproto contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -18,6 +18,58 @@ const x = defineSecrets({
 })
 ```
 
+## Exposure surface (`@agentproto/secrets/exposure`)
+
+The manifest says *which* secrets exist; an **exposure** says *how* a resolved
+secret reaches a runtime. `SecretExposure` is a discriminated union — one
+`kind` per delivery mechanism, so consumers filter with the `isExposureKind`
+guard and handle each with one switch case:
+
+| `kind` | Delivers the secret as… |
+| --- | --- |
+| `env` | an environment variable on the agent process |
+| `file` | a file written into the workspace |
+| `egress-substitute` | a `$$SECRET[NAME]$$` placeholder substituted on egress |
+| `mcp-header` | an HTTP **auth header** on an MCP server's transport |
+
+```ts
+import { isExposureKind, type SecretExposure } from "@agentproto/secrets/exposure"
+
+const headerExposures = exposures.filter(e => isExposureKind(e, "mcp-header"))
+```
+
+### `mcp-header` — brokered MCP auth
+
+```ts
+interface McpHeaderExposure {
+  kind: "mcp-header"
+  credentialPath: string   // broker path: "<providerId>" or "<providerId>/<account>"
+  server?: string          // optional upstream override, forwarded to the broker
+}
+```
+
+`resolveMcpHeaderExposure(exposure, resolver, { signal })` turns that path into
+a ready-to-use header map. The `resolver` is a **structural**
+`McpHeaderResolver` (`resolveHeaders({ path, server?, signal? })`) — the
+`CredentialBroker` from `@agentproto/auth` satisfies it with no adapter, so
+this package stays **dependency-free of `auth`** while still driving it.
+
+Every resolved header **value** is run through `assertSafeSecretValue` before
+return — a value containing CR/LF/NUL is rejected, closing off header-injection
+(a smuggled newline can't append extra header lines onto the transport).
+
+```ts
+import { resolveMcpHeaderExposure } from "@agentproto/secrets/exposure"
+import { CredentialBroker } from "@agentproto/auth"
+
+const headers = await resolveMcpHeaderExposure(exposure, broker, { signal })
+// → { Authorization: "Bearer …" }, guarded
+```
+
+The same guard (`assertSafeSecretValue`) and the `$$SECRET[NAME]$$` engine
+(`substituteSecrets`, `SECRET_PLACEHOLDER_PATTERN`, `formatPlaceholder`) are
+exported from this subpath for the `egress-substitute` path.
+
 ## License
 
 MIT — see [LICENSE](./LICENSE).

package/bin/agentproto-secrets.mjs

@@ -1,4 +1,17 @@
 #!/usr/bin/env node
-// Thin launcher — the built CLI runs on import. Kept separate so the shebang
-// lives on a checked-in file rather than fighting the bundler's per-entry output.
-import "../dist/cli.mjs"
+// Thin launcher — invokes the built CLI's exported `main`. Kept separate so
+// the shebang lives on a checked-in file rather than fighting the bundler's
+// per-entry output. `main` is exported (not run at import time) so tests can
+// import `cli.ts`'s helpers without triggering a real CLI invocation.
+import { main } from "../dist/cli.mjs"
+
+main()
+  .then(code => {
+    process.exitCode = code
+  })
+  .catch(err => {
+    process.stderr.write(
+      `agentproto-secrets: ${err instanceof Error ? err.message : String(err)}\n`
+    )
+    process.exitCode = 1
+  })

package/dist/chunk-2DL6W33G.mjs

@@ -0,0 +1,126 @@
+import { generateKeyPairSync, createHash, createPrivateKey, sign, createPublicKey, verify } from 'crypto';
+import { readFile, mkdir, writeFile, chmod, rename } from 'fs/promises';
+import { dirname, join, basename } from 'path';
+
+/**
+ * @agentproto/secrets v0.1.0-alpha
+ * AIP-19 SECRETS.md `defineSecrets` reference implementation.
+ */
+
+var IDENTITY_VERSION = 1;
+var IdentityError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "IdentityError";
+  }
+};
+function generateIdentity() {
+  const x = generateKeyPairSync("x25519");
+  const ed = generateKeyPairSync("ed25519");
+  return {
+    v: IDENTITY_VERSION,
+    x25519: {
+      pub: x.publicKey.export({ type: "spki", format: "der" }).toString("base64"),
+      priv: x.privateKey.export({ type: "pkcs8", format: "der" }).toString("base64")
+    },
+    ed25519: {
+      pub: ed.publicKey.export({ type: "spki", format: "der" }).toString("base64"),
+      priv: ed.privateKey.export({ type: "pkcs8", format: "der" }).toString("base64")
+    },
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function identityFingerprint(x25519Pub) {
+  return createHash("sha256").update(Buffer.from(x25519Pub, "base64")).digest("hex").slice(0, 16);
+}
+function isEnoent(err) {
+  return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
+}
+function isRecord(v) {
+  return typeof v === "object" && v !== null;
+}
+function isKeyPair(kp) {
+  return isRecord(kp) && typeof kp["pub"] === "string" && typeof kp["priv"] === "string";
+}
+function isDaemonIdentity(value) {
+  if (!isRecord(value)) return false;
+  if (value["v"] !== IDENTITY_VERSION) return false;
+  if (typeof value["createdAt"] !== "string") return false;
+  return isKeyPair(value["x25519"]) && isKeyPair(value["ed25519"]);
+}
+async function loadOrCreateIdentity(filePath) {
+  try {
+    const raw = await readFile(filePath, "utf8");
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      throw new IdentityError(
+        `identity file ${filePath} is not valid JSON \u2014 refusing to overwrite; move it aside to regenerate`
+      );
+    }
+    if (!isDaemonIdentity(parsed)) {
+      throw new IdentityError(
+        `identity file ${filePath} is malformed or an unsupported version \u2014 refusing to overwrite; move it aside to regenerate`
+      );
+    }
+    return parsed;
+  } catch (err) {
+    if (!isEnoent(err)) throw err;
+  }
+  const identity = generateIdentity();
+  await persistIdentity(filePath, identity);
+  return identity;
+}
+async function persistIdentity(filePath, identity) {
+  const dir = dirname(filePath);
+  await mkdir(dir, { recursive: true });
+  const tmp = join(dir, `.${basename(filePath)}.tmp-${process.pid}`);
+  await writeFile(tmp, JSON.stringify(identity, null, 2) + "\n", {
+    encoding: "utf8",
+    mode: 384
+  });
+  await chmod(tmp, 384).catch(() => {
+  });
+  await rename(tmp, filePath);
+}
+function signTranscript(ed25519Priv, transcript) {
+  let priv;
+  try {
+    priv = createPrivateKey({
+      key: Buffer.from(ed25519Priv, "base64"),
+      format: "der",
+      type: "pkcs8"
+    });
+  } catch {
+    throw new IdentityError("invalid ed25519 private key");
+  }
+  return sign(null, Buffer.from(transcript), priv).toString("base64");
+}
+function verifyTranscript(ed25519Pub, transcript, signature) {
+  let pub;
+  try {
+    pub = createPublicKey({
+      key: Buffer.from(ed25519Pub, "base64"),
+      format: "der",
+      type: "spki"
+    });
+  } catch {
+    throw new IdentityError("invalid ed25519 public key");
+  }
+  let sig;
+  try {
+    sig = Buffer.from(signature, "base64");
+  } catch {
+    return false;
+  }
+  try {
+    return verify(null, Buffer.from(transcript), pub, sig);
+  } catch {
+    return false;
+  }
+}
+
+export { IDENTITY_VERSION, IdentityError, generateIdentity, identityFingerprint, loadOrCreateIdentity, signTranscript, verifyTranscript };
+//# sourceMappingURL=chunk-2DL6W33G.mjs.map
+//# sourceMappingURL=chunk-2DL6W33G.mjs.map

package/dist/chunk-2DL6W33G.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/identity/index.ts"],"names":["edSign","edVerify"],"mappings":";;;;;;;;;AAiCO,IAAM,gBAAA,GAAmB;AAIzB,IAAM,aAAA,GAAN,cAA4B,KAAA,CAAM;AAAA,EACvC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,eAAA;AAAA,EACd;AACF;AA+BO,SAAS,gBAAA,GAAmC;AACjD,EAAA,MAAM,CAAA,GAAI,oBAAoB,QAAQ,CAAA;AACtC,EAAA,MAAM,EAAA,GAAK,oBAAoB,SAAS,CAAA;AACxC,EAAA,OAAO;AAAA,IACL,CAAA,EAAG,gBAAA;AAAA,IACH,MAAA,EAAQ;AAAA,MACN,GAAA,EAAK,CAAA,CAAE,SAAA,CAAU,MAAA,CAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAA,EAAQ,KAAA,EAAO,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AAAA,MAC1E,IAAA,EAAM,CAAA,CAAE,UAAA,CAAW,MAAA,CAAO,EAAE,IAAA,EAAM,OAAA,EAAS,MAAA,EAAQ,KAAA,EAAO,CAAA,CAAE,QAAA,CAAS,QAAQ;AAAA,KAC/E;AAAA,IACA,OAAA,EAAS;AAAA,MACP,GAAA,EAAK,EAAA,CAAG,SAAA,CAAU,MAAA,CAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAA,EAAQ,KAAA,EAAO,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AAAA,MAC3E,IAAA,EAAM,EAAA,CAAG,UAAA,CAAW,MAAA,CAAO,EAAE,IAAA,EAAM,OAAA,EAAS,MAAA,EAAQ,KAAA,EAAO,CAAA,CAAE,QAAA,CAAS,QAAQ;AAAA,KAChF;AAAA,IACA,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,GACpC;AACF;AAQO,SAAS,oBAAoB,SAAA,EAA2B;AAC7D,EAAA,OAAO,UAAA,CAAW,QAAQ,CAAA,CACvB,MAAA,CAAO,OAAO,IAAA,CAAK,SAAA,EAAW,QAAQ,CAAC,EACvC,MAAA,CAAO,KAAK,CAAA,CACZ,KAAA,CAAM,GAAG,EAAE,CAAA;AAChB;AAGA,SAAS,SAAS,GAAA,EAAuB;AACvC,EAAA,OACE,OAAO,QAAQ,QAAA,IACf,GAAA,KAAQ,QACR,MAAA,IAAU,GAAA,IACV,IAAI,IAAA,KAAS,QAAA;AAEjB;AAEA,SAAS,SAAS,CAAA,EAA0C;AAC1D,EAAA,OAAO,OAAO,CAAA,KAAM,QAAA,IAAY,CAAA,KAAM,IAAA;AACxC;AAEA,SAAS,UAAU,EAAA,EAAsB;AACvC,EAAA,OAAO,QAAA,CAAS,EAAE,CAAA,IAAK,OAAO,EAAA,CAAG,KAAK,CAAA,KAAM,QAAA,IAAY,OAAO,EAAA,CAAG,MAAM,CAAA,KAAM,QAAA;AAChF;AAEA,SAAS,iBAAiB,KAAA,EAAyC;AACjE,EAAA,IAAI,CAAC,QAAA,CAAS,KAAK,CAAA,EAAG,OAAO,KAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,GAAG,CAAA,KAAM,gBAAA,EAAkB,OAAO,KAAA;AAC5C,EAAA,IAAI,OAAO,KAAA,CAAM,WAAW,CAAA,KAAM,UAAU,OAAO,KAAA;AACnD,EAAA,OAAO,SAAA,CAAU,MAAM,QAAQ,CAAC,KAAK,SAAA,CAAU,KAAA,CAAM,SAAS,CAAC,CAAA;AACjE;AAaA,eAAsB,qBACpB,QAAA,EACyB;AACzB,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,QAAA,CAAS,QAAA,EAAU,MAAM,CAAA;AAC3C,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,IACzB,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,aAAA;AAAA,QACR,iBAAiB,QAAQ,CAAA,4EAAA;AAAA,OAE3B;AAAA,IACF;AACA,IAAA,IAAI,CAAC,gBAAA,CAAiB,MAAM,CAAA,EAAG;AAC7B,MAAA,MAAM,IAAI,aAAA;AAAA,QACR,iBAAiB,QAAQ,CAAA,iGAAA;AAAA,OAE3B;AAAA,IACF;AACA,IAAA,OAAO,MAAA;AAAA,EACT,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,CAAC,QAAA,CAAS,GAAG,CAAA,EAAG,MAAM,GAAA;AAAA,EAE5B;AAEA,EAAA,MAAM,WAAW,gBAAA,EAAiB;AAClC,EAAA,MAAM,eAAA,CAAgB,UAAU,QAAQ,CAAA;AACxC,EAAA,OAAO,QAAA;AACT;AAIA,eAAe,eAAA,CACb,UACA,QAAA,EACe;AACf,EAAA,MAAM,GAAA,GAAM,QAAQ,QAAQ,CAAA;AAC5B,EAAA,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,SAAA,EAAW,MAAM,CAAA;AACpC,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,EAAK,CAAA,CAAA,EAAI,QAAA,CAAS,QAAQ,CAAC,CAAA,KAAA,EAAQ,OAAA,CAAQ,GAAG,CAAA,CAAE,CAAA;AACjE,EAAA,MAAM,SAAA,CAAU,KAAK,IAAA,CAAK,SAAA,CAAU,UAAU,IAAA,EAAM,CAAC,IAAI,IAAA,EAAM;AAAA,IAC7D,QAAA,EAAU,MAAA;AAAA,IACV,IAAA,EAAM;AAAA,GACP,CAAA;AAKD,EAAA,MAAM,KAAA,CAAM,GAAA,EAAK,GAAK,CAAA,CAAE,MAAM,MAAM;AAAA,EAAC,CAAC,CAAA;AACtC,EAAA,MAAM,MAAA,CAAO,KAAK,QAAQ,CAAA;AAC5B;AAQO,SAAS,cAAA,CACd,aACA,UAAA,EACQ;AACR,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,gBAAA,CAAiB;AAAA,MACtB,GAAA,EAAK,MAAA,CAAO,IAAA,CAAK,WAAA,EAAa,QAAQ,CAAA;AAAA,MACtC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,cAAc,6BAA6B,CAAA;AAAA,EACvD;AAEA,EAAA,OAAOA,IAAA,CAAO,MAAM,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA,EAAG,IAAI,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AACtE;AAOO,SAAS,gBAAA,CACd,UAAA,EACA,UAAA,EACA,SAAA,EACS;AACT,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,eAAA,CAAgB;AAAA,MACpB,GAAA,EAAK,MAAA,CAAO,IAAA,CAAK,UAAA,EAAY,QAAQ,CAAA;AAAA,MACrC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,cAAc,4BAA4B,CAAA;AAAA,EACtD;AACA,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAA,CAAO,IAAA,CAAK,SAAA,EAAW,QAAQ,CAAA;AAAA,EACvC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI;AACF,IAAA,OAAOC,OAAS,IAAA,EAAM,MAAA,CAAO,KAAK,UAAU,CAAA,EAAG,KAAK,GAAG,CAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF","file":"chunk-2DL6W33G.mjs","sourcesContent":["/**\n * @agentproto/secrets/identity — the daemon's persistent cryptographic\n * identity for E2E pairing (design: PAIRING / DESIGN §1).\n *\n * A daemon that accepts pairings needs a stable identity a client can pin:\n *   - an **X25519** keypair for key agreement (the client seals its hello to\n *     this key, and it is one of the two ECDH inputs to the session key), and\n *   - an **Ed25519** keypair for authenticity (the daemon signs the handshake\n *     transcript so the client — who learned the public halves out-of-band via\n *     the offer URL — can prove it is really talking to the daemon it scanned,\n *     not an evil rendezvous in the middle).\n *\n * Both keypairs are stored base64-DER (SPKI public / PKCS8 private), the exact\n * shape `@agentproto/secrets/seal` already uses, so the identity file travels\n * as plain JSON and the seal box can consume the X25519 public half verbatim.\n *\n * Everything here is `node:crypto` — X25519, Ed25519, SHA-256 — so the package\n * keeps its zero-native-dependency footprint. The private halves never leave\n * the identity file (mode 0600) and are never logged.\n */\n\nimport {\n  generateKeyPairSync,\n  createPublicKey,\n  createPrivateKey,\n  createHash,\n  sign as edSign,\n  verify as edVerify,\n} from \"node:crypto\"\nimport { mkdir, readFile, writeFile, chmod, rename } from \"node:fs/promises\"\nimport { dirname, join, basename } from \"node:path\"\n\n/** Current identity-file schema version. */\nexport const IDENTITY_VERSION = 1 as const\n\n/** Raised for every identity load/generate/sign/verify failure. The message\n *  is safe to surface — it never contains private key material. */\nexport class IdentityError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = \"IdentityError\"\n  }\n}\n\n/** One keypair, both halves base64-DER. Public = SPKI, private = PKCS8. */\nexport interface IdentityKeyPair {\n  /** base64 DER (SPKI) public key — publishable. */\n  pub: string\n  /** base64 DER (PKCS8) private key — secret. */\n  priv: string\n}\n\n/**\n * A daemon's persistent identity. Serialized verbatim to\n * `~/.agentproto/identity.json` (0600). The `x25519` public half is the key a\n * client seals its hello to; the `ed25519` public half is the key a client\n * verifies the daemon's transcript signature against. Both public halves are\n * carried in the offer URL.\n */\nexport interface DaemonIdentity {\n  v: typeof IDENTITY_VERSION\n  /** Encryption / key-agreement keypair. */\n  x25519: IdentityKeyPair\n  /** Signing / authenticity keypair. */\n  ed25519: IdentityKeyPair\n  /** ISO-8601 creation timestamp. */\n  createdAt: string\n}\n\n/**\n * Mint a fresh daemon identity: one X25519 keypair (encryption) and one\n * Ed25519 keypair (signing). Called lazily on first `pair offer`.\n */\nexport function generateIdentity(): DaemonIdentity {\n  const x = generateKeyPairSync(\"x25519\")\n  const ed = generateKeyPairSync(\"ed25519\")\n  return {\n    v: IDENTITY_VERSION,\n    x25519: {\n      pub: x.publicKey.export({ type: \"spki\", format: \"der\" }).toString(\"base64\"),\n      priv: x.privateKey.export({ type: \"pkcs8\", format: \"der\" }).toString(\"base64\"),\n    },\n    ed25519: {\n      pub: ed.publicKey.export({ type: \"spki\", format: \"der\" }).toString(\"base64\"),\n      priv: ed.privateKey.export({ type: \"pkcs8\", format: \"der\" }).toString(\"base64\"),\n    },\n    createdAt: new Date().toISOString(),\n  }\n}\n\n/**\n * Stable short identifier for a daemon, derived from its X25519 public key —\n * the same construction as `sealKeyId` in `@agentproto/secrets/seal` (first 16\n * hex of `sha256(pub DER)`). Displayed everywhere a human confirms identity\n * (offer QR, `pair accept`, `pair ls`). Not a secret.\n */\nexport function identityFingerprint(x25519Pub: string): string {\n  return createHash(\"sha256\")\n    .update(Buffer.from(x25519Pub, \"base64\"))\n    .digest(\"hex\")\n    .slice(0, 16)\n}\n\n/** True for a filesystem \"no such file\" error, without an unchecked cast. */\nfunction isEnoent(err: unknown): boolean {\n  return (\n    typeof err === \"object\" &&\n    err !== null &&\n    \"code\" in err &&\n    err.code === \"ENOENT\"\n  )\n}\n\nfunction isRecord(v: unknown): v is Record<string, unknown> {\n  return typeof v === \"object\" && v !== null\n}\n\nfunction isKeyPair(kp: unknown): boolean {\n  return isRecord(kp) && typeof kp[\"pub\"] === \"string\" && typeof kp[\"priv\"] === \"string\"\n}\n\nfunction isDaemonIdentity(value: unknown): value is DaemonIdentity {\n  if (!isRecord(value)) return false\n  if (value[\"v\"] !== IDENTITY_VERSION) return false\n  if (typeof value[\"createdAt\"] !== \"string\") return false\n  return isKeyPair(value[\"x25519\"]) && isKeyPair(value[\"ed25519\"])\n}\n\n/**\n * Load the daemon identity from `filePath`, creating it on first use. The\n * caller supplies the path (typically `~/.agentproto/identity.json`) so this\n * module stays free of any home-dir policy.\n *\n * The private halves are secret, so a freshly created file is written 0600 and\n * atomically (temp file in the same directory + `rename`, so a crash mid-write\n * can never leave a half-written identity or a world-readable window). A\n * malformed existing file is a hard error — never silently overwritten, since\n * that would rotate the daemon's identity and orphan every existing pairing.\n */\nexport async function loadOrCreateIdentity(\n  filePath: string\n): Promise<DaemonIdentity> {\n  try {\n    const raw = await readFile(filePath, \"utf8\")\n    let parsed: unknown\n    try {\n      parsed = JSON.parse(raw)\n    } catch {\n      throw new IdentityError(\n        `identity file ${filePath} is not valid JSON — refusing to overwrite; ` +\n          `move it aside to regenerate`\n      )\n    }\n    if (!isDaemonIdentity(parsed)) {\n      throw new IdentityError(\n        `identity file ${filePath} is malformed or an unsupported version — ` +\n          `refusing to overwrite; move it aside to regenerate`\n      )\n    }\n    return parsed\n  } catch (err) {\n    if (!isEnoent(err)) throw err\n    // ENOENT → first run; fall through to lazy creation below.\n  }\n\n  const identity = generateIdentity()\n  await persistIdentity(filePath, identity)\n  return identity\n}\n\n/** Atomic 0600 write: serialize to a sibling temp file, chmod it before it\n *  holds any secret bytes, then rename over the target. */\nasync function persistIdentity(\n  filePath: string,\n  identity: DaemonIdentity\n): Promise<void> {\n  const dir = dirname(filePath)\n  await mkdir(dir, { recursive: true })\n  const tmp = join(dir, `.${basename(filePath)}.tmp-${process.pid}`)\n  await writeFile(tmp, JSON.stringify(identity, null, 2) + \"\\n\", {\n    encoding: \"utf8\",\n    mode: 0o600,\n  })\n  // Belt-and-suspenders: writeFile's mode is subject to umask on some\n  // platforms, so tighten explicitly before the file is visible at its\n  // final name. Windows / mounts that ignore chmod fall back to the\n  // already-private user profile dir.\n  await chmod(tmp, 0o600).catch(() => {})\n  await rename(tmp, filePath)\n}\n\n/**\n * Sign a handshake transcript with the daemon's Ed25519 private key. Returns a\n * base64 signature. `transcript` is the exact bytes both sides agree on\n * (`sha256(e_pub ‖ ct₀ ‖ d_e_pub)`); signing it — not the raw messages — is\n * what binds the daemon's authenticity to the whole exchange.\n */\nexport function signTranscript(\n  ed25519Priv: string,\n  transcript: Uint8Array\n): string {\n  let priv\n  try {\n    priv = createPrivateKey({\n      key: Buffer.from(ed25519Priv, \"base64\"),\n      format: \"der\",\n      type: \"pkcs8\",\n    })\n  } catch {\n    throw new IdentityError(\"invalid ed25519 private key\")\n  }\n  // Ed25519 takes a null digest algorithm — it hashes internally.\n  return edSign(null, Buffer.from(transcript), priv).toString(\"base64\")\n}\n\n/**\n * Verify a transcript signature against a daemon's Ed25519 public key. Returns\n * a boolean — never throws on a bad signature (only on a structurally invalid\n * key), so callers branch on the result rather than a control-flow exception.\n */\nexport function verifyTranscript(\n  ed25519Pub: string,\n  transcript: Uint8Array,\n  signature: string\n): boolean {\n  let pub\n  try {\n    pub = createPublicKey({\n      key: Buffer.from(ed25519Pub, \"base64\"),\n      format: \"der\",\n      type: \"spki\",\n    })\n  } catch {\n    throw new IdentityError(\"invalid ed25519 public key\")\n  }\n  let sig: Buffer\n  try {\n    sig = Buffer.from(signature, \"base64\")\n  } catch {\n    return false\n  }\n  try {\n    return edVerify(null, Buffer.from(transcript), pub, sig)\n  } catch {\n    return false\n  }\n}\n"]}

package/dist/cli.d.ts

@@ -1,2 +1,48 @@
+/**
+ * agentproto-secrets — a small CLI over the seal primitive + provision flow.
+ *
+ *   agentproto-secrets keygen                          mint a sealing keypair (JSON)
+ *   agentproto-secrets seal     --pubkey <b64> [src]   seal a value -> sealed blob
+ *   agentproto-secrets unseal   --privkey <b64> [blob] open a sealed blob -> plaintext
+ *   agentproto-secrets provision --provider P --method M \
+ *       --seal-key-url URL --install-url URL [--header 'K: V']... [src]
+ *                                                       seal a local credential and
+ *                                                       install it into a vault,
+ *                                                       carrying only ciphertext
+ *
+ *   credential source [src]: --from-file <path> [--json-path a.b.c] | --from-env <VAR>
+ *
+ * Vendor-neutral: `provision` takes the server's URLs + auth headers as flags.
+ * The plaintext credential is read, sealed, and sent — it is never printed.
+ * When `--header` is omitted and `--provider` names an auth provider
+ * registered in `@agentproto/auth`, the Authorization header is instead
+ * resolved via `CredentialBroker` (this is the only file in this package
+ * that imports `@agentproto/auth` — see `ProvisionAuthDeps` below).
+ */
+/** Structural shape `CredentialBroker` satisfies — kept local (rather than
+ *  importing the class as a type) so tests can inject a fake without touching
+ *  Keychain or the network. */
+interface AuthHeaderResolver {
+    resolveHeaders(o: {
+        path: string;
+        audience?: string;
+        server?: string;
+        signal?: AbortSignal;
+    }): Promise<Record<string, string>>;
+}
+interface ProvisionAuthDeps {
+    /** Whether `providerId` is a known `@agentproto/auth` auth provider. */
+    isRegistered(providerId: string): boolean;
+    resolver: AuthHeaderResolver;
+}
+/**
+ * Resolve the Authorization (etc.) headers a provision request carries.
+ * `--header` is an explicit override — when present, the broker is never
+ * consulted. Otherwise, a `--provider` registered in `@agentproto/auth`
+ * resolves its headers via the broker; an unregistered provider degrades to
+ * `explicitHeaders` (empty when none were passed) rather than failing.
+ */
+declare function resolveProvisionHeaders(provider: string, explicitHeaders: string[], deps?: ProvisionAuthDeps): Promise<Record<string, string>>;
+declare function main(): Promise<number>;
 
-export {  }
+export { type AuthHeaderResolver, type ProvisionAuthDeps, main, resolveProvisionHeaders };

package/dist/cli.mjs

@@ -1,13 +1,12 @@
 import { listRecipeIds, resolveRecipeMethod, resolveSourceSpec } from './chunk-NEGXQWE5.mjs';
 import { httpTarget, provisionSealed, resolveCredential } from './chunk-NLZ5HXGO.mjs';
 import { unseal, seal, generateSealKeyPair, sealKeyId } from './chunk-MVHOJPML.mjs';
+import { CredentialBroker, getAuthProvider, KeychainStore } from '@agentproto/auth';
 
 /**
  * @agentproto/secrets v0.1.0-alpha
  * AIP-19 SECRETS.md `defineSecrets` reference implementation.
  */
-
-// src/cli.ts
 function parse(argv) {
   const positionals = [];
   const flags = {};
@@ -90,6 +89,23 @@ function parseHeaders(raw) {
   }
   return out;
 }
+function defaultProvisionAuthDeps() {
+  return {
+    isRegistered: (id) => getAuthProvider(id) !== void 0,
+    resolver: new CredentialBroker({
+      store: new KeychainStore(),
+      getProvider: getAuthProvider
+    })
+  };
+}
+async function resolveProvisionHeaders(provider, explicitHeaders, deps) {
+  const parsed = parseHeaders(explicitHeaders);
+  if (explicitHeaders.length > 0) return parsed;
+  const { isRegistered, resolver } = deps ?? defaultProvisionAuthDeps();
+  if (!isRegistered(provider)) return parsed;
+  const brokered = await resolver.resolveHeaders({ path: provider, audience: "api" });
+  return { ...brokered, ...parsed };
+}
 var USAGE = `agentproto-secrets \u2014 seal secrets and install them into a vault
 
   keygen                                   mint a sealing keypair (JSON to stdout)
@@ -150,11 +166,13 @@ async function main() {
       } catch (err) {
         return fail(err instanceof Error ? err.message : String(err));
       }
-      const target = httpTarget({
-        sealKeyUrl,
-        installUrl,
-        headers: parseHeaders(args.headers)
-      });
+      let headers;
+      try {
+        headers = await resolveProvisionHeaders(provider, args.headers);
+      } catch (err) {
+        return fail(err instanceof Error ? err.message : String(err));
+      }
+      const target = httpTarget({ sealKeyUrl, installUrl, headers });
       try {
         const out = await provisionSealed({
           target,
@@ -190,14 +208,7 @@ function fail(message) {
 `);
   return 1;
 }
-main().then((code) => {
-  process.exitCode = code;
-}).catch((err) => {
-  process.stderr.write(
-    `agentproto-secrets: ${err instanceof Error ? err.message : String(err)}
-`
-  );
-  process.exitCode = 1;
-});
+
+export { main, resolveProvisionHeaders };
 //# sourceMappingURL=cli.mjs.map
 //# sourceMappingURL=cli.mjs.map