@descryy/runtime-environment-profile 0.0.0

package/dist/credential-store.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Credential storage — DEC-270: "Credentials stored locally, in the OS
+ * keychain on the user's machine — not on a Descry server." This repo has
+ * no server component (`descry-core` CLAUDE.md, "Repo split"), so that
+ * guarantee is entirely a local-storage concern here.
+ *
+ * `CredentialStore` is the seam a real OS-keychain backend (`keytar` or
+ * equivalent) plugs into later. **Chosen for this pass:
+ * `EncryptedFileCredentialStore`, an at-rest AES-256-GCM file store, not a
+ * real keychain integration** — disclosed per the "honest degradation"
+ * rule (`descry-core` CLAUDE.md rule 7), not silently passed off as the
+ * real thing:
+ *
+ *  - Neither this repo's root `package.json` nor `descry-core`'s already
+ *    depends on `keytar` or any keychain wrapper (checked before writing
+ *    this file), and `keytar` itself is an unmaintained native module
+ *    (prebuilt binaries, no upstream releases since 2021) — exactly the
+ *    "heavy new dependency added without checking existing ones" this
+ *    pass was told to avoid, for a package that would need per-platform
+ *    native builds to even test in CI.
+ *  - `node:crypto` is already a dependency of this repo (`randomUUID` is
+ *    used in `backend-observation`, `browser`, `controller`,
+ *    `evidence-store`) and needs no native build step, so the interim
+ *    implementation is buildable and testable everywhere `node --test`
+ *    already runs.
+ *  - The interface below does not leak this choice: a future
+ *    `KeychainCredentialStore` satisfies the same three methods and every
+ *    caller (including the safety gate) is unaffected by the swap.
+ */
+export interface CredentialStore {
+    /** Stores `secret` under `credentialRef`, overwriting any existing value for that ref. */
+    store(credentialRef: string, secret: string): Promise<void>;
+    /** Returns the stored secret, or `null` if nothing is stored under this exact `credentialRef`. */
+    retrieve(credentialRef: string): Promise<string | null>;
+    /** Removes any stored secret for `credentialRef`. A no-op, not an error, if nothing was stored. */
+    delete(credentialRef: string): Promise<void>;
+}
+/**
+ * AES-256-GCM file-at-rest fallback. One file per `credentialRef`, named
+ * by the SHA-256 hash of the ref rather than the ref itself — so scoping
+ * is enforced structurally (a lookup under a different ref hashes to a
+ * different filename and simply finds nothing) rather than only by
+ * convention, and so a ref containing characters unsafe for a filename
+ * never needs special-casing.
+ *
+ * The AES key is a 32-byte value generated once and written to
+ * `master.key` inside the store directory, `chmod`'d to `0o600`
+ * (owner-only) immediately after write — the directory itself is created
+ * `0o700`. This protects against other *users* on a shared machine, not
+ * against another *process running as the same user*, which is the
+ * limitation a real OS keychain (backed by the platform's own access
+ * control / user login secret) does not have. That gap is exactly why
+ * this is documented as an interim fallback rather than the intended
+ * long-term implementation.
+ */
+export declare class EncryptedFileCredentialStore implements CredentialStore {
+    private readonly baseDir;
+    private readonly entriesDir;
+    private readonly keyPath;
+    private keyPromise;
+    constructor(options?: {
+        readonly baseDir?: string;
+    });
+    store(credentialRef: string, secret: string): Promise<void>;
+    retrieve(credentialRef: string): Promise<string | null>;
+    delete(credentialRef: string): Promise<void>;
+    private entryPath;
+    private loadOrCreateKey;
+    private loadOrCreateKeyUncached;
+}
+//# sourceMappingURL=credential-store.d.ts.map

package/dist/credential-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.d.ts","sourceRoot":"","sources":["../src/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAQH,MAAM,WAAW,eAAe;IAC9B,0FAA0F;IAC1F,KAAK,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,kGAAkG;IAClG,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACxD,mGAAmG;IACnG,MAAM,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9C;AAYD;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,4BAA6B,YAAW,eAAe;IAClE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,UAAU,CAAgC;gBAEtC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE;IAM7C,KAAK,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB3D,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAiBvD,MAAM,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWlD,OAAO,CAAC,SAAS;YAKH,eAAe;YAOf,uBAAuB;CAUtC"}

package/dist/credential-store.js

@@ -0,0 +1,129 @@
+/**
+ * Credential storage — DEC-270: "Credentials stored locally, in the OS
+ * keychain on the user's machine — not on a Descry server." This repo has
+ * no server component (`descry-core` CLAUDE.md, "Repo split"), so that
+ * guarantee is entirely a local-storage concern here.
+ *
+ * `CredentialStore` is the seam a real OS-keychain backend (`keytar` or
+ * equivalent) plugs into later. **Chosen for this pass:
+ * `EncryptedFileCredentialStore`, an at-rest AES-256-GCM file store, not a
+ * real keychain integration** — disclosed per the "honest degradation"
+ * rule (`descry-core` CLAUDE.md rule 7), not silently passed off as the
+ * real thing:
+ *
+ *  - Neither this repo's root `package.json` nor `descry-core`'s already
+ *    depends on `keytar` or any keychain wrapper (checked before writing
+ *    this file), and `keytar` itself is an unmaintained native module
+ *    (prebuilt binaries, no upstream releases since 2021) — exactly the
+ *    "heavy new dependency added without checking existing ones" this
+ *    pass was told to avoid, for a package that would need per-platform
+ *    native builds to even test in CI.
+ *  - `node:crypto` is already a dependency of this repo (`randomUUID` is
+ *    used in `backend-observation`, `browser`, `controller`,
+ *    `evidence-store`) and needs no native build step, so the interim
+ *    implementation is buildable and testable everywhere `node --test`
+ *    already runs.
+ *  - The interface below does not leak this choice: a future
+ *    `KeychainCredentialStore` satisfies the same three methods and every
+ *    caller (including the safety gate) is unaffected by the swap.
+ */
+import { randomBytes, createCipheriv, createDecipheriv, createHash } from "node:crypto";
+import { mkdir, readFile, writeFile, unlink, chmod } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+const ALGORITHM = "aes-256-gcm";
+const KEY_BYTES = 32;
+const IV_BYTES = 12;
+/**
+ * AES-256-GCM file-at-rest fallback. One file per `credentialRef`, named
+ * by the SHA-256 hash of the ref rather than the ref itself — so scoping
+ * is enforced structurally (a lookup under a different ref hashes to a
+ * different filename and simply finds nothing) rather than only by
+ * convention, and so a ref containing characters unsafe for a filename
+ * never needs special-casing.
+ *
+ * The AES key is a 32-byte value generated once and written to
+ * `master.key` inside the store directory, `chmod`'d to `0o600`
+ * (owner-only) immediately after write — the directory itself is created
+ * `0o700`. This protects against other *users* on a shared machine, not
+ * against another *process running as the same user*, which is the
+ * limitation a real OS keychain (backed by the platform's own access
+ * control / user login secret) does not have. That gap is exactly why
+ * this is documented as an interim fallback rather than the intended
+ * long-term implementation.
+ */
+export class EncryptedFileCredentialStore {
+    baseDir;
+    entriesDir;
+    keyPath;
+    keyPromise = null;
+    constructor(options) {
+        this.baseDir = options?.baseDir ?? join(homedir(), ".descry", "credentials");
+        this.entriesDir = join(this.baseDir, "entries");
+        this.keyPath = join(this.baseDir, "master.key");
+    }
+    async store(credentialRef, secret) {
+        await mkdir(this.entriesDir, { recursive: true, mode: 0o700 });
+        const key = await this.loadOrCreateKey();
+        const iv = randomBytes(IV_BYTES);
+        const cipher = createCipheriv(ALGORITHM, key, iv);
+        const ciphertext = Buffer.concat([cipher.update(secret, "utf8"), cipher.final()]);
+        const envelope = {
+            iv: iv.toString("base64"),
+            authTag: cipher.getAuthTag().toString("base64"),
+            ciphertext: ciphertext.toString("base64"),
+        };
+        const path = this.entryPath(credentialRef);
+        await writeFile(path, JSON.stringify(envelope), { mode: 0o600 });
+        await chmod(path, 0o600);
+    }
+    async retrieve(credentialRef) {
+        const path = this.entryPath(credentialRef);
+        if (!existsSync(path)) {
+            return null;
+        }
+        const key = await this.loadOrCreateKey();
+        const raw = await readFile(path, "utf8");
+        const envelope = JSON.parse(raw);
+        const decipher = createDecipheriv(ALGORITHM, key, Buffer.from(envelope.iv, "base64"));
+        decipher.setAuthTag(Buffer.from(envelope.authTag, "base64"));
+        const plaintext = Buffer.concat([
+            decipher.update(Buffer.from(envelope.ciphertext, "base64")),
+            decipher.final(),
+        ]);
+        return plaintext.toString("utf8");
+    }
+    async delete(credentialRef) {
+        const path = this.entryPath(credentialRef);
+        try {
+            await unlink(path);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT") {
+                throw error;
+            }
+        }
+    }
+    entryPath(credentialRef) {
+        const digest = createHash("sha256").update(credentialRef, "utf8").digest("hex");
+        return join(this.entriesDir, `${digest}.json`);
+    }
+    async loadOrCreateKey() {
+        if (this.keyPromise === null) {
+            this.keyPromise = this.loadOrCreateKeyUncached();
+        }
+        return this.keyPromise;
+    }
+    async loadOrCreateKeyUncached() {
+        await mkdir(this.baseDir, { recursive: true, mode: 0o700 });
+        if (existsSync(this.keyPath)) {
+            return readFile(this.keyPath);
+        }
+        const key = randomBytes(KEY_BYTES);
+        await writeFile(this.keyPath, key, { mode: 0o600 });
+        await chmod(this.keyPath, 0o600);
+        return key;
+    }
+}
+//# sourceMappingURL=credential-store.js.map

package/dist/credential-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../src/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAWjC,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,QAAQ,GAAG,EAAE,CAAC;AAQpB;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,4BAA4B;IACtB,OAAO,CAAS;IAChB,UAAU,CAAS;IACnB,OAAO,CAAS;IACzB,UAAU,GAA2B,IAAI,CAAC;IAElD,YAAY,OAAuC;QACjD,IAAI,CAAC,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QAC7E,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,aAAqB,EAAE,MAAc;QAC/C,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAClF,MAAM,QAAQ,GAAsB;YAClC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACzB,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/C,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;SAC1C,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAC3C,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,aAAqB;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC;QACtD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QACtF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC3D,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,aAAqB;QACrC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,MAAM,OAAO,CAAC,CAAC;IACjD,CAAC;IAEO,KAAK,CAAC,eAAe;QAC3B,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YAC7B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;QACnD,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,uBAAuB;QACnC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,GAAG,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjC,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export type { EnvironmentProfile, SafetyLevel, ProfileValidationError, ProfileMode } from "./profile.ts";
+export { SAFETY_LEVELS, PROFILE_MODES, validateProfile, createEnvironmentProfile } from "./profile.ts";
+export type { CredentialStore } from "./credential-store.ts";
+export { EncryptedFileCredentialStore } from "./credential-store.ts";
+export type { GateDecision, ProposedAction } from "./safety-gate.ts";
+export { GATE_DECISIONS, evaluateAction } from "./safety-gate.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,kBAAkB,EAAE,WAAW,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACzG,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAEvG,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AAErE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -0,0 +1,4 @@
+export { SAFETY_LEVELS, PROFILE_MODES, validateProfile, createEnvironmentProfile } from "./profile.js";
+export { EncryptedFileCredentialStore } from "./credential-store.js";
+export { GATE_DECISIONS, evaluateAction } from "./safety-gate.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAGvG,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AAGrE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/profile.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Environment profile — DEC-270 (`documents/decisions-inbox/
+ * DEC-270-environment-profiles-declare-safety-not-infer-it.md`), building on
+ * DEC-266's four target kinds (local booted, local attached, remote
+ * dev/staging/preview, production).
+ *
+ * A profile is a **user-named** target: no fixed vocabulary. "staging"
+ * means different things at different companies, so nothing here
+ * pattern-matches on `name` — the safety level below is the only thing
+ * that governs what is permitted, and it is always set explicitly by the
+ * user, never guessed from the name or the URL.
+ *
+ * `credentialRef` is a reference into a `CredentialStore` (see
+ * `credential-store.ts`), never the raw secret — this type is safe to log,
+ * serialize or hand to a planner without ever exposing what it points at.
+ *
+ * `mode` and `remoteLogSource` are RT-197/DEC-271's addition. Until this
+ * pass `EnvironmentProfile` had no field naming which of DEC-266's four
+ * kinds a given profile actually was — `@descryhq-wq/runtime-remote-log-ingestion`
+ * existed with real tests and zero callers, and there was no profile-level
+ * place for a "remote/production" target to declare where its logs live,
+ * so nothing could have called it. `mode` closes that: it is what
+ * `packages/orchestrator/src/profile-backend-observation.ts` reads to
+ * choose DEC-271's mechanism — a real `InboundProxy` for `"localBooted"`,
+ * `remote-log-ingestion` for `"remote"`/`"production"`, never both.
+ */
+import type { RemoteLogSourceConfig } from "@descryhq-wq/runtime-remote-log-ingestion";
+/** Set once by the user per profile. Never inferred from `name` (DEC-270's core rule). */
+export declare const SAFETY_LEVELS: readonly ["readOnly", "write", "destructiveWithApproval"];
+export type SafetyLevel = (typeof SAFETY_LEVELS)[number];
+/**
+ * DEC-266's four target kinds, named as a closed union for the first time
+ * (RT-197). Set once by the user per profile, same discipline as
+ * `safetyLevel` — never inferred from `name` or `url`.
+ */
+export declare const PROFILE_MODES: readonly ["localBooted", "localAttached", "remote", "production"];
+export type ProfileMode = (typeof PROFILE_MODES)[number];
+export interface EnvironmentProfile {
+    /** User-given, free-form. Not matched against any fixed vocabulary anywhere in this package. */
+    readonly name: string;
+    readonly url: string;
+    readonly safetyLevel: SafetyLevel;
+    /**
+     * Opaque key into a `CredentialStore` — never the raw secret itself.
+     * Scoped to this profile only: two profiles must never share a
+     * `credentialRef`, so a credential entered for one is never retrievable
+     * under another's identity, even by accident (DEC-270).
+     */
+    readonly credentialRef: string;
+    /** Which of DEC-266's four kinds this profile targets. Governs DEC-271's mechanism choice — see this file's own header. */
+    readonly mode: ProfileMode;
+    /**
+     * DEC-271's "ask, don't guess" input for the remote/production mechanism
+     * — where the user says their logs live, per
+     * `@descryhq-wq/runtime-remote-log-ingestion`'s `RemoteLogSourceConfig`. Only
+     * meaningful for `mode: "remote"` or `mode: "production"`;
+     * `validateProfile` rejects it on a `"localBooted"`/`"localAttached"`
+     * profile rather than silently ignoring it, because a caller that set it
+     * there believed it would be honored and it would not have been.
+     *
+     * `null`/absent on a remote or production profile is a real, honest
+     * state — DEC-271's own "or a plain 'not observable here' when there's
+     * nothing to work with" — not an error. This type has no dependency in
+     * the other direction: `@descryhq-wq/runtime-remote-log-ingestion` does not
+     * import from this package.
+     */
+    readonly remoteLogSource?: RemoteLogSourceConfig | null;
+}
+export type ProfileValidationError = "EMPTY_NAME" | "EMPTY_CREDENTIAL_REF" | "INVALID_URL" | "INVALID_SAFETY_LEVEL" | "INVALID_MODE" | "REMOTE_LOG_SOURCE_NOT_ALLOWED_FOR_MODE";
+/**
+ * Structural validation only — no attempt to reach `url` or verify the
+ * credential exists. Reachability and secret presence are runtime
+ * concerns; this stays a pure check so it can run before either is
+ * possible (e.g. while a setup form is still being filled in).
+ */
+export declare function validateProfile(input: {
+    readonly name: string;
+    readonly url: string;
+    readonly safetyLevel: string;
+    readonly credentialRef: string;
+    readonly mode: string;
+    readonly remoteLogSource?: RemoteLogSourceConfig | null;
+}): readonly ProfileValidationError[];
+/**
+ * Validates and constructs a profile in one step. Throws with every
+ * validation error joined, rather than the first one only, so a caller
+ * building a setup form doesn't have to fix and resubmit one field at a
+ * time.
+ */
+export declare function createEnvironmentProfile(input: {
+    readonly name: string;
+    readonly url: string;
+    readonly safetyLevel: SafetyLevel;
+    readonly credentialRef: string;
+    readonly mode: ProfileMode;
+    readonly remoteLogSource?: RemoteLogSourceConfig | null;
+}): EnvironmentProfile;
+//# sourceMappingURL=profile.d.ts.map

package/dist/profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../src/profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AAEvF,0FAA0F;AAC1F,eAAO,MAAM,aAAa,2DAA4D,CAAC;AACvF,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD;;;;GAIG;AACH,eAAO,MAAM,aAAa,mEAAoE,CAAC;AAC/F,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD,MAAM,WAAW,kBAAkB;IACjC,gGAAgG;IAChG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,2HAA2H;IAC3H,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACzD;AAED,MAAM,MAAM,sBAAsB,GAC9B,YAAY,GACZ,sBAAsB,GACtB,aAAa,GACb,sBAAsB,GACtB,cAAc,GACd,wCAAwC,CAAC;AAE7C;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACzD,GAAG,SAAS,sBAAsB,EAAE,CA6BpC;AAWD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACzD,GAAG,kBAAkB,CAarB"}

package/dist/profile.js

@@ -0,0 +1,96 @@
+/**
+ * Environment profile — DEC-270 (`documents/decisions-inbox/
+ * DEC-270-environment-profiles-declare-safety-not-infer-it.md`), building on
+ * DEC-266's four target kinds (local booted, local attached, remote
+ * dev/staging/preview, production).
+ *
+ * A profile is a **user-named** target: no fixed vocabulary. "staging"
+ * means different things at different companies, so nothing here
+ * pattern-matches on `name` — the safety level below is the only thing
+ * that governs what is permitted, and it is always set explicitly by the
+ * user, never guessed from the name or the URL.
+ *
+ * `credentialRef` is a reference into a `CredentialStore` (see
+ * `credential-store.ts`), never the raw secret — this type is safe to log,
+ * serialize or hand to a planner without ever exposing what it points at.
+ *
+ * `mode` and `remoteLogSource` are RT-197/DEC-271's addition. Until this
+ * pass `EnvironmentProfile` had no field naming which of DEC-266's four
+ * kinds a given profile actually was — `@descryhq-wq/runtime-remote-log-ingestion`
+ * existed with real tests and zero callers, and there was no profile-level
+ * place for a "remote/production" target to declare where its logs live,
+ * so nothing could have called it. `mode` closes that: it is what
+ * `packages/orchestrator/src/profile-backend-observation.ts` reads to
+ * choose DEC-271's mechanism — a real `InboundProxy` for `"localBooted"`,
+ * `remote-log-ingestion` for `"remote"`/`"production"`, never both.
+ */
+/** Set once by the user per profile. Never inferred from `name` (DEC-270's core rule). */
+export const SAFETY_LEVELS = ["readOnly", "write", "destructiveWithApproval"];
+/**
+ * DEC-266's four target kinds, named as a closed union for the first time
+ * (RT-197). Set once by the user per profile, same discipline as
+ * `safetyLevel` — never inferred from `name` or `url`.
+ */
+export const PROFILE_MODES = ["localBooted", "localAttached", "remote", "production"];
+/**
+ * Structural validation only — no attempt to reach `url` or verify the
+ * credential exists. Reachability and secret presence are runtime
+ * concerns; this stays a pure check so it can run before either is
+ * possible (e.g. while a setup form is still being filled in).
+ */
+export function validateProfile(input) {
+    const errors = [];
+    if (input.name.trim().length === 0) {
+        errors.push("EMPTY_NAME");
+    }
+    if (input.credentialRef.trim().length === 0) {
+        errors.push("EMPTY_CREDENTIAL_REF");
+    }
+    if (!isParsableUrl(input.url)) {
+        errors.push("INVALID_URL");
+    }
+    if (!SAFETY_LEVELS.includes(input.safetyLevel)) {
+        errors.push("INVALID_SAFETY_LEVEL");
+    }
+    if (!PROFILE_MODES.includes(input.mode)) {
+        errors.push("INVALID_MODE");
+    }
+    // A log source declared on a mode DEC-271 never reads it for is a
+    // silently-ignored setting, not a harmless extra -- rejected rather than
+    // dropped, so the caller who set it learns it would not have been honored.
+    if (input.remoteLogSource != null &&
+        (input.mode === "localBooted" || input.mode === "localAttached")) {
+        errors.push("REMOTE_LOG_SOURCE_NOT_ALLOWED_FOR_MODE");
+    }
+    return errors;
+}
+function isParsableUrl(url) {
+    try {
+        void new URL(url);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Validates and constructs a profile in one step. Throws with every
+ * validation error joined, rather than the first one only, so a caller
+ * building a setup form doesn't have to fix and resubmit one field at a
+ * time.
+ */
+export function createEnvironmentProfile(input) {
+    const errors = validateProfile(input);
+    if (errors.length > 0) {
+        throw new Error(`Invalid environment profile: ${errors.join(", ")}`);
+    }
+    return {
+        name: input.name.trim(),
+        url: input.url,
+        safetyLevel: input.safetyLevel,
+        credentialRef: input.credentialRef.trim(),
+        mode: input.mode,
+        remoteLogSource: input.remoteLogSource ?? null,
+    };
+}
+//# sourceMappingURL=profile.js.map

package/dist/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../src/profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,0FAA0F;AAC1F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,yBAAyB,CAAU,CAAC;AAGvF;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,aAAa,EAAE,eAAe,EAAE,QAAQ,EAAE,YAAY,CAAU,CAAC;AA2C/F;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAO/B;IACC,MAAM,MAAM,GAA6B,EAAE,CAAC;IAE5C,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,CAAE,aAAmC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,CAAE,aAAmC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC9B,CAAC;IACD,kEAAkE;IAClE,yEAAyE;IACzE,2EAA2E;IAC3E,IACE,KAAK,CAAC,eAAe,IAAI,IAAI;QAC7B,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,CAAC,EAChE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAOxC;IACC,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;QACvB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE;QACzC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;KAC/C,CAAC;AACJ,CAAC"}

package/dist/safety-gate.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Safety gate — the enforcement point DEC-270 requires: "Any destructive
+ * action checks the profile's declared level before running, not the
+ * environment's name or the fact that it's 'not prod.'"
+ *
+ * This function does not wire itself into any caller — DEC-270 only asks
+ * that it exist and be correct; the runners that actually perform
+ * destructive actions (a different lane's work) call it before acting.
+ */
+import type { EnvironmentProfile } from "./profile.ts";
+export declare const GATE_DECISIONS: readonly ["allow", "deny", "requiresApproval"];
+export type GateDecision = (typeof GATE_DECISIONS)[number];
+export interface ProposedAction {
+    /** True for anything that changes state on the target — not just destructive actions. */
+    readonly write: boolean;
+    /**
+     * True for an irreversible or high-blast-radius action (delete, drop,
+     * force-push, and similar). Every destructive action is implicitly a
+     * write too, whether or not `write` is also set explicitly.
+     */
+    readonly destructive: boolean;
+}
+/**
+ * Decision matrix, one row per `SafetyLevel`:
+ *
+ * | safetyLevel               | read-only action | non-destructive write | destructive |
+ * |----------------------------|-------------------|------------------------|-------------|
+ * | `readOnly`                 | allow             | deny                   | deny        |
+ * | `write`                    | allow             | allow                  | deny        |
+ * | `destructiveWithApproval`  | allow             | allow                  | requiresApproval |
+ *
+ * `write` denies destructive rather than escalating it to approval — a
+ * profile owner who chose `write` explicitly did not choose
+ * `destructiveWithApproval`, and DEC-270's whole point is that the level
+ * is declared, not inferred or auto-upgraded.
+ */
+export declare function evaluateAction(profile: EnvironmentProfile, action: ProposedAction): GateDecision;
+//# sourceMappingURL=safety-gate.d.ts.map

package/dist/safety-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safety-gate.d.ts","sourceRoot":"","sources":["../src/safety-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,eAAO,MAAM,cAAc,gDAAiD,CAAC;AAC7E,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D,MAAM,WAAW,cAAc;IAC7B,yFAAyF;IACzF,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,cAAc,GAAG,YAAY,CAQhG"}

package/dist/safety-gate.js

@@ -0,0 +1,34 @@
+/**
+ * Safety gate — the enforcement point DEC-270 requires: "Any destructive
+ * action checks the profile's declared level before running, not the
+ * environment's name or the fact that it's 'not prod.'"
+ *
+ * This function does not wire itself into any caller — DEC-270 only asks
+ * that it exist and be correct; the runners that actually perform
+ * destructive actions (a different lane's work) call it before acting.
+ */
+export const GATE_DECISIONS = ["allow", "deny", "requiresApproval"];
+/**
+ * Decision matrix, one row per `SafetyLevel`:
+ *
+ * | safetyLevel               | read-only action | non-destructive write | destructive |
+ * |----------------------------|-------------------|------------------------|-------------|
+ * | `readOnly`                 | allow             | deny                   | deny        |
+ * | `write`                    | allow             | allow                  | deny        |
+ * | `destructiveWithApproval`  | allow             | allow                  | requiresApproval |
+ *
+ * `write` denies destructive rather than escalating it to approval — a
+ * profile owner who chose `write` explicitly did not choose
+ * `destructiveWithApproval`, and DEC-270's whole point is that the level
+ * is declared, not inferred or auto-upgraded.
+ */
+export function evaluateAction(profile, action) {
+    if (action.destructive) {
+        return profile.safetyLevel === "destructiveWithApproval" ? "requiresApproval" : "deny";
+    }
+    if (action.write) {
+        return profile.safetyLevel === "readOnly" ? "deny" : "allow";
+    }
+    return "allow";
+}
+//# sourceMappingURL=safety-gate.js.map

package/dist/safety-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safety-gate.js","sourceRoot":"","sources":["../src/safety-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAU,CAAC;AAc7E;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,OAA2B,EAAE,MAAsB;IAChF,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,OAAO,OAAO,CAAC,WAAW,KAAK,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC;IACzF,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,OAAO,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAC/D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@descryy/runtime-environment-profile",
+  "version": "0.0.0",
+  "type": "module",
+  "description": "Environment profiles per DEC-270/DEC-266: a user-named target (local booted/attached, remote dev/staging/preview, production) carrying a declared safety level, scoped credentials, and the safety-gate enforcement point destructive actions must call before running.",
+  "license": "UNLICENSED",
+  "engines": {
+    "node": ">=22.5"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -b"
+  },
+  "dependencies": {
+    "@descryhq-wq/runtime-remote-log-ingestion": "0.0.0"
+  }
+}