@agentproto/secrets 0.2.5 → 1.0.0

package/dist/{chunk-NLZ5HXGO.mjs → chunk-7V6U6DII.mjs}

@@ -1,4 +1,4 @@
-import { seal } from './chunk-MVHOJPML.mjs';
+import { seal } from './chunk-PCFPJ47T.mjs';
 
 /**
  * @agentproto/secrets v0.1.0-alpha
@@ -8,7 +8,7 @@ import { seal } from './chunk-MVHOJPML.mjs';
 // src/provision/index.ts
 async function provisionSealed(input) {
   const key = await input.target.fetchSealKey();
-  const sealedValue = seal(input.credential, key.publicKey);
+  const sealedValue = await seal(input.credential, key.publicKey);
   const result = await input.target.installSealed({
     provider: input.provider,
     methodId: input.methodId,
@@ -86,5 +86,5 @@ async function resolveCredential(source) {
 }
 
 export { extractJsonPath, httpTarget, provisionSealed, resolveCredential };
-//# sourceMappingURL=chunk-NLZ5HXGO.mjs.map
-//# sourceMappingURL=chunk-NLZ5HXGO.mjs.map
+//# sourceMappingURL=chunk-7V6U6DII.mjs.map
+//# sourceMappingURL=chunk-7V6U6DII.mjs.map

package/dist/{chunk-NLZ5HXGO.mjs.map → chunk-7V6U6DII.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/provision/index.ts"],"names":[],"mappings":";;;;;;;;AA8DA,eAAsB,gBACpB,KAAA,EAC+C;AAC/C,EAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,MAAA,CAAO,YAAA,EAAa;AAC5C,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,UAAA,EAAY,IAAI,SAAS,CAAA;AACxD,EAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,MAAA,CAAO,aAAA,CAAc;AAAA,IAC9C,UAAU,KAAA,CAAM,QAAA;AAAA,IAChB,UAAU,KAAA,CAAM,QAAA;AAAA,IAChB,KAAA,EAAO,WAAA;AAAA,IACP,OAAO,GAAA,CAAI,KAAA;AAAA,IACX,GAAI,MAAM,KAAA,GAAQ,EAAE,OAAO,KAAA,CAAM,KAAA,KAAU;AAAC,GAC7C,CAAA;AACD,EAAA,OAAO,EAAE,GAAG,MAAA,EAAQ,KAAA,EAAO,IAAI,KAAA,EAAM;AACvC;AAOO,SAAS,WAAW,MAAA,EAMH;AACtB,EAAA,MAAM,OAAA,GAAU,OAAO,SAAA,IAAa,KAAA;AACpC,EAAA,OAAO;AAAA,IACL,MAAM,YAAA,GAAe;AACnB,MAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,MAAA,CAAO,UAAA,EAAY;AAAA,QAC3C,SAAS,MAAA,CAAO;AAAA,OACjB,CAAA;AACD,MAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACtB,QAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,MACxD;AACA,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,MAC7D;AACA,MAAA,OAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,IACzB,CAAA;AAAA,IACA,MAAM,cAAc,YAAA,EAAc;AAChC,MAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,MAAA,CAAO,UAAA,EAAY;AAAA,QAC3C,MAAA,EAAQ,MAAA;AAAA,QACR,SAAS,EAAE,GAAG,MAAA,CAAO,OAAA,EAAS,gBAAgB,kBAAA,EAAmB;AAAA,QACjE,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,GAAG,YAAA,EAAc,MAAA,EAAQ,MAAM;AAAA,OACvD,CAAA;AACD,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC5C,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,qBAAA,EAAwB,IAAI,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CAAA;AAAA,MAC9D;AACA,MAAA,OAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,IACzB;AAAA,GACF;AACF;AAgBA,SAAS,WAAW,CAAA,EAAmB;AACrC,EAAA,IAAI,CAAA,KAAM,GAAA,EAAK,OAAO,OAAA,EAAQ;AAC9B,EAAA,IAAI,CAAA,CAAE,UAAA,CAAW,IAAI,CAAA,EAAG,OAAO,QAAA,CAAS,OAAA,EAAQ,EAAG,CAAA,CAAE,KAAA,CAAM,CAAC,CAAC,CAAA;AAC7D,EAAA,OAAO,CAAA;AACT;AAIA,SAAS,OAAA,GAAkB;AACzB,EAAA,OACE,OAAA,CAAQ,GAAA,CAAI,IAAA,IAAQ,OAAA,CAAQ,IAAI,WAAA,IAAe,GAAA;AAEnD;AACA,SAAS,QAAA,CAAS,GAAW,CAAA,EAAmB;AAC9C,EAAA,OAAO,CAAA,CAAE,QAAQ,KAAA,EAAO,EAAE,IAAI,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACzD;AAEO,SAAS,eAAA,CAAgB,KAAa,IAAA,EAAsB;AACjE,EAAA,IAAI,GAAA,GAAe,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AACjC,EAAA,KAAA,MAAW,IAAA,IAAQ,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA,EAAG;AAClC,IAAA,IAAI,GAAA,IAAO,IAAA,IAAQ,OAAO,GAAA,KAAQ,QAAA,EAAU;AAC1C,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,IAAI,CAAA,mBAAA,CAAqB,CAAA;AAAA,IAChE;AACA,IAAA,GAAA,GAAO,IAAgC,IAAI,CAAA;AAAA,EAC7C;AACA,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,WAAW,CAAA,EAAG;AAC/C,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,IAAI,CAAA,2BAAA,CAA6B,CAAA;AAAA,EACxE;AACA,EAAA,OAAO,GAAA;AACT;AAOA,eAAsB,kBACpB,MAAA,EACiB;AACjB,EAAA,IAAI,OAAO,OAAA,EAAS;AAClB,IAAA,MAAM,CAAA,GAAI,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,OAAO,CAAA;AACpC,IAAA,IAAI,CAAC,GAAG,MAAM,IAAI,MAAM,CAAA,QAAA,EAAW,MAAA,CAAO,OAAO,CAAA,iBAAA,CAAmB,CAAA;AACpE,IAAA,OAAO,CAAA;AAAA,EACT;AACA,EAAA,IAAI,CAAC,OAAO,QAAA,EAAU;AACpB,IAAA,MAAM,IAAI,MAAM,qDAAgD,CAAA;AAAA,EAClE;AACA,EAAA,MAAM,EAAE,YAAA,EAAa,GAAI,MAAM,OAAO,IAAS,CAAA;AAC/C,EAAA,MAAM,MAAM,YAAA,CAAa,UAAA,CAAW,MAAA,CAAO,QAAQ,GAAG,MAAM,CAAA;AAC5D,EAAA,OAAO,MAAA,CAAO,WAAW,eAAA,CAAgB,GAAA,EAAK,OAAO,QAAQ,CAAA,GAAI,IAAI,IAAA,EAAK;AAC5E","file":"chunk-NLZ5HXGO.mjs","sourcesContent":["/**\n * @agentproto/secrets/provision — seal a secret and install it into a remote\n * vault, carrying only ciphertext.\n *\n * The flow is: resolve a credential → fetch the target's sealing public key →\n * seal to it → hand the sealed blob to the target's install. The plaintext\n * exists only on the origin machine and, transiently, inside the target's\n * unseal boundary — never in whatever drives this (an agent, a relay, a log).\n *\n * The target is an INJECTED PORT: this module knows nothing about any specific\n * server. A caller provides a `SealedInstallTarget` — `httpTarget()` builds a\n * generic one from a seal-key URL + install URL + headers; a host-specific\n * caller (e.g. a product that knows its own server's paths and auth) injects\n * its own. No vendor names leak into this package.\n */\n\nimport { seal } from \"../seal/index.js\"\n\n/** Public sealing material a target advertises so a sender can seal to it. */\nexport interface SealKeyInfo {\n  keyId: string\n  alg: string\n  publicKey: string\n}\n\n/** The sealed payload handed to a target's install. `value` is already a\n *  sealed envelope (opaque); `keyId` lets the target reject a value sealed\n *  against a rotated key. */\nexport interface SealedInstallInput {\n  provider: string\n  methodId: string\n  value: string\n  keyId: string\n  label?: string\n}\n\n/**\n * A server that can receive a sealed credential. The two halves a provision\n * needs: advertise the sealing key, and accept the sealed install. Implement\n * this for any concrete server; the provision flow is agnostic to how.\n */\nexport interface SealedInstallTarget {\n  fetchSealKey(): Promise<SealKeyInfo>\n  installSealed(input: SealedInstallInput): Promise<{ secretId?: string }>\n}\n\nexport interface ProvisionSealedInput {\n  target: SealedInstallTarget\n  provider: string\n  methodId: string\n  /** The plaintext credential. Resolve it (e.g. via `resolveCredential`) right\n   *  before calling so it lives as briefly as possible; it is sealed here and\n   *  never returned or logged. */\n  credential: string\n  label?: string\n}\n\n/**\n * Seal `credential` to the target's current key and install it. Returns the\n * target's result plus the keyId used. The plaintext is consumed here and\n * never leaves.\n */\nexport async function provisionSealed(\n  input: ProvisionSealedInput\n): Promise<{ secretId?: string; keyId: string }> {\n  const key = await input.target.fetchSealKey()\n  const sealedValue = seal(input.credential, key.publicKey)\n  const result = await input.target.installSealed({\n    provider: input.provider,\n    methodId: input.methodId,\n    value: sealedValue,\n    keyId: key.keyId,\n    ...(input.label ? { label: input.label } : {}),\n  })\n  return { ...result, keyId: key.keyId }\n}\n\n/**\n * Build a generic HTTP target from a seal-key URL, an install URL, and\n * optional headers (auth). Vendor-neutral — the URLs and headers are the\n * caller's to supply. The install POSTs `{ ...input, sealed: true }` as JSON.\n */\nexport function httpTarget(config: {\n  sealKeyUrl: string\n  installUrl: string\n  headers?: Record<string, string>\n  /** Injected for tests; defaults to global fetch. */\n  fetchImpl?: typeof fetch\n}): SealedInstallTarget {\n  const doFetch = config.fetchImpl ?? fetch\n  return {\n    async fetchSealKey() {\n      const res = await doFetch(config.sealKeyUrl, {\n        headers: config.headers,\n      })\n      if (res.status === 404) {\n        throw new Error(\"target has no sealing key configured\")\n      }\n      if (!res.ok) {\n        throw new Error(`seal-key fetch failed: HTTP ${res.status}`)\n      }\n      return (await res.json()) as SealKeyInfo\n    },\n    async installSealed(installInput) {\n      const res = await doFetch(config.installUrl, {\n        method: \"POST\",\n        headers: { ...config.headers, \"content-type\": \"application/json\" },\n        body: JSON.stringify({ ...installInput, sealed: true }),\n      })\n      if (!res.ok) {\n        const text = await res.text().catch(() => \"\")\n        throw new Error(`install failed: HTTP ${res.status} ${text}`)\n      }\n      return (await res.json()) as { secretId?: string }\n    },\n  }\n}\n\n// ── Credential resolution (local sources) ──────────────────────────────\n// A small convenience for CLI / origin-machine callers. Reads a credential\n// from an env var or a file (optionally extracting a JSON field). The result\n// is sensitive — seal it immediately, never print it.\n\nexport interface CredentialSource {\n  /** Read from this process env var. */\n  fromEnv?: string\n  /** Read from this file path (`~` expands to the home dir). */\n  fromFile?: string\n  /** Dot-path to extract a string from the file's JSON (else whole file). */\n  jsonPath?: string\n}\n\nfunction expandHome(p: string): string {\n  if (p === \"~\") return homeDir()\n  if (p.startsWith(\"~/\")) return joinPath(homeDir(), p.slice(2))\n  return p\n}\n\n// Lazily reach for node built-ins so the module stays importable in any\n// runtime; resolveCredential is only called by origin-machine callers.\nfunction homeDir(): string {\n  return (\n    process.env.HOME ?? process.env.USERPROFILE ?? \"~\"\n  )\n}\nfunction joinPath(a: string, b: string): string {\n  return a.replace(/\\/$/, \"\") + \"/\" + b.replace(/^\\//, \"\")\n}\n\nexport function extractJsonPath(raw: string, path: string): string {\n  let cur: unknown = JSON.parse(raw)\n  for (const part of path.split(\".\")) {\n    if (cur == null || typeof cur !== \"object\") {\n      throw new Error(`credential field '${path}' not found in file`)\n    }\n    cur = (cur as Record<string, unknown>)[part]\n  }\n  if (typeof cur !== \"string\" || cur.length === 0) {\n    throw new Error(`credential field '${path}' is not a non-empty string`)\n  }\n  return cur\n}\n\n/**\n * Resolve a plaintext credential from a local source. Sensitive — callers\n * seal the result immediately and never print it. Uses a dynamic `fs` import\n * so the module has no hard Node filesystem dependency at import time.\n */\nexport async function resolveCredential(\n  source: CredentialSource\n): Promise<string> {\n  if (source.fromEnv) {\n    const v = process.env[source.fromEnv]\n    if (!v) throw new Error(`env var ${source.fromEnv} is empty / unset`)\n    return v\n  }\n  if (!source.fromFile) {\n    throw new Error(\"no credential source — set fromFile or fromEnv\")\n  }\n  const { readFileSync } = await import(\"node:fs\")\n  const raw = readFileSync(expandHome(source.fromFile), \"utf8\")\n  return source.jsonPath ? extractJsonPath(raw, source.jsonPath) : raw.trim()\n}\n"]}
+{"version":3,"sources":["../src/provision/index.ts"],"names":[],"mappings":";;;;;;;;AA8DA,eAAsB,gBACpB,KAAA,EAC+C;AAC/C,EAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,MAAA,CAAO,YAAA,EAAa;AAC5C,EAAA,MAAM,cAAc,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,EAAY,IAAI,SAAS,CAAA;AAC9D,EAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,MAAA,CAAO,aAAA,CAAc;AAAA,IAC9C,UAAU,KAAA,CAAM,QAAA;AAAA,IAChB,UAAU,KAAA,CAAM,QAAA;AAAA,IAChB,KAAA,EAAO,WAAA;AAAA,IACP,OAAO,GAAA,CAAI,KAAA;AAAA,IACX,GAAI,MAAM,KAAA,GAAQ,EAAE,OAAO,KAAA,CAAM,KAAA,KAAU;AAAC,GAC7C,CAAA;AACD,EAAA,OAAO,EAAE,GAAG,MAAA,EAAQ,KAAA,EAAO,IAAI,KAAA,EAAM;AACvC;AAOO,SAAS,WAAW,MAAA,EAMH;AACtB,EAAA,MAAM,OAAA,GAAU,OAAO,SAAA,IAAa,KAAA;AACpC,EAAA,OAAO;AAAA,IACL,MAAM,YAAA,GAAe;AACnB,MAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,MAAA,CAAO,UAAA,EAAY;AAAA,QAC3C,SAAS,MAAA,CAAO;AAAA,OACjB,CAAA;AACD,MAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACtB,QAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,MACxD;AACA,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,MAC7D;AACA,MAAA,OAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,IACzB,CAAA;AAAA,IACA,MAAM,cAAc,YAAA,EAAc;AAChC,MAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,MAAA,CAAO,UAAA,EAAY;AAAA,QAC3C,MAAA,EAAQ,MAAA;AAAA,QACR,SAAS,EAAE,GAAG,MAAA,CAAO,OAAA,EAAS,gBAAgB,kBAAA,EAAmB;AAAA,QACjE,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,GAAG,YAAA,EAAc,MAAA,EAAQ,MAAM;AAAA,OACvD,CAAA;AACD,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC5C,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,qBAAA,EAAwB,IAAI,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CAAA;AAAA,MAC9D;AACA,MAAA,OAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,IACzB;AAAA,GACF;AACF;AAgBA,SAAS,WAAW,CAAA,EAAmB;AACrC,EAAA,IAAI,CAAA,KAAM,GAAA,EAAK,OAAO,OAAA,EAAQ;AAC9B,EAAA,IAAI,CAAA,CAAE,UAAA,CAAW,IAAI,CAAA,EAAG,OAAO,QAAA,CAAS,OAAA,EAAQ,EAAG,CAAA,CAAE,KAAA,CAAM,CAAC,CAAC,CAAA;AAC7D,EAAA,OAAO,CAAA;AACT;AAIA,SAAS,OAAA,GAAkB;AACzB,EAAA,OACE,OAAA,CAAQ,GAAA,CAAI,IAAA,IAAQ,OAAA,CAAQ,IAAI,WAAA,IAAe,GAAA;AAEnD;AACA,SAAS,QAAA,CAAS,GAAW,CAAA,EAAmB;AAC9C,EAAA,OAAO,CAAA,CAAE,QAAQ,KAAA,EAAO,EAAE,IAAI,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACzD;AAEO,SAAS,eAAA,CAAgB,KAAa,IAAA,EAAsB;AACjE,EAAA,IAAI,GAAA,GAAe,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AACjC,EAAA,KAAA,MAAW,IAAA,IAAQ,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA,EAAG;AAClC,IAAA,IAAI,GAAA,IAAO,IAAA,IAAQ,OAAO,GAAA,KAAQ,QAAA,EAAU;AAC1C,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,IAAI,CAAA,mBAAA,CAAqB,CAAA;AAAA,IAChE;AACA,IAAA,GAAA,GAAO,IAAgC,IAAI,CAAA;AAAA,EAC7C;AACA,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,WAAW,CAAA,EAAG;AAC/C,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,IAAI,CAAA,2BAAA,CAA6B,CAAA;AAAA,EACxE;AACA,EAAA,OAAO,GAAA;AACT;AAOA,eAAsB,kBACpB,MAAA,EACiB;AACjB,EAAA,IAAI,OAAO,OAAA,EAAS;AAClB,IAAA,MAAM,CAAA,GAAI,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,OAAO,CAAA;AACpC,IAAA,IAAI,CAAC,GAAG,MAAM,IAAI,MAAM,CAAA,QAAA,EAAW,MAAA,CAAO,OAAO,CAAA,iBAAA,CAAmB,CAAA;AACpE,IAAA,OAAO,CAAA;AAAA,EACT;AACA,EAAA,IAAI,CAAC,OAAO,QAAA,EAAU;AACpB,IAAA,MAAM,IAAI,MAAM,qDAAgD,CAAA;AAAA,EAClE;AACA,EAAA,MAAM,EAAE,YAAA,EAAa,GAAI,MAAM,OAAO,IAAS,CAAA;AAC/C,EAAA,MAAM,MAAM,YAAA,CAAa,UAAA,CAAW,MAAA,CAAO,QAAQ,GAAG,MAAM,CAAA;AAC5D,EAAA,OAAO,MAAA,CAAO,WAAW,eAAA,CAAgB,GAAA,EAAK,OAAO,QAAQ,CAAA,GAAI,IAAI,IAAA,EAAK;AAC5E","file":"chunk-7V6U6DII.mjs","sourcesContent":["/**\n * @agentproto/secrets/provision — seal a secret and install it into a remote\n * vault, carrying only ciphertext.\n *\n * The flow is: resolve a credential → fetch the target's sealing public key →\n * seal to it → hand the sealed blob to the target's install. The plaintext\n * exists only on the origin machine and, transiently, inside the target's\n * unseal boundary — never in whatever drives this (an agent, a relay, a log).\n *\n * The target is an INJECTED PORT: this module knows nothing about any specific\n * server. A caller provides a `SealedInstallTarget` — `httpTarget()` builds a\n * generic one from a seal-key URL + install URL + headers; a host-specific\n * caller (e.g. a product that knows its own server's paths and auth) injects\n * its own. No vendor names leak into this package.\n */\n\nimport { seal } from \"../seal/index.js\"\n\n/** Public sealing material a target advertises so a sender can seal to it. */\nexport interface SealKeyInfo {\n  keyId: string\n  alg: string\n  publicKey: string\n}\n\n/** The sealed payload handed to a target's install. `value` is already a\n *  sealed envelope (opaque); `keyId` lets the target reject a value sealed\n *  against a rotated key. */\nexport interface SealedInstallInput {\n  provider: string\n  methodId: string\n  value: string\n  keyId: string\n  label?: string\n}\n\n/**\n * A server that can receive a sealed credential. The two halves a provision\n * needs: advertise the sealing key, and accept the sealed install. Implement\n * this for any concrete server; the provision flow is agnostic to how.\n */\nexport interface SealedInstallTarget {\n  fetchSealKey(): Promise<SealKeyInfo>\n  installSealed(input: SealedInstallInput): Promise<{ secretId?: string }>\n}\n\nexport interface ProvisionSealedInput {\n  target: SealedInstallTarget\n  provider: string\n  methodId: string\n  /** The plaintext credential. Resolve it (e.g. via `resolveCredential`) right\n   *  before calling so it lives as briefly as possible; it is sealed here and\n   *  never returned or logged. */\n  credential: string\n  label?: string\n}\n\n/**\n * Seal `credential` to the target's current key and install it. Returns the\n * target's result plus the keyId used. The plaintext is consumed here and\n * never leaves.\n */\nexport async function provisionSealed(\n  input: ProvisionSealedInput\n): Promise<{ secretId?: string; keyId: string }> {\n  const key = await input.target.fetchSealKey()\n  const sealedValue = await seal(input.credential, key.publicKey)\n  const result = await input.target.installSealed({\n    provider: input.provider,\n    methodId: input.methodId,\n    value: sealedValue,\n    keyId: key.keyId,\n    ...(input.label ? { label: input.label } : {}),\n  })\n  return { ...result, keyId: key.keyId }\n}\n\n/**\n * Build a generic HTTP target from a seal-key URL, an install URL, and\n * optional headers (auth). Vendor-neutral — the URLs and headers are the\n * caller's to supply. The install POSTs `{ ...input, sealed: true }` as JSON.\n */\nexport function httpTarget(config: {\n  sealKeyUrl: string\n  installUrl: string\n  headers?: Record<string, string>\n  /** Injected for tests; defaults to global fetch. */\n  fetchImpl?: typeof fetch\n}): SealedInstallTarget {\n  const doFetch = config.fetchImpl ?? fetch\n  return {\n    async fetchSealKey() {\n      const res = await doFetch(config.sealKeyUrl, {\n        headers: config.headers,\n      })\n      if (res.status === 404) {\n        throw new Error(\"target has no sealing key configured\")\n      }\n      if (!res.ok) {\n        throw new Error(`seal-key fetch failed: HTTP ${res.status}`)\n      }\n      return (await res.json()) as SealKeyInfo\n    },\n    async installSealed(installInput) {\n      const res = await doFetch(config.installUrl, {\n        method: \"POST\",\n        headers: { ...config.headers, \"content-type\": \"application/json\" },\n        body: JSON.stringify({ ...installInput, sealed: true }),\n      })\n      if (!res.ok) {\n        const text = await res.text().catch(() => \"\")\n        throw new Error(`install failed: HTTP ${res.status} ${text}`)\n      }\n      return (await res.json()) as { secretId?: string }\n    },\n  }\n}\n\n// ── Credential resolution (local sources) ──────────────────────────────\n// A small convenience for CLI / origin-machine callers. Reads a credential\n// from an env var or a file (optionally extracting a JSON field). The result\n// is sensitive — seal it immediately, never print it.\n\nexport interface CredentialSource {\n  /** Read from this process env var. */\n  fromEnv?: string\n  /** Read from this file path (`~` expands to the home dir). */\n  fromFile?: string\n  /** Dot-path to extract a string from the file's JSON (else whole file). */\n  jsonPath?: string\n}\n\nfunction expandHome(p: string): string {\n  if (p === \"~\") return homeDir()\n  if (p.startsWith(\"~/\")) return joinPath(homeDir(), p.slice(2))\n  return p\n}\n\n// Lazily reach for node built-ins so the module stays importable in any\n// runtime; resolveCredential is only called by origin-machine callers.\nfunction homeDir(): string {\n  return (\n    process.env.HOME ?? process.env.USERPROFILE ?? \"~\"\n  )\n}\nfunction joinPath(a: string, b: string): string {\n  return a.replace(/\\/$/, \"\") + \"/\" + b.replace(/^\\//, \"\")\n}\n\nexport function extractJsonPath(raw: string, path: string): string {\n  let cur: unknown = JSON.parse(raw)\n  for (const part of path.split(\".\")) {\n    if (cur == null || typeof cur !== \"object\") {\n      throw new Error(`credential field '${path}' not found in file`)\n    }\n    cur = (cur as Record<string, unknown>)[part]\n  }\n  if (typeof cur !== \"string\" || cur.length === 0) {\n    throw new Error(`credential field '${path}' is not a non-empty string`)\n  }\n  return cur\n}\n\n/**\n * Resolve a plaintext credential from a local source. Sensitive — callers\n * seal the result immediately and never print it. Uses a dynamic `fs` import\n * so the module has no hard Node filesystem dependency at import time.\n */\nexport async function resolveCredential(\n  source: CredentialSource\n): Promise<string> {\n  if (source.fromEnv) {\n    const v = process.env[source.fromEnv]\n    if (!v) throw new Error(`env var ${source.fromEnv} is empty / unset`)\n    return v\n  }\n  if (!source.fromFile) {\n    throw new Error(\"no credential source — set fromFile or fromEnv\")\n  }\n  const { readFileSync } = await import(\"node:fs\")\n  const raw = readFileSync(expandHome(source.fromFile), \"utf8\")\n  return source.jsonPath ? extractJsonPath(raw, source.jsonPath) : raw.trim()\n}\n"]}