@clef-sh/core 0.1.20 → 0.1.21-beta.154

package/dist/artifact/hash.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Compute the canonical SHA-256 hash of an artifact's base64-encoded ciphertext.
+ *
+ * Used by the packer to populate `PackedArtifact.ciphertextHash`, by the runtime
+ * to verify integrity on fetch, and by the envelope debugger to recompute on
+ * inspect. A single implementation across all three sites prevents silent
+ * divergence that would hide corruption.
+ */
+export declare function computeCiphertextHash(ciphertext: string): string;
+//# sourceMappingURL=hash.d.ts.map

package/dist/artifact/hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../../src/artifact/hash.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEhE"}

package/dist/artifact/packer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"packer.d.ts","sourceRoot":"","sources":["../../src/artifact/packer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAiB,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAkB,MAAM,SAAS,CAAC;AAKjE;;;;;;GAMG;AACH,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAFJ,UAAU,EAAE,iBAAiB,EAC7B,aAAa,EAAE,aAAa,EAC5B,GAAG,CAAC,EAAE,WAAW,YAAA;IAGpC;;;OAGG;IACG,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CAiI9F"}
+{"version":3,"file":"packer.d.ts","sourceRoot":"","sources":["../../src/artifact/packer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAiB,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAkB,MAAM,SAAS,CAAC;AAMjE;;;;;;GAMG;AACH,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAFJ,UAAU,EAAE,iBAAiB,EAC7B,aAAa,EAAE,aAAa,EAC5B,GAAG,CAAC,EAAE,WAAW,YAAA;IAGpC;;;OAGG;IACG,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CAiI9F"}

package/dist/envelope-debug/builders.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Pure builders that produce the envelope-debug output shapes from a
+ * {@link PackedArtifact} and per-check inputs. No I/O.
+ *
+ * Consumed by both the CLI (`clef envelope {inspect,verify,decrypt}` with
+ * `--json`) and the UI server (`/api/envelope/{inspect,verify,decrypt}`).
+ * Golden-snapshot fixtures pin the output byte-for-byte.
+ */
+import type { PackedArtifact } from "../artifact/types";
+import type { DecryptResult, DecryptSuccessInputs, InspectResult, VerifyInputs, VerifyResult } from "./types";
+/** Build an {@link InspectResult} for a source that could not be fetched or parsed. */
+export declare function buildInspectError(source: string, code: string, message: string): InspectResult;
+/**
+ * Build an {@link InspectResult} from a parsed artifact.
+ *
+ * When `hashOk === null`, hash verification was skipped (`--no-verify-hash`).
+ * `now` is injectable so tests produce deterministic `packedAtAgeMs` values.
+ */
+export declare function buildInspectResult(source: string, artifact: PackedArtifact, hashOk: boolean | null, now?: number): InspectResult;
+/** Build a {@link VerifyResult} for a source that could not be fetched or parsed. */
+export declare function buildVerifyError(source: string, code: string, message: string): VerifyResult;
+/** Combine per-check results into a {@link VerifyResult} with `overall` derived. */
+export declare function buildVerifyResult(source: string, inputs: VerifyInputs): VerifyResult;
+/** Build a {@link DecryptResult} for a source that could not be decrypted. */
+export declare function buildDecryptError(source: string, code: string, message: string): DecryptResult;
+/** Build a success {@link DecryptResult}. Enforces the safe default: names only. */
+export declare function buildDecryptResult(source: string, inputs: DecryptSuccessInputs): DecryptResult;
+//# sourceMappingURL=builders.d.ts.map

package/dist/envelope-debug/builders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/envelope-debug/builders.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EACV,aAAa,EACb,oBAAoB,EACpB,aAAa,EAEb,YAAY,EACZ,YAAY,EACb,MAAM,SAAS,CAAC;AAIjB,uFAAuF;AACvF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,CAoB9F;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,cAAc,EACxB,MAAM,EAAE,OAAO,GAAG,IAAI,EACtB,GAAG,GAAE,MAAmB,GACvB,aAAa,CAoCf;AAID,qFAAqF;AACrF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,YAAY,CAY5F;AAED,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,YAAY,CAepF;AAID,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,CAS9F;AAED,oFAAoF;AACpF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,aAAa,CAe9F"}

package/dist/envelope-debug/index.d.ts

@@ -0,0 +1,5 @@
+export type { InspectEnvelope, InspectResult, HashStatus, SignatureStatus, ExpiryStatus, RevocationStatus, OverallStatus, VerifyResult, VerifyInputs, DecryptStatus, DecryptResult, DecryptSuccessInputs, } from "./types";
+export { buildInspectError, buildInspectResult, buildVerifyError, buildVerifyResult, buildDecryptError, buildDecryptResult, } from "./builders";
+export { REVEAL_WARNING, formatRevealWarning } from "./warnings";
+export { parseSignerKey } from "./signer-key";
+//# sourceMappingURL=index.d.ts.map

package/dist/envelope-debug/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/envelope-debug/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,eAAe,EACf,aAAa,EACb,UAAU,EACV,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,EACb,oBAAoB,GACrB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}

package/dist/envelope-debug/signer-key.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Parse a signer-key argument into a base64-encoded DER SPKI public key
+ * suitable for `verifySignature`.
+ *
+ * Input precedence:
+ *   1. Starts with `-----BEGIN`              → parsed as PEM (any public-key type).
+ *   2. Otherwise                             → treated as an already-base64 DER SPKI.
+ *
+ * The base64 branch is validated by round-tripping through `createPublicKey`
+ * so malformed input fails here, not deep inside verify.
+ *
+ * This function never touches the filesystem. CLI callers that want to accept
+ * a `--signer-key-file <path>` flag must read the file themselves and pass
+ * the contents in — that keeps the file-read sink at an explicit operator
+ * boundary rather than smuggling it inside a parser.
+ */
+export declare function parseSignerKey(input: string): string;
+//# sourceMappingURL=signer-key.d.ts.map

package/dist/envelope-debug/signer-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer-key.d.ts","sourceRoot":"","sources":["../../src/envelope-debug/signer-key.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAoBpD"}

package/dist/envelope-debug/types.d.ts

@@ -0,0 +1,142 @@
+/**
+ * Shared output shapes for the envelope debugging surface.
+ *
+ * These types define the binding contract for both the `clef envelope`
+ * CLI's `--json` output and the UI server's `/api/envelope/*` responses.
+ * Golden-snapshot fixtures in `__fixtures__/envelope-snapshots/` pin the
+ * wire shape byte-for-byte; changing a field here requires regenerating
+ * those fixtures intentionally.
+ *
+ * Pure type declarations only — no runtime code. Builders live in
+ * `./builders`.
+ */
+/** Envelope descriptor used in both human and JSON inspect output. */
+export type InspectEnvelope = {
+    provider: "age";
+    kms: null;
+} | {
+    provider: string;
+    kms: {
+        provider: string;
+        keyId: string;
+        algorithm: string;
+    };
+};
+/**
+ * Shape of a single-source inspect result. Fields are never elided; absent
+ * data is `null`. Error cases swap the success fields for an `error`
+ * envelope.
+ */
+export interface InspectResult {
+    source: string;
+    version: number | null;
+    identity: string | null;
+    environment: string | null;
+    packedAt: string | null;
+    packedAtAgeMs: number | null;
+    revision: string | null;
+    ciphertextHash: string | null;
+    ciphertextHashVerified: boolean | null;
+    ciphertextBytes: number | null;
+    expiresAt: string | null;
+    expired: boolean | null;
+    revokedAt: string | null;
+    revoked: boolean | null;
+    envelope: InspectEnvelope | null;
+    signature: {
+        present: boolean;
+        algorithm: string | null;
+        verified: boolean | null;
+    };
+    error: {
+        code: string;
+        message: string;
+    } | null;
+}
+export type HashStatus = "ok" | "mismatch" | "skipped";
+export type SignatureStatus = "valid" | "invalid" | "absent" | "not_verified";
+export type ExpiryStatus = "ok" | "expired" | "absent";
+export type RevocationStatus = "ok" | "revoked" | "absent";
+export type OverallStatus = "pass" | "fail";
+/**
+ * Shape of a `verify` result.
+ *
+ * The `overall` field summarizes the four checks: `fail` if any is
+ * `mismatch` or `invalid`, otherwise `pass`. Expiry and revocation are
+ * reports-only in v1 — they do not flip `overall` to `fail`.
+ */
+export interface VerifyResult {
+    source: string;
+    checks: {
+        hash: {
+            status: HashStatus;
+        };
+        signature: {
+            status: SignatureStatus;
+            algorithm: string | null;
+        };
+        expiry: {
+            status: ExpiryStatus;
+            expiresAt: string | null;
+        };
+        revocation: {
+            status: RevocationStatus;
+            revokedAt: string | null;
+        };
+    };
+    overall: OverallStatus;
+    error: {
+        code: string;
+        message: string;
+    } | null;
+}
+export interface VerifyInputs {
+    hash: HashStatus;
+    signature: {
+        status: SignatureStatus;
+        algorithm: string | null;
+    };
+    expiry: {
+        status: ExpiryStatus;
+        expiresAt: string | null;
+    };
+    revocation: {
+        status: RevocationStatus;
+        revokedAt: string | null;
+    };
+}
+export type DecryptStatus = "ok" | "error";
+/**
+ * Shape of a `decrypt` result.
+ *
+ * `values` is `null` unless `--reveal` or `--key <name>` was passed;
+ * `revealed` lets downstream scripts assert the expected safety posture.
+ * Errors swap `status` to `"error"` and populate the `error` envelope.
+ */
+export interface DecryptResult {
+    source: string;
+    status: DecryptStatus;
+    error: {
+        code: string;
+        message: string;
+    } | null;
+    revealed: boolean;
+    keys: string[];
+    values: Record<string, string> | null;
+}
+export interface DecryptSuccessInputs {
+    /** Key names from the decrypted payload. Always present (sorted by the builder). */
+    keys: string[];
+    /** Full key-value map, only set when `--reveal` was passed. */
+    allValues?: Record<string, string>;
+    /**
+     * Single-key disclosure — set when `--key <name>` was passed. Reduces the
+     * render surface to one value; the rest remain hidden. Mutually exclusive
+     * with `allValues` at the command layer (the command validates this).
+     */
+    singleKey?: {
+        name: string;
+        value: string;
+    };
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/envelope-debug/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/envelope-debug/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,sEAAsE;AACtE,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,IAAI,CAAA;CAAE,GAC9B;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE;QACH,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH,CAAC;AAEN;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,sBAAsB,EAAE,OAAO,GAAG,IAAI,CAAC;IACvC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;IACjC,SAAS,EAAE;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;KAC1B,CAAC;IACF,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACjD;AAID,MAAM,MAAM,UAAU,GAAG,IAAI,GAAG,UAAU,GAAG,SAAS,CAAC;AACvD,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,cAAc,CAAC;AAC9E,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,SAAS,GAAG,QAAQ,CAAC;AACvD,MAAM,MAAM,gBAAgB,GAAG,IAAI,GAAG,SAAS,GAAG,QAAQ,CAAC;AAC3D,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,CAAC;AAE5C;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE;QACN,IAAI,EAAE;YAAE,MAAM,EAAE,UAAU,CAAA;SAAE,CAAC;QAC7B,SAAS,EAAE;YAAE,MAAM,EAAE,eAAe,CAAC;YAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC;QACjE,MAAM,EAAE;YAAE,MAAM,EAAE,YAAY,CAAC;YAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC;QAC3D,UAAU,EAAE;YAAE,MAAM,EAAE,gBAAgB,CAAC;YAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC;KACpE,CAAC;IACF,OAAO,EAAE,aAAa,CAAC;IACvB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACjD;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAC;IACjB,SAAS,EAAE;QAAE,MAAM,EAAE,eAAe,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACjE,MAAM,EAAE;QAAE,MAAM,EAAE,YAAY,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC3D,UAAU,EAAE;QAAE,MAAM,EAAE,gBAAgB,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CACpE;AAID,MAAM,MAAM,aAAa,GAAG,IAAI,GAAG,OAAO,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,aAAa,CAAC;IACtB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAChD,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;CACvC;AAED,MAAM,WAAW,oBAAoB;IACnC,oFAAoF;IACpF,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;;OAIG;IACH,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C"}

package/dist/envelope-debug/warnings.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Canonical `--reveal` warning strings for the envelope debug surface.
+ *
+ * Emitted by the CLI to stderr (before the first stdout byte of a revealed
+ * value, only after validation passes), and by the UI as a banner above the
+ * Decrypt card. Two variants:
+ *
+ *   - REVEAL_WARNING (all-values)      — used with --reveal (unscoped)
+ *   - formatRevealWarning("DB_URL")    — named-key variant, used with --key
+ *
+ * The named-key variant exists because `--key <name>` reduces the
+ * disclosure surface to a single value; the warning should say which
+ * value is about to appear so the operator can make an informed call
+ * (a shoulder-surfer sees one secret, not the whole payload).
+ */
+export declare const REVEAL_WARNING = "WARNING: plaintext will be printed to stdout. Shell history, terminal scrollback, and any attached logging (tmux capture-pane, CI log collectors, screen-recording) may retain it. Proceed only if this terminal and its upstream captures are trusted.";
+/**
+ * Build the `--reveal` warning. Without `key`, returns the canonical
+ * all-values `REVEAL_WARNING`. With a key name, returns a variant that
+ * names exactly which value is about to appear.
+ */
+export declare function formatRevealWarning(key?: string): string;
+//# sourceMappingURL=warnings.d.ts.map

package/dist/envelope-debug/warnings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"warnings.d.ts","sourceRoot":"","sources":["../../src/envelope-debug/warnings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAOH,eAAO,MAAM,cAAc,4PAAkE,CAAC;AAE9F;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAGxD"}

package/dist/index.d.mts

@@ -5,6 +5,8 @@ export { ScanRunner, shannonEntropy, isHighEntropy, matchPatterns, redactValue,
 export type { ScanMatch, ScanResult, ScanOptions, ClefIgnoreRules } from "./scanner";
 export { MatrixManager } from "./matrix/manager";
 export { SchemaValidator } from "./schema/validator";
+export { serializeSchema, writeSchema, writeSchemaRaw, emptyTemplate, exampleTemplate, } from "./schema/writer";
+export type { SerializeSchemaOptions } from "./schema/writer";
 export { DiffEngine } from "./diff/engine";
 export { BulkOps } from "./bulk/ops";
 export { GitIntegration } from "./git/integration";
@@ -49,6 +51,9 @@ export { isPackedArtifact, validatePackedArtifact, assertPackedArtifact, Invalid
 export type { ValidationResult } from "./artifact/guards";
 export type { PackedArtifact, PackConfig, PackResult, PackOutput, KmsEnvelope, SignatureAlgorithm, } from "./artifact/types";
 export { buildSigningPayload, generateSigningKeyPair, signEd25519, signKms, verifySignature, detectAlgorithm, } from "./artifact/signer";
+export { computeCiphertextHash } from "./artifact/hash";
+export type { InspectEnvelope, InspectResult, HashStatus, SignatureStatus, ExpiryStatus, RevocationStatus, OverallStatus, VerifyResult, VerifyInputs, DecryptStatus, DecryptResult, DecryptSuccessInputs, } from "./envelope-debug";
+export { buildInspectError, buildInspectResult, buildVerifyError, buildVerifyResult, buildDecryptError, buildDecryptResult, REVEAL_WARNING, formatRevealWarning, parseSignerKey, } from "./envelope-debug";
 export { PackBackendRegistry } from "./pack/registry";
 export type { PackBackend, PackBackendFactory, PackRequest, PackServices, BackendPackResult, } from "./pack/types";
 export { JsonEnvelopeBackend } from "./pack/backends/json-envelope";

package/dist/index.d.ts

@@ -5,6 +5,8 @@ export { ScanRunner, shannonEntropy, isHighEntropy, matchPatterns, redactValue,
 export type { ScanMatch, ScanResult, ScanOptions, ClefIgnoreRules } from "./scanner";
 export { MatrixManager } from "./matrix/manager";
 export { SchemaValidator } from "./schema/validator";
+export { serializeSchema, writeSchema, writeSchemaRaw, emptyTemplate, exampleTemplate, } from "./schema/writer";
+export type { SerializeSchemaOptions } from "./schema/writer";
 export { DiffEngine } from "./diff/engine";
 export { BulkOps } from "./bulk/ops";
 export { GitIntegration } from "./git/integration";
@@ -49,6 +51,9 @@ export { isPackedArtifact, validatePackedArtifact, assertPackedArtifact, Invalid
 export type { ValidationResult } from "./artifact/guards";
 export type { PackedArtifact, PackConfig, PackResult, PackOutput, KmsEnvelope, SignatureAlgorithm, } from "./artifact/types";
 export { buildSigningPayload, generateSigningKeyPair, signEd25519, signKms, verifySignature, detectAlgorithm, } from "./artifact/signer";
+export { computeCiphertextHash } from "./artifact/hash";
+export type { InspectEnvelope, InspectResult, HashStatus, SignatureStatus, ExpiryStatus, RevocationStatus, OverallStatus, VerifyResult, VerifyInputs, DecryptStatus, DecryptResult, DecryptSuccessInputs, } from "./envelope-debug";
+export { buildInspectError, buildInspectResult, buildVerifyError, buildVerifyResult, buildDecryptError, buildDecryptResult, REVEAL_WARNING, formatRevealWarning, parseSignerKey, } from "./envelope-debug";
 export { PackBackendRegistry } from "./pack/registry";
 export type { PackBackend, PackBackendFactory, PackRequest, PackServices, BackendPackResult, } from "./pack/types";
 export { JsonEnvelopeBackend } from "./pack/backends/json-envelope";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1F,OAAO,EACL,UAAU,EACV,cAAc,EACd,aAAa,EACb,aAAa,EACb,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,MAAM,CAAC;AACd,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAChG,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACvE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,eAAe,EACf,oBAAoB,GACrB,MAAM,OAAO,CAAC;AACf,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzF,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,YAAY,EACZ,cAAc,EACd,SAAS,EACT,cAAc,EACd,cAAc,EACd,YAAY,EACZ,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACpG,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxF,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC1E,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,IAAI,mBAAmB,EACpC,WAAW,GACZ,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EACL,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,gBAAgB,GACjB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,YAAY,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,YAAY,EACV,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,YAAY,EACV,cAAc,EACd,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,EACX,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,WAAW,EACX,OAAO,EACP,eAAe,EACf,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,YAAY,EACV,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,YAAY,EACZ,iBAAiB,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,YAAY,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACzE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,OAAO,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAClF,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACjG,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1F,OAAO,EACL,UAAU,EACV,cAAc,EACd,aAAa,EACb,aAAa,EACb,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EACL,eAAe,EACf,WAAW,EACX,cAAc,EACd,aAAa,EACb,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,MAAM,CAAC;AACd,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAChG,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACvE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,eAAe,EACf,oBAAoB,GACrB,MAAM,OAAO,CAAC;AACf,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzF,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,YAAY,EACZ,cAAc,EACd,SAAS,EACT,cAAc,EACd,cAAc,EACd,YAAY,EACZ,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACpG,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxF,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC1E,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,IAAI,mBAAmB,EACpC,WAAW,GACZ,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EACL,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,gBAAgB,GACjB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,YAAY,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,YAAY,EACV,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,YAAY,EACV,cAAc,EACd,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,EACX,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,WAAW,EACX,OAAO,EACP,eAAe,EACf,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,YAAY,EACV,eAAe,EACf,aAAa,EACb,UAAU,EACV,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,EACb,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,YAAY,EACV,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,YAAY,EACZ,iBAAiB,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,YAAY,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACzE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,OAAO,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAClF,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACjG,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC"}