@the-ai-company/cbio-node-runtime 1.19.0 → 1.21.0

package/README.md

@@ -75,14 +75,18 @@ const profile = await readIdentityPrivateVaultProfile(storage, rootIdentity);
 const children = await readIdentityPrivateVaultChildrenState(storage, rootIdentity.privateKey);
 ```
 
-Vaults also support an optional human-readable nickname:
-
-```ts
-const createdVault = await createVault({
-  ownerIdentity: rootIdentity,
-  nickname: 'main-vault',
-});
-```
+Vaults also support optional public metadata for discovery:
+ 
+ ```ts
+ const createdVault = await createVault({
+   ownerIdentity: rootIdentity,
+   nickname: 'main-vault',
+   publicMetadata: {
+     displayName: 'Primary Vault',
+     tags: ['production', 'main'],
+   },
+ });
+ ```
 
 If you want to override the default workspace directory:
 
@@ -94,14 +98,9 @@ const createdVault = await createVault(storage, {
 });
 ```
 
-The workspace root can contain many vaults. Each vault is isolated under `vaults/<vaultId>/...`.
-
-Each identity now has its own private namespace in storage under `vault/private/identities/<identityId>/...`. That namespace holds identity-level metadata such as:
-
-- `profile.json`
-- `children.json`
-
-Those files are encrypted with a key derived from the identity private key, so they are not stored as plaintext JSON.
+The workspace root can contain many vaults. Each vault is physically divided into `vault/sealed/` (encrypted) and `vault/public/` (plaintext discovery).
+ 
+ Each identity also has its own private namespace under `identities/<identityId>/sealed/...` for encrypted metadata such as `profile.sealed` and `children.sealed`.
 
 ## Architecture
 

package/dist/runtime/bootstrap.d.ts

@@ -5,6 +5,7 @@ import type { CreatedIdentity } from "./identity.js";
 export interface CreateVaultOptions extends Omit<CreatePersistentVaultCoreDependenciesOptions, "vaultWorkingKey" | "vaultId"> {
     vaultId?: string;
     nickname?: string;
+    publicMetadata?: Record<string, any>;
     ownerIdentity: CreatedIdentity;
     vault?: {
         customFlows?: VaultCustomFlowResolver;

package/dist/runtime/bootstrap.js

@@ -49,9 +49,12 @@ export async function createVault(storageOrOptions, maybeOptions) {
     await core.bootstrapOwnerIdentity(bootstrapOwner);
     const nickname = options.nickname?.trim() ? options.nickname.trim() : undefined;
     await writeVaultProfile(storage, {
-        vaultId,
-        nickname,
-    });
+        sealed: {
+            vaultId,
+            nickname,
+        },
+        public: options.publicMetadata ?? {},
+    }, vaultWorkingKey);
     return {
         core,
         vault: wrapVaultCoreAsVaultService(core, options.vault),
@@ -69,11 +72,11 @@ export async function recoverVault(storageOrOptions, maybeOptions) {
         vaultWorkingKey,
     });
     const core = createVaultCore(deps);
-    const profile = await readVaultProfile(storage);
+    const profile = await readVaultProfile(storage, vaultWorkingKey);
     return {
         core,
         vault: wrapVaultCoreAsVaultService(core, options.vault),
-        nickname: profile?.nickname,
+        nickname: profile?.sealed.nickname,
         storage,
     };
 }

package/dist/runtime/bootstrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/runtime/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EACL,qCAAqC,GAItC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,2BAA2B,GAG5B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAG7D,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,SAAS,qBAAqB,CAAC,UAAkB,EAAE,OAAe;IAChE,OAAO,MAAM;SACV,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,2BAA2B,CAAC;SACnC,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,OAAO,CAAC;SACf,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IACzC,OAAO,UAAU,OAAO,EAAE,CAAC;AAC7B,CAAC;AAqCD,SAAS,cAAc,CACrB,gBAA6E,EAC7E,YAAuD;IAEvD,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO;YACL,OAAO,EAAE,gBAAoC;YAC7C,OAAO,EAAE,YAAY;SACtB,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,sBAAsB,EAAE;QACjC,OAAO,EAAE,gBAA4D;KACtE,CAAC;AACJ,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,gBAAuD,EACvD,YAAiC;IAEjC,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,gBAAgB,EAAE,YAAY,CAG3F,CAAC;IACF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,SAAS,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,qBAAqB,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;IACrF,MAAM,eAAe,GAAG,qBAAqB,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,qCAAqC,CAAC,OAAO,EAAE;QAC1D,GAAG,OAAO;QACV,OAAO;QACP,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,cAAc,GAAwB;QAC1C,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU;QACzC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,SAAS;KAC3C,CAAC;IACF,MAAM,IAAI,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,MAAM,iBAAiB,CAAC,OAAO,EAAE;QAC/B,OAAO;QACP,QAAQ;KACT,CAAC,CAAC;IACH,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC;QACvD,QAAQ;QACR,OAAO;KACR,CAAC;AACJ,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,gBAAwD,EACxD,YAAkC;IAElC,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,gBAAgB,EAAE,YAAY,CAG3F,CAAC;IACF,MAAM,OAAO,GAAG,qBAAqB,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7F,MAAM,eAAe,GAAG,qBAAqB,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACjG,MAAM,IAAI,GAAG,qCAAqC,CAAC,OAAO,EAAE;QAC1D,GAAG,OAAO;QACV,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC;QACvD,QAAQ,EAAE,OAAO,EAAE,QAAQ;QAC3B,OAAO;KACR,CAAC;AACJ,CAAC"}
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/runtime/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EACL,qCAAqC,GAItC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,2BAA2B,GAG5B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAG7D,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,SAAS,qBAAqB,CAAC,UAAkB,EAAE,OAAe;IAChE,OAAO,MAAM;SACV,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,2BAA2B,CAAC;SACnC,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,OAAO,CAAC;SACf,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IACzC,OAAO,UAAU,OAAO,EAAE,CAAC;AAC7B,CAAC;AAsCD,SAAS,cAAc,CACrB,gBAA6E,EAC7E,YAAuD;IAEvD,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO;YACL,OAAO,EAAE,gBAAoC;YAC7C,OAAO,EAAE,YAAY;SACtB,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,sBAAsB,EAAE;QACjC,OAAO,EAAE,gBAA4D;KACtE,CAAC;AACJ,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,gBAAuD,EACvD,YAAiC;IAEjC,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,gBAAgB,EAAE,YAAY,CAG3F,CAAC;IACF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,SAAS,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,qBAAqB,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;IACrF,MAAM,eAAe,GAAG,qBAAqB,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,qCAAqC,CAAC,OAAO,EAAE;QAC1D,GAAG,OAAO;QACV,OAAO;QACP,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,cAAc,GAAwB;QAC1C,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU;QACzC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,SAAS;KAC3C,CAAC;IACF,MAAM,IAAI,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,MAAM,iBAAiB,CAAC,OAAO,EAAE;QAC/B,MAAM,EAAE;YACN,OAAO;YACP,QAAQ;SACT;QACD,MAAM,EAAE,OAAO,CAAC,cAAc,IAAI,EAAE;KACrC,EAAE,eAAe,CAAC,CAAC;IACpB,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC;QACvD,QAAQ;QACR,OAAO;KACR,CAAC;AACJ,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,gBAAwD,EACxD,YAAkC;IAElC,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,gBAAgB,EAAE,YAAY,CAG3F,CAAC;IACF,MAAM,OAAO,GAAG,qBAAqB,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7F,MAAM,eAAe,GAAG,qBAAqB,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACjG,MAAM,IAAI,GAAG,qCAAqC,CAAC,OAAO,EAAE;QAC1D,GAAG,OAAO;QACV,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACjE,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC;QACvD,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ;QAClC,OAAO;KACR,CAAC;AACJ,CAAC"}

package/dist/runtime/private-vault.js

@@ -1,20 +1,19 @@
-import { Buffer } from "node:buffer";
 import { createHash } from "node:crypto";
-import { SEALED_BLOB_VERSION, sealBlob, unsealBlob } from "../sealed/seal.js";
+import { SealedJsonRepository } from "../sealed/index.js";
 import { restoreIdentity } from "./identity.js";
-const PRIVATE_VAULT_PREFIX = "vault/private/identities";
+const PRIVATE_VAULT_PREFIX = "identities";
 const PRIVATE_VAULT_LOCK_SUFFIX = ".lock";
 export function identityPrivateVaultPrefix(identityId) {
     return `${PRIVATE_VAULT_PREFIX}/${identityId}`;
 }
 export function identityPrivateVaultProfileKey(identityId) {
-    return `${identityPrivateVaultPrefix(identityId)}/profile.json`;
+    return `${identityPrivateVaultPrefix(identityId)}/sealed/profile.sealed`;
 }
 export function identityPrivateVaultChildrenKey(identityId) {
-    return `${identityPrivateVaultPrefix(identityId)}/children.json`;
+    return `${identityPrivateVaultPrefix(identityId)}/sealed/children.sealed`;
 }
 function lockKey(identityId) {
-    return `${identityPrivateVaultPrefix(identityId)}${PRIVATE_VAULT_LOCK_SUFFIX}`;
+    return `${identityPrivateVaultPrefix(identityId)}/sealed/locks/vault${PRIVATE_VAULT_LOCK_SUFFIX}`;
 }
 function normalizeIdentityAccess(identityOrPrivateKey) {
     if (typeof identityOrPrivateKey === "string") {
@@ -31,33 +30,6 @@ function deriveIdentityPrivateVaultKey(identity) {
         .update(identity.privateKey)
         .digest("base64url");
 }
-function sealIdentityPrivateVaultJson(identity, value, kind) {
-    const sealed = sealBlob({
-        version: SEALED_BLOB_VERSION,
-        secrets: {
-            payload: JSON.stringify(value),
-        },
-        secretMetadata: {
-            kind,
-            identityId: identity.identityId,
-        },
-    }, deriveIdentityPrivateVaultKey(identity));
-    return Buffer.from(sealed, "utf8");
-}
-function unsealIdentityPrivateVaultJson(identity, payload, expectedKind) {
-    const unsealed = unsealBlob(payload.toString("utf8"), deriveIdentityPrivateVaultKey(identity));
-    if (unsealed.secretMetadata.kind !== expectedKind) {
-        throw new Error(`unexpected identity private vault payload kind: ${String(unsealed.secretMetadata.kind)}`);
-    }
-    if (unsealed.secretMetadata.identityId !== identity.identityId) {
-        throw new Error("identity private vault payload identity mismatch");
-    }
-    const secretPayload = unsealed.secrets.payload;
-    if (typeof secretPayload !== "string") {
-        throw new Error("identity private vault payload missing body");
-    }
-    return JSON.parse(secretPayload);
-}
 export async function ensureIdentityPrivateVault(storage, identity) {
     const profile = {
         identityId: identity.identityId,
@@ -66,31 +38,27 @@ export async function ensureIdentityPrivateVault(storage, identity) {
         parentIdentityId: identity.parentIdentityId,
         childIndex: identity.childIndex,
     };
-    await storage.write(identityPrivateVaultProfileKey(identity.identityId), sealIdentityPrivateVaultJson(identity, profile, "identity_private_vault_profile"));
+    const profileRepo = new SealedJsonRepository(storage, identityPrivateVaultProfileKey(identity.identityId), deriveIdentityPrivateVaultKey(identity));
+    await profileRepo.write(profile, "identity_private_vault_profile");
     const childrenKey = identityPrivateVaultChildrenKey(identity.identityId);
     if (!(await storage.has(childrenKey))) {
         const emptyState = {
             nextChildIndex: 0,
             children: [],
         };
-        await storage.write(childrenKey, sealIdentityPrivateVaultJson(identity, emptyState, "identity_private_vault_children"));
+        const childrenRepo = new SealedJsonRepository(storage, childrenKey, deriveIdentityPrivateVaultKey(identity));
+        await childrenRepo.write(emptyState, "identity_private_vault_children");
     }
 }
 export async function readIdentityPrivateVaultProfile(storage, identityOrPrivateKey) {
     const identity = normalizeIdentityAccess(identityOrPrivateKey);
-    const raw = await storage.read(identityPrivateVaultProfileKey(identity.identityId));
-    if (!raw) {
-        return null;
-    }
-    return unsealIdentityPrivateVaultJson(identity, raw, "identity_private_vault_profile");
+    const repo = new SealedJsonRepository(storage, identityPrivateVaultProfileKey(identity.identityId), deriveIdentityPrivateVaultKey(identity));
+    return repo.read(null);
 }
 export async function readIdentityPrivateVaultChildrenState(storage, identityOrPrivateKey) {
     const identity = normalizeIdentityAccess(identityOrPrivateKey);
-    const raw = await storage.read(identityPrivateVaultChildrenKey(identity.identityId));
-    if (!raw) {
-        return { nextChildIndex: 0, children: [] };
-    }
-    const parsed = unsealIdentityPrivateVaultJson(identity, raw, "identity_private_vault_children");
+    const repo = new SealedJsonRepository(storage, identityPrivateVaultChildrenKey(identity.identityId), deriveIdentityPrivateVaultKey(identity));
+    const parsed = await repo.read({ nextChildIndex: 0, children: [] });
     return {
         nextChildIndex: parsed.nextChildIndex ?? parsed.children.length,
         children: parsed.children ?? [],
@@ -98,7 +66,8 @@ export async function readIdentityPrivateVaultChildrenState(storage, identityOrP
 }
 export async function writeIdentityPrivateVaultChildrenState(storage, identityOrPrivateKey, state) {
     const identity = normalizeIdentityAccess(identityOrPrivateKey);
-    await storage.write(identityPrivateVaultChildrenKey(identity.identityId), sealIdentityPrivateVaultJson(identity, state, "identity_private_vault_children"));
+    const repo = new SealedJsonRepository(storage, identityPrivateVaultChildrenKey(identity.identityId), deriveIdentityPrivateVaultKey(identity));
+    await repo.write(state, "identity_private_vault_children");
 }
 export async function withIdentityPrivateVaultLock(storage, identityOrPrivateKey, task) {
     const identity = normalizeIdentityAccess(identityOrPrivateKey);

package/dist/runtime/private-vault.js.map

@@ -1 +1 @@
-{"version":3,"file":"private-vault.js","sourceRoot":"","sources":["../../src/runtime/private-vault.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE9E,OAAO,EAAE,eAAe,EAAwB,MAAM,eAAe,CAAC;AAEtE,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AACxD,MAAM,yBAAyB,GAAG,OAAO,CAAC;AAyB1C,MAAM,UAAU,0BAA0B,CAAC,UAAkB;IAC3D,OAAO,GAAG,oBAAoB,IAAI,UAAU,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,UAAkB;IAC/D,OAAO,GAAG,0BAA0B,CAAC,UAAU,CAAC,eAAe,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,UAAkB;IAChE,OAAO,GAAG,0BAA0B,CAAC,UAAU,CAAC,gBAAgB,CAAC;AACnE,CAAC;AAED,SAAS,OAAO,CAAC,UAAkB;IACjC,OAAO,GAAG,0BAA0B,CAAC,UAAU,CAAC,GAAG,yBAAyB,EAAE,CAAC;AACjF,CAAC;AAED,SAAS,uBAAuB,CAAC,oBAAgD;IAC/E,IAAI,OAAO,oBAAoB,KAAK,QAAQ,EAAE,CAAC;QAC7C,OAAO,eAAe,CAAC,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED,SAAS,6BAA6B,CAAC,QAAyB;IAC9D,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,gCAAgC,CAAC;SACxC,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;SAC3B,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;SAC3B,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,4BAA4B,CAAC,QAAyB,EAAE,KAAc,EAAE,IAAY;IAC3F,MAAM,MAAM,GAAG,QAAQ,CACrB;QACE,OAAO,EAAE,mBAAmB;QAC5B,OAAO,EAAE;YACP,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SAC/B;QACD,cAAc,EAAE;YACd,IAAI;YACJ,UAAU,EAAE,QAAQ,CAAC,UAAU;SAChC;KACF,EACD,6BAA6B,CAAC,QAAQ,CAAC,CACxC,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,8BAA8B,CACrC,QAAyB,EACzB,OAAe,EACf,YAAoB;IAEpB,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/F,IAAI,QAAQ,CAAC,cAAc,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,mDAAmD,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,QAAQ,CAAC,cAAc,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;IAC/C,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAM,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAAyB,EACzB,QAAyB;IAEzB,MAAM,OAAO,GAAgC;QAC3C,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CAAC;IACF,MAAM,OAAO,CAAC,KAAK,CACjB,8BAA8B,CAAC,QAAQ,CAAC,UAAU,CAAC,EACnD,4BAA4B,CAAC,QAAQ,EAAE,OAAO,EAAE,gCAAgC,CAAC,CAClF,CAAC;IAEF,MAAM,WAAW,GAAG,+BAA+B,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACtC,MAAM,UAAU,GAAsC;YACpD,cAAc,EAAE,CAAC;YACjB,QAAQ,EAAE,EAAE;SACb,CAAC;QACF,MAAM,OAAO,CAAC,KAAK,CACjB,WAAW,EACX,4BAA4B,CAAC,QAAQ,EAAE,UAAU,EAAE,iCAAiC,CAAC,CACtF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,OAAyB,EACzB,oBAAgD;IAEhD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,8BAA8B,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,8BAA8B,CACnC,QAAQ,EACR,GAAG,EACH,gCAAgC,CACjC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,OAAyB,EACzB,oBAAgD;IAEhD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,MAAM,GAAG,8BAA8B,CAC3C,QAAQ,EACR,GAAG,EACH,iCAAiC,CAClC,CAAC;IACF,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC/D,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;KAChC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,OAAyB,EACzB,oBAAgD,EAChD,KAAwC;IAExC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IAC/D,MAAM,OAAO,CAAC,KAAK,CACjB,+BAA+B,CAAC,QAAQ,CAAC,UAAU,CAAC,EACpD,4BAA4B,CAAC,QAAQ,EAAE,KAAK,EAAE,iCAAiC,CAAC,CACjF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAyB,EACzB,oBAAgD,EAChD,IAAsB;IAEtB,MAAM,QAAQ,GAAG,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC"}
+{"version":3,"file":"private-vault.js","sourceRoot":"","sources":["../../src/runtime/private-vault.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAwB,MAAM,eAAe,CAAC;AAEtE,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAC1C,MAAM,yBAAyB,GAAG,OAAO,CAAC;AAyB1C,MAAM,UAAU,0BAA0B,CAAC,UAAkB;IAC3D,OAAO,GAAG,oBAAoB,IAAI,UAAU,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,UAAkB;IAC/D,OAAO,GAAG,0BAA0B,CAAC,UAAU,CAAC,wBAAwB,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,UAAkB;IAChE,OAAO,GAAG,0BAA0B,CAAC,UAAU,CAAC,yBAAyB,CAAC;AAC5E,CAAC;AAED,SAAS,OAAO,CAAC,UAAkB;IACjC,OAAO,GAAG,0BAA0B,CAAC,UAAU,CAAC,sBAAsB,yBAAyB,EAAE,CAAC;AACpG,CAAC;AAED,SAAS,uBAAuB,CAAC,oBAAgD;IAC/E,IAAI,OAAO,oBAAoB,KAAK,QAAQ,EAAE,CAAC;QAC7C,OAAO,eAAe,CAAC,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED,SAAS,6BAA6B,CAAC,QAAyB;IAC9D,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,gCAAgC,CAAC;SACxC,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;SAC3B,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;SAC3B,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAAyB,EACzB,QAAyB;IAEzB,MAAM,OAAO,GAAgC;QAC3C,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,oBAAoB,CAC1C,OAAO,EACP,8BAA8B,CAAC,QAAQ,CAAC,UAAU,CAAC,EACnD,6BAA6B,CAAC,QAAQ,CAAC,CACxC,CAAC;IACF,MAAM,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,gCAAgC,CAAC,CAAC;IAEnE,MAAM,WAAW,GAAG,+BAA+B,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACtC,MAAM,UAAU,GAAsC;YACpD,cAAc,EAAE,CAAC;YACjB,QAAQ,EAAE,EAAE;SACb,CAAC;QACF,MAAM,YAAY,GAAG,IAAI,oBAAoB,CAC3C,OAAO,EACP,WAAW,EACX,6BAA6B,CAAC,QAAQ,CAAC,CACxC,CAAC;QACF,MAAM,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,iCAAiC,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,OAAyB,EACzB,oBAAgD;IAEhD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,oBAAoB,CACnC,OAAO,EACP,8BAA8B,CAAC,QAAQ,CAAC,UAAU,CAAC,EACnD,6BAA6B,CAAC,QAAQ,CAAC,CACxC,CAAC;IACF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAW,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,OAAyB,EACzB,oBAAgD;IAEhD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,oBAAoB,CACnC,OAAO,EACP,+BAA+B,CAAC,QAAQ,CAAC,UAAU,CAAC,EACpD,6BAA6B,CAAC,QAAQ,CAAC,CACxC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IACpE,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC/D,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;KAChC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,OAAyB,EACzB,oBAAgD,EAChD,KAAwC;IAExC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,oBAAoB,CACnC,OAAO,EACP,+BAA+B,CAAC,QAAQ,CAAC,UAAU,CAAC,EACpD,6BAA6B,CAAC,QAAQ,CAAC,CACxC,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAyB,EACzB,oBAAgD,EAChD,IAAsB;IAEtB,MAAM,QAAQ,GAAG,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC"}

package/dist/runtime/vault-metadata.d.ts

@@ -1,7 +1,7 @@
 import type { IStorageProvider } from "../storage/provider.js";
 export interface VaultProfile {
-    vaultId: string;
-    nickname?: string;
+    sealed: Record<string, any>;
+    public: Record<string, any>;
 }
-export declare function writeVaultProfile(storage: IStorageProvider, profile: VaultProfile): Promise<void>;
-export declare function readVaultProfile(storage: IStorageProvider): Promise<VaultProfile | null>;
+export declare function writeVaultProfile(storage: IStorageProvider, profile: VaultProfile, vaultWorkingKey: string): Promise<void>;
+export declare function readVaultProfile(storage: IStorageProvider, vaultWorkingKey: string): Promise<VaultProfile | null>;

package/dist/runtime/vault-metadata.js

@@ -1,13 +1,32 @@
 import { Buffer } from "node:buffer";
-const VAULT_PROFILE_KEY = "vault/profile.json";
-export async function writeVaultProfile(storage, profile) {
-    await storage.write(VAULT_PROFILE_KEY, Buffer.from(JSON.stringify(profile, null, 2)));
+import { SealedJsonRepository } from "../sealed/index.js";
+const VAULT_SEALED_PROFILE_KEY = "vault/sealed/profile.sealed";
+const VAULT_PUBLIC_PROFILE_KEY = "vault/public/profile.json";
+export async function writeVaultProfile(storage, profile, vaultWorkingKey) {
+    // 1. Write Sealed Profile
+    const repo = new SealedJsonRepository(storage, VAULT_SEALED_PROFILE_KEY, vaultWorkingKey);
+    await repo.write(profile.sealed, "vault_profile_sealed");
+    // 2. Write Public Profile
+    if (profile.public && Object.keys(profile.public).length > 0) {
+        await storage.write(VAULT_PUBLIC_PROFILE_KEY, Buffer.from(JSON.stringify(profile.public, null, 2), "utf8"));
+    }
+    else {
+        if (await storage.has(VAULT_PUBLIC_PROFILE_KEY)) {
+            await storage.delete(VAULT_PUBLIC_PROFILE_KEY);
+        }
+    }
 }
-export async function readVaultProfile(storage) {
-    const payload = await storage.read(VAULT_PROFILE_KEY);
-    if (!payload) {
+export async function readVaultProfile(storage, vaultWorkingKey) {
+    const repo = new SealedJsonRepository(storage, VAULT_SEALED_PROFILE_KEY, vaultWorkingKey);
+    const sealed = await repo.read(null);
+    if (!sealed) {
         return null;
     }
-    return JSON.parse(payload.toString("utf8"));
+    const publicRaw = await storage.read(VAULT_PUBLIC_PROFILE_KEY);
+    const publicData = publicRaw ? JSON.parse(publicRaw.toString("utf8")) : {};
+    return {
+        sealed,
+        public: publicData,
+    };
 }
 //# sourceMappingURL=vault-metadata.js.map

package/dist/runtime/vault-metadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"vault-metadata.js","sourceRoot":"","sources":["../../src/runtime/vault-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAQrC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAE/C,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAyB,EACzB,OAAqB;IAErB,MAAM,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAyB;IAC9D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"vault-metadata.js","sourceRoot":"","sources":["../../src/runtime/vault-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAO1D,MAAM,wBAAwB,GAAG,6BAA6B,CAAC;AAC/D,MAAM,wBAAwB,GAAG,2BAA2B,CAAC;AAE7D,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAyB,EACzB,OAAqB,EACrB,eAAuB;IAEvB,0BAA0B;IAC1B,MAAM,IAAI,GAAG,IAAI,oBAAoB,CAAsB,OAAO,EAAE,wBAAwB,EAAE,eAAe,CAAC,CAAC;IAC/G,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAEzD,0BAA0B;IAC1B,IAAI,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7D,MAAM,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9G,CAAC;SAAM,CAAC;QACN,IAAI,MAAM,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,CAAC;YAChD,MAAM,OAAO,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAyB,EACzB,eAAuB;IAEvB,MAAM,IAAI,GAAG,IAAI,oBAAoB,CAAsB,OAAO,EAAE,wBAAwB,EAAE,eAAe,CAAC,CAAC;IAC/G,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAW,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE3E,OAAO;QACL,MAAM;QACN,MAAM,EAAE,UAAU;KACnB,CAAC;AACJ,CAAC"}

package/dist/sealed/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Sealed blob export. Seal/unseal primitives and sealed blob format helpers.
+ * Do not depend on agent-facing client code.
+ */
+export { sealBlob, unsealBlob, SEALED_BLOB_VERSION } from './seal.js';
+export type { SealedBlobPayload } from './seal.js';
+export { SealedJsonRepository } from './json-repo.js';

package/dist/sealed/index.js

@@ -0,0 +1,7 @@
+/**
+ * Sealed blob export. Seal/unseal primitives and sealed blob format helpers.
+ * Do not depend on agent-facing client code.
+ */
+export { sealBlob, unsealBlob, SEALED_BLOB_VERSION } from './seal.js';
+export { SealedJsonRepository } from './json-repo.js';
+//# sourceMappingURL=index.js.map

package/dist/sealed/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sealed/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/sealed/json-repo.d.ts

@@ -0,0 +1,13 @@
+import type { IStorageProvider } from "../storage/provider.js";
+/**
+ * Universal sealed JSON storage repository.
+ * Used by both ordinary vaults and identity private vaults.
+ */
+export declare class SealedJsonRepository<T> {
+    readonly storage: IStorageProvider;
+    private readonly _key;
+    private readonly _vaultWorkingKey?;
+    constructor(storage: IStorageProvider, _key: string, _vaultWorkingKey?: string | undefined);
+    read(fallback: T): Promise<T>;
+    write(value: T, metadataKind?: string): Promise<void>;
+}

package/dist/sealed/json-repo.js

@@ -0,0 +1,56 @@
+import { Buffer } from "node:buffer";
+import { sealBlob, unsealBlob } from "./seal.js";
+/**
+ * Universal sealed JSON storage repository.
+ * Used by both ordinary vaults and identity private vaults.
+ */
+export class SealedJsonRepository {
+    storage;
+    _key;
+    _vaultWorkingKey;
+    constructor(storage, _key, _vaultWorkingKey) {
+        this.storage = storage;
+        this._key = _key;
+        this._vaultWorkingKey = _vaultWorkingKey;
+    }
+    async read(fallback) {
+        const payload = await this.storage.read(this._key);
+        if (!payload) {
+            return fallback;
+        }
+        if (!this._vaultWorkingKey) {
+            return JSON.parse(payload.toString("utf8"));
+        }
+        try {
+            const unsealed = unsealBlob(payload.toString("utf8"), this._vaultWorkingKey);
+            const secretPayload = unsealed.secrets.payload;
+            if (typeof secretPayload !== "string") {
+                throw new Error("sealed payload missing body");
+            }
+            return JSON.parse(secretPayload);
+        }
+        catch (e) {
+            // If we have a key but unseal fails, it might be legacy plaintext or wrong key.
+            throw e;
+        }
+    }
+    async write(value, metadataKind) {
+        if (!this._vaultWorkingKey) {
+            const data = Buffer.from(JSON.stringify(value, null, 2), "utf8");
+            await this.storage.write(this._key, data);
+            return;
+        }
+        const sealed = sealBlob({
+            version: "v1.0",
+            secrets: {
+                payload: JSON.stringify(value),
+            },
+            secretMetadata: {
+                kind: metadataKind || "sealed_json",
+                key: this._key,
+            },
+        }, this._vaultWorkingKey);
+        await this.storage.write(this._key, Buffer.from(sealed, "utf8"));
+    }
+}
+//# sourceMappingURL=json-repo.js.map

package/dist/sealed/json-repo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-repo.js","sourceRoot":"","sources":["../../src/sealed/json-repo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAGjD;;;GAGG;AACH,MAAM,OAAO,oBAAoB;IAEb;IACC;IACA;IAHnB,YACkB,OAAyB,EACxB,IAAY,EACZ,gBAAyB;QAF1B,YAAO,GAAP,OAAO,CAAkB;QACxB,SAAI,GAAJ,IAAI,CAAQ;QACZ,qBAAgB,GAAhB,gBAAgB,CAAS;IACzC,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,QAAW;QACpB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAM,CAAC;QACnD,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC7E,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;YAC/C,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACjD,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAM,CAAC;QACxC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,gFAAgF;YAChF,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAQ,EAAE,YAAqB;QACzC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACjE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CACrB;YACE,OAAO,EAAE,MAAM;YACf,OAAO,EAAE;gBACP,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;aAC/B;YACD,cAAc,EAAE;gBACd,IAAI,EAAE,YAAY,IAAI,aAAa;gBACnC,GAAG,EAAE,IAAI,CAAC,IAAI;aACf;SACF,EACD,IAAI,CAAC,gBAAgB,CACtB,CAAC;QACF,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnE,CAAC;CACF"}

package/dist/vault-core/persistence.d.ts

@@ -3,7 +3,7 @@ import type { AgentCapability, AgentIdentityRecord, AuditEntry, AuditQuery, Owne
 import type { AgentIdentityRegistry, AuditLog, CapabilityRegistry, CapabilityRevocationRegistry, CustomHttpFlowRegistry, OwnerIdentityRegistry, RateLimitStore, ReplayGuard, SecretCustody, SecretRepository } from "./ports.js";
 import { createDefaultVaultCoreDependencies, type CreateDefaultVaultCoreDependenciesOptions } from "./defaults.js";
 import type { DispatchRequest } from "./contracts.js";
-export declare const DEFAULT_VAULT_KEY_CUSTODY_BLOB_KEY = "vault/custody/working-key.sealed";
+export declare const DEFAULT_VAULT_KEY_CUSTODY_BLOB_KEY = "vault/sealed/custody/working-key.sealed";
 export interface InitializeVaultCustodyOptions {
     vaultWorkingKey?: string;
     vaultRecoveryKey?: string;
@@ -21,10 +21,9 @@ export interface CreatePersistentVaultCoreDependenciesOptions extends CreateDefa
 export declare function initializeVaultCustody(storage: IStorageProvider, options?: InitializeVaultCustodyOptions): Promise<InitializedVaultCustody>;
 export declare function recoverVaultWorkingKey(storage: IStorageProvider, vaultRecoveryKey: string, storageKey?: string): Promise<string>;
 export declare class FileSecretRepository implements SecretRepository {
-    private readonly _storage;
-    private readonly _key;
     private readonly _lockKey;
-    constructor(_storage: IStorageProvider, _key?: string, _lockKey?: string);
+    private readonly _repo;
+    constructor(storage: IStorageProvider, vaultWorkingKey: string, key?: string, _lockKey?: string);
     private loadState;
     save(record: SecretRecord): Promise<void>;
     delete(secretId: SecretId): Promise<void>;
@@ -32,19 +31,17 @@ export declare class FileSecretRepository implements SecretRepository {
     getById(secretId: SecretId): Promise<SecretRecord | null>;
 }
 export declare class FileAgentIdentityRegistry implements AgentIdentityRegistry {
-    private readonly _storage;
-    private readonly _key;
     private readonly _lockKey;
-    constructor(_storage: IStorageProvider, _key?: string, _lockKey?: string);
+    private readonly _repo;
+    constructor(storage: IStorageProvider, vaultWorkingKey: string, key?: string, _lockKey?: string);
     private loadState;
     register(identity: AgentIdentityRecord): Promise<void>;
     get(vaultId: VaultId, agentId: string): Promise<AgentIdentityRecord | null>;
 }
 export declare class FileOwnerIdentityRegistry implements OwnerIdentityRegistry {
-    private readonly _storage;
-    private readonly _key;
     private readonly _lockKey;
-    constructor(_storage: IStorageProvider, _key?: string, _lockKey?: string);
+    private readonly _repo;
+    constructor(storage: IStorageProvider, vaultWorkingKey: string, key?: string, _lockKey?: string);
     private loadState;
     register(identity: OwnerIdentityRecord): Promise<void>;
     get(vaultId: VaultId, ownerId: string): Promise<OwnerIdentityRecord | null>;
@@ -72,43 +69,38 @@ export declare class FileSecretCustody implements SecretCustody {
     delete(secretId: SecretId): Promise<void>;
 }
 export declare class FileReplayGuard implements ReplayGuard {
-    private readonly _storage;
-    private readonly _key;
     private readonly _lockKey;
     private readonly _ttlMs;
-    constructor(_storage: IStorageProvider, _key?: string, _lockKey?: string, _ttlMs?: number);
+    private readonly _repo;
+    constructor(storage: IStorageProvider, vaultWorkingKey: string, key?: string, _lockKey?: string, _ttlMs?: number);
     assertNotReplayed(request: DispatchRequest): Promise<void>;
 }
 export declare class FileCapabilityRegistry implements CapabilityRegistry {
-    private readonly _storage;
-    private readonly _key;
     private readonly _lockKey;
-    constructor(_storage: IStorageProvider, _key?: string, _lockKey?: string);
+    private readonly _repo;
+    constructor(storage: IStorageProvider, vaultWorkingKey: string, key?: string, _lockKey?: string);
     private loadState;
     register(capability: AgentCapability): Promise<void>;
     get(vaultId: VaultId, agentId: string, capabilityId: string): Promise<AgentCapability | null>;
 }
 export declare class FileRateLimitStore implements RateLimitStore {
-    private readonly _storage;
-    private readonly _key;
     private readonly _lockKey;
-    constructor(_storage: IStorageProvider, _key?: string, _lockKey?: string);
+    private readonly _repo;
+    constructor(storage: IStorageProvider, vaultWorkingKey: string, key?: string, _lockKey?: string);
     consume(key: string, maxRequests: number, windowMs: number, nowMs: number): Promise<void>;
 }
 export declare class FileCapabilityRevocationRegistry implements CapabilityRevocationRegistry {
-    private readonly _storage;
-    private readonly _key;
     private readonly _lockKey;
-    constructor(_storage: IStorageProvider, _key?: string, _lockKey?: string);
+    private readonly _repo;
+    constructor(storage: IStorageProvider, vaultWorkingKey: string, key?: string, _lockKey?: string);
     private compositeKey;
     get(vaultId: VaultId, agentId: string, capabilityId: string): Promise<number>;
     revoke(vaultId: VaultId, agentId: string, capabilityId: string): Promise<number>;
 }
 export declare class FileCustomHttpFlowRegistry implements CustomHttpFlowRegistry {
-    private readonly _storage;
-    private readonly _key;
     private readonly _lockKey;
-    constructor(_storage: IStorageProvider, _key?: string, _lockKey?: string);
+    private readonly _repo;
+    constructor(storage: IStorageProvider, vaultWorkingKey: string, key?: string, _lockKey?: string);
     private loadState;
     register(flow: CustomHttpFlowDefinition): Promise<void>;
     get(vaultId: VaultId, flowId: string): Promise<CustomHttpFlowDefinition | null>;

package/dist/vault-core/persistence.js

@@ -1,18 +1,8 @@
-import { sealBlob, unsealBlob } from "../sealed/seal.js";
+import { sealBlob, unsealBlob, SealedJsonRepository } from "../sealed/index.js";
 import { DefaultPolicyEngine, SignatureAgentProofVerifier, SignatureOwnerProofVerifier, createDefaultVaultCoreDependencies, } from "./defaults.js";
 import { createHash, randomBytes } from "node:crypto";
 import { VaultCoreError } from "./errors.js";
-export const DEFAULT_VAULT_KEY_CUSTODY_BLOB_KEY = "vault/custody/working-key.sealed";
-function serializeJson(value) {
-    return Buffer.from(JSON.stringify(value, null, 2), "utf8");
-}
-async function readJson(storage, key, fallback) {
-    const payload = await storage.read(key);
-    if (!payload) {
-        return fallback;
-    }
-    return JSON.parse(payload.toString("utf8"));
-}
+export const DEFAULT_VAULT_KEY_CUSTODY_BLOB_KEY = "vault/sealed/custody/working-key.sealed";
 async function withStorageLock(storage, key, task) {
     if (storage.withLock) {
         return storage.withLock(key, task);
@@ -58,30 +48,28 @@ export async function recoverVaultWorkingKey(storage, vaultRecoveryKey, storageK
     return vaultWorkingKey;
 }
 export class FileSecretRepository {
-    _storage;
-    _key;
     _lockKey;
-    constructor(_storage, _key = "vault/secrets.json", _lockKey = "vault/locks/secrets") {
-        this._storage = _storage;
-        this._key = _key;
+    _repo;
+    constructor(storage, vaultWorkingKey, key = "vault/sealed/secrets.sealed", _lockKey = "vault/sealed/locks/secrets") {
         this._lockKey = _lockKey;
+        this._repo = new SealedJsonRepository(storage, key, vaultWorkingKey);
     }
     async loadState() {
-        return readJson(this._storage, this._key, { records: [] });
+        return this._repo.read({ records: [] });
     }
     async save(record) {
-        await withStorageLock(this._storage, this._lockKey, async () => {
+        await withStorageLock(this._repo.storage, this._lockKey, async () => {
             const state = await this.loadState();
             const next = state.records.filter((candidate) => candidate.secretId.value !== record.secretId.value);
             next.push(record);
-            await this._storage.write(this._key, serializeJson({ records: next }));
+            await this._repo.write({ records: next }, "secrets_state");
         });
     }
     async delete(secretId) {
-        await withStorageLock(this._storage, this._lockKey, async () => {
+        await withStorageLock(this._repo.storage, this._lockKey, async () => {
             const state = await this.loadState();
             const next = state.records.filter((candidate) => candidate.secretId.value !== secretId.value);
-            await this._storage.write(this._key, serializeJson({ records: next }));
+            await this._repo.write({ records: next }, "secrets_state");
         });
     }
     async getByAlias(alias) {
@@ -94,23 +82,21 @@ export class FileSecretRepository {
     }
 }
 export class FileAgentIdentityRegistry {
-    _storage;
-    _key;
     _lockKey;
-    constructor(_storage, _key = "vault/identities/agents.json", _lockKey = "vault/locks/agent-identities") {
-        this._storage = _storage;
-        this._key = _key;
+    _repo;
+    constructor(storage, vaultWorkingKey, key = "vault/sealed/identities/agents.sealed", _lockKey = "vault/sealed/locks/agent-identities") {
         this._lockKey = _lockKey;
+        this._repo = new SealedJsonRepository(storage, key, vaultWorkingKey);
     }
     async loadState() {
-        return readJson(this._storage, this._key, { identities: [] });
+        return this._repo.read({ identities: [] });
     }
     async register(identity) {
-        await withStorageLock(this._storage, this._lockKey, async () => {
+        await withStorageLock(this._repo.storage, this._lockKey, async () => {
             const state = await this.loadState();
             const next = state.identities.filter((candidate) => !(candidate.vaultId.value === identity.vaultId.value && candidate.agentId === identity.agentId));
             next.push(identity);
-            await this._storage.write(this._key, serializeJson({ identities: next }));
+            await this._repo.write({ identities: next }, "agent_identity_state");
         });
     }
     async get(vaultId, agentId) {
@@ -119,23 +105,21 @@ export class FileAgentIdentityRegistry {
     }
 }
 export class FileOwnerIdentityRegistry {
-    _storage;
-    _key;
     _lockKey;
-    constructor(_storage, _key = "vault/identities/owners.json", _lockKey = "vault/locks/owner-identities") {
-        this._storage = _storage;
-        this._key = _key;
+    _repo;
+    constructor(storage, vaultWorkingKey, key = "vault/sealed/identities/owners.sealed", _lockKey = "vault/sealed/locks/owner-identities") {
         this._lockKey = _lockKey;
+        this._repo = new SealedJsonRepository(storage, key, vaultWorkingKey);
     }
     async loadState() {
-        return readJson(this._storage, this._key, { identities: [] });
+        return this._repo.read({ identities: [] });
     }
     async register(identity) {
-        await withStorageLock(this._storage, this._lockKey, async () => {
+        await withStorageLock(this._repo.storage, this._lockKey, async () => {
             const state = await this.loadState();
             const next = state.identities.filter((candidate) => !(candidate.vaultId.value === identity.vaultId.value && candidate.ownerId === identity.ownerId));
             next.push(identity);
-            await this._storage.write(this._key, serializeJson({ identities: next }));
+            await this._repo.write({ identities: next }, "owner_identity_state");
         });
     }
     async get(vaultId, ownerId) {
@@ -151,7 +135,7 @@ export class FileAuditLog {
     _storage;
     _key;
     _lockKey;
-    constructor(_storage, _key = "vault/audit.jsonl", _lockKey = "vault/locks/audit") {
+    constructor(_storage, _key = "vault/sealed/audit.jsonl", _lockKey = "vault/sealed/locks/audit") {
         this._storage = _storage;
         this._key = _key;
         this._lockKey = _lockKey;
@@ -224,7 +208,7 @@ export class FileSecretCustody {
     _storage;
     _vaultWorkingKey;
     _keyPrefix;
-    constructor(_storage, _vaultWorkingKey, _keyPrefix = "vault/custody") {
+    constructor(_storage, _vaultWorkingKey, _keyPrefix = "vault/sealed/custody") {
         this._storage = _storage;
         this._vaultWorkingKey = _vaultWorkingKey;
         this._keyPrefix = _keyPrefix;
@@ -261,20 +245,18 @@ export class FileSecretCustody {
     }
 }
 export class FileReplayGuard {
-    _storage;
-    _key;
     _lockKey;
     _ttlMs;
-    constructor(_storage, _key = "vault/security/replay.json", _lockKey = "vault/locks/replay", _ttlMs = 5 * 60 * 1000) {
-        this._storage = _storage;
-        this._key = _key;
+    _repo;
+    constructor(storage, vaultWorkingKey, key = "vault/sealed/security/replay.sealed", _lockKey = "vault/sealed/locks/replay", _ttlMs = 5 * 60 * 1000) {
         this._lockKey = _lockKey;
         this._ttlMs = _ttlMs;
+        this._repo = new SealedJsonRepository(storage, key, vaultWorkingKey);
     }
     async assertNotReplayed(request) {
-        await withStorageLock(this._storage, this._lockKey, async () => {
+        await withStorageLock(this._repo.storage, this._lockKey, async () => {
             const now = Date.now();
-            const state = await readJson(this._storage, this._key, { seen: {} });
+            const state = await this._repo.read({ seen: {} });
             const nextSeen = {};
             for (const [key, seenAt] of Object.entries(state.seen)) {
                 if (now - seenAt <= this._ttlMs) {
@@ -286,30 +268,28 @@ export class FileReplayGuard {
                 throw new VaultCoreError("request replay detected", "VAULT_DISPATCH_DENIED");
             }
             nextSeen[replayKey] = now;
-            await this._storage.write(this._key, serializeJson({ seen: nextSeen }));
+            await this._repo.write({ seen: nextSeen }, "replay_guard_state");
         });
     }
 }
 export class FileCapabilityRegistry {
-    _storage;
-    _key;
     _lockKey;
-    constructor(_storage, _key = "vault/capabilities.json", _lockKey = "vault/locks/capabilities") {
-        this._storage = _storage;
-        this._key = _key;
+    _repo;
+    constructor(storage, vaultWorkingKey, key = "vault/sealed/capabilities.sealed", _lockKey = "vault/sealed/locks/capabilities") {
         this._lockKey = _lockKey;
+        this._repo = new SealedJsonRepository(storage, key, vaultWorkingKey);
     }
     async loadState() {
-        return readJson(this._storage, this._key, { capabilities: [] });
+        return this._repo.read({ capabilities: [] });
     }
     async register(capability) {
-        await withStorageLock(this._storage, this._lockKey, async () => {
+        await withStorageLock(this._repo.storage, this._lockKey, async () => {
             const state = await this.loadState();
             const next = state.capabilities.filter((candidate) => !(candidate.vaultId.value === capability.vaultId.value
                 && candidate.agentId === capability.agentId
                 && candidate.capabilityId === capability.capabilityId));
             next.push(capability);
-            await this._storage.write(this._key, serializeJson({ capabilities: next }));
+            await this._repo.write({ capabilities: next }, "capability_state");
         });
     }
     async get(vaultId, agentId, capabilityId) {
@@ -320,17 +300,15 @@ export class FileCapabilityRegistry {
     }
 }
 export class FileRateLimitStore {
-    _storage;
-    _key;
     _lockKey;
-    constructor(_storage, _key = "vault/security/rate-limits.json", _lockKey = "vault/locks/rate-limits") {
-        this._storage = _storage;
-        this._key = _key;
+    _repo;
+    constructor(storage, vaultWorkingKey, key = "vault/sealed/security/rate-limits.sealed", _lockKey = "vault/sealed/locks/rate-limits") {
         this._lockKey = _lockKey;
+        this._repo = new SealedJsonRepository(storage, key, vaultWorkingKey);
     }
     async consume(key, maxRequests, windowMs, nowMs) {
-        await withStorageLock(this._storage, this._lockKey, async () => {
-            const state = await readJson(this._storage, this._key, { buckets: {} });
+        await withStorageLock(this._repo.storage, this._lockKey, async () => {
+            const state = await this._repo.read({ buckets: {} });
             const nextBuckets = {};
             for (const [bucketKey, bucket] of Object.entries(state.buckets)) {
                 if (nowMs < bucket.resetAt) {
@@ -350,55 +328,51 @@ export class FileRateLimitStore {
                 }
                 current.count += 1;
             }
-            await this._storage.write(this._key, serializeJson({ buckets: nextBuckets }));
+            await this._repo.write({ buckets: nextBuckets }, "rate_limit_state");
         });
     }
 }
 export class FileCapabilityRevocationRegistry {
-    _storage;
-    _key;
     _lockKey;
-    constructor(_storage, _key = "vault/security/revocations.json", _lockKey = "vault/locks/revocations") {
-        this._storage = _storage;
-        this._key = _key;
+    _repo;
+    constructor(storage, vaultWorkingKey, key = "vault/sealed/security/revocations.sealed", _lockKey = "vault/sealed/locks/revocations") {
         this._lockKey = _lockKey;
+        this._repo = new SealedJsonRepository(storage, key, vaultWorkingKey);
     }
     compositeKey(vaultId, agentId, capabilityId) {
         return `${vaultId.value}:${agentId}:${capabilityId}`;
     }
     async get(vaultId, agentId, capabilityId) {
-        const state = await readJson(this._storage, this._key, { versions: {} });
+        const state = await this._repo.read({ versions: {} });
         return state.versions[this.compositeKey(vaultId, agentId, capabilityId)] ?? 0;
     }
     async revoke(vaultId, agentId, capabilityId) {
-        return withStorageLock(this._storage, this._lockKey, async () => {
-            const state = await readJson(this._storage, this._key, { versions: {} });
+        return withStorageLock(this._repo.storage, this._lockKey, async () => {
+            const state = await this._repo.read({ versions: {} });
             const key = this.compositeKey(vaultId, agentId, capabilityId);
             const next = (state.versions[key] ?? 0) + 1;
             state.versions[key] = next;
-            await this._storage.write(this._key, serializeJson(state));
+            await this._repo.write(state, "revocation_state");
             return next;
         });
     }
 }
 export class FileCustomHttpFlowRegistry {
-    _storage;
-    _key;
     _lockKey;
-    constructor(_storage, _key = "vault/custom-flows.json", _lockKey = "vault/locks/custom-flows") {
-        this._storage = _storage;
-        this._key = _key;
+    _repo;
+    constructor(storage, vaultWorkingKey, key = "vault/sealed/custom-flows.sealed", _lockKey = "vault/sealed/locks/custom-flows") {
         this._lockKey = _lockKey;
+        this._repo = new SealedJsonRepository(storage, key, vaultWorkingKey);
     }
     async loadState() {
-        return readJson(this._storage, this._key, { flows: [] });
+        return this._repo.read({ flows: [] });
     }
     async register(flow) {
-        await withStorageLock(this._storage, this._lockKey, async () => {
+        await withStorageLock(this._repo.storage, this._lockKey, async () => {
             const state = await this.loadState();
             const next = state.flows.filter((candidate) => candidate.flowId !== flow.flowId);
             next.push(flow);
-            await this._storage.write(this._key, serializeJson({ flows: next }));
+            await this._repo.write({ flows: next }, "custom_flow_state");
         });
     }
     async get(vaultId, flowId) {
@@ -408,14 +382,14 @@ export class FileCustomHttpFlowRegistry {
 }
 export function createPersistentVaultCoreDependencies(storage, options) {
     const defaults = createDefaultVaultCoreDependencies(options);
-    const agentIdentities = new FileAgentIdentityRegistry(storage);
-    const ownerIdentities = new FileOwnerIdentityRegistry(storage);
-    const capabilityRevocations = new FileCapabilityRevocationRegistry(storage);
-    const capabilities = new FileCapabilityRegistry(storage);
-    const customFlows = new FileCustomHttpFlowRegistry(storage);
+    const agentIdentities = new FileAgentIdentityRegistry(storage, options.vaultWorkingKey);
+    const ownerIdentities = new FileOwnerIdentityRegistry(storage, options.vaultWorkingKey);
+    const capabilityRevocations = new FileCapabilityRevocationRegistry(storage, options.vaultWorkingKey);
+    const capabilities = new FileCapabilityRegistry(storage, options.vaultWorkingKey);
+    const customFlows = new FileCustomHttpFlowRegistry(storage, options.vaultWorkingKey);
     return {
         ...defaults,
-        secrets: new FileSecretRepository(storage),
+        secrets: new FileSecretRepository(storage, options.vaultWorkingKey),
         custody: new FileSecretCustody(storage, options.vaultWorkingKey),
         audit: new FileAuditLog(storage),
         agentIdentities,
@@ -423,9 +397,9 @@ export function createPersistentVaultCoreDependencies(storage, options) {
         policy: new DefaultPolicyEngine({
             ...(options.policy ?? {}),
             capabilityRevocationRegistry: capabilityRevocations,
-            rateLimitStore: new FileRateLimitStore(storage),
+            rateLimitStore: new FileRateLimitStore(storage, options.vaultWorkingKey),
         }),
-        replayGuard: new FileReplayGuard(storage, "vault/security/replay.json", "vault/locks/replay", options.proofVerifier?.maxSkewMs ?? (5 * 60 * 1000)),
+        replayGuard: new FileReplayGuard(storage, options.vaultWorkingKey, "vault/sealed/security/replay.sealed", "vault/sealed/locks/replay", options.proofVerifier?.maxSkewMs ?? (5 * 60 * 1000)),
         proofVerifier: new SignatureAgentProofVerifier(agentIdentities, options.proofVerifier),
         ownerProofVerifier: new SignatureOwnerProofVerifier(ownerIdentities, options.proofVerifier),
         capabilities,

package/dist/vault-core/persistence.js.map

@@ -1 +1 @@
-{"version":3,"file":"persistence.js","sourceRoot":"","sources":["../../src/vault-core/persistence.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAyBzD,OAAO,EACL,mBAAmB,EACnB,2BAA2B,EAC3B,2BAA2B,EAC3B,kCAAkC,GAEnC,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAmC7C,MAAM,CAAC,MAAM,kCAAkC,GAAG,kCAAkC,CAAC;AAmBrF,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,QAAQ,CAAI,OAAyB,EAAE,GAAW,EAAE,QAAW;IAC5E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAM,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,eAAe,CAAI,OAAyB,EAAE,GAAW,EAAE,IAAsB;IAC9F,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAyB,EACzB,UAAyC,EAAE;IAE3C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,kCAAkC,CAAC;IAC5E,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,eAAe,EAAE,CAAC;IACrE,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,eAAe,EAAE,CAAC;IACvE,MAAM,MAAM,GAAG,QAAQ,CACrB;QACE,OAAO,EAAE,MAAM;QACf,OAAO,EAAE;YACP,eAAe;SAChB;QACD,cAAc,EAAE;YACd,IAAI,EAAE,mBAAmB;SAC1B;KACF,EACD,gBAAgB,CACjB,CAAC;IACF,MAAM,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7D,OAAO;QACL,eAAe;QACf,gBAAgB;QAChB,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAyB,EACzB,gBAAwB,EACxB,UAAU,GAAG,kCAAkC;IAE/C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACxE,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC;IACzD,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,CAAC,eAAe,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,MAAM,OAAO,oBAAoB;IAEZ;IACA;IACA;IAHnB,YACmB,QAA0B,EAC1B,OAAO,oBAAoB,EAC3B,WAAW,qBAAqB;QAFhC,aAAQ,GAAR,QAAQ,CAAkB;QAC1B,SAAI,GAAJ,IAAI,CAAuB;QAC3B,aAAQ,GAAR,QAAQ,CAAwB;IAChD,CAAC;IAEI,KAAK,CAAC,SAAS;QACrB,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAoB;QAC7B,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,KAAK,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACrG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClB,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAkB;QAC7B,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC9F,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAkB;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAkB;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;IAC1F,CAAC;CACF;AAED,MAAM,OAAO,yBAAyB;IAEjB;IACA;IACA;IAHnB,YACmB,QAA0B,EAC1B,OAAO,8BAA8B,EACrC,WAAW,8BAA8B;QAFzC,aAAQ,GAAR,QAAQ,CAAkB;QAC1B,SAAI,GAAJ,IAAI,CAAiC;QACrC,aAAQ,GAAR,QAAQ,CAAiC;IACzD,CAAC;IAEI,KAAK,CAAC,SAAS;QACrB,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,QAA6B;QAC1C,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CACjD,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,CAAC,CAChG,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACpB,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAgB,EAAE,OAAe;QACzC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC;IAC/H,CAAC;CACF;AAED,MAAM,OAAO,yBAAyB;IAEjB;IACA;IACA;IAHnB,YACmB,QAA0B,EAC1B,OAAO,8BAA8B,EACrC,WAAW,8BAA8B;QAFzC,aAAQ,GAAR,QAAQ,CAAkB;QAC1B,SAAI,GAAJ,IAAI,CAAiC;QACrC,aAAQ,GAAR,QAAQ,CAAiC;IACzD,CAAC;IAEI,KAAK,CAAC,SAAS;QACrB,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,QAA6B;QAC1C,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CACjD,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,CAAC,CAChG,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACpB,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAgB,EAAE,OAAe;QACzC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC;IAC/H,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAgB;QAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC;IACvF,CAAC;CACF;AAED,MAAM,OAAO,YAAY;IAEJ;IACA;IACA;IAHnB,YACmB,QAA0B,EAC1B,OAAO,mBAAmB,EAC1B,WAAW,mBAAmB;QAF9B,aAAQ,GAAR,QAAQ,CAAkB;QAC1B,SAAI,GAAJ,IAAI,CAAsB;QAC1B,aAAQ,GAAR,QAAQ,CAAsB;IAC9C,CAAC;IAEI,IAAI,CAAC,KAAa;QACxB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAEO,mBAAmB,CAAC,KAAe;QACzC,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,IAAI,YAAY,GAAG,SAAS,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA6D,CAAC;YAC5F,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5F,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,CAAC,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,MAAM,CAAC,QAAQ,KAAK,YAAY,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACrE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACrD,CAAC;YACD,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,WAAW;QACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAiB;QAC5B,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM;gBAC/B,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAsB,CAAC,IAAI;gBAChE,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,YAAY,GAAG;gBACnB,QAAQ,EAAE,YAAY;gBACtB,KAAK;gBACL,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;aACnE,CAAC;YACF,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YAC5E,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAC9B,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,OAAO;gBAAE,OAAO,KAAK,CAAC;YACpE,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC;YAC/E,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;gBAAE,OAAO,KAAK,CAAC;YACzE,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,iBAAiB;IAET;IACA;IACA;IAHnB,YACmB,QAA0B,EAC1B,gBAAwB,EACxB,aAAa,eAAe;QAF5B,aAAQ,GAAR,QAAQ,CAAkB;QAC1B,qBAAgB,GAAhB,gBAAgB,CAAQ;QACxB,eAAU,GAAV,UAAU,CAAkB;IAC5C,CAAC;IAEI,GAAG,CAAC,QAAkB;QAC5B,OAAO,GAAG,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,KAAK,SAAS,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAkB,EAAE,SAAiB;QAC/C,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YAC5E,MAAM,MAAM,GAAG,QAAQ,CACrB;gBACE,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE;oBACP,QAAQ,EAAE,SAAS;iBACpB;gBACD,cAAc,EAAE;oBACd,QAAQ,EAAE,QAAQ,CAAC,KAAK;iBACzB;aACF,EACD,IAAI,CAAC,gBAAgB,CACtB,CAAC;YACF,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAkB;QAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7E,OAAO,QAAQ,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAkB;QAC7B,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YAC5E,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,eAAe;IAEP;IACA;IACA;IACA;IAJnB,YACmB,QAA0B,EAC1B,OAAO,4BAA4B,EACnC,WAAW,oBAAoB,EAC/B,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI;QAHtB,aAAQ,GAAR,QAAQ,CAAkB;QAC1B,SAAI,GAAJ,IAAI,CAA+B;QACnC,aAAQ,GAAR,QAAQ,CAAuB;QAC/B,WAAM,GAAN,MAAM,CAAgB;IACtC,CAAC;IAEJ,KAAK,CAAC,iBAAiB,CAAC,OAAwB;QAC9C,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAc,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAClF,MAAM,QAAQ,GAA2B,EAAE,CAAC;YAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvD,IAAI,GAAG,GAAG,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBAChC,QAAQ,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;gBACzB,CAAC;YACH,CAAC;YACD,MAAM,SAAS,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YAC7D,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,cAAc,CAAC,yBAAyB,EAAE,uBAAuB,CAAC,CAAC;YAC/E,CAAC;YACD,QAAQ,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC;YAC1B,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,sBAAsB;IAEd;IACA;IACA;IAHnB,YACmB,QAA0B,EAC1B,OAAO,yBAAyB,EAChC,WAAW,0BAA0B;QAFrC,aAAQ,GAAR,QAAQ,CAAkB;QAC1B,SAAI,GAAJ,IAAI,CAA4B;QAChC,aAAQ,GAAR,QAAQ,CAA6B;IACrD,CAAC;IAEI,KAAK,CAAC,SAAS;QACrB,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,UAA2B;QACxC,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CACnD,CAAC,CACC,SAAS,CAAC,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC,OAAO,CAAC,KAAK;mBACjD,SAAS,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO;mBACxC,SAAS,CAAC,YAAY,KAAK,UAAU,CAAC,YAAY,CACtD,CACF,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtB,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAgB,EAAE,OAAe,EAAE,YAAoB;QAC/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAC5C,UAAU,CAAC,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK;eACvC,UAAU,CAAC,OAAO,KAAK,OAAO;eAC9B,UAAU,CAAC,YAAY,KAAK,YAAY,CAC5C,IAAI,IAAI,CAAC;IACZ,CAAC;CACF;AAED,MAAM,OAAO,kBAAkB;IAEV;IACA;IACA;IAHnB,YACmB,QAA0B,EAC1B,OAAO,iCAAiC,EACxC,WAAW,yBAAyB;QAFpC,aAAQ,GAAR,QAAQ,CAAkB;QAC1B,SAAI,GAAJ,IAAI,CAAoC;QACxC,aAAQ,GAAR,QAAQ,CAA4B;IACpD,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,WAAmB,EAAE,QAAgB,EAAE,KAAa;QAC7E,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAiB,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;YACxF,MAAM,WAAW,GAAuD,EAAE,CAAC;YAC3E,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChE,IAAI,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC3B,WAAW,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC;gBAClC,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,OAAO,IAAI,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACzC,WAAW,CAAC,GAAG,CAAC,GAAG;oBACjB,KAAK,EAAE,CAAC;oBACR,OAAO,EAAE,KAAK,GAAG,QAAQ;iBAC1B,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,IAAI,OAAO,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC;oBACjC,MAAM,IAAI,cAAc,CAAC,gCAAgC,EAAE,uBAAuB,CAAC,CAAC;gBACtF,CAAC;gBACD,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;YACrB,CAAC;YACD,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QAChF,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,gCAAgC;IAExB;IACA;IACA;IAHnB,YACmB,QAA0B,EAC1B,OAAO,iCAAiC,EACxC,WAAW,yBAAyB;QAFpC,aAAQ,GAAR,QAAQ,CAAkB;QAC1B,SAAI,GAAJ,IAAI,CAAoC;QACxC,aAAQ,GAAR,QAAQ,CAA4B;IACpD,CAAC;IAEI,YAAY,CAAC,OAAgB,EAAE,OAAe,EAAE,YAAoB;QAC1E,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,IAAI,YAAY,EAAE,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAgB,EAAE,OAAe,EAAE,YAAoB;QAC/D,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAkB,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1F,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAgB,EAAE,OAAe,EAAE,YAAoB;QAClE,OAAO,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC9D,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAkB,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;YAC9D,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAC5C,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YAC3B,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,0BAA0B;IAElB;IACA;IACA;IAHnB,YACmB,QAA0B,EAC1B,OAAO,yBAAyB,EAChC,WAAW,0BAA0B;QAFrC,aAAQ,GAAR,QAAQ,CAAkB;QAC1B,SAAI,GAAJ,IAAI,CAA4B;QAChC,aAAQ,GAAR,QAAQ,CAA6B;IACrD,CAAC;IAEI,KAAK,CAAC,SAAS;QACrB,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAA8B;QAC3C,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;YACjF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChB,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAgB,EAAE,MAAc;QACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC;IAC5G,CAAC;CACF;AAED,MAAM,UAAU,qCAAqC,CACnD,OAAyB,EACzB,OAAqD;IAmBrD,MAAM,QAAQ,GAAG,kCAAkC,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,eAAe,GAAG,IAAI,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,eAAe,GAAG,IAAI,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,qBAAqB,GAAG,IAAI,gCAAgC,CAAC,OAAO,CAAC,CAAC;IAC5E,MAAM,YAAY,GAAG,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,IAAI,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO;QACL,GAAG,QAAQ;QACX,OAAO,EAAE,IAAI,oBAAoB,CAAC,OAAO,CAAC;QAC1C,OAAO,EAAE,IAAI,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC;QAChE,KAAK,EAAE,IAAI,YAAY,CAAC,OAAO,CAAC;QAChC,eAAe;QACf,eAAe;QACf,MAAM,EAAE,IAAI,mBAAmB,CAAC;YAC9B,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;YACzB,4BAA4B,EAAE,qBAAqB;YACnD,cAAc,EAAE,IAAI,kBAAkB,CAAC,OAAO,CAAC;SAChD,CAAC;QACF,WAAW,EAAE,IAAI,eAAe,CAC9B,OAAO,EACP,4BAA4B,EAC5B,oBAAoB,EACpB,OAAO,CAAC,aAAa,EAAE,SAAS,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CACpD;QACD,aAAa,EAAE,IAAI,2BAA2B,CAAC,eAAe,EAAE,OAAO,CAAC,aAAa,CAAC;QACtF,kBAAkB,EAAE,IAAI,2BAA2B,CAAC,eAAe,EAAE,OAAO,CAAC,aAAa,CAAC;QAC3F,YAAY;QACZ,qBAAqB;QACrB,WAAW;KACZ,CAAC;AACJ,CAAC"}
+{"version":3,"file":"persistence.js","sourceRoot":"","sources":["../../src/vault-core/persistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AA0BhF,OAAO,EACL,mBAAmB,EACnB,2BAA2B,EAC3B,2BAA2B,EAC3B,kCAAkC,GAEnC,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAmC7C,MAAM,CAAC,MAAM,kCAAkC,GAAG,yCAAyC,CAAC;AAmB5F,KAAK,UAAU,eAAe,CAAI,OAAyB,EAAE,GAAW,EAAE,IAAsB;IAC9F,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAGD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAyB,EACzB,UAAyC,EAAE;IAE3C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,kCAAkC,CAAC;IAC5E,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,eAAe,EAAE,CAAC;IACrE,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,eAAe,EAAE,CAAC;IACvE,MAAM,MAAM,GAAG,QAAQ,CACrB;QACE,OAAO,EAAE,MAAM;QACf,OAAO,EAAE;YACP,eAAe;SAChB;QACD,cAAc,EAAE;YACd,IAAI,EAAE,mBAAmB;SAC1B;KACF,EACD,gBAAgB,CACjB,CAAC;IACF,MAAM,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7D,OAAO;QACL,eAAe;QACf,gBAAgB;QAChB,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAyB,EACzB,gBAAwB,EACxB,UAAU,GAAG,kCAAkC;IAE/C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACxE,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC;IACzD,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,CAAC,eAAe,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,MAAM,OAAO,oBAAoB;IAOZ;IANF,KAAK,CAA8C;IAEpE,YACE,OAAyB,EACzB,eAAuB,EACvB,GAAG,GAAG,6BAA6B,EAClB,WAAW,4BAA4B;QAAvC,aAAQ,GAAR,QAAQ,CAA+B;QAExD,IAAI,CAAC,KAAK,GAAG,IAAI,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;IACvE,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAoB;QAC7B,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,KAAK,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACrG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClB,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,eAAe,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAkB;QAC7B,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC9F,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,eAAe,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAkB;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAkB;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;IAC1F,CAAC;CACF;AAED,MAAM,OAAO,yBAAyB;IAOjB;IANF,KAAK,CAA2C;IAEjE,YACE,OAAyB,EACzB,eAAuB,EACvB,GAAG,GAAG,uCAAuC,EAC5B,WAAW,qCAAqC;QAAhD,aAAQ,GAAR,QAAQ,CAAwC;QAEjE,IAAI,CAAC,KAAK,GAAG,IAAI,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;IACvE,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,QAA6B;QAC1C,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CACjD,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,CAAC,CAChG,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACpB,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,sBAAsB,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAgB,EAAE,OAAe;QACzC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC;IAC/H,CAAC;CACF;AAED,MAAM,OAAO,yBAAyB;IAOjB;IANF,KAAK,CAA2C;IAEjE,YACE,OAAyB,EACzB,eAAuB,EACvB,GAAG,GAAG,uCAAuC,EAC5B,WAAW,qCAAqC;QAAhD,aAAQ,GAAR,QAAQ,CAAwC;QAEjE,IAAI,CAAC,KAAK,GAAG,IAAI,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;IACvE,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,QAA6B;QAC1C,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CACjD,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,CAAC,CAChG,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACpB,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,sBAAsB,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAgB,EAAE,OAAe;QACzC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC;IAC/H,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAgB;QAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC;IACvF,CAAC;CACF;AAED,MAAM,OAAO,YAAY;IAEJ;IACA;IACA;IAHnB,YACmB,QAA0B,EAC1B,OAAO,0BAA0B,EACjC,WAAW,0BAA0B;QAFrC,aAAQ,GAAR,QAAQ,CAAkB;QAC1B,SAAI,GAAJ,IAAI,CAA6B;QACjC,aAAQ,GAAR,QAAQ,CAA6B;IACrD,CAAC;IAEI,IAAI,CAAC,KAAa;QACxB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAEO,mBAAmB,CAAC,KAAe;QACzC,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,IAAI,YAAY,GAAG,SAAS,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA6D,CAAC;YAC5F,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5F,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,CAAC,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,MAAM,CAAC,QAAQ,KAAK,YAAY,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACrE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACrD,CAAC;YACD,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,WAAW;QACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAiB;QAC5B,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM;gBAC/B,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAsB,CAAC,IAAI;gBAChE,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,YAAY,GAAG;gBACnB,QAAQ,EAAE,YAAY;gBACtB,KAAK;gBACL,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;aACnE,CAAC;YACF,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YAC5E,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAC9B,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,OAAO;gBAAE,OAAO,KAAK,CAAC;YACpE,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC;YAC/E,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;gBAAE,OAAO,KAAK,CAAC;YACzE,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,iBAAiB;IAET;IACA;IACA;IAHnB,YACmB,QAA0B,EAC1B,gBAAwB,EACxB,aAAa,sBAAsB;QAFnC,aAAQ,GAAR,QAAQ,CAAkB;QAC1B,qBAAgB,GAAhB,gBAAgB,CAAQ;QACxB,eAAU,GAAV,UAAU,CAAyB;IACnD,CAAC;IAEI,GAAG,CAAC,QAAkB;QAC5B,OAAO,GAAG,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,KAAK,SAAS,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAkB,EAAE,SAAiB;QAC/C,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YAC5E,MAAM,MAAM,GAAG,QAAQ,CACrB;gBACE,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE;oBACP,QAAQ,EAAE,SAAS;iBACpB;gBACD,cAAc,EAAE;oBACd,QAAQ,EAAE,QAAQ,CAAC,KAAK;iBACzB;aACF,EACD,IAAI,CAAC,gBAAgB,CACtB,CAAC;YACF,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAkB;QAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7E,OAAO,QAAQ,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAkB;QAC7B,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YAC5E,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,eAAe;IAOP;IACA;IAPF,KAAK,CAAoC;IAE1D,YACE,OAAyB,EACzB,eAAuB,EACvB,GAAG,GAAG,qCAAqC,EAC1B,WAAW,2BAA2B,EACtC,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI;QADtB,aAAQ,GAAR,QAAQ,CAA8B;QACtC,WAAM,GAAN,MAAM,CAAgB;QAEvC,IAAI,CAAC,KAAK,GAAG,IAAI,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,OAAwB;QAC9C,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAClD,MAAM,QAAQ,GAA2B,EAAE,CAAC;YAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvD,IAAI,GAAG,GAAG,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBAChC,QAAQ,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;gBACzB,CAAC;YACH,CAAC;YACD,MAAM,SAAS,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YAC7D,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,cAAc,CAAC,yBAAyB,EAAE,uBAAuB,CAAC,CAAC;YAC/E,CAAC;YACD,QAAQ,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC;YAC1B,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,oBAAoB,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,sBAAsB;IAOd;IANF,KAAK,CAAwC;IAE9D,YACE,OAAyB,EACzB,eAAuB,EACvB,GAAG,GAAG,kCAAkC,EACvB,WAAW,iCAAiC;QAA5C,aAAQ,GAAR,QAAQ,CAAoC;QAE7D,IAAI,CAAC,KAAK,GAAG,IAAI,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;IACvE,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,UAA2B;QACxC,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CACnD,CAAC,CACC,SAAS,CAAC,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC,OAAO,CAAC,KAAK;mBACjD,SAAS,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO;mBACxC,SAAS,CAAC,YAAY,KAAK,UAAU,CAAC,YAAY,CACtD,CACF,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtB,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAgB,EAAE,OAAe,EAAE,YAAoB;QAC/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAC5C,UAAU,CAAC,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK;eACvC,UAAU,CAAC,OAAO,KAAK,OAAO;eAC9B,UAAU,CAAC,YAAY,KAAK,YAAY,CAC5C,IAAI,IAAI,CAAC;IACZ,CAAC;CACF;AAED,MAAM,OAAO,kBAAkB;IAOV;IANF,KAAK,CAAuC;IAE7D,YACE,OAAyB,EACzB,eAAuB,EACvB,GAAG,GAAG,0CAA0C,EAC/B,WAAW,gCAAgC;QAA3C,aAAQ,GAAR,QAAQ,CAAmC;QAE5D,IAAI,CAAC,KAAK,GAAG,IAAI,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,WAAmB,EAAE,QAAgB,EAAE,KAAa;QAC7E,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;YACrD,MAAM,WAAW,GAAuD,EAAE,CAAC;YAC3E,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChE,IAAI,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC3B,WAAW,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC;gBAClC,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,OAAO,IAAI,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACzC,WAAW,CAAC,GAAG,CAAC,GAAG;oBACjB,KAAK,EAAE,CAAC;oBACR,OAAO,EAAE,KAAK,GAAG,QAAQ;iBAC1B,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,IAAI,OAAO,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC;oBACjC,MAAM,IAAI,cAAc,CAAC,gCAAgC,EAAE,uBAAuB,CAAC,CAAC;gBACtF,CAAC;gBACD,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;YACrB,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,kBAAkB,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,gCAAgC;IAOxB;IANF,KAAK,CAAwC;IAE9D,YACE,OAAyB,EACzB,eAAuB,EACvB,GAAG,GAAG,0CAA0C,EAC/B,WAAW,gCAAgC;QAA3C,aAAQ,GAAR,QAAQ,CAAmC;QAE5D,IAAI,CAAC,KAAK,GAAG,IAAI,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;IACvE,CAAC;IAEO,YAAY,CAAC,OAAgB,EAAE,OAAe,EAAE,YAAoB;QAC1E,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,IAAI,YAAY,EAAE,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAgB,EAAE,OAAe,EAAE,YAAoB;QAC/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QACtD,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAgB,EAAE,OAAe,EAAE,YAAoB;QAClE,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YACtD,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;YAC9D,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAC5C,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YAC3B,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;YAClD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,0BAA0B;IAOlB;IANF,KAAK,CAAwC;IAE9D,YACE,OAAyB,EACzB,eAAuB,EACvB,GAAG,GAAG,kCAAkC,EACvB,WAAW,iCAAiC;QAA5C,aAAQ,GAAR,QAAQ,CAAoC;QAE7D,IAAI,CAAC,KAAK,GAAG,IAAI,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;IACvE,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAA8B;QAC3C,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;YACjF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChB,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAgB,EAAE,MAAc;QACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC;IAC5G,CAAC;CACF;AAED,MAAM,UAAU,qCAAqC,CACnD,OAAyB,EACzB,OAAqD;IAmBrD,MAAM,QAAQ,GAAG,kCAAkC,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,eAAe,GAAG,IAAI,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACxF,MAAM,eAAe,GAAG,IAAI,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACxF,MAAM,qBAAqB,GAAG,IAAI,gCAAgC,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACrG,MAAM,YAAY,GAAG,IAAI,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAClF,MAAM,WAAW,GAAG,IAAI,0BAA0B,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACrF,OAAO;QACL,GAAG,QAAQ;QACX,OAAO,EAAE,IAAI,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC;QACnE,OAAO,EAAE,IAAI,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC;QAChE,KAAK,EAAE,IAAI,YAAY,CAAC,OAAO,CAAC;QAChC,eAAe;QACf,eAAe;QACf,MAAM,EAAE,IAAI,mBAAmB,CAAC;YAC9B,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;YACzB,4BAA4B,EAAE,qBAAqB;YACnD,cAAc,EAAE,IAAI,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC;SACzE,CAAC;QACF,WAAW,EAAE,IAAI,eAAe,CAC9B,OAAO,EACP,OAAO,CAAC,eAAe,EACvB,qCAAqC,EACrC,2BAA2B,EAC3B,OAAO,CAAC,aAAa,EAAE,SAAS,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CACpD;QACD,aAAa,EAAE,IAAI,2BAA2B,CAAC,eAAe,EAAE,OAAO,CAAC,aAAa,CAAC;QACtF,kBAAkB,EAAE,IAAI,2BAA2B,CAAC,eAAe,EAAE,OAAO,CAAC,aAAa,CAAC;QAC3F,YAAY;QACZ,qBAAqB;QACrB,WAAW;KACZ,CAAC;AACJ,CAAC"}

package/docs/ARCHITECTURE.md

@@ -44,6 +44,20 @@ This means:
 
 - `vault-ingress`
   Accepts request-shaped calls, resolves vault-managed capability records inside the vault boundary, performs trusted acquisition flows, and forwards dispatch into vault-core internals.
+ 
+## Dual-Area Storage
+
+The vault is physically divided into two partitions to balance security and discoverability:
+
+- **Sealed Area (`vault/sealed/`)**
+  - **Security**: AES-256-GCM encrypted blobs (`.sealed`).
+  - **Access**: Requires the Vault Working Key (identity-derived) for both read and write.
+  - **Auditing**: Every access is tracked and logged in the append-only audit trail.
+
+- **Public Area (`vault/public/`)**
+  - **Security**: Plaintext JSON (`.json`).
+  - **Access**: Identity is required for **writing** (authorized update), but **reading is open**.
+  - **Auditing**: Reading from the public area is **untracked**, reducing audit noise for discovery / identity resolution.
 
 ## Core Rules
 
@@ -51,6 +65,8 @@ This means:
 2. Only owner and trusted issuer paths may write secrets.
 3. Agent can only request dispatch through capability + proof.
 4. Vault validates and audits every dispatch.
+5. Public data (e.g., nicknames, public keys) is explicitly mirrored to the Public Area for discovery.
+6. Identity-specific private data is stored in `identities/`, separate from named `vaults/`.
 
 ## Current HTTP Secret Flows
 

package/docs/REFERENCE.md

@@ -36,11 +36,11 @@ Recommended persistent-vault entrypoints:
 - `createVault(...)`
 - `recoverVault(...)`
 
-`createVault({ ownerIdentity, nickname })` creates a vault in the default workspace and persists `nickname` into `vaults/<vaultId>/vault/profile.json`.
+`createVault({ ownerIdentity, nickname, publicMetadata })` creates a vault in the default workspace.
 
-`createVault(storage, { ownerIdentity, nickname })` overrides the workspace storage explicitly.
+`createVault(storage, { ownerIdentity, nickname, publicMetadata })` overrides the workspace storage explicitly.
 
-`recoverVault({ vaultId, ownerIdentity })` reopens a vault from the default workspace and returns the persisted `nickname` when present.
+`recoverVault({ vaultId, ownerIdentity })` reopens a vault and returns the `nickname` from the sealed profile.
 
 `recoverVault(storage, { vaultId, ownerIdentity })` overrides the workspace storage explicitly.
 
@@ -78,14 +78,14 @@ Role rules:
 
 `deriveChildIdentity(parentIdentity, childIndex, { nickname })` deterministically reconstructs a child identity for a known `childIndex`.
 
-`ensureIdentityPrivateVault(storage, identity)` creates or refreshes the identity's fixed namespace under `vault/private/identities/<identityId>/...`.
+`ensureIdentityPrivateVault(storage, identity)` creates or refreshes the identity's fixed namespace under `identities/<identityId>/...`.
+ 
+ That namespace stores identity-level files such as:
 
-That namespace stores identity-level files such as:
+- `sealed/profile.sealed`
+- `sealed/children.sealed`
 
-- `profile.json`
-- `children.json`
-
-Those files are encrypted at rest with a key derived from that identity's private key. They are not readable as plain JSON on disk.
+Those files are encrypted at rest in the `sealed/` sub-directory and are not readable as plain JSON on disk.
 
 `restoreIdentity(privateKey)` returns the same shape for an existing private key.
 
@@ -354,7 +354,7 @@ If the custom flow mode includes secret acquisition, the owner also defines a re
 
 ## Persistent Dependencies
 
-`createPersistentVaultCoreDependencies(...)` builds a file-backed single-node profile with:
+`createPersistentVaultCoreDependencies(...)` builds a file-backed single-node profile under `vault/sealed/` with:
 
 - persistent secret metadata
 - sealed secret custody blobs

package/docs/es/README.md

@@ -38,8 +38,9 @@ import {
 
 Ruta principal recomendada para vault persistente:
 
-- crear el vault persistente con `createVault(...)`
+- crear el vault persistente con `createVault(...)` (soporta `publicMetadata` para el descubrimiento de información pública)
 - recuperar el vault persistente con `recoverVault(...)` usando la identidad del owner
+- Capas de almacenamiento divididas: `vaults/` (Bóvedas con nombre) e `identities/` (Espacio de identidad personal)
 
 La API antigua centrada en `CbioIdentity` ya no es la superficie principal del producto.
 

package/docs/fr/README.md

@@ -38,8 +38,9 @@ import {
 
 Chemin principal recommande pour un vault persistant :
 
-- creer le vault persistant avec `createVault(...)`
-- restaurer le vault persistant avec `recoverVault(...)` via l'identite du owner
+- créer le coffre persistant avec `createVault(...)` (prend en charge `publicMetadata` pour la découverte d'informations publiques)
+- restaurer le coffre persistant avec `recoverVault(...)` via l'identité de l'owner
+- Couches de stockage divisées : `vaults/` (Coffres nommés) et `identities/` (Espace d'identité personnel)
 
 L'ancienne API centree sur `CbioIdentity` n'est plus la surface principale du produit.
 

package/docs/ja/README.md

@@ -38,8 +38,9 @@ import {
 
 推奨される persistent-vault の主経路:
 
-- `createVault(...)` で persistent vault を作成する
+- `createVault(...)` で persistent vault を作成する (`publicMetadata` による公開情報のディスカバリをサポート)
 - `recoverVault(...)` で owner identity を使って persistent vault を復旧する
+- 分離されたストレージ層: `vaults/` (具名 Vault) と `identities/` (個人 ID スペース)
 
 旧 `CbioIdentity` 中心 API は、もはや主要な公開面ではありません。
 

package/docs/ko/README.md

@@ -38,8 +38,9 @@ import {
 
 권장되는 persistent-vault 주 경로:
 
-- `createVault(...)` 로 persistent vault 를 생성합니다
+- `createVault(...)` 로 persistent vault 를 생성합니다 (`publicMetadata` 를 통한 공개 정보 검색 지원)
 - `recoverVault(...)` 로 owner identity 를 사용해 persistent vault 를 복구합니다
+- 분리된 스토리지 계층: `vaults/` (기명 Vault) 및 `identities/` (개인 ID 공간)
 
 이전 `CbioIdentity` 중심 API 는 더 이상 주요 제품 표면이 아닙니다.
 

package/docs/pt/README.md

@@ -38,8 +38,9 @@ import {
 
 Caminho principal recomendado para vault persistente:
 
-- criar o vault persistente com `createVault(...)`
-- recuperar o vault persistente com `recoverVault(...)` usando a identidade do owner
+- criar o cofre persistente com `createVault(...)` (suporta `publicMetadata` para a descoberta de informações públicas)
+- recuperar o cofre persistente com `recoverVault(...)` usando a identidade do owner
+- Camadas de armazenamento divididas: `vaults/` (Cofres nomeados) e `identities/` (Espaço de identidade pessoal)
 
 A antiga API centrada em `CbioIdentity` nao e mais a superficie principal do produto.
 

package/docs/zh/README.md

@@ -38,8 +38,9 @@ import {
 
 推荐的持久化主路径：
 
-- 通过 `createVault(...)` 创建持久化 vault
+- 通过 `createVault(...)` 创建持久化 vault (支持 `publicMetadata` 用于公开发现)
 - 通过 `recoverVault(...)` 用 owner 身份恢复持久化 vault
+- 分区存储：`vaults/` (具名保险箱) 与 `identities/` (身份私有空间)
 
 ## 构建
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@the-ai-company/cbio-node-runtime",
-  "version": "1.19.0",
+  "version": "1.21.0",
   "description": "Node.js runtime for cbio identity and credential vault. Library only, no CLI or TUI.",
   "type": "module",
   "main": "./dist/runtime/index.js",