@caplets/core 0.25.0 → 0.26.0

package/dist/{validation-DgxCzt-A.js → validation-C4tYXw6G.js}

@@ -113,7 +113,7 @@ function errorResult(error, fallback) {
 const SERVER_ID_PATTERN = /^[a-zA-Z0-9_-]{1,64}$/;
 const HEADER_NAME_PATTERN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
 const HTTP_BASE_URL_PATTERN = /^(?![a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^/?#]*@)[^?#]*$/;
-const FORBIDDEN_HEADERS = new Set([
+const FORBIDDEN_HEADERS = /* @__PURE__ */ new Set([
 	"accept",
 	"authorization",
 	"connection",

package/dist/vault/access.d.ts

@@ -0,0 +1,5 @@
+import type { VaultAccessGrant, VaultAccessGrantFilter, VaultAccessGrantInput, VaultConfigOrigin } from "./types";
+export declare function normalizeVaultGrant(input: VaultAccessGrantInput): VaultAccessGrant;
+export declare function upsertVaultGrant(grants: VaultAccessGrant[], input: VaultAccessGrantInput): VaultAccessGrant[];
+export declare function filterVaultGrants(grants: VaultAccessGrant[], filter?: VaultAccessGrantFilter): VaultAccessGrant[];
+export declare function sameOrigin(left: VaultConfigOrigin, right: VaultConfigOrigin): boolean;

package/dist/vault/crypto.d.ts

@@ -0,0 +1,19 @@
+import { Buffer } from "node:buffer";
+export type VaultEncryptedRecord = {
+    version: 1;
+    algorithm: "aes-256-gcm";
+    nonce: string;
+    ciphertext: string;
+    authTag: string;
+    valueBytes: number;
+    createdAt: string;
+    updatedAt: string;
+};
+export declare function encryptVaultValue(input: {
+    plaintext: string;
+    key: Buffer;
+    now: Date;
+    existing?: VaultEncryptedRecord | undefined;
+}): VaultEncryptedRecord;
+export declare function decryptVaultValue(record: unknown, key: Buffer): string;
+export declare function parseEncryptedRecord(record: unknown): VaultEncryptedRecord;

package/dist/vault/index.d.ts

@@ -0,0 +1,40 @@
+import { validateVaultKeyName } from "./keys";
+import { VAULT_MAX_VALUE_BYTES, type VaultAccessGrant, type VaultAccessGrantFilter, type VaultAccessGrantInput, type VaultConfigOrigin, type VaultDeleteStatus, type VaultKeySourceStatus, type VaultResolvedGrant, type VaultValueStatus } from "./types";
+export { VAULT_MAX_VALUE_BYTES, validateVaultKeyName, type VaultAccessGrant, type VaultAccessGrantFilter, type VaultAccessGrantInput, type VaultConfigOrigin, type VaultDeleteStatus, type VaultKeySourceStatus, type VaultResolvedGrant, type VaultValueStatus, };
+type FileVaultStoreOptions = {
+    root?: string | undefined;
+    env?: Record<string, string | undefined> | undefined;
+};
+type SetOptions = {
+    force?: boolean | undefined;
+    now?: Date | undefined;
+};
+export declare class FileVaultStore {
+    readonly root: string;
+    readonly env: Record<string, string | undefined>;
+    readonly paths: {
+        keyFile: string;
+        valuesDir: string;
+        grantsFile: string;
+    };
+    constructor(options?: FileVaultStoreOptions);
+    valuePath(key: string): string;
+    set(key: string, value: string, options?: SetOptions): VaultValueStatus;
+    getStatus(key: string): VaultValueStatus;
+    listValues(): VaultValueStatus[];
+    resolveValue(key: string): string;
+    delete(key: string): VaultDeleteStatus;
+    keySourceStatus(): VaultKeySourceStatus;
+    grantAccess(input: VaultAccessGrantInput): VaultAccessGrant;
+    listAccess(filter?: VaultAccessGrantFilter): VaultAccessGrant[];
+    revokeAccess(filter: VaultAccessGrantFilter): VaultAccessGrant[];
+    resolveGrantedValue(input: {
+        referenceName: string;
+        capletId: string;
+        origin: VaultConfigOrigin;
+    }): VaultResolvedGrant;
+    private loadValueRecord;
+    private statusForRecord;
+    private loadAccessGrants;
+    private saveAccessGrants;
+}

package/dist/vault/keys.d.ts

@@ -0,0 +1,15 @@
+import { Buffer } from "node:buffer";
+import type { VaultKeySourceStatus } from "./types";
+export declare function validateVaultKeyName(name: string): string;
+export declare function loadVaultKey(input: {
+    keyFile: string;
+    env?: Record<string, string | undefined> | undefined;
+}): Buffer;
+export declare function ensureVaultKey(input: {
+    keyFile: string;
+    env?: Record<string, string | undefined> | undefined;
+}): Buffer;
+export declare function vaultKeySourceStatus(input: {
+    keyFile: string;
+    env?: Record<string, string | undefined> | undefined;
+}): VaultKeySourceStatus;

package/dist/vault/store.d.ts

@@ -0,0 +1,4 @@
+export declare function ensurePrivateDir(path: string): void;
+export declare function writePrivateFileAtomic(path: string, contents: string): void;
+export declare function readJsonFile<T>(path: string, fallback: T): T;
+export declare function deleteFile(path: string): boolean;

package/dist/vault/types.d.ts

@@ -0,0 +1,68 @@
+import type { ConfigSourceKind } from "../config";
+export declare const VAULT_MAX_VALUE_BYTES: number;
+export type VaultConfigOrigin = {
+    kind: ConfigSourceKind;
+    path: string;
+};
+export type VaultKeySourceStatus = {
+    available: true;
+    source: "env";
+    keyFile?: undefined;
+} | {
+    available: true;
+    source: "file";
+    keyFile: string;
+} | {
+    available: false;
+    source: "env" | "file";
+    reason: "missing" | "invalid" | "unreadable" | "wrong-permissions" | "unsupported-version";
+    keyFile?: string | undefined;
+};
+export type VaultValueStatus = {
+    key: string;
+    present: boolean;
+    valueBytes?: number | undefined;
+    createdAt?: string | undefined;
+    updatedAt?: string | undefined;
+};
+export type VaultAccessGrant = {
+    storedKey: string;
+    referenceName: string;
+    capletId: string;
+    origin: VaultConfigOrigin;
+    createdAt: string;
+    updatedAt: string;
+};
+export type VaultAccessGrantInput = {
+    storedKey: string;
+    referenceName: string;
+    capletId: string;
+    origin: VaultConfigOrigin;
+    now?: Date | undefined;
+};
+export type VaultAccessGrantFilter = {
+    storedKey?: string | undefined;
+    referenceName?: string | undefined;
+    capletId?: string | undefined;
+    origin?: VaultConfigOrigin | undefined;
+};
+export type VaultResolvedGrant = {
+    storedKey: string;
+    value: string;
+} | {
+    reason: "ungranted";
+    referenceName: string;
+    capletId: string;
+    origin: VaultConfigOrigin;
+} | {
+    reason: "missing";
+    storedKey: string;
+    referenceName: string;
+    capletId: string;
+    origin: VaultConfigOrigin;
+};
+export type VaultDeleteStatus = {
+    key: string;
+    deleted: boolean;
+    grantsRetained: number;
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@caplets/core",
-  "version": "0.25.0",
+  "version": "0.26.0",
   "description": "Core runtime library for Caplets Code Mode and progressive disclosure gateways.",
   "keywords": [
     "caplets",