@cleocode/core 2026.9.15 → 2026.9.17

package/dist/changesets/parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/changesets/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EACL,KAAK,cAAc,EAGpB,MAAM,qBAAqB,CAAC;AA6J7B;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAkE/D;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,EAAE,CAU/D"}
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/changesets/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EACL,KAAK,cAAc,EAGpB,MAAM,qBAAqB,CAAC;AA4N7B;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAsF/D;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,EAAE,CAU/D"}

package/dist/changesets/parser.js

@@ -103,6 +103,54 @@ function locateSchemaIssueLine(frontmatter, issuePath) {
     }
     return lastMatchLine;
 }
+// ─── Reserved leading character hint (T12351) ────────────────────────────────
+/**
+ * Characters that cannot start a YAML plain scalar, or that silently change
+ * its meaning: backtick and `@` are reserved, `%` is a directive, `|`/`>`
+ * start block scalars, `*` an alias, `&` an anchor, `!` a tag, `#` a comment.
+ * Flow collections (`[`, `{`) are omitted — `tasks: [T1]` is legitimate — and
+ * so are quotes, which are the fix.
+ */
+const RESERVED_LEADING = new Set(['`', '@', '%', '|', '>', '*', '&', '!', '#']);
+/**
+ * Find top-level `key: value` lines whose unquoted value starts with a
+ * YAML-reserved character. A bare block-scalar header (`summary: >-`) is a
+ * legitimate multi-line value and is not reported.
+ *
+ * @internal
+ * @task T12351
+ */
+function findReservedLeadingValues(frontmatter) {
+    const found = [];
+    const lines = frontmatter.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+        const match = lines[i]?.match(/^([A-Za-z_][\w-]*):[ \t]+(\S.*?)\s*$/);
+        if (!match)
+            continue;
+        const key = match[1] ?? '';
+        const value = match[2] ?? '';
+        const char = value[0] ?? '';
+        if (!RESERVED_LEADING.has(char))
+            continue;
+        if ((char === '|' || char === '>') && /^[|>][+-]?\d*$/.test(value))
+            continue;
+        found.push({ line: i + 1, key, value, char });
+    }
+    return found;
+}
+/**
+ * Build the remediation for a reserved leading character: the exact line to
+ * write, with the value wrapped in double quotes and inner quotes/backslashes
+ * escaped.
+ *
+ * @internal
+ * @task T12351
+ */
+function reservedLeadingHint(entry) {
+    const quoted = entry.value.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+    return (`'${entry.key}' starts with the YAML-reserved character '${entry.char}' — ` +
+        `wrap the value in double quotes: ${entry.key}: "${quoted}"`);
+}
 /**
  * Split a markdown file into its YAML frontmatter and body sections.
  *
@@ -167,11 +215,30 @@ export function parseChangesetFile(path) {
         // the surfaced line number matches the actual file line.
         const line = yamlLine !== null ? split.frontmatterStartLine + yamlLine : null;
         const snippet = yamlLine !== null ? extractSnippet(split.frontmatter, yamlLine) : undefined;
+        // T12351: name the fix. Prefer the reserved value on the reported line.
+        const reserved = findReservedLeadingValues(split.frontmatter);
+        const culprit = reserved.find((entry) => entry.line === yamlLine) ?? reserved[0];
         throw new ChangesetYamlInvalidError({
             file: path,
             line,
             ...(snippet !== undefined ? { snippet } : {}),
             parserMessage,
+            ...(culprit !== undefined ? { hint: reservedLeadingHint(culprit) } : {}),
+        });
+    }
+    // T12351: `&` (anchor), `!` (tag) and `#` (comment) do not fail to parse —
+    // they silently drop text from the value (`summary: &x fixed` reads as
+    // "fixed"). Any unquoted reserved leading character is rejected with the fix.
+    const silent = findReservedLeadingValues(split.frontmatter)[0];
+    if (silent !== undefined) {
+        const line = split.frontmatterStartLine + silent.line;
+        const snippet = extractSnippet(split.frontmatter, silent.line);
+        throw new ChangesetYamlInvalidError({
+            file: path,
+            line,
+            ...(snippet !== undefined ? { snippet } : {}),
+            parserMessage: `'${silent.key}' value starts with the YAML indicator '${silent.char}', which YAML reads as syntax, not text`,
+            hint: reservedLeadingHint(silent),
         });
     }
     if (frontmatterData === null || typeof frontmatterData !== 'object') {

package/dist/changesets/parser.js.map

@@ -1 +1 @@
-{"version":3,"file":"parser.js","sourceRoot":"","sources":["../../src/changesets/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAEL,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1C,gFAAgF;AAEhF;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,OAAO,GAAI,GAA6B,CAAC,OAAO,CAAC;IACvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;IAChD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,WAAmB,EAAE,IAAY;IACvD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzC,qDAAqD;IACrD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5E,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,qBAAqB,CAC5B,WAAmB,EACnB,SAAgD;IAEhD,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;IAClF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC;IACtB,IAAI,aAAa,GAAkB,IAAI,CAAC;IAExC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,UAAU,UAAU,OAAO,CAAC,CAAC;QAC3D,IAAI,KAAK,GAAG,KAAK,CAAC;QAElB,KAAK,IAAI,CAAC,GAAG,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;gBACpF,SAAS;YAEX,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;YACnD,IAAI,YAAY,IAAI,CAAC,IAAI,MAAM,IAAI,YAAY;gBAAE,MAAM;YAEvD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,SAAS;YAErB,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC;YACrC,WAAW,GAAG,CAAC,GAAG,CAAC,CAAC;YACpB,aAAa,GAAG,CAAC,GAAG,CAAC,CAAC;YACtB,KAAK,GAAG,IAAI,CAAC;YACb,MAAM;QACR,CAAC;QAED,IAAI,CAAC,KAAK;YAAE,OAAO,aAAa,CAAC;IACnC,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAqBD;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,QAAgB,EAAE,GAAW;IACrD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,4CAA4C,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;YAC/B,UAAU,GAAG,CAAC,CAAC;YACf,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,IAAI,KAAK,CAAC,MAAM,0CAA0C,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,KAAK;SACf,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC;SACrB,IAAI,CAAC,IAAI,CAAC;SACV,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;SACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEvB,OAAO;QACL,WAAW;QACX,IAAI;QACJ,oBAAoB,EAAE,CAAC;QACvB,kBAAkB,EAAE,UAAU,GAAG,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAE1C,IAAI,eAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,eAAe,GAAG,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,aAAa,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,gDAAgD;QAChD,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,yEAAyE;QACzE,wEAAwE;QACxE,yDAAyD;QACzD,MAAM,IAAI,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,oBAAoB,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9E,MAAM,OAAO,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,MAAM,IAAI,yBAAyB,CAAC;YAClC,IAAI,EAAE,IAAI;YACV,IAAI;YACJ,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAED,IAAI,eAAe,KAAK,IAAI,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,IAAI,KAAK,CAAC,oBAAoB,4CAA4C,OAAO,eAAe,GAAG,CAC3G,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,4DAA4D;IAC5D,MAAM,SAAS,GAA4B,EAAE,GAAI,eAA2C,EAAE,CAAC;IAC/F,IAAI,CAAC,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,SAAS,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAEpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAC/B,GAAG,CAAC,CAAC,KAAkB,EAAE,EAAE;YAC1B,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC1E,OAAO,OAAO,SAAS,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;QAC9C,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/F,MAAM,IAAI,GACR,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,oBAAoB,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,iCAAiC,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,qEAAqE;IACrE,0EAA0E;IAC1E,qDAAqD;IACrD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,IAAI,KAAK,CAAC,oBAAoB,QAAQ,MAAM,CAAC,IAAI,CAAC,EAAE,mCAAmC,UAAU,GAAG,CAC5G,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC;SAC3B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,WAAW,CAAC;SAC9D,IAAI,EAAE,CAAC;IAEV,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"parser.js","sourceRoot":"","sources":["../../src/changesets/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAEL,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1C,gFAAgF;AAEhF;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,OAAO,GAAI,GAA6B,CAAC,OAAO,CAAC;IACvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;IAChD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,WAAmB,EAAE,IAAY;IACvD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzC,qDAAqD;IACrD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5E,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,qBAAqB,CAC5B,WAAmB,EACnB,SAAgD;IAEhD,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;IAClF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC;IACtB,IAAI,aAAa,GAAkB,IAAI,CAAC;IAExC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,UAAU,UAAU,OAAO,CAAC,CAAC;QAC3D,IAAI,KAAK,GAAG,KAAK,CAAC;QAElB,KAAK,IAAI,CAAC,GAAG,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;gBACpF,SAAS;YAEX,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;YACnD,IAAI,YAAY,IAAI,CAAC,IAAI,MAAM,IAAI,YAAY;gBAAE,MAAM;YAEvD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,SAAS;YAErB,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC;YACrC,WAAW,GAAG,CAAC,GAAG,CAAC,CAAC;YACpB,aAAa,GAAG,CAAC,GAAG,CAAC,CAAC;YACtB,KAAK,GAAG,IAAI,CAAC;YACb,MAAM;QACR,CAAC;QAED,IAAI,CAAC,KAAK;YAAE,OAAO,aAAa,CAAC;IACnC,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAchF;;;;;;;GAOG;AACH,SAAS,yBAAyB,CAAC,WAAmB;IACpD,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACtE,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC1C,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QAC7E,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,KAA2B;IACtD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvE,OAAO,CACL,IAAI,KAAK,CAAC,GAAG,8CAA8C,KAAK,CAAC,IAAI,MAAM;QAC3E,oCAAoC,KAAK,CAAC,GAAG,MAAM,MAAM,GAAG,CAC7D,CAAC;AACJ,CAAC;AAqBD;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,QAAgB,EAAE,GAAW;IACrD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,4CAA4C,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;YAC/B,UAAU,GAAG,CAAC,CAAC;YACf,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,IAAI,KAAK,CAAC,MAAM,0CAA0C,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,KAAK;SACf,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC;SACrB,IAAI,CAAC,IAAI,CAAC;SACV,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;SACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEvB,OAAO;QACL,WAAW;QACX,IAAI;QACJ,oBAAoB,EAAE,CAAC;QACvB,kBAAkB,EAAE,UAAU,GAAG,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAE1C,IAAI,eAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,eAAe,GAAG,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,aAAa,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,gDAAgD;QAChD,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,yEAAyE;QACzE,wEAAwE;QACxE,yDAAyD;QACzD,MAAM,IAAI,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,oBAAoB,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9E,MAAM,OAAO,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,wEAAwE;QACxE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC;QACjF,MAAM,IAAI,yBAAyB,CAAC;YAClC,IAAI,EAAE,IAAI;YACV,IAAI;YACJ,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,aAAa;YACb,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,8EAA8E;IAC9E,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK,CAAC,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC;QACtD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,IAAI,yBAAyB,CAAC;YAClC,IAAI,EAAE,IAAI;YACV,IAAI;YACJ,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,aAAa,EAAE,IAAI,MAAM,CAAC,GAAG,2CAA2C,MAAM,CAAC,IAAI,yCAAyC;YAC5H,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,eAAe,KAAK,IAAI,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,IAAI,KAAK,CAAC,oBAAoB,4CAA4C,OAAO,eAAe,GAAG,CAC3G,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,4DAA4D;IAC5D,MAAM,SAAS,GAA4B,EAAE,GAAI,eAA2C,EAAE,CAAC;IAC/F,IAAI,CAAC,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,SAAS,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAEpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAC/B,GAAG,CAAC,CAAC,KAAkB,EAAE,EAAE;YAC1B,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC1E,OAAO,OAAO,SAAS,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;QAC9C,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/F,MAAM,IAAI,GACR,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,oBAAoB,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,iCAAiC,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,qEAAqE;IACrE,0EAA0E;IAC1E,qDAAqD;IACrD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,IAAI,KAAK,CAAC,oBAAoB,QAAQ,MAAM,CAAC,IAAI,CAAC,EAAE,mCAAmC,UAAU,GAAG,CAC5G,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC;SAC3B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,WAAW,CAAC;SAC9D,IAAI,EAAE,CAAC;IAEV,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/crypto/credentials.d.ts

@@ -1,42 +1,142 @@
 /**
- * Credential encryption — AES-256-GCM with machine-bound key derivation.
+ * Credential encryption — AES-256-GCM with device-bound key derivation.
  *
- * API keys (`sk_live_*`) are encrypted at rest in SQLite using AES-256-GCM.
- * The encryption key is derived per-project from a machine-specific secret:
+ * Every key derives from the 32-byte `machine-key` in the CLEO home. That key
+ * NEVER leaves the device; credentials cross devices only through the
+ * passphrase-sealed path in `store/credential-transfer.ts`.
  *
- *   machine-key (32 random bytes at ~/.local/share/cleo/machine-key)
- *   + project path
- *   = HMAC-SHA256(machine-key, project-path) → per-project AES key
+ * Two KDFs:
  *
- * This means credentials are bound to BOTH the machine AND the project.
- * Moving `.cleo/tasks.db` to another machine renders stored keys unreadable.
+ * - **Project** (T12326): `HMAC-SHA256(machine-key, "cleo:project-credential:v2\0"
+ *   ‖ projectId)`, ciphertext version `0x02`. Keyed by project IDENTITY, so a
+ *   moved or renamed project still decrypts. The pre-T12326 path-bound KDF
+ *   (`HMAC-SHA256(machine-key, projectPath)`, version `0x01`) is read-only and
+ *   migrated on first successful decrypt ({@link decryptProjectSecret}).
+ * - **Global** (ADR-037 §5): `HMAC-SHA256(machine-key ‖ global-salt, id)`,
+ *   version `0x01`, for project-independent credentials.
  *
  * @see docs/specs/SIGNALDOCK-UNIFIED-AGENT-REGISTRY.md Section 3.6
  * @module crypto/credentials
  */
 /**
- * Encrypt a plaintext string using AES-256-GCM with a per-project key.
+ * Absolute path to the machine key file: `<cleoHome>/machine-key`.
  *
- * Output format: base64(version + iv + ciphertext + authTag)
- *   - version: 1 byte (0x01 = AES-256-GCM)
- *   - iv: 12 bytes
- *   - ciphertext: variable length
- *   - authTag: 16 bytes
+ * Resolved through {@link getCleoHome} — the same root as `global-salt` and
+ * the agent registry's key reader — so `CLEO_HOME` relocates all of them
+ * together. (Before T12326 this function re-derived the XDG path itself and
+ * ignored `CLEO_HOME`, so a relocated home read the salt from one directory
+ * and the key from another.) On every platform the default resolves to the
+ * same file as before.
  *
- * @param plaintext - The string to encrypt (e.g. an API key).
- * @param projectPath - Absolute path to the project directory (used for key derivation).
- * @returns Base64-encoded ciphertext.
+ * The machine key is DEVICE-LOCAL by design: it is never exported in any
+ * backup bundle. Credentials move between devices through
+ * `store/credential-transfer.ts` instead.
+ *
+ * @param cleoHome - CLEO home to resolve against (defaults to the ambient home).
+ * @returns Absolute path to the machine key.
+ * @task T12326
  */
-export declare function encrypt(plaintext: string, projectPath: string): Promise<string>;
+export declare function getMachineKeyPath(cleoHome?: string): string;
 /**
- * Decrypt a base64-encoded ciphertext using AES-256-GCM with a per-project key.
+ * Options shared by every credential encrypt/decrypt call.
  *
- * @param ciphertext - Base64-encoded string from `encrypt()`.
- * @param projectPath - Absolute path to the project directory (must match the one used for encryption).
- * @returns The original plaintext string.
- * @throws If decryption fails (wrong key, corrupted data, or machine key mismatch).
+ * @task T12326
+ */
+export interface CredentialKeyOptions {
+    /**
+     * CLEO home whose `machine-key` (and `global-salt`, for the global KDF) keys
+     * the operation. Defaults to the ambient home. A backup import passes the
+     * home it is restoring INTO, which need not be the process's own; an explicit
+     * home also reads the salt fresh instead of from the process memo.
+     */
+    readonly cleoHome?: string;
+}
+/**
+ * Ciphertext version written by the pre-T12326 project KDF,
+ * `HMAC-SHA256(machine-key, projectPath)`. Read-only: decrypted during
+ * migration, never written.
+ */
+export declare const PROJECT_CIPHERTEXT_VERSION_LEGACY_PATH = 1;
+/**
+ * Ciphertext version written by the project-identity KDF,
+ * `HMAC-SHA256(machine-key, "cleo:project-credential:v2\0" ‖ projectId)`.
+ */
+export declare const PROJECT_CIPHERTEXT_VERSION_PROJECT_ID = 2;
+/**
+ * Which KDF decrypted a project credential.
+ *
+ * @task T12326
+ */
+export type ProjectCredentialKdf = 'project-id' | 'legacy-path';
+/**
+ * Key context for {@link decryptProjectSecret}.
+ *
+ * @task T12326
+ */
+export interface ProjectSecretContext extends CredentialKeyOptions {
+    /**
+     * Stable project identity — the `projectId` of `.cleo/project-info.json`
+     * (or its tracked successor). Travels with the project directory, so a
+     * moved or renamed checkout derives the same key.
+     */
+    readonly projectId: string;
+    /**
+     * Candidate project paths for ciphertexts still under the legacy path KDF
+     * (typically the current root plus the path the registry last recorded).
+     * Tried in order; unused for project-id ciphertexts.
+     */
+    readonly legacyProjectPaths?: readonly string[];
+}
+/**
+ * Result of {@link decryptProjectSecret}.
+ *
+ * @task T12326
+ */
+export interface ProjectSecretReadResult {
+    /** The decrypted secret. */
+    readonly plaintext: string;
+    /** Which KDF opened it. */
+    readonly kdf: ProjectCredentialKdf;
+    /**
+     * When the ciphertext was legacy (path-bound): the same secret re-encrypted
+     * under the project-id KDF. The caller persists it in place of the old
+     * ciphertext. `null` when the ciphertext was already current.
+     */
+    readonly rewrapped: string | null;
+}
+/**
+ * Encrypt a project-scoped secret under the project-identity KDF.
+ *
+ * The key is `HMAC-SHA256(machine-key, "cleo:project-credential:v2\0" ‖
+ * projectId)`: bound to this device (machine-key) and to the project's
+ * identity, but NOT to where the project directory lives. Moving or renaming
+ * the checkout keeps the key; a different device does not (see
+ * `store/credential-transfer.ts` for the portable path).
+ *
+ * @param plaintext - The secret (e.g. an agent API key).
+ * @param projectId - Stable project identity.
+ * @param options - Key options (which CLEO home's machine-key).
+ * @returns Base64 ciphertext, version byte {@link PROJECT_CIPHERTEXT_VERSION_PROJECT_ID}.
+ * @task T12326
+ */
+export declare function encryptProjectSecret(plaintext: string, projectId: string, options?: CredentialKeyOptions): Promise<string>;
+/**
+ * Decrypt a project-scoped secret, migrating legacy ciphertexts on the way.
+ *
+ * - Version `0x02` ciphertexts open with the project-identity key.
+ * - Version `0x01` (legacy, path-bound) ciphertexts are tried against each of
+ *   `legacyProjectPaths`; the first that authenticates wins and the secret is
+ *   re-encrypted under the project-identity KDF and returned as `rewrapped`
+ *   for the caller to persist. The legacy ciphertext is never needed again.
+ *
+ * @param ciphertext - Base64 ciphertext from either KDF.
+ * @param context - Project identity plus legacy path candidates.
+ * @returns The plaintext, which KDF opened it, and any re-wrapped ciphertext.
+ * @throws {Error} If no key authenticates. The message names the paths tried
+ *   so the caller can report which credential to re-enter.
+ * @task T12326
  */
-export declare function decrypt(ciphertext: string, projectPath: string): Promise<string>;
+export declare function decryptProjectSecret(ciphertext: string, context: ProjectSecretContext): Promise<ProjectSecretReadResult>;
 /**
  * Encrypt a plaintext string using AES-256-GCM with a global, machine-bound key.
  *
@@ -53,12 +153,13 @@ export declare function decrypt(ciphertext: string, projectPath: string): Promis
  *
  * @param plaintext - The string to encrypt (e.g. an LLM API key).
  * @param id - The stable identity used for key derivation (e.g. an agentId).
+ * @param options - Key options (which CLEO home's machine-key + salt).
  * @returns Base64-encoded ciphertext.
  *
  * @see decryptGlobal — the inverse operation.
  * @task T11710
  */
-export declare function encryptGlobal(plaintext: string, id: string): Promise<string>;
+export declare function encryptGlobal(plaintext: string, id: string, options?: CredentialKeyOptions): Promise<string>;
 /**
  * Decrypt a base64-encoded ciphertext produced by {@link encryptGlobal} using
  * the global, machine-bound key derived from `id`.
@@ -66,6 +167,7 @@ export declare function encryptGlobal(plaintext: string, id: string): Promise<st
  * @param ciphertext - Base64-encoded string from {@link encryptGlobal}.
  * @param id - The identity used at encryption time. A mismatched `id` derives a
  *   different key and fails the GCM auth tag (throws).
+ * @param options - Key options (which CLEO home's machine-key + salt).
  * @returns The original plaintext string.
  * @throws If decryption fails (wrong id, corrupted data, or machine-key/
  *   global-salt mismatch).
@@ -73,5 +175,5 @@ export declare function encryptGlobal(plaintext: string, id: string): Promise<st
  * @see encryptGlobal — the inverse operation.
  * @task T11710
  */
-export declare function decryptGlobal(ciphertext: string, id: string): Promise<string>;
+export declare function decryptGlobal(ciphertext: string, id: string, options?: CredentialKeyOptions): Promise<string>;
 //# sourceMappingURL=credentials.d.ts.map

package/dist/crypto/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/crypto/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA4JH;;;;;;;;;;;;GAYG;AACH,wBAAsB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAYrF;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAkCtF;AAyCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAYlF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiCnF"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/crypto/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAqBH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,GAAE,MAAsB,GAAG,MAAM,CAE1E;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAuID;;;;GAIG;AACH,eAAO,MAAM,sCAAsC,IAAO,CAAC;AAE3D;;;GAGG;AACH,eAAO,MAAM,qCAAqC,IAAO,CAAC;AAK1D;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,aAAa,CAAC;AAEhE;;;;GAIG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IAChE;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACjD;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,4BAA4B;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,2BAA2B;IAC3B,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AA2BD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,uBAAuB,CAAC,CAyClC;AAyCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,MAAM,EACV,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,CAiBjB"}