@cuna_labs/cli 0.1.0

package/dist/core/validation.d.ts

@@ -0,0 +1,90 @@
+export declare function assertPublicId(value: string, label: string): string;
+export declare function encodePublicId(value: string, label: string): string;
+export declare function assertCanonicalUuid(value: string, label: string): string;
+export declare function encodeCanonicalUuid(value: string, label: string): string;
+/**
+ * A machine identifier, in the one shape the product accepts.
+ *
+ * The command layer used `assertPublicId` and the transport used
+ * `encodeCanonicalUuid`, so `mch_1` passed preflight, spent a capability
+ * round-trip, and only then failed deep in the transport against a rule the
+ * command layer never enforced. The user paid a network call to learn that
+ * their argument was malformed, and the error named a layer they had never
+ * heard of.
+ *
+ * The transport is the authority here — the server routes by canonical UUID —
+ * so both layers now call this, and the shape is stated once. Note that
+ * `--machine` on `cuna claude` is a machine NAME, not an ID, and is deliberately
+ * not validated here.
+ */
+export declare function assertMachineId(value: string): string;
+/** The same authority, percent-encoded for a request path. */
+export declare function encodeMachineId(value: string): string;
+export declare function assertIdempotencyKey(value: string): string;
+export declare function isIdempotencyKey(value: string): boolean;
+/**
+ * Parse a command-line integer option, or throw a usage error naming it.
+ *
+ * `Number(raw)` is not a base-10 integer parser. It accepts `0x1F4` (500),
+ * `1e5` (100000), `" 500 "`, `+500`, `.5e3`, `0b111` and `Infinity`, and
+ * `Number.isInteger` then waves the first five through. That is tolerable for a
+ * timeout and not tolerable for `--workspace-generation`, which is a fencing
+ * token: `1e3` silently becoming 1000 is a write against the wrong generation,
+ * and the mistake is invisible because the value looks like what was typed.
+ *
+ * Both the root option parser and the per-command option parser now go through
+ * here, because the two had independently written the same `Number(raw)` bug.
+ */
+export declare function integerArgument(raw: string, name: string, minimum: number, maximum: number): number;
+export declare function safeReasonCode(value: unknown): string | undefined;
+export declare function assertSafeDisplayText(value: string, label: string): string;
+export declare function isObject(value: unknown): value is Record<string, unknown>;
+/**
+ * A response that did not match the published contract, carrying WHICH part.
+ *
+ * WHY THIS TYPE EXISTS. Every decoder in `api/contracts.ts` already knew the
+ * exact predicate that failed and threw a bare `TypeError` whose message the
+ * client then discarded, so `cuna.remote.malformed_response` reached the user as
+ * one unactionable sentence — "Cuna returned a response that does not match the
+ * public contract." — with no `details` and no `hint`. Finding out that
+ * production omits `workspace.id` required isolating `decodeCunaIdentity` in a
+ * throwaway script. That is a diagnosis a user cannot perform and the CLI did
+ * not need to lose: the information existed at the throw site and died one
+ * `catch` later.
+ *
+ * WHAT MAY BE CARRIED, AND WHAT MAY NOT. `field` and `predicate` are NAMES and
+ * SHAPES. A response body may hold an API key, an email address, or a workspace
+ * path, so no value from the payload is ever placed on this error — not the
+ * offending value, not a truncation of it, not its length. `field` is the key
+ * path the CLI itself asked for and `predicate` is a fixed token chosen from
+ * this source tree. Both are safe to print and safe to log.
+ *
+ * `field` is the NARROWEST KNOWN location, not necessarily a leaf. A compound
+ * check that spans a subtree reports the subtree, because claiming a leaf it did
+ * not test would be a more precise answer than the code actually has.
+ */
+export declare class ContractViolation extends TypeError {
+    /** Narrowest known location, e.g. `workspace.id` or `capabilities[3].id`. */
+    readonly field: string | undefined;
+    /** Stable token naming the rule that failed, e.g. `required_string`. */
+    readonly predicate: string;
+    constructor(predicate: string, field?: string);
+}
+/** Mint a contract violation. `field` is omitted when the check spans no one key. */
+export declare function contractViolation(predicate: string, field?: string): ContractViolation;
+/**
+ * Run a nested decode, reporting any violation under `prefix`.
+ *
+ * Without this, `decodeCunaIdentity` reported `id` for a violation inside
+ * `workspace`, which names a key that also exists at the root — the one reading
+ * that would send a user to the wrong field.
+ */
+export declare function underField<T>(prefix: string, run: () => T): T;
+/** The same, for one element of a decoded array. */
+export declare function underIndex<T>(prefix: string, index: number, run: () => T): T;
+export declare function requiredString(source: Record<string, unknown>, key: string): string;
+export declare function requiredDisplayString(source: Record<string, unknown>, key: string): string;
+export declare function optionalDisplayString(source: Record<string, unknown>, key: string): string | undefined;
+export declare function optionalString(source: Record<string, unknown>, key: string): string | undefined;
+export declare function optionalNumber(source: Record<string, unknown>, key: string): number | undefined;
+//# sourceMappingURL=validation.d.ts.map

package/dist/core/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/core/validation.ts"],"names":[],"mappings":"AAWA,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAKnE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAKxE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAExE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,8DAA8D;AAC9D,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQ1D;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEvD;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,MAAM,CAWR;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAEjE;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAK1E;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,iBAAkB,SAAQ,SAAS;IAC9C,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM;CAQ9C;AAED,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAEtF;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAY7D;AAED,oDAAoD;AACpD,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAE5E;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAMnF;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAI1F;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMtG;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK/F;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAO/F"}

package/dist/core/validation.js

@@ -0,0 +1,199 @@
+import { usageError } from "./errors.js";
+const PUBLIC_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
+const SAFE_CODE = /^[a-z][a-z0-9_.-]{0,127}$/u;
+// C0/C1 controls and Unicode format controls can mutate terminal state, forge
+// rows, reverse text direction, or hide content. They are never valid in a
+// Cuna display name, state label, or workspace path.
+const UNSAFE_DISPLAY_CHARACTER = /[\p{Cc}\p{Cf}]/u;
+const IDEMPOTENCY_KEY = /^[!-~]{8,128}$/u;
+const CANONICAL_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/u;
+export function assertPublicId(value, label) {
+    if (!PUBLIC_ID.test(value)) {
+        throw usageError(`Invalid ${label}.`, `${label} must be an opaque public Cuna identifier.`);
+    }
+    return value;
+}
+export function encodePublicId(value, label) {
+    return encodeURIComponent(assertPublicId(value, label));
+}
+export function assertCanonicalUuid(value, label) {
+    if (!CANONICAL_UUID.test(value)) {
+        throw usageError(`Invalid ${label}.`, `${label} must be a canonical lowercase Cuna UUID.`);
+    }
+    return value;
+}
+export function encodeCanonicalUuid(value, label) {
+    return encodeURIComponent(assertCanonicalUuid(value, label));
+}
+/**
+ * A machine identifier, in the one shape the product accepts.
+ *
+ * The command layer used `assertPublicId` and the transport used
+ * `encodeCanonicalUuid`, so `mch_1` passed preflight, spent a capability
+ * round-trip, and only then failed deep in the transport against a rule the
+ * command layer never enforced. The user paid a network call to learn that
+ * their argument was malformed, and the error named a layer they had never
+ * heard of.
+ *
+ * The transport is the authority here — the server routes by canonical UUID —
+ * so both layers now call this, and the shape is stated once. Note that
+ * `--machine` on `cuna claude` is a machine NAME, not an ID, and is deliberately
+ * not validated here.
+ */
+export function assertMachineId(value) {
+    return assertCanonicalUuid(value, "machine ID");
+}
+/** The same authority, percent-encoded for a request path. */
+export function encodeMachineId(value) {
+    return encodeURIComponent(assertMachineId(value));
+}
+export function assertIdempotencyKey(value) {
+    if (!isIdempotencyKey(value)) {
+        throw usageError("Invalid idempotency key.", "Idempotency key must contain 8 through 128 printable ASCII characters.");
+    }
+    return value;
+}
+export function isIdempotencyKey(value) {
+    return IDEMPOTENCY_KEY.test(value);
+}
+// Exactly a base-10 integer: no sign, no radix prefix, no exponent, no
+// surrounding whitespace, no decimal point.
+const DECIMAL_INTEGER = /^\d+$/u;
+/**
+ * Parse a command-line integer option, or throw a usage error naming it.
+ *
+ * `Number(raw)` is not a base-10 integer parser. It accepts `0x1F4` (500),
+ * `1e5` (100000), `" 500 "`, `+500`, `.5e3`, `0b111` and `Infinity`, and
+ * `Number.isInteger` then waves the first five through. That is tolerable for a
+ * timeout and not tolerable for `--workspace-generation`, which is a fencing
+ * token: `1e3` silently becoming 1000 is a write against the wrong generation,
+ * and the mistake is invisible because the value looks like what was typed.
+ *
+ * Both the root option parser and the per-command option parser now go through
+ * here, because the two had independently written the same `Number(raw)` bug.
+ */
+export function integerArgument(raw, name, minimum, maximum) {
+    const invalid = () => {
+        throw usageError(`Option --${name} must be an integer from ${minimum} through ${maximum}.`, "Write the value in base 10 with no sign, exponent, radix prefix, or surrounding spaces.");
+    };
+    if (!DECIMAL_INTEGER.test(raw))
+        return invalid();
+    const value = Number(raw);
+    if (!Number.isSafeInteger(value) || value < minimum || value > maximum)
+        return invalid();
+    return value;
+}
+export function safeReasonCode(value) {
+    return typeof value === "string" && SAFE_CODE.test(value) ? value : undefined;
+}
+export function assertSafeDisplayText(value, label) {
+    if (UNSAFE_DISPLAY_CHARACTER.test(value)) {
+        throw usageError(`Invalid ${label}.`, `${label} must not contain control or formatting characters.`);
+    }
+    return value;
+}
+export function isObject(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/**
+ * A response that did not match the published contract, carrying WHICH part.
+ *
+ * WHY THIS TYPE EXISTS. Every decoder in `api/contracts.ts` already knew the
+ * exact predicate that failed and threw a bare `TypeError` whose message the
+ * client then discarded, so `cuna.remote.malformed_response` reached the user as
+ * one unactionable sentence — "Cuna returned a response that does not match the
+ * public contract." — with no `details` and no `hint`. Finding out that
+ * production omits `workspace.id` required isolating `decodeCunaIdentity` in a
+ * throwaway script. That is a diagnosis a user cannot perform and the CLI did
+ * not need to lose: the information existed at the throw site and died one
+ * `catch` later.
+ *
+ * WHAT MAY BE CARRIED, AND WHAT MAY NOT. `field` and `predicate` are NAMES and
+ * SHAPES. A response body may hold an API key, an email address, or a workspace
+ * path, so no value from the payload is ever placed on this error — not the
+ * offending value, not a truncation of it, not its length. `field` is the key
+ * path the CLI itself asked for and `predicate` is a fixed token chosen from
+ * this source tree. Both are safe to print and safe to log.
+ *
+ * `field` is the NARROWEST KNOWN location, not necessarily a leaf. A compound
+ * check that spans a subtree reports the subtree, because claiming a leaf it did
+ * not test would be a more precise answer than the code actually has.
+ */
+export class ContractViolation extends TypeError {
+    /** Narrowest known location, e.g. `workspace.id` or `capabilities[3].id`. */
+    field;
+    /** Stable token naming the rule that failed, e.g. `required_string`. */
+    predicate;
+    constructor(predicate, field) {
+        super(field === undefined
+            ? `Contract violation: ${predicate}`
+            : `Contract violation: ${predicate} at ${field}`);
+        this.name = "ContractViolation";
+        this.predicate = predicate;
+        this.field = field;
+    }
+}
+/** Mint a contract violation. `field` is omitted when the check spans no one key. */
+export function contractViolation(predicate, field) {
+    return field === undefined ? new ContractViolation(predicate) : new ContractViolation(predicate, field);
+}
+/**
+ * Run a nested decode, reporting any violation under `prefix`.
+ *
+ * Without this, `decodeCunaIdentity` reported `id` for a violation inside
+ * `workspace`, which names a key that also exists at the root — the one reading
+ * that would send a user to the wrong field.
+ */
+export function underField(prefix, run) {
+    try {
+        return run();
+    }
+    catch (error) {
+        if (error instanceof ContractViolation) {
+            throw contractViolation(error.predicate, error.field === undefined ? prefix : `${prefix}.${error.field}`);
+        }
+        throw error;
+    }
+}
+/** The same, for one element of a decoded array. */
+export function underIndex(prefix, index, run) {
+    return underField(`${prefix}[${index}]`, run);
+}
+export function requiredString(source, key) {
+    const value = source[key];
+    if (typeof value !== "string" || value.length === 0) {
+        throw contractViolation("required_non_empty_string", key);
+    }
+    return value;
+}
+export function requiredDisplayString(source, key) {
+    const value = requiredString(source, key);
+    if (UNSAFE_DISPLAY_CHARACTER.test(value))
+        throw contractViolation("no_control_characters", key);
+    return value;
+}
+export function optionalDisplayString(source, key) {
+    const value = optionalString(source, key);
+    if (value !== undefined && UNSAFE_DISPLAY_CHARACTER.test(value)) {
+        throw contractViolation("no_control_characters", key);
+    }
+    return value;
+}
+export function optionalString(source, key) {
+    const value = source[key];
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value !== "string")
+        throw contractViolation("string_when_present", key);
+    return value;
+}
+export function optionalNumber(source, key) {
+    const value = source[key];
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value !== "number" || !Number.isFinite(value)) {
+        throw contractViolation("finite_number_when_present", key);
+    }
+    return value;
+}
+//# sourceMappingURL=validation.js.map

package/dist/core/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../src/core/validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,SAAS,GAAG,sCAAsC,CAAC;AACzD,MAAM,SAAS,GAAG,4BAA4B,CAAC;AAC/C,8EAA8E;AAC9E,2EAA2E;AAC3E,qDAAqD;AACrD,MAAM,wBAAwB,GAAG,iBAAiB,CAAC;AACnD,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAC1C,MAAM,cAAc,GAAG,iEAAiE,CAAC;AAEzF,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,KAAa;IACzD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,UAAU,CAAC,WAAW,KAAK,GAAG,EAAE,GAAG,KAAK,4CAA4C,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,KAAa;IACzD,OAAO,kBAAkB,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,KAAa;IAC9D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,UAAU,CAAC,WAAW,KAAK,GAAG,EAAE,GAAG,KAAK,2CAA2C,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,KAAa;IAC9D,OAAO,kBAAkB,CAAC,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,mBAAmB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;AAClD,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,kBAAkB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,UAAU,CACd,0BAA0B,EAC1B,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrC,CAAC;AAED,uEAAuE;AACvE,4CAA4C;AAC5C,MAAM,eAAe,GAAG,QAAQ,CAAC;AAEjC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAW,EACX,IAAY,EACZ,OAAe,EACf,OAAe;IAEf,MAAM,OAAO,GAAG,GAAU,EAAE;QAC1B,MAAM,UAAU,CACd,YAAY,IAAI,4BAA4B,OAAO,YAAY,OAAO,GAAG,EACzE,yFAAyF,CAC1F,CAAC;IACJ,CAAC,CAAC;IACF,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,EAAE,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,OAAO,IAAI,KAAK,GAAG,OAAO;QAAE,OAAO,OAAO,EAAE,CAAC;IACzF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,KAAa;IAChE,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,UAAU,CAAC,WAAW,KAAK,GAAG,EAAE,GAAG,KAAK,qDAAqD,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,OAAO,iBAAkB,SAAQ,SAAS;IAC9C,6EAA6E;IACpE,KAAK,CAAqB;IACnC,wEAAwE;IAC/D,SAAS,CAAS;IAE3B,YAAY,SAAiB,EAAE,KAAc;QAC3C,KAAK,CAAC,KAAK,KAAK,SAAS;YACvB,CAAC,CAAC,uBAAuB,SAAS,EAAE;YACpC,CAAC,CAAC,uBAAuB,SAAS,OAAO,KAAK,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,KAAc;IACjE,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AAC1G,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAI,MAAc,EAAE,GAAY;IACxD,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;YACvC,MAAM,iBAAiB,CACrB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,KAAK,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,UAAU,CAAI,MAAc,EAAE,KAAa,EAAE,GAAY;IACvE,OAAO,UAAU,CAAC,GAAG,MAAM,IAAI,KAAK,GAAG,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAA+B,EAAE,GAAW;IACzE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,iBAAiB,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAA+B,EAAE,GAAW;IAChF,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,iBAAiB,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAChG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAA+B,EAAE,GAAW;IAChF,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,SAAS,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,iBAAiB,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAA+B,EAAE,GAAW;IACzE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,iBAAiB,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAA+B,EAAE,GAAW;IACzE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,iBAAiB,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/credentials/contracts.d.ts

@@ -0,0 +1,82 @@
+import type { SecretMaterial } from "./secret-material.js";
+export declare const CREDENTIAL_BACKEND_PROTOCOL: "cuna.secure-vault.v1";
+export interface CredentialBinding {
+    readonly profileId: string;
+    readonly accountId: string;
+    readonly workspaceId: string;
+    readonly kind: string;
+}
+/**
+ * `preview` is deliberately not a production security claim. It is only
+ * accepted by an explicitly constructed preview vault and therefore cannot
+ * satisfy the public encrypted-session readiness gate.
+ */
+export type CredentialBackendStatus = "verified" | "preview" | "unavailable" | "unknown";
+export interface CredentialBackendEvidence {
+    readonly protocol: typeof CREDENTIAL_BACKEND_PROTOCOL;
+    readonly backendId: string;
+    readonly platform: NodeJS.Platform;
+    readonly status: CredentialBackendStatus;
+    readonly observedAt: number;
+    readonly expiresAt: number;
+    readonly source: "live_round_trip" | "encrypted_local_file" | "local_file_preview" | "probe_failed";
+    readonly reason?: string;
+}
+/**
+ * An implementation MUST replace one target atomically and MUST NOT expose the
+ * protected value through argv, environment variables, errors, or diagnostics.
+ */
+export interface SecureCredentialBackend {
+    readonly backendId: string;
+    readonly platform: NodeJS.Platform;
+    probe(): Promise<CredentialBackendEvidence>;
+    read(target: string): Promise<Uint8Array | undefined>;
+    replace(target: string, protectedValue: Uint8Array): Promise<void>;
+    delete(target: string): Promise<"deleted" | "absent">;
+    /**
+     * Optional durable compare-and-swap operations. File-backed implementations
+     * use these to fence independent CLI processes; an in-memory queue is not an
+     * inter-process authority.
+     */
+    compareAndSwap?(target: string, expectedSha256: string | null, protectedValue: Uint8Array): Promise<"replaced" | "conflict">;
+    compareAndDelete?(target: string, expectedSha256: string): Promise<"deleted" | "absent" | "conflict">;
+    /**
+     * Optional cross-process refresh authority. It is deliberately separate
+     * from the backend's storage lock: the callback reads and CAS-writes through
+     * that storage lock while this outer authority prevents sibling CLI
+     * processes from re-exchanging the same renewable session concurrently.
+     */
+    withRefreshLock?<T>(target: string, operation: () => Promise<T>): Promise<T>;
+}
+export interface CredentialSnapshot {
+    readonly material: SecretMaterial;
+    readonly revision: number;
+    readonly expiresAt: number | undefined;
+}
+export interface CredentialStatus {
+    readonly backendId: string;
+    readonly backendStatus: CredentialBackendStatus;
+    readonly state: "present" | "expired" | "absent" | "corrupt" | "revoked" | "unavailable";
+    readonly bindingDigest: string;
+    readonly revision?: number;
+    readonly expiresAt?: number;
+}
+export type CredentialRefreshResult = {
+    readonly status: "rotated";
+    readonly material: SecretMaterial;
+    readonly expiresAt?: number;
+} | {
+    readonly status: "retained";
+} | {
+    readonly status: "missing";
+} | {
+    readonly status: "rejected";
+    /**
+     * The vault always revision-fences removal, but the caller must still
+     * distinguish a remote terminal fact from local expiry or validation.
+     * Only `authoritative_remote` permits a later logout to report that the
+     * remote family was already revoked.
+     */
+    readonly reason: "authoritative_remote" | "local_expired" | "local_integrity";
+};
+//# sourceMappingURL=contracts.d.ts.map

package/dist/credentials/contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../../src/credentials/contracts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,eAAO,MAAM,2BAA2B,EAAG,sBAA+B,CAAC;AAE3E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,CAAC;AAEzF,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,OAAO,2BAA2B,CAAC;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,GAAG,sBAAsB,GAAG,oBAAoB,GAAG,cAAc,CAAC;IACpG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IACnC,KAAK,IAAI,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACtD,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,QAAQ,CAAC,CAAC;IACtD;;;;OAIG;IACH,cAAc,CAAC,CACb,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,GAAG,IAAI,EAC7B,cAAc,EAAE,UAAU,GACzB,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC,CAAC;IACpC,gBAAgB,CAAC,CACf,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC,CAAC;IAC9C;;;;;OAKG;IACH,eAAe,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9E;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;IACzF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,uBAAuB,GAC/B;IACE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,GACD;IAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GAI/B;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GAC9B;IACE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,sBAAsB,GAAG,eAAe,GAAG,iBAAiB,CAAC;CAC/E,CAAC"}

package/dist/credentials/contracts.js

@@ -0,0 +1,2 @@
+export const CREDENTIAL_BACKEND_PROTOCOL = "cuna.secure-vault.v1";
+//# sourceMappingURL=contracts.js.map

package/dist/credentials/contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../src/credentials/contracts.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,2BAA2B,GAAG,sBAA+B,CAAC"}

package/dist/credentials/errors.d.ts

@@ -0,0 +1,19 @@
+export type CredentialErrorCode = "credential_backend_unavailable" | "credential_backend_unverified" | "credential_backend_failure" | "credential_binding_invalid" | "credential_corrupt" | "credential_missing" | "credential_revision_conflict" | "credential_refresh_failed" | "credential_revoked" | "credential_process_failed" | "credential_process_timeout" | "credential_output_oversized";
+export declare class CredentialBoundaryError extends Error {
+    readonly code: CredentialErrorCode;
+    readonly retryable: boolean;
+    readonly safeDetails: Readonly<Record<string, string | number | boolean | null>> | undefined;
+    constructor(input: {
+        readonly code: CredentialErrorCode;
+        readonly message: string;
+        readonly retryable?: boolean;
+        readonly safeDetails?: Readonly<Record<string, string | number | boolean | null>>;
+        readonly cause?: unknown;
+    });
+}
+export declare function credentialFailure(code: CredentialErrorCode, message: string, options?: {
+    readonly retryable?: boolean;
+    readonly safeDetails?: Readonly<Record<string, string | number | boolean | null>>;
+    readonly cause?: unknown;
+}): CredentialBoundaryError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/credentials/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/credentials/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,mBAAmB,GAC3B,gCAAgC,GAChC,+BAA+B,GAC/B,4BAA4B,GAC5B,4BAA4B,GAC5B,oBAAoB,GACpB,oBAAoB,GACpB,8BAA8B,GAC9B,2BAA2B,GAC3B,oBAAoB,GACpB,2BAA2B,GAC3B,4BAA4B,GAC5B,6BAA6B,CAAC;AAElC,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;gBAEjF,KAAK,EAAE;QACjB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;QACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC;QAClF,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;KAC1B;CAOF;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IACP,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC;IAClF,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CACrB,GACL,uBAAuB,CAEzB"}

package/dist/credentials/errors.js

@@ -0,0 +1,16 @@
+export class CredentialBoundaryError extends Error {
+    code;
+    retryable;
+    safeDetails;
+    constructor(input) {
+        super(input.message, { cause: input.cause });
+        this.name = "CredentialBoundaryError";
+        this.code = input.code;
+        this.retryable = input.retryable ?? false;
+        this.safeDetails = input.safeDetails;
+    }
+}
+export function credentialFailure(code, message, options = {}) {
+    return new CredentialBoundaryError({ code, message, ...options });
+}
+//# sourceMappingURL=errors.js.map

package/dist/credentials/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/credentials/errors.ts"],"names":[],"mappings":"AAcA,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,IAAI,CAAsB;IAC1B,SAAS,CAAU;IACnB,WAAW,CAAyE;IAE7F,YAAY,KAMX;QACC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACvB,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC;QAC1C,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACvC,CAAC;CACF;AAED,MAAM,UAAU,iBAAiB,CAC/B,IAAyB,EACzB,OAAe,EACf,UAII,EAAE;IAEN,OAAO,IAAI,uBAAuB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;AACpE,CAAC"}

package/dist/credentials/index.d.ts

@@ -0,0 +1,6 @@
+export * from "./contracts.js";
+export * from "./errors.js";
+export * from "./local-session.js";
+export * from "./secret-material.js";
+export * from "./vault.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/credentials/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credentials/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,YAAY,CAAC"}

package/dist/credentials/index.js

@@ -0,0 +1,6 @@
+export * from "./contracts.js";
+export * from "./errors.js";
+export * from "./local-session.js";
+export * from "./secret-material.js";
+export * from "./vault.js";
+//# sourceMappingURL=index.js.map

package/dist/credentials/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/credentials/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,YAAY,CAAC"}

package/dist/credentials/local-session.d.ts

@@ -0,0 +1,101 @@
+import { type CredentialBackendEvidence, type SecureCredentialBackend } from "./contracts.js";
+/**
+ * These programs are deliberately static. Dynamic values are supplied through
+ * a child-only environment instead of being interpolated into `-Command`.
+ * This keeps the Restricted-policy-compatible invocation while avoiding
+ * encoded/dynamically generated PowerShell source.
+ */
+export declare const WINDOWS_ACL_COMMAND_PROGRAMS: Readonly<{
+    inspect: string;
+    inspectMany: string;
+    reconcileFile: string;
+    reconcileDirectory: string;
+}>;
+/**
+ * The production authority is the operating-system ACL implementation below.
+ * The override exists only so the sequencing and fail-closed behaviour can be
+ * tested deterministically; product wiring must not provide one.
+ */
+interface WindowsAclInspection {
+    readonly currentSid: string;
+    readonly ownerSid: string;
+    readonly daclOwnerOnly: boolean;
+}
+interface WindowsAclReconciliation {
+    readonly before: WindowsAclInspection;
+    readonly after: WindowsAclInspection;
+    readonly repaired: boolean;
+}
+interface WindowsAclInspectionRequest {
+    readonly path: string;
+    readonly directory: boolean;
+}
+interface WindowsAclAuthority {
+    inspectOwnerOnly(path: string, directory: boolean): Promise<WindowsAclInspection>;
+    /**
+     * Optional: inspect several paths in one OS invocation. The result is
+     * index-aligned with the request; `undefined` means "not inspected" (for
+     * example, the path does not exist yet) and the caller must fall back to
+     * `inspectOwnerOnly` before trusting anything about that path.
+     */
+    inspectManyOwnerOnly?(requests: readonly WindowsAclInspectionRequest[]): Promise<readonly (WindowsAclInspection | undefined)[]>;
+    reconcileNewOwnerOnly(path: string, directory: boolean): Promise<WindowsAclReconciliation>;
+}
+/**
+ * Pure-JavaScript session persistence for the durable browser login code.
+ * The random AES key and ciphertext are separate current-user-only files.
+ * Their separation is not a backup boundary: a copied profile containing both
+ * files, or compromise of the same OS account, can decrypt the session.
+ */
+export declare class LocalEncryptedSessionBackend implements SecureCredentialBackend {
+    #private;
+    readonly backendId = "cuna-local-aes256gcm-v1";
+    readonly platform: NodeJS.Platform;
+    constructor(input: {
+        readonly sessionFile: string;
+        readonly keyFile: string;
+        readonly platform: NodeJS.Platform;
+        readonly clock?: () => number;
+        readonly lockTimeoutMs?: number;
+        readonly windowsAcl?: WindowsAclAuthority;
+    });
+    probe(): Promise<CredentialBackendEvidence>;
+    read(_target: string): Promise<Uint8Array | undefined>;
+    replace(_target: string, protectedValue: Uint8Array): Promise<void>;
+    compareAndSwap(_target: string, expectedSha256: string | null, protectedValue: Uint8Array): Promise<"replaced" | "conflict">;
+    compareAndDelete(_target: string, expectedSha256: string): Promise<"deleted" | "absent" | "conflict">;
+    delete(_target: string): Promise<"deleted" | "absent">;
+    withRefreshLock<T>(_target: string, operation: () => Promise<T>): Promise<T>;
+}
+export declare function localEncryptedSessionPaths(configDirectory: string, profile?: string): {
+    readonly sessionFile: string;
+    readonly keyFile: string;
+};
+/**
+ * Isolates the two ACL inputs from inherited Windows environment variables.
+ * Windows environment-variable names are case-insensitive, so simply adding
+ * canonical uppercase keys would leave an attacker-controlled differently
+ * cased duplicate ambiguous to the child process.
+ */
+export declare function isolateWindowsAclChildEnvironment(inherited: NodeJS.ProcessEnv, path: string): NodeJS.ProcessEnv;
+/**
+ * The batched variant carries a newline-separated list under its own name.
+ * Both isolated environments strip every ACL input name, so a single-path
+ * child never sees a list and a batched child never sees a single path.
+ */
+export declare function isolateWindowsAclBatchChildEnvironment(inherited: NodeJS.ProcessEnv, paths: readonly string[]): NodeJS.ProcessEnv;
+/**
+ * Batched form of `inspectWindowsAcl`: one `powershell.exe` spawn for every
+ * requested path. Exported so the real program and its parser can be
+ * exercised against real files on Windows.
+ */
+export declare function inspectWindowsAclMany(requests: readonly WindowsAclInspectionRequest[]): Promise<readonly (WindowsAclInspection | undefined)[]>;
+/**
+ * Parses `inspectMany` output. Exactly one `CUNA_CURRENT_SID=` line is
+ * required; each `CUNA_SDDL:<index>=` line yields an inspection at that index
+ * and an index without a line stays `undefined`. A duplicated or out-of-range
+ * index is a malformed observation and rejects the whole batch.
+ */
+export declare function parseWindowsAclBatchInspection(stdout: string, directories: readonly boolean[]): readonly (WindowsAclInspection | undefined)[];
+export {};
+//# sourceMappingURL=local-session.d.ts.map

package/dist/credentials/local-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-session.d.ts","sourceRoot":"","sources":["../../src/credentials/local-session.ts"],"names":[],"mappings":"AAUA,OAAO,EAA+B,KAAK,yBAAyB,EAAE,KAAK,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AA6B3H;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B;;;;;EAsGvC,CAAC;AAUH;;;;GAIG;AACH,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;CACjC;AAED,UAAU,wBAAwB;IAChC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED,UAAU,2BAA2B;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,UAAU,mBAAmB;IAC3B,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAClF;;;;;OAKG;IACH,oBAAoB,CAAC,CAAC,QAAQ,EAAE,SAAS,2BAA2B,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,oBAAoB,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IAChI,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;CAC5F;AAoBD;;;;;GAKG;AACH,qBAAa,4BAA6B,YAAW,uBAAuB;;IAC1E,QAAQ,CAAC,SAAS,6BAA6B;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;gBAQvB,KAAK,EAAE;QACjB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;QACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;QAC9B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;KAC3C;IAeK,KAAK,IAAI,OAAO,CAAC,yBAAyB,CAAC;IAgB3C,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;IA8CtD,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAcnE,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,EAAE,cAAc,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;IAa5H,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;IAUrG,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,QAAQ,CAAC;IAItD,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CA2PnF;AA4FD,wBAAgB,0BAA0B,CAAC,eAAe,EAAE,MAAM,EAAE,OAAO,SAAY,GAAG;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAUnJ;AAqCD;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,SAAS,EAAE,MAAM,CAAC,UAAU,EAC5B,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,UAAU,CAInB;AAED;;;;GAIG;AACH,wBAAgB,sCAAsC,CACpD,SAAS,EAAE,MAAM,CAAC,UAAU,EAC5B,KAAK,EAAE,SAAS,MAAM,EAAE,GACvB,MAAM,CAAC,UAAU,CAQnB;AAyED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,SAAS,2BAA2B,EAAE,GAC/C,OAAO,CAAC,SAAS,CAAC,oBAAoB,GAAG,SAAS,CAAC,EAAE,CAAC,CAgBxD;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,SAAS,OAAO,EAAE,GAC9B,SAAS,CAAC,oBAAoB,GAAG,SAAS,CAAC,EAAE,CAc/C"}