@the-ai-company/cbio-node-runtime 1.25.0 → 1.27.0

package/README.md

@@ -103,9 +103,9 @@ const createdVault = await createVault(storage, {
 });
 ```
 
-The workspace root can contain many vaults. Each vault is physically divided into `vault/sealed/` (encrypted) and `vault/public/` (plaintext discovery).
+The workspace root can contain many vaults. Each vault is physically divided into `vault/sealed/` (encrypted) and `vault/public/` (signed discovery).
  
- Each identity also has its own private namespace under `identities/<identityId>/sealed/...` for encrypted metadata such as `profile.sealed` and `children.sealed`.
+ Every identity also has its own private namespace under `identities/<identityId>/sealed/...` for encrypted metadata, and a companion `public/profile.json` for verified discovery.
 
 ## Architecture
 

package/dist/runtime/bootstrap.d.ts

@@ -2,11 +2,14 @@ import { type CreatePersistentVaultCoreDependenciesOptions, type VaultCore } fro
 import { type VaultService, type VaultCustomFlowResolver } from "../vault-ingress/index.js";
 import type { IStorageProvider } from "../storage/provider.js";
 import type { CreatedIdentity } from "./identity.js";
+export interface VaultPublicMetadata extends Record<string, any> {
+    nickname?: string;
+    ownerId?: string;
+}
 export interface CreateVaultOptions extends Omit<CreatePersistentVaultCoreDependenciesOptions, "vaultWorkingKey" | "vaultId"> {
     vaultId?: string;
     nickname?: string;
-    exposeNickname?: boolean;
-    publicMetadata?: Record<string, any>;
+    publicMetadata?: VaultPublicMetadata;
     ownerIdentity: CreatedIdentity;
     vault?: {
         customFlows?: VaultCustomFlowResolver;
@@ -35,14 +38,24 @@ export interface RecoverVaultOptions extends Omit<CreatePersistentVaultCoreDepen
 }
 export interface RecoveredVault extends VaultObject {
 }
-export declare function createVault(options: CreateVaultOptions): Promise<CreatedVault>;
+/**
+ * Creates a new vault.
+ *
+ * @param storage The storage provider to use.
+ * @param options Configuration for the new vault.
+ */
 export declare function createVault(storage: IStorageProvider, options: CreateVaultOptions): Promise<CreatedVault>;
-export declare function recoverVault(options: RecoverVaultOptions): Promise<RecoveredVault>;
+/**
+ * Recovers an existing vault.
+ *
+ * @param storage The storage provider where the vault is located.
+ * @param options Recovery options including vaultId and owner identity.
+ */
 export declare function recoverVault(storage: IStorageProvider, options: RecoverVaultOptions): Promise<RecoveredVault>;
 /**
  * Lists all vaults in the workspace with their public discovery metadata.
  */
-export declare function listVaults(storage: IStorageProvider): Promise<{
+export declare function listVaults(storage: IStorageProvider): Promise<Array<{
     vaultId: string;
-    public: Record<string, any>;
-}[]>;
+    public: VaultPublicMetadata;
+}>>;

package/dist/runtime/bootstrap.js

@@ -3,8 +3,8 @@ import { createVaultCore } from "../vault-core/core.js";
 import { createPersistentVaultCoreDependencies, } from "../vault-core/index.js";
 import { wrapVaultCoreAsVaultService, } from "../vault-ingress/index.js";
 import { createPrefixedStorage } from "../storage/prefix.js";
-import { readVaultProfile, writeVaultProfile, readVaultPublicMetadata } from "./vault-metadata.js";
-import { createWorkspaceStorage } from "./workspace-storage.js";
+import { readVaultProfile, writeVaultProfile } from "./vault-metadata.js";
+import { writeVerifiableMetadata, readVerifiableMetadata } from "./verifiable-metadata.js";
 function deriveVaultWorkingKey(privateKey, vaultId) {
     return crypto
         .createHash("sha256")
@@ -18,24 +18,17 @@ function deriveVaultWorkingKey(privateKey, vaultId) {
 function vaultStoragePrefix(vaultId) {
     return `vaults/${vaultId}`;
 }
-function resolveStorage(storageOrOptions, maybeOptions) {
-    if (maybeOptions) {
-        return {
-            storage: storageOrOptions,
-            options: maybeOptions,
-        };
-    }
-    return {
-        storage: createWorkspaceStorage(),
-        options: storageOrOptions,
-    };
-}
-export async function createVault(storageOrOptions, maybeOptions) {
-    const { storage: workspaceStorage, options } = resolveStorage(storageOrOptions, maybeOptions);
+/**
+ * Creates a new vault.
+ *
+ * @param storage The storage provider to use.
+ * @param options Configuration for the new vault.
+ */
+export async function createVault(storage, options) {
     const vaultId = options.vaultId ?? `vault_${crypto.randomUUID()}`;
-    const storage = createPrefixedStorage(workspaceStorage, vaultStoragePrefix(vaultId));
+    const vaultStorage = createPrefixedStorage(storage, vaultStoragePrefix(vaultId));
     const vaultWorkingKey = deriveVaultWorkingKey(options.ownerIdentity.privateKey, vaultId);
-    const deps = createPersistentVaultCoreDependencies(storage, {
+    const deps = createPersistentVaultCoreDependencies(vaultStorage, {
         ...options,
         vaultId,
         vaultWorkingKey,
@@ -48,17 +41,20 @@ export async function createVault(storageOrOptions, maybeOptions) {
     };
     await core.bootstrapOwnerIdentity(bootstrapOwner);
     const nickname = options.nickname?.trim() ? options.nickname.trim() : undefined;
-    const publicMetadata = { ...(options.publicMetadata || {}) };
-    if (options.exposeNickname && nickname) {
-        publicMetadata.nickname = nickname;
-    }
+    // Nickname is public-by-design for discovery
+    const publicMetadata = {
+        ...(options.publicMetadata || {}),
+        ...(nickname ? { nickname } : {})
+    };
     await writeVaultProfile(storage, {
         sealed: {
             vaultId,
-            nickname,
+            // nickname removed from sealed area
         },
-        public: publicMetadata,
+        public: {}, // Sealed profile no longer carries public mirror
     }, vaultWorkingKey);
+    // Write Signed Public Profile for Discovery
+    await writeVerifiableMetadata(storage, "vault/public/profile.json", publicMetadata, options.ownerIdentity.privateKey);
     return {
         core,
         vault: wrapVaultCoreAsVaultService(core, options.vault),
@@ -66,21 +62,27 @@ export async function createVault(storageOrOptions, maybeOptions) {
         storage,
     };
 }
-export async function recoverVault(storageOrOptions, maybeOptions) {
-    const { storage: workspaceStorage, options } = resolveStorage(storageOrOptions, maybeOptions);
-    const storage = createPrefixedStorage(workspaceStorage, vaultStoragePrefix(options.vaultId));
+/**
+ * Recovers an existing vault.
+ *
+ * @param storage The storage provider where the vault is located.
+ * @param options Recovery options including vaultId and owner identity.
+ */
+export async function recoverVault(storage, options) {
+    const vaultStorage = createPrefixedStorage(storage, vaultStoragePrefix(options.vaultId));
     const vaultWorkingKey = deriveVaultWorkingKey(options.ownerIdentity.privateKey, options.vaultId);
-    const deps = createPersistentVaultCoreDependencies(storage, {
+    const deps = createPersistentVaultCoreDependencies(vaultStorage, {
         ...options,
         vaultId: options.vaultId,
         vaultWorkingKey,
     });
     const core = createVaultCore(deps);
     const profile = await readVaultProfile(storage, vaultWorkingKey);
+    const publicMeta = await readVerifiableMetadata(storage, "vault/public/profile.json", options.ownerIdentity.publicKey).catch(() => null);
     return {
         core,
         vault: wrapVaultCoreAsVaultService(core, options.vault),
-        nickname: profile?.sealed.nickname,
+        nickname: publicMeta?.nickname,
         storage,
     };
 }
@@ -95,10 +97,10 @@ export async function listVaults(storage) {
     const results = [];
     for (const id of ids) {
         const vaultStorage = createPrefixedStorage(storage, vaultStoragePrefix(id));
-        const publicData = await readVaultPublicMetadata(vaultStorage).catch(() => ({}));
+        const publicData = await readVerifiableMetadata(vaultStorage, "vault/public/profile.json").catch(() => ({}));
         results.push({
             vaultId: id,
-            public: publicData,
+            public: (publicData || {}),
         });
     }
     return results;

package/dist/runtime/bootstrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/runtime/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EACL,qCAAqC,GAItC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,2BAA2B,GAG5B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAG7D,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACnG,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,SAAS,qBAAqB,CAAC,UAAkB,EAAE,OAAe;IAChE,OAAO,MAAM;SACV,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,2BAA2B,CAAC;SACnC,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,OAAO,CAAC;SACf,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IACzC,OAAO,UAAU,OAAO,EAAE,CAAC;AAC7B,CAAC;AAuCD,SAAS,cAAc,CACrB,gBAA6E,EAC7E,YAAuD;IAEvD,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO;YACL,OAAO,EAAE,gBAAoC;YAC7C,OAAO,EAAE,YAAY;SACtB,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,sBAAsB,EAAE;QACjC,OAAO,EAAE,gBAA4D;KACtE,CAAC;AACJ,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,gBAAuD,EACvD,YAAiC;IAEjC,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,gBAAgB,EAAE,YAAY,CAG3F,CAAC;IACF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,SAAS,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,qBAAqB,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;IACrF,MAAM,eAAe,GAAG,qBAAqB,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,qCAAqC,CAAC,OAAO,EAAE;QAC1D,GAAG,OAAO;QACV,OAAO;QACP,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,cAAc,GAAwB;QAC1C,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU;QACzC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,SAAS;KAC3C,CAAC;IACF,MAAM,IAAI,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,MAAM,cAAc,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,CAAC;IAC7D,IAAI,OAAO,CAAC,cAAc,IAAI,QAAQ,EAAE,CAAC;QACvC,cAAc,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACrC,CAAC;IACD,MAAM,iBAAiB,CAAC,OAAO,EAAE;QAC/B,MAAM,EAAE;YACN,OAAO;YACP,QAAQ;SACT;QACD,MAAM,EAAE,cAAc;KACvB,EAAE,eAAe,CAAC,CAAC;IACpB,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC;QACvD,QAAQ;QACR,OAAO;KACR,CAAC;AACJ,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,gBAAwD,EACxD,YAAkC;IAElC,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,gBAAgB,EAAE,YAAY,CAG3F,CAAC;IACF,MAAM,OAAO,GAAG,qBAAqB,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7F,MAAM,eAAe,GAAG,qBAAqB,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACjG,MAAM,IAAI,GAAG,qCAAqC,CAAC,OAAO,EAAE;QAC1D,GAAG,OAAO;QACV,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACjE,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC;QACvD,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ;QAClC,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAyB;IACxD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,OAAO,GAAuD,EAAE,CAAC;IACvE,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC;YACX,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,UAAU;SACnB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/runtime/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EACL,qCAAqC,GAItC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,2BAA2B,GAG5B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAG7D,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAE3F,SAAS,qBAAqB,CAAC,UAAkB,EAAE,OAAe;IAChE,OAAO,MAAM;SACV,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,2BAA2B,CAAC;SACnC,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,OAAO,CAAC;SACf,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IACzC,OAAO,UAAU,OAAO,EAAE,CAAC;AAC7B,CAAC;AA2CD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAyB,EACzB,OAA2B;IAE3B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,SAAS,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;IAClE,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;IACjF,MAAM,eAAe,GAAG,qBAAqB,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,qCAAqC,CAAC,YAAY,EAAE;QAC/D,GAAG,OAAO;QACV,OAAO;QACP,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,cAAc,GAAwB;QAC1C,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU;QACzC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,SAAS;KAC3C,CAAC;IACF,MAAM,IAAI,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAElD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAEhF,6CAA6C;IAC7C,MAAM,cAAc,GAAG;QACrB,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;QACjC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAC;IAEF,MAAM,iBAAiB,CAAC,OAAO,EAAE;QAC/B,MAAM,EAAE;YACN,OAAO;YACP,oCAAoC;SACrC;QACD,MAAM,EAAE,EAAE,EAAE,iDAAiD;KAC9D,EAAE,eAAe,CAAC,CAAC;IAEpB,4CAA4C;IAC5C,MAAM,uBAAuB,CAC3B,OAAO,EACP,2BAA2B,EAC3B,cAAc,EACd,OAAO,CAAC,aAAa,CAAC,UAAU,CACjC,CAAC;IACF,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC;QACvD,QAAQ;QACR,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAyB,EACzB,OAA4B;IAE5B,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,EAAE,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACzF,MAAM,eAAe,GAAG,qBAAqB,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACjG,MAAM,IAAI,GAAG,qCAAqC,CAAC,YAAY,EAAE;QAC/D,GAAG,OAAO;QACV,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAC7C,OAAO,EACP,2BAA2B,EAC3B,OAAO,CAAC,aAAa,CAAC,SAAS,CAChC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAEpB,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC;QACvD,QAAQ,EAAE,UAAU,EAAE,QAAQ;QAC9B,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAyB;IACxD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,OAAO,GAA4D,EAAE,CAAC;IAC5E,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAC7C,YAAY,EACZ,2BAA2B,CAC5B,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAEpB,OAAO,CAAC,IAAI,CAAC;YACX,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,CAAC,UAAU,IAAI,EAAE,CAAwB;SAClD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/runtime/index.d.ts

@@ -13,14 +13,15 @@ export { createChildIdentity, type CreateChildIdentityOptions, } from "./child-i
 export { readVaultProfile, writeVaultProfile, readVaultPublicMetadata, type VaultProfile, } from "./vault-metadata.js";
 export { createWorkspaceStorage, getDefaultWorkspaceDir, } from "./workspace-storage.js";
 export { ensureIdentityPrivateVault, readIdentityPrivateVaultProfile, readIdentityPrivateVaultChildrenState, readIdentityMetadata, listIdentities, identityPrivateVaultPrefix, identityPrivateVaultProfileKey, identityPrivateVaultChildrenKey, type IdentityPrivateVaultProfile, type IdentityPrivateVaultChildRecord, type IdentityPrivateVaultChildrenState, type IdentityPublicProfile, } from "./private-vault.js";
-export { createVault, recoverVault, listVaults, type CreateVaultOptions, type CreatedVault, type RecoverVaultOptions, type RecoveredVault, type VaultObject, } from "./bootstrap.js";
+export { createVault, recoverVault, listVaults, type CreateVaultOptions, type CreatedVault, type RecoverVaultOptions, type RecoveredVault, type VaultObject, type VaultPublicMetadata, } from "./bootstrap.js";
 export { createVaultCore, DefaultVaultCore, VaultCoreError, createDefaultVaultCoreDependencies, type CreateDefaultVaultCoreDependenciesOptions, type DefaultPolicyEngineOptions, DefaultPolicyEngine, createPersistentVaultCoreDependencies, initializeVaultCustody, recoverVaultWorkingKey, DEFAULT_VAULT_KEY_CUSTODY_BLOB_KEY, type InitializeVaultCustodyOptions, type InitializedVaultCustody, type CreatePersistentVaultCoreDependenciesOptions, PersistentVaultAgentIdentityRegistry, PersistentVaultAuditLog, PersistentVaultOwnerIdentityRegistry, PersistentVaultCapabilityRegistry, PersistentVaultCapabilityRevocationRegistry, PersistentVaultCustomHttpFlowRegistry, PersistentVaultRateLimitStore, PersistentVaultReplayGuard, PersistentVaultSecretCustody, PersistentVaultSecretRepository, HttpDispatchExecutor, InMemoryAgentIdentityRegistry, InMemoryCapabilityRegistry, InMemoryCapabilityRevocationRegistry, InMemoryCustomHttpFlowRegistry, InMemoryRateLimitStore, InMemoryReplayGuard, InMemoryAuditLog, InMemoryOwnerIdentityRegistry, InMemorySecretCustody, InMemorySecretRepository, RandomIdGenerator, SignatureOwnerProofVerifier, type SignatureAgentProofVerifierOptions, SignatureAgentProofVerifier, SystemClock, type AgentCapability, type AgentIdentityRecord, type AgentProof, type OwnerAuditRequest, type OwnerExportSecretRequest, type OwnerDefineSecretTargetsCommand, type OwnerRegisterCapabilityCommand, type OwnerRegisterAgentIdentityCommand, type OwnerRegisterCustomHttpFlowCommand, type OwnerSecretExport, type OwnerIdentityRecord, type CustomHttpFlowDefinition, type OwnerProof, type AuditEntry, type AuditLog, type AuditQuery, type Clock, type DispatchAuthorization, type DispatchInstruction, type DispatchRequest, type DispatchResult, type IdGenerator, type OwnerIdentityRegistry, type OwnerProofVerifier, type PolicyEngine, type RateLimitStore, type ReplayGuard, type CustomHttpFlowRegistry, type SecretAlias, type SecretCustody, type SecretId, type SecretRecord, type SecretRepository, type SecretVersion, type TrustedExecutor, type VaultCore, type VaultCoreDependencies, type VaultPrincipal, type VaultPrincipalKind, type VaultTargetBinding, type VaultWriteSecretCommand, type VaultId, type AgentIdentityRegistry, type AgentProofVerifier, type CapabilityRevocationRegistry, type CapabilityRegistry, } from "../vault-core/index.js";
 export { createVaultClient, type VaultClient, type CreateVaultClientOptions, type VaultIdentity, type VaultSigner, type VaultAuditQueryInput, type OwnerDefineSecretTargetsInput, type VaultExportSecretInput, type VaultGrantCapabilityInput, type VaultRegisterFlowInput, type VaultRegisterAgentInput, type OwnerSecretTargetBinding, type OwnerStoreSecretInput, type OwnerWriteSecretInput, } from "../clients/owner/index.js";
 export { createAgentClient, type AgentClient, type CreateAgentClientOptions, type AgentIdentity, type AgentCapabilityEnvelope, type AgentDispatchIntent, type AgentDispatchTransport, type AgentSigner, } from "../clients/agent/index.js";
 export { createVaultService, wrapVaultCoreAsVaultService, createOwnerHttpFlowBoundary, createStandardAcquireBoundary, createStandardDispatchBoundary, toOwnerHttpFlowBoundary, type VaultService, type VaultAcquireSecretInput, type VaultAcquireSecretResult, type VaultAcquireSecretFlow, type VaultCustomFlowResolver, type VaultAgentDispatchRequest, type VaultAgentDispatchResponse, type VaultAgentDispatchErrorResponse, type RedactedResponseShape, type OwnerHttpFlowBoundary, } from "../vault-ingress/index.js";
 export { LocalVaultTransport } from "../vault-ingress/defaults.js";
-export type Identity = import("./identity.js").CreatedIdentity;
-export type VaultMetadata = import("./vault-metadata.js").VaultProfile;
+/**
+ * Main runtime interface.
+ */
 export interface CbioRuntime {
     IdentityError: typeof import("../errors.js").IdentityError;
     IdentityErrorCode: typeof import("../errors.js").IdentityErrorCode;
@@ -38,7 +39,13 @@ export interface CbioRuntime {
     readIdentityPrivateVaultProfile: typeof import("./private-vault.js").readIdentityPrivateVaultProfile;
     readIdentityPrivateVaultChildrenState: typeof import("./private-vault.js").readIdentityPrivateVaultChildrenState;
     readIdentityMetadata: typeof import("./private-vault.js").readIdentityMetadata;
+    /**
+     * Lists all identities in the workspace.
+     */
     listIdentities: typeof import("./private-vault.js").listIdentities;
+    /**
+     * Lists all vaults in the workspace.
+     */
     listVaults: typeof import("./bootstrap.js").listVaults;
     createVault: typeof import("./bootstrap.js").createVault;
     recoverVault: typeof import("./bootstrap.js").recoverVault;

package/dist/runtime/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,GAKhB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,mBAAmB,GAEpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,qCAAqC,EACrC,oBAAoB,EACpB,cAAc,EACd,0BAA0B,EAC1B,8BAA8B,EAC9B,+BAA+B,GAKhC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,WAAW,EACX,YAAY,EACZ,UAAU,GAMX,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,kCAAkC,EAGlC,mBAAmB,EACnB,qCAAqC,EACrC,sBAAsB,EACtB,sBAAsB,EACtB,kCAAkC,EAIlC,oCAAoC,EACpC,uBAAuB,EACvB,oCAAoC,EACpC,iCAAiC,EACjC,2CAA2C,EAC3C,qCAAqC,EACrC,6BAA6B,EAC7B,0BAA0B,EAC1B,4BAA4B,EAC5B,+BAA+B,EAC/B,oBAAoB,EACpB,6BAA6B,EAC7B,0BAA0B,EAC1B,oCAAoC,EACpC,8BAA8B,EAC9B,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,EAChB,6BAA6B,EAC7B,qBAAqB,EACrB,wBAAwB,EACxB,iBAAiB,EACjB,2BAA2B,EAE3B,2BAA2B,EAC3B,WAAW,GA+CZ,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,iBAAiB,GAclB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,iBAAiB,GAQlB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,kBAAkB,EAClB,2BAA2B,EAC3B,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC9B,uBAAuB,GAWxB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,GAKhB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,mBAAmB,GAEpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,qCAAqC,EACrC,oBAAoB,EACpB,cAAc,EACd,0BAA0B,EAC1B,8BAA8B,EAC9B,+BAA+B,GAKhC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,WAAW,EACX,YAAY,EACZ,UAAU,GAOX,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,kCAAkC,EAGlC,mBAAmB,EACnB,qCAAqC,EACrC,sBAAsB,EACtB,sBAAsB,EACtB,kCAAkC,EAIlC,oCAAoC,EACpC,uBAAuB,EACvB,oCAAoC,EACpC,iCAAiC,EACjC,2CAA2C,EAC3C,qCAAqC,EACrC,6BAA6B,EAC7B,0BAA0B,EAC1B,4BAA4B,EAC5B,+BAA+B,EAC/B,oBAAoB,EACpB,6BAA6B,EAC7B,0BAA0B,EAC1B,oCAAoC,EACpC,8BAA8B,EAC9B,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,EAChB,6BAA6B,EAC7B,qBAAqB,EACrB,wBAAwB,EACxB,iBAAiB,EACjB,2BAA2B,EAE3B,2BAA2B,EAC3B,WAAW,GA+CZ,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,iBAAiB,GAclB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,iBAAiB,GAQlB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,kBAAkB,EAClB,2BAA2B,EAC3B,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC9B,uBAAuB,GAWxB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/runtime/private-vault.d.ts

@@ -2,7 +2,6 @@ import type { IStorageProvider } from "../storage/provider.js";
 import { type CreatedIdentity } from "./identity.js";
 export interface IdentityPrivateVaultProfile {
     identityId: string;
-    nickname?: string;
     publicKey: string;
     parentIdentityId?: string;
     childIndex?: number;

package/dist/runtime/private-vault.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { SealedJsonRepository } from "../sealed/index.js";
 import { restoreIdentity } from "./identity.js";
+import { writeVerifiableMetadata, readVerifiableMetadata } from "./verifiable-metadata.js";
 const PRIVATE_VAULT_PREFIX = "identities";
 const PRIVATE_VAULT_LOCK_SUFFIX = ".lock";
 export function identityPrivateVaultPrefix(identityId) {
@@ -37,27 +38,26 @@ export async function ensureIdentityPrivateVault(storage, identity) {
     const profileKey = identityPrivateVaultProfileKey(identity.identityId);
     const profileRepo = new SealedJsonRepository(storage, profileKey, deriveIdentityPrivateVaultKey(identity));
     const existingProfile = await profileRepo.read(null);
+    // Read current public profile to preserve nickname if needed
+    const publicPath = identityPrivateVaultPublicProfileKey(identity.identityId);
+    const publicRaw = await storage.read(publicPath);
+    const existingPublic = publicRaw ? JSON.parse(publicRaw.toString()) : {};
     const profile = {
         identityId: identity.identityId,
-        nickname: identity.nickname || existingProfile?.nickname,
         publicKey: identity.publicKey,
         parentIdentityId: identity.parentIdentityId || existingProfile?.parentIdentityId,
         childIndex: identity.childIndex ?? existingProfile?.childIndex,
     };
-    // Only write if new profile differs or doesn't exist
-    if (!existingProfile ||
-        profile.nickname !== existingProfile.nickname ||
-        profile.parentIdentityId !== existingProfile.parentIdentityId) {
-        await profileRepo.write(profile, "identity_private_vault_profile");
-        // Sync public profile mirror (Plaintext)
-        const publicProfile = {
-            identityId: profile.identityId,
-            publicKey: profile.publicKey,
-            nickname: profile.nickname,
-            parentIdentityId: profile.parentIdentityId,
-        };
-        await storage.write(identityPrivateVaultPublicProfileKey(identity.identityId), Buffer.from(JSON.stringify(publicProfile, null, 2)));
-    }
+    // Profile data in sealed area (excluding nickname)
+    await profileRepo.write(profile, "identity_private_vault_profile");
+    // Write Signed Public Profile for Discovery
+    const publicProfile = {
+        identityId: profile.identityId,
+        publicKey: profile.publicKey,
+        nickname: identity.nickname || existingPublic?.nickname,
+        parentIdentityId: profile.parentIdentityId,
+    };
+    await writeVerifiableMetadata(storage, publicPath, publicProfile, identity.privateKey);
     const childrenKey = identityPrivateVaultChildrenKey(identity.identityId);
     if (!(await storage.has(childrenKey))) {
         const emptyState = {
@@ -78,31 +78,29 @@ export async function readIdentityPrivateVaultProfile(storage, identityOrPrivate
  * Handles both open discovery (identityId only) and authorized read (privateKey).
  */
 export async function readIdentityMetadata(storage, identityId, privateKey) {
-    // If private key is provided, we prefer the full sealed profile
+    const publicPath = identityPrivateVaultPublicProfileKey(identityId);
+    const publicProfile = await readVerifiableMetadata(storage, publicPath).catch(() => null);
+    // If private key is provided, try to read and merge the full sealed profile
     if (privateKey) {
         try {
             const identity = restoreIdentity(privateKey);
             if (identity.identityId !== identityId) {
                 throw new Error("identityId mismatch");
             }
-            return await readIdentityPrivateVaultProfile(storage, identity);
-        }
-        catch {
-            // Fallback to public if privateKey is invalid or decryption fails
-        }
-    }
-    // Otherwise, read the public discovery profile
-    const publicPath = identityPrivateVaultPublicProfileKey(identityId);
-    const publicData = await storage.read(publicPath);
-    if (publicData) {
-        try {
-            return JSON.parse(publicData.toString());
+            const sealed = await readIdentityPrivateVaultProfile(storage, identity);
+            if (sealed) {
+                return {
+                    ...publicProfile, // Spread public profile (contains nickname)
+                    ...sealed, // Spread sealed profile (contains keys/metadata)
+                };
+            }
         }
-        catch {
-            return null;
+        catch (e) {
+            // Fallback to public if decryption fails
+            console.warn(`[IdentityMetadata] Decryption failed for ${identityId}:`, e);
         }
     }
-    return null;
+    return publicProfile;
 }
 export async function readIdentityPrivateVaultChildrenState(storage, identityOrPrivateKey) {
     const identity = normalizeIdentityAccess(identityOrPrivateKey);

package/dist/runtime/private-vault.js.map

@@ -1 +1 @@
-{"version":3,"file":"private-vault.js","sourceRoot":"","sources":["../../src/runtime/private-vault.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAwB,MAAM,eAAe,CAAC;AAEtE,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAC1C,MAAM,yBAAyB,GAAG,OAAO,CAAC;AAgC1C,MAAM,UAAU,0BAA0B,CAAC,UAAkB;IAC3D,OAAO,GAAG,oBAAoB,IAAI,UAAU,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,UAAkB;IAC/D,OAAO,GAAG,0BAA0B,CAAC,UAAU,CAAC,wBAAwB,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,UAAkB;IAChE,OAAO,GAAG,0BAA0B,CAAC,UAAU,CAAC,yBAAyB,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,UAAkB;IACrE,OAAO,GAAG,0BAA0B,CAAC,UAAU,CAAC,sBAAsB,CAAC;AACzE,CAAC;AAED,SAAS,OAAO,CAAC,UAAkB;IACjC,OAAO,GAAG,0BAA0B,CAAC,UAAU,CAAC,sBAAsB,yBAAyB,EAAE,CAAC;AACpG,CAAC;AAED,SAAS,uBAAuB,CAAC,oBAAgD;IAC/E,IAAI,OAAO,oBAAoB,KAAK,QAAQ,EAAE,CAAC;QAC7C,OAAO,eAAe,CAAC,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED,SAAS,6BAA6B,CAAC,QAAyB;IAC9D,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,gCAAgC,CAAC;SACxC,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;SAC3B,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;SAC3B,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAAyB,EACzB,QAAyB;IAEzB,MAAM,UAAU,GAAG,8BAA8B,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,IAAI,oBAAoB,CAC1C,OAAO,EACP,UAAU,EACV,6BAA6B,CAAC,QAAQ,CAAC,CACxC,CAAC;IAEF,MAAM,eAAe,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,IAAW,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAgC;QAC3C,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,eAAe,EAAE,QAAQ;QACxD,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,IAAI,eAAe,EAAE,gBAAgB;QAChF,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,eAAe,EAAE,UAAU;KAC/D,CAAC;IAEF,qDAAqD;IACrD,IACE,CAAC,eAAe;QAChB,OAAO,CAAC,QAAQ,KAAK,eAAe,CAAC,QAAQ;QAC7C,OAAO,CAAC,gBAAgB,KAAK,eAAe,CAAC,gBAAgB,EAC7D,CAAC;QACD,MAAM,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,gCAAgC,CAAC,CAAC;QAEnE,yCAAyC;QACzC,MAAM,aAAa,GAA0B;YAC3C,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;SAC3C,CAAC;QACF,MAAM,OAAO,CAAC,KAAK,CACjB,oCAAoC,CAAC,QAAQ,CAAC,UAAU,CAAC,EACzD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CACpD,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,+BAA+B,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACtC,MAAM,UAAU,GAAsC;YACpD,cAAc,EAAE,CAAC;YACjB,QAAQ,EAAE,EAAE;SACb,CAAC;QACF,MAAM,YAAY,GAAG,IAAI,oBAAoB,CAC3C,OAAO,EACP,WAAW,EACX,6BAA6B,CAAC,QAAQ,CAAC,CACxC,CAAC;QACF,MAAM,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,iCAAiC,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,OAAyB,EACzB,oBAAgD;IAEhD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,oBAAoB,CACnC,OAAO,EACP,8BAA8B,CAAC,QAAQ,CAAC,UAAU,CAAC,EACnD,6BAA6B,CAAC,QAAQ,CAAC,CACxC,CAAC;IACF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAW,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAyB,EACzB,UAAkB,EAClB,UAAmB;IAEnB,gEAAgE;IAChE,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;YAC7C,IAAI,QAAQ,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACzC,CAAC;YACD,OAAO,MAAM,+BAA+B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,MAAM,UAAU,GAAG,oCAAoC,CAAC,UAAU,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,CAA0B,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,OAAyB,EACzB,oBAAgD;IAEhD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,oBAAoB,CACnC,OAAO,EACP,+BAA+B,CAAC,QAAQ,CAAC,UAAU,CAAC,EACpD,6BAA6B,CAAC,QAAQ,CAAC,CACxC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IACpE,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC/D,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;KAChC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,OAAyB,EACzB,oBAAgD,EAChD,KAAwC;IAExC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,oBAAoB,CACnC,OAAO,EACP,+BAA+B,CAAC,QAAQ,CAAC,UAAU,CAAC,EACpD,6BAA6B,CAAC,QAAQ,CAAC,CACxC,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAyB,EACzB,oBAAgD,EAChD,IAAsB;IAEtB,MAAM,QAAQ,GAAG,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAyB;IAC5D,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACrD,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,qDAAqD;QACrD,IAAI,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;YAAE,SAAS;QAErD,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,OAAgC,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"private-vault.js","sourceRoot":"","sources":["../../src/runtime/private-vault.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAwB,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAE3F,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAC1C,MAAM,yBAAyB,GAAG,OAAO,CAAC;AA+B1C,MAAM,UAAU,0BAA0B,CAAC,UAAkB;IAC3D,OAAO,GAAG,oBAAoB,IAAI,UAAU,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,UAAkB;IAC/D,OAAO,GAAG,0BAA0B,CAAC,UAAU,CAAC,wBAAwB,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,UAAkB;IAChE,OAAO,GAAG,0BAA0B,CAAC,UAAU,CAAC,yBAAyB,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,UAAkB;IACrE,OAAO,GAAG,0BAA0B,CAAC,UAAU,CAAC,sBAAsB,CAAC;AACzE,CAAC;AAED,SAAS,OAAO,CAAC,UAAkB;IACjC,OAAO,GAAG,0BAA0B,CAAC,UAAU,CAAC,sBAAsB,yBAAyB,EAAE,CAAC;AACpG,CAAC;AAED,SAAS,uBAAuB,CAAC,oBAAgD;IAC/E,IAAI,OAAO,oBAAoB,KAAK,QAAQ,EAAE,CAAC;QAC7C,OAAO,eAAe,CAAC,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED,SAAS,6BAA6B,CAAC,QAAyB;IAC9D,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,gCAAgC,CAAC;SACxC,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;SAC3B,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;SAC3B,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAAyB,EACzB,QAAyB;IAEzB,MAAM,UAAU,GAAG,8BAA8B,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,IAAI,oBAAoB,CAC1C,OAAO,EACP,UAAU,EACV,6BAA6B,CAAC,QAAQ,CAAC,CACxC,CAAC;IAEF,MAAM,eAAe,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,IAAW,CAAC,CAAC;IAE5D,6DAA6D;IAC7D,MAAM,UAAU,GAAG,oCAAoC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEzE,MAAM,OAAO,GAAgC;QAC3C,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,IAAI,eAAe,EAAE,gBAAgB;QAChF,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,eAAe,EAAE,UAAU;KAC/D,CAAC;IAEF,mDAAmD;IACnD,MAAM,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,gCAAgC,CAAC,CAAC;IAEnE,4CAA4C;IAC5C,MAAM,aAAa,GAA0B;QAC3C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,cAAc,EAAE,QAAQ;QACvD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;KAC3C,CAAC;IACF,MAAM,uBAAuB,CAC3B,OAAO,EACP,UAAU,EACV,aAAa,EACb,QAAQ,CAAC,UAAU,CACpB,CAAC;IAEF,MAAM,WAAW,GAAG,+BAA+B,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACtC,MAAM,UAAU,GAAsC;YACpD,cAAc,EAAE,CAAC;YACjB,QAAQ,EAAE,EAAE;SACb,CAAC;QACF,MAAM,YAAY,GAAG,IAAI,oBAAoB,CAC3C,OAAO,EACP,WAAW,EACX,6BAA6B,CAAC,QAAQ,CAAC,CACxC,CAAC;QACF,MAAM,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,iCAAiC,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,OAAyB,EACzB,oBAAgD;IAEhD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,oBAAoB,CACnC,OAAO,EACP,8BAA8B,CAAC,QAAQ,CAAC,UAAU,CAAC,EACnD,6BAA6B,CAAC,QAAQ,CAAC,CACxC,CAAC;IACF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAW,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAyB,EACzB,UAAkB,EAClB,UAAmB;IAEnB,MAAM,UAAU,GAAG,oCAAoC,CAAC,UAAU,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAChD,OAAO,EACP,UAAU,CACX,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAEpB,4EAA4E;IAC5E,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;YAC7C,IAAI,QAAQ,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACzC,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACxE,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO;oBACL,GAAG,aAAa,EAAE,4CAA4C;oBAC9D,GAAG,MAAM,EAAS,iDAAiD;iBAC7D,CAAC;YACX,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,yCAAyC;YACzC,OAAO,CAAC,IAAI,CAAC,4CAA4C,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,OAAyB,EACzB,oBAAgD;IAEhD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,oBAAoB,CACnC,OAAO,EACP,+BAA+B,CAAC,QAAQ,CAAC,UAAU,CAAC,EACpD,6BAA6B,CAAC,QAAQ,CAAC,CACxC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IACpE,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC/D,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;KAChC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,OAAyB,EACzB,oBAAgD,EAChD,KAAwC;IAExC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,oBAAoB,CACnC,OAAO,EACP,+BAA+B,CAAC,QAAQ,CAAC,UAAU,CAAC,EACpD,6BAA6B,CAAC,QAAQ,CAAC,CACxC,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAyB,EACzB,oBAAgD,EAChD,IAAsB;IAEtB,MAAM,QAAQ,GAAG,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAyB;IAC5D,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACrD,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,qDAAqD;QACrD,IAAI,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;YAAE,SAAS;QAErD,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,OAAgC,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/runtime/vault-metadata.d.ts

@@ -1,7 +1,9 @@
 import type { IStorageProvider } from "../storage/provider.js";
 export interface VaultProfile {
     sealed: Record<string, any>;
-    public: Record<string, any>;
+    public: Record<string, any> & {
+        nickname?: string;
+    };
 }
 export declare const VAULT_PUBLIC_PROFILE_KEY = "vault/public/profile.json";
 /**

package/dist/runtime/vault-metadata.js

@@ -1,27 +1,20 @@
-import { Buffer } from "node:buffer";
 import { SealedJsonRepository } from "../sealed/index.js";
 const VAULT_SEALED_PROFILE_KEY = "vault/sealed/profile.sealed";
 export const VAULT_PUBLIC_PROFILE_KEY = "vault/public/profile.json";
+import { readVerifiableMetadata } from "./verifiable-metadata.js";
 /**
  * Reads only the public (plaintext) metadata of a vault. No key required.
  */
 export async function readVaultPublicMetadata(storage) {
-    const publicRaw = await storage.read(VAULT_PUBLIC_PROFILE_KEY);
-    return publicRaw ? JSON.parse(publicRaw.toString("utf8")) : {};
+    const data = await readVerifiableMetadata(storage, VAULT_PUBLIC_PROFILE_KEY).catch(() => null);
+    return data || {};
 }
 export async function writeVaultProfile(storage, profile, vaultWorkingKey) {
     // 1. Write Sealed Profile
     const repo = new SealedJsonRepository(storage, VAULT_SEALED_PROFILE_KEY, vaultWorkingKey);
     await repo.write(profile.sealed, "vault_profile_sealed");
-    // 2. Write Public Profile
-    if (profile.public && Object.keys(profile.public).length > 0) {
-        await storage.write(VAULT_PUBLIC_PROFILE_KEY, Buffer.from(JSON.stringify(profile.public, null, 2), "utf8"));
-    }
-    else {
-        if (await storage.has(VAULT_PUBLIC_PROFILE_KEY)) {
-            await storage.delete(VAULT_PUBLIC_PROFILE_KEY);
-        }
-    }
+    // NOTE: Public profile writing is handled separately via writeVerifiableMetadata
+    // by the component that holds the owner's private key (e.g., bootstrap.ts).
 }
 export async function readVaultProfile(storage, vaultWorkingKey) {
     const repo = new SealedJsonRepository(storage, VAULT_SEALED_PROFILE_KEY, vaultWorkingKey);
@@ -29,8 +22,7 @@ export async function readVaultProfile(storage, vaultWorkingKey) {
     if (!sealed) {
         return null;
     }
-    const publicRaw = await storage.read(VAULT_PUBLIC_PROFILE_KEY);
-    const publicData = publicRaw ? JSON.parse(publicRaw.toString("utf8")) : {};
+    const publicData = await readVaultPublicMetadata(storage);
     return {
         sealed,
         public: publicData,

package/dist/runtime/vault-metadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"vault-metadata.js","sourceRoot":"","sources":["../../src/runtime/vault-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAO1D,MAAM,wBAAwB,GAAG,6BAA6B,CAAC;AAC/D,MAAM,CAAC,MAAM,wBAAwB,GAAG,2BAA2B,CAAC;AAEpE;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAyB;IAEzB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC/D,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAyB,EACzB,OAAqB,EACrB,eAAuB;IAEvB,0BAA0B;IAC1B,MAAM,IAAI,GAAG,IAAI,oBAAoB,CAAsB,OAAO,EAAE,wBAAwB,EAAE,eAAe,CAAC,CAAC;IAC/G,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAEzD,0BAA0B;IAC1B,IAAI,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7D,MAAM,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9G,CAAC;SAAM,CAAC;QACN,IAAI,MAAM,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,CAAC;YAChD,MAAM,OAAO,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAyB,EACzB,eAAuB;IAEvB,MAAM,IAAI,GAAG,IAAI,oBAAoB,CAAsB,OAAO,EAAE,wBAAwB,EAAE,eAAe,CAAC,CAAC;IAC/G,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAW,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE3E,OAAO;QACL,MAAM;QACN,MAAM,EAAE,UAAU;KACnB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"vault-metadata.js","sourceRoot":"","sources":["../../src/runtime/vault-metadata.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAO1D,MAAM,wBAAwB,GAAG,6BAA6B,CAAC;AAC/D,MAAM,CAAC,MAAM,wBAAwB,GAAG,2BAA2B,CAAC;AAEpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAyB;IAEzB,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAsB,OAAO,EAAE,wBAAwB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACpH,OAAO,IAAI,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAyB,EACzB,OAAqB,EACrB,eAAuB;IAEvB,0BAA0B;IAC1B,MAAM,IAAI,GAAG,IAAI,oBAAoB,CAAsB,OAAO,EAAE,wBAAwB,EAAE,eAAe,CAAC,CAAC;IAC/G,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAEzD,iFAAiF;IACjF,4EAA4E;AAC9E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAyB,EACzB,eAAuB;IAEvB,MAAM,IAAI,GAAG,IAAI,oBAAoB,CAAsB,OAAO,EAAE,wBAAwB,EAAE,eAAe,CAAC,CAAC;IAC/G,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAW,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAE1D,OAAO;QACL,MAAM;QACN,MAAM,EAAE,UAAU;KACnB,CAAC;AACJ,CAAC"}

package/dist/runtime/verifiable-metadata.d.ts

@@ -0,0 +1,18 @@
+import type { IStorageProvider } from "../storage/provider.js";
+/**
+ * A verifiable envelope for public metadata.
+ * Proves that the data was signed by the rightful owner.
+ */
+export interface VerifiableMetadata<T> {
+    payload: T;
+    signature: string;
+    signer: string;
+}
+/**
+ * Signs and writes a payload to storage as a verifiable metadata envelope.
+ */
+export declare function writeVerifiableMetadata<T>(storage: IStorageProvider, path: string, payload: T, privateKey: string): Promise<void>;
+/**
+ * Reads and optionally verifies a verifiable metadata envelope from storage.
+ */
+export declare function readVerifiableMetadata<T>(storage: IStorageProvider, path: string, expectedSigner?: string): Promise<T | null>;

package/dist/runtime/verifiable-metadata.js

@@ -0,0 +1,41 @@
+import { signPayload, verifySignature } from "../protocol/crypto.js";
+/**
+ * Signs and writes a payload to storage as a verifiable metadata envelope.
+ */
+export async function writeVerifiableMetadata(storage, path, payload, privateKey) {
+    const payloadStr = JSON.stringify(payload);
+    const signature = await signPayload(privateKey, payloadStr);
+    const signer = await import("../protocol/crypto.js").then(m => m.derivePublicKey(privateKey));
+    const envelope = {
+        payload,
+        signature,
+        signer,
+    };
+    await storage.write(path, Buffer.from(JSON.stringify(envelope, null, 2)));
+}
+/**
+ * Reads and optionally verifies a verifiable metadata envelope from storage.
+ */
+export async function readVerifiableMetadata(storage, path, expectedSigner) {
+    const raw = await storage.read(path);
+    if (!raw)
+        return null;
+    try {
+        const envelope = JSON.parse(raw.toString());
+        // If expectedSigner is provided, we MUST verify
+        if (expectedSigner && envelope.signer !== expectedSigner) {
+            return null; // Signer mismatch
+        }
+        const payloadStr = JSON.stringify(envelope.payload);
+        const isValid = await verifySignature(envelope.signer, payloadStr, envelope.signature);
+        if (!isValid) {
+            console.warn(`[VerifiableMetadata] Invalid signature at ${path}`);
+            return null;
+        }
+        return envelope.payload;
+    }
+    catch (e) {
+        return null;
+    }
+}
+//# sourceMappingURL=verifiable-metadata.js.map

package/dist/runtime/verifiable-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifiable-metadata.js","sourceRoot":"","sources":["../../src/runtime/verifiable-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAarE;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAyB,EACzB,IAAY,EACZ,OAAU,EACV,UAAkB;IAElB,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;IAE9F,MAAM,QAAQ,GAA0B;QACtC,OAAO;QACP,SAAS;QACT,MAAM;KACP,CAAC;IAEF,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAyB,EACzB,IAAY,EACZ,cAAuB;IAEvB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAA0B,CAAC;QAErE,gDAAgD;QAChD,IAAI,cAAc,IAAI,QAAQ,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC,CAAC,kBAAkB;QACjC,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QAEvF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,6CAA6C,IAAI,EAAE,CAAC,CAAC;YAClE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,QAAQ,CAAC,OAAO,CAAC;IAC1B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/docs/ARCHITECTURE.md

@@ -55,9 +55,10 @@ The vault is physically divided into two partitions to balance security and disc
   - **Auditing**: Every access is tracked and logged in the append-only audit trail.
 
 - **Public Area (`vault/public/`)**
-  - **Security**: Plaintext JSON (`.json`).
-  - **Access**: Identity is required for **writing** (authorized update), but **reading is open**.
-  - **Auditing**: Reading from the public area is **untracked**, reducing audit noise for discovery / identity resolution.
+  - **Security**: Verifiable JSON Envelopes (`.json`).
+  - **Integrity**: Every public file is **digitally signed** by the vault owner's private key.
+  - **Access**: Reading is open and anonymous; however, the SDK automatically verifies signatures to prevent unauthorized tampering.
+  - **Auditing**: Anonymous reading is untracked to reduce noise. Writing requires proving identity through a valid signature.
 
 ## Core Rules
 
@@ -65,7 +66,7 @@ The vault is physically divided into two partitions to balance security and disc
 2. Only owner and trusted issuer paths may write secrets.
 3. Agent can only request dispatch through capability + proof.
 4. Vault validates and audits every dispatch.
-5. Public data (e.g., nicknames, public keys) is explicitly mirrored to the Public Area for discovery.
+5. Public metadata (e.g., nicknames, discovery profile) is stored **exclusively** in the Public Area and is digitally signed.
 6. Identity-specific private data is stored in `identities/`, separate from named `vaults/`.
 
 ## Current HTTP Secret Flows

package/docs/REFERENCE.md

@@ -40,7 +40,7 @@ Recommended persistent-vault entrypoints:
 
 `createVault(storage, { ownerIdentity, nickname, publicMetadata })` overrides the workspace storage explicitly.
 
-`recoverVault({ vaultId, ownerIdentity })` reopens a vault and returns the `nickname` from the sealed profile.
+`recoverVault({ vaultId, ownerIdentity })` reopens a vault and returns metadata (including `nickname`) from the **public signed profile**.
 
 `recoverVault(storage, { vaultId, ownerIdentity })` overrides the workspace storage explicitly.
 
@@ -87,6 +87,8 @@ Role rules:
 
 Those files are encrypted at rest in the `sealed/` sub-directory and are not readable as plain JSON on disk.
 
+Identities also maintain a **public discovery area** at `public/profile.json`. This file is readable without authentication but is **digitally signed** by the identity's private key to prevent anonymous tampering.
+
 `restoreIdentity(privateKey)` returns the same shape for an existing private key.
 
 `readIdentityPrivateVaultProfile(storage, identityOrPrivateKey)` decrypts and returns the current identity profile for the supplied identity or private key.
@@ -97,9 +99,9 @@ Those files are encrypted at rest in the `sealed/` sub-directory and are not rea
 If `privateKey` is provided, it returns the full sealed profile.
 If `privateKey` is missing, it returns the public discovery profile (nickname, publicKey, parentIdentityId).
 
-`listIdentities(storage)` returns all identity discovery profiles in the workspace.
+`listIdentities(storage)` returns all identity discovery profiles. These profiles are automatically verified for signature integrity.
 
-`listVaults(storage)` returns all vault metadata summaries in the workspace.
+`listVaults(storage)` returns all vault metadata summaries. These summaries are pulled from the public signed profiles and verified.
 
 Typical relationship lookup flow when you already have a private key:
 
@@ -360,6 +362,21 @@ If the custom flow mode includes secret acquisition, the owner also defines a re
 }
 ```
 
+## Verifiable Discovery (Signed Content)
+
+The CBIO Node Runtime implements a **Public-Read, Owner-Write (Signed)** protection for discovery metadata.
+
+- **Storage**: `vault/public/profile.json` and `identities/{id}/public/profile.json`.
+- **Integrity**: These files are wrapped in a verifiable envelope:
+    ```json
+    {
+      "payload": { "nickname": "...", ... },
+      "signature": "...",
+      "signer": "publicKey"
+    }
+    ```
+- **Verification**: The SDK automatically verifies signatures during `listVaults`, `listIdentities`, and retrieval. Corrupted or tampered files are ignored to prevent phishing or metadata poisoning.
+
 ## Persistent Dependencies
 
 `createPersistentVaultCoreDependencies(...)` builds a file-backed single-node profile under `vault/sealed/` with:

package/docs/es/README.md

@@ -23,8 +23,8 @@ import {
   readIdentityMetadata,
    createVault,
   listIdentities,
-+  listVaults,
-   recoverVault,
+  listVaults,
+  recoverVault,
   LocalVaultTransport,
   createVaultClient,
   createAgentClient,
@@ -44,6 +44,9 @@ Ruta principal recomendada para vault persistente:
 - crear el vault persistente con `createVault(...)` (soporta `publicMetadata` para el descubrimiento de información pública)
 - recuperar el vault persistente con `recoverVault(...)` usando la identidad del owner
 - Capas de almacenamiento divididas: `vaults/` (Bóvedas con nombre) e `identities/` (Espacio de identidad personal)
+- **Descubrimiento Verificable (Verifiable Discovery)**:
+    - El área pública (`public/`) utiliza el modelo **“Lectura Anónima, Escritura del Propietario”**.
+    - Todos los metadatos públicos (como el apodo) incluyen una **firma digital**, la cual el SDK verifica automáticamente para prevenir manipulaciones anónimas.
 
 La API antigua centrada en `CbioIdentity` ya no es la superficie principal del producto.
 

package/docs/fr/README.md

@@ -23,8 +23,8 @@ import {
   readIdentityMetadata,
    createVault,
   listIdentities,
-+  listVaults,
-   recoverVault,
+  listVaults,
+  recoverVault,
   LocalVaultTransport,
   createVaultClient,
   createAgentClient,

package/docs/ja/README.md

@@ -23,8 +23,8 @@ import {
   readIdentityMetadata,
    createVault,
   listIdentities,
-+  listVaults,
-   recoverVault,
+  listVaults,
+  recoverVault,
   LocalVaultTransport,
   createVaultClient,
   createAgentClient,
@@ -44,6 +44,9 @@ import {
 - `createVault(...)` で persistent vault を作成する (`publicMetadata` による公開情報のディスカバリをサポート)
 - `recoverVault(...)` で owner identity を使って persistent vault を復旧する
 - 分離されたストレージ層: `vaults/` (具名 Vault) と `identities/` (個人 ID スペース)
+- **検証可能なディスカバリ (Verifiable Discovery)**:
+    - 公開エリア (`public/`) は **「匿名読み取り、所有者書き込み」** モデルを採用しています。
+    - ニックネームなどのすべての公開メタデータには **電子署名** が付与されており、SDK がその正当性を自動的に検証することで、匿名による改ざんを防止します。
 
 旧 `CbioIdentity` 中心 API は、もはや主要な公開面ではありません。
 

package/docs/ko/README.md

@@ -23,8 +23,8 @@ import {
   readIdentityMetadata,
    createVault,
   listIdentities,
-+  listVaults,
-   recoverVault,
+  listVaults,
+  recoverVault,
   LocalVaultTransport,
   createVaultClient,
   createAgentClient,
@@ -44,6 +44,9 @@ import {
 - `createVault(...)` 로 persistent vault 를 생성합니다 (`publicMetadata` 를 통한 공개 정보 검색 지원)
 - `recoverVault(...)` 로 owner identity 를 사용해 persistent vault 를 복구합니다
 - 분리된 스토리지 계층: `vaults/` (기명 Vault) 및 `identities/` (개인 ID 공간)
+- **검증 가능한 디스커버리 (Verifiable Discovery)**:
+    - 공개 영역 (`public/`)은 **"익명 읽기, 소유자 쓰기"** 모델을 채택하고 있습니다.
+    - 닉네임과 같은 모든 공개 메타데이터에는 **디지털 서명**이 포함되어 있으며, SDK가 그 정당성을 자동으로 검증하여 익명에 의한 변조를 방지합니다.
 
 이전 `CbioIdentity` 중심 API 는 더 이상 주요 제품 표면이 아닙니다.
 

package/docs/pt/README.md

@@ -23,8 +23,8 @@ import {
   readIdentityMetadata,
    createVault,
   listIdentities,
-+  listVaults,
-   recoverVault,
+  listVaults,
+  recoverVault,
   LocalVaultTransport,
   createVaultClient,
   createAgentClient,
@@ -44,6 +44,9 @@ Caminho principal recomendado para vault persistente:
 - criar o cofre persistente com `createVault(...)` (suporta `publicMetadata` para a descoberta de informações públicas)
 - recuperar o cofre persistente com `recoverVault(...)` usando a identidade do owner
 - Camadas de armazenamento divididas: `vaults/` (Cofres nomeados) e `identities/` (Espaço de identidade pessoal)
+- **Descoberta Verificável (Verifiable Discovery)**:
+    - A área pública (`public/`) utiliza o modelo **“Leitura Anônima, Escrita do Proprietário”**.
+    - Todos os metadados públicos (como o apelido) incluem uma **assinatura digital**, que o SDK verifica automaticamente para evitar adulterações anônimas.
 
 A antiga API centrada em `CbioIdentity` nao e mais a superficie principal do produto.
 

package/docs/zh/README.md

@@ -45,6 +45,9 @@ import {
 - 通过 `createVault(...)` 创建持久化 vault (支持 `publicMetadata` 用于公开发现)
 - 通过 `recoverVault(...)` 用 owner 身份恢复持久化 vault
 - 分区存储：`vaults/` (具名保险箱) 与 `identities/` (身份私有空间)
+- **可验证发现 (Verifiable Discovery)**:
+    - 公开区 (`public/`) 采用 **“匿名读、所有者写”** 模式。
+    - 所有公开元数据（如昵称）均附带**数字签名**，SDK 会自动验证其真实性，防止匿名篡改。
 
 ## 构建
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@the-ai-company/cbio-node-runtime",
-  "version": "1.25.0",
+  "version": "1.27.0",
   "description": "Node.js runtime for cbio identity and credential vault. Library only, no CLI or TUI.",
   "type": "module",
   "main": "./dist/runtime/index.js",