@the-ai-company/cbio-node-runtime 1.34.0 → 1.36.0

package/dist/runtime/bootstrap.d.ts

@@ -2,14 +2,13 @@ import { type CreatePersistentVaultCoreDependenciesOptions, type VaultCore } fro
 import { type VaultService, type VaultCustomFlowResolver } from "../vault-ingress/index.js";
 import type { IStorageProvider } from "../storage/provider.js";
 import type { CreatedIdentity } from "./identity.js";
-export interface VaultPublicMetadata extends Record<string, any> {
+export interface VaultMetadata extends Record<string, any> {
     nickname?: string;
     ownerId?: string;
 }
 export interface CreateVaultOptions extends Omit<CreatePersistentVaultCoreDependenciesOptions, "vaultWorkingKey" | "vaultId"> {
     vaultId?: string;
     nickname?: string;
-    publicMetadata?: VaultPublicMetadata;
     ownerIdentity: CreatedIdentity;
     vault?: {
         customFlows?: VaultCustomFlowResolver;
@@ -65,9 +64,9 @@ export declare function recoverVault(storage: IStorageProvider, options: Recover
  */
 export declare function recoverVault(options: RecoverVaultOptions): Promise<RecoveredVault>;
 /**
- * Lists all vaults in the workspace with their public discovery metadata.
+ * Lists all vaults in the workspace with their discovery metadata.
  */
 export declare function listVaults(storage: IStorageProvider): Promise<Array<{
     vaultId: string;
-    public: VaultPublicMetadata;
+    public: any;
 }>>;

package/dist/runtime/bootstrap.js

@@ -3,9 +3,8 @@ import { createVaultCore } from "../vault-core/core.js";
 import { createPersistentVaultCoreDependencies, } from "../vault-core/index.js";
 import { wrapVaultCoreAsVaultService, } from "../vault-ingress/index.js";
 import { createPrefixedStorage } from "../storage/prefix.js";
-import { readVaultProfile, writeVaultProfile } from "./vault-metadata.js";
+import { readVaultProfile, writeVaultProfile, readVaultPublicMetadata } from "./vault-metadata.js";
 import { createWorkspaceStorage } from "./workspace-storage.js";
-import { writeVerifiableMetadata, readVerifiableMetadata } from "./verifiable-metadata.js";
 function deriveVaultWorkingKey(privateKey, vaultId) {
     return crypto
         .createHash("sha256")
@@ -50,20 +49,18 @@ export async function createVault(storageOrOptions, maybeOptions) {
     };
     await core.bootstrapOwnerIdentity(bootstrapOwner);
     const nickname = options.nickname?.trim() ? options.nickname.trim() : undefined;
-    // Nickname is public-by-design for discovery
-    const publicMetadata = {
-        ...(options.publicMetadata || {}),
-        ...(nickname ? { nickname } : {})
-    };
+    // 1. All sensitive metadata is in the private sealed profile (requires owner PK)
+    // 2. Discovery metadata (nickname) is in the public sealed profile (requires only vaultId)
     await writeVaultProfile(storage, {
-        sealed: {
+        sealedPrivate: {
             vaultId,
-            // nickname removed from sealed area
+            ownerId: options.ownerIdentity.identityId,
         },
-        public: {}, // Sealed profile no longer carries public mirror
-    }, vaultWorkingKey);
-    // Write Signed Public Profile for Discovery
-    await writeVerifiableMetadata(storage, "vault/public/profile.json", publicMetadata, options.ownerIdentity.privateKey);
+        sealedPublic: {
+            vaultId,
+            nickname,
+        }
+    }, vaultWorkingKey, vaultId);
     return {
         core,
         vault: wrapVaultCoreAsVaultService(core, options.vault),
@@ -81,17 +78,19 @@ export async function recoverVault(storageOrOptions, maybeOptions) {
         vaultWorkingKey,
     });
     const core = createVaultCore(deps);
-    const profile = await readVaultProfile(storage, vaultWorkingKey);
-    const publicMeta = await readVerifiableMetadata(storage, "vault/public/profile.json", options.ownerIdentity.publicKey).catch(() => null);
+    const profile = await readVaultProfile(storage, vaultWorkingKey, options.vaultId);
+    if (!profile) {
+        throw new Error("vault profile not found or decryption failed");
+    }
     return {
         core,
         vault: wrapVaultCoreAsVaultService(core, options.vault),
-        nickname: publicMeta?.nickname,
+        nickname: profile.sealedPublic.nickname,
         storage,
     };
 }
 /**
- * Lists all vaults in the workspace with their public discovery metadata.
+ * Lists all vaults in the workspace with their discovery metadata.
  */
 export async function listVaults(storage) {
     if (!storage.list) {
@@ -101,10 +100,10 @@ export async function listVaults(storage) {
     const results = [];
     for (const id of ids) {
         const vaultStorage = createPrefixedStorage(storage, vaultStoragePrefix(id));
-        const publicData = await readVerifiableMetadata(vaultStorage, "vault/public/profile.json").catch(() => ({}));
+        const publicData = await readVaultPublicMetadata(vaultStorage, id);
         results.push({
             vaultId: id,
-            public: (publicData || {}),
+            public: publicData || {},
         });
     }
     return results;

package/dist/runtime/bootstrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/runtime/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EACL,qCAAqC,GAItC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,2BAA2B,GAG5B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAG7D,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAE3F,SAAS,qBAAqB,CAAC,UAAkB,EAAE,OAAe;IAChE,OAAO,MAAM;SACV,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,2BAA2B,CAAC;SACnC,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,OAAO,CAAC;SACf,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IACzC,OAAO,UAAU,OAAO,EAAE,CAAC;AAC7B,CAAC;AA2CD,SAAS,cAAc,CACrB,gBAA6E,EAC7E,YAAuD;IAEvD,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO;YACL,OAAO,EAAE,gBAAoC;YAC7C,OAAO,EAAE,YAAY;SACtB,CAAC;IACJ,CAAC;IACD,gEAAgE;IAChE,OAAO;QACL,OAAO,EAAE,sBAAsB,EAAE;QACjC,OAAO,EAAE,gBAA4D;KACtE,CAAC;AACJ,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,gBAAuD,EACvD,YAAiC;IAEjC,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,gBAAgB,EAAE,YAAY,CAG3F,CAAC;IACF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,SAAS,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,qBAAqB,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;IACrF,MAAM,eAAe,GAAG,qBAAqB,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,qCAAqC,CAAC,OAAO,EAAE;QAC1D,GAAG,OAAO;QACV,OAAO;QACP,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,cAAc,GAAwB;QAC1C,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU;QACzC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,SAAS;KAC3C,CAAC;IACF,MAAM,IAAI,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAElD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAEhF,6CAA6C;IAC7C,MAAM,cAAc,GAAG;QACrB,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;QACjC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAC;IAEF,MAAM,iBAAiB,CAAC,OAAO,EAAE;QAC/B,MAAM,EAAE;YACN,OAAO;YACP,oCAAoC;SACrC;QACD,MAAM,EAAE,EAAE,EAAE,iDAAiD;KAC9D,EAAE,eAAe,CAAC,CAAC;IAEpB,4CAA4C;IAC5C,MAAM,uBAAuB,CAC3B,OAAO,EACP,2BAA2B,EAC3B,cAAc,EACd,OAAO,CAAC,aAAa,CAAC,UAAU,CACjC,CAAC;IACF,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC;QACvD,QAAQ;QACR,OAAO;KACR,CAAC;AACJ,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,gBAAwD,EACxD,YAAkC;IAElC,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,gBAAgB,EAAE,YAAY,CAG3F,CAAC;IACF,MAAM,OAAO,GAAG,qBAAqB,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7F,MAAM,eAAe,GAAG,qBAAqB,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACjG,MAAM,IAAI,GAAG,qCAAqC,CAAC,OAAO,EAAE;QAC1D,GAAG,OAAO;QACV,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAC7C,OAAO,EACP,2BAA2B,EAC3B,OAAO,CAAC,aAAa,CAAC,SAAS,CAChC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAEpB,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC;QACvD,QAAQ,EAAE,UAAU,EAAE,QAAQ;QAC9B,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAyB;IACxD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,OAAO,GAA4D,EAAE,CAAC;IAC5E,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAC7C,YAAY,EACZ,2BAA2B,CAC5B,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAEpB,OAAO,CAAC,IAAI,CAAC;YACX,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,CAAC,UAAU,IAAI,EAAE,CAAwB;SAClD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/runtime/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EACL,qCAAqC,GAItC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,2BAA2B,GAG5B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAG7D,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACnG,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,SAAS,qBAAqB,CAAC,UAAkB,EAAE,OAAe;IAChE,OAAO,MAAM;SACV,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,2BAA2B,CAAC;SACnC,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,OAAO,CAAC;SACf,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IACzC,OAAO,UAAU,OAAO,EAAE,CAAC;AAC7B,CAAC;AA0CD,SAAS,cAAc,CACrB,gBAA6E,EAC7E,YAAuD;IAEvD,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO;YACL,OAAO,EAAE,gBAAoC;YAC7C,OAAO,EAAE,YAAY;SACtB,CAAC;IACJ,CAAC;IACD,gEAAgE;IAChE,OAAO;QACL,OAAO,EAAE,sBAAsB,EAAE;QACjC,OAAO,EAAE,gBAA4D;KACtE,CAAC;AACJ,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,gBAAuD,EACvD,YAAiC;IAEjC,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,gBAAgB,EAAE,YAAY,CAG3F,CAAC;IACF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,SAAS,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,qBAAqB,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;IACrF,MAAM,eAAe,GAAG,qBAAqB,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,qCAAqC,CAAC,OAAO,EAAE;QAC1D,GAAG,OAAO;QACV,OAAO;QACP,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,cAAc,GAAwB;QAC1C,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU;QACzC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,SAAS;KAC3C,CAAC;IACF,MAAM,IAAI,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAElD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAEhF,iFAAiF;IACjF,2FAA2F;IAC3F,MAAM,iBAAiB,CAAC,OAAO,EAAE;QAC/B,aAAa,EAAE;YACb,OAAO;YACP,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU;SAC1C;QACD,YAAY,EAAE;YACZ,OAAO;YACP,QAAQ;SACT;KACF,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IAE7B,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC;QACvD,QAAQ;QACR,OAAO;KACR,CAAC;AACJ,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,gBAAwD,EACxD,YAAkC;IAElC,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,gBAAgB,EAAE,YAAY,CAG3F,CAAC;IACF,MAAM,OAAO,GAAG,qBAAqB,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7F,MAAM,eAAe,GAAG,qBAAqB,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACjG,MAAM,IAAI,GAAG,qCAAqC,CAAC,OAAO,EAAE;QAC1D,GAAG,OAAO;QACV,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAClF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC;QACvD,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,QAAQ;QACvC,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAyB;IACxD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,OAAO,GAA4C,EAAE,CAAC;IAC5D,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAEnE,OAAO,CAAC,IAAI,CAAC;YACX,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,UAAU,IAAI,EAAE;SACzB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/runtime/index.d.ts

@@ -12,8 +12,8 @@ export { createIdentity, deriveChildIdentity, restoreIdentity, type CreateIdenti
 export { createChildIdentity, type CreateChildIdentityOptions, } from "./child-identity.js";
 export { readVaultProfile, writeVaultProfile, readVaultPublicMetadata, type VaultProfile, } from "./vault-metadata.js";
 export { createWorkspaceStorage, getDefaultWorkspaceDir, } from "./workspace-storage.js";
-export { ensureIdentityPrivateVault, readIdentityPrivateVaultProfile, readIdentityPrivateVaultChildrenState, readIdentityMetadata, listIdentities, identityPrivateVaultPrefix, identityPrivateVaultProfileKey, identityPrivateVaultChildrenKey, type IdentityPrivateVaultProfile, type IdentityPrivateVaultChildRecord, type IdentityPrivateVaultChildrenState, type IdentityPublicProfile, } from "./private-vault.js";
-export { createVault, recoverVault, listVaults, type CreateVaultOptions, type CreatedVault, type RecoverVaultOptions, type RecoveredVault, type VaultObject, type VaultPublicMetadata, } from "./bootstrap.js";
+export { ensureIdentityPrivateVault, readIdentityPrivateVaultProfile, readIdentityPrivateVaultChildrenState, readIdentityMetadata, listIdentities, identityPrivateVaultPrefix, identityPrivateVaultProfileKey, identityPrivateVaultChildrenKey, type IdentityPrivateVaultProfile, type IdentityPrivateVaultChildRecord, type IdentityPrivateVaultChildrenState, } from "./private-vault.js";
+export { createVault, recoverVault, listVaults, type CreateVaultOptions, type CreatedVault, type RecoverVaultOptions, type RecoveredVault, type VaultObject, type VaultMetadata as VaultPublicMetadata, } from "./bootstrap.js";
 export { createVaultCore, DefaultVaultCore, VaultCoreError, createDefaultVaultCoreDependencies, type CreateDefaultVaultCoreDependenciesOptions, type DefaultPolicyEngineOptions, DefaultPolicyEngine, createPersistentVaultCoreDependencies, initializeVaultCustody, recoverVaultWorkingKey, DEFAULT_VAULT_KEY_CUSTODY_BLOB_KEY, type InitializeVaultCustodyOptions, type InitializedVaultCustody, type CreatePersistentVaultCoreDependenciesOptions, PersistentVaultAgentIdentityRegistry, PersistentVaultAuditLog, PersistentVaultOwnerIdentityRegistry, PersistentVaultCapabilityRegistry, PersistentVaultCapabilityRevocationRegistry, PersistentVaultCustomHttpFlowRegistry, PersistentVaultRateLimitStore, PersistentVaultReplayGuard, PersistentVaultSecretCustody, PersistentVaultSecretRepository, HttpDispatchExecutor, InMemoryAgentIdentityRegistry, InMemoryCapabilityRegistry, InMemoryCapabilityRevocationRegistry, InMemoryCustomHttpFlowRegistry, InMemoryRateLimitStore, InMemoryReplayGuard, InMemoryAuditLog, InMemoryOwnerIdentityRegistry, InMemorySecretCustody, InMemorySecretRepository, RandomIdGenerator, SignatureOwnerProofVerifier, type SignatureAgentProofVerifierOptions, SignatureAgentProofVerifier, SystemClock, type AgentCapability, type AgentIdentityRecord, type AgentProof, type OwnerAuditRequest, type OwnerExportSecretRequest, type OwnerDefineSecretTargetsCommand, type OwnerRegisterCapabilityCommand, type OwnerRegisterAgentIdentityCommand, type OwnerRegisterCustomHttpFlowCommand, type OwnerSecretExport, type OwnerIdentityRecord, type CustomHttpFlowDefinition, type OwnerProof, type AuditEntry, type AuditLog, type AuditQuery, type Clock, type DispatchAuthorization, type DispatchInstruction, type DispatchRequest, type DispatchResult, type IdGenerator, type OwnerIdentityRegistry, type OwnerProofVerifier, type PolicyEngine, type RateLimitStore, type ReplayGuard, type CustomHttpFlowRegistry, type SecretAlias, type SecretCustody, type SecretId, type SecretRecord, type SecretRepository, type SecretVersion, type TrustedExecutor, type VaultCore, type VaultCoreDependencies, type VaultPrincipal, type VaultPrincipalKind, type VaultTargetBinding, type VaultWriteSecretCommand, type VaultId, type AgentIdentityRegistry, type AgentProofVerifier, type CapabilityRevocationRegistry, type CapabilityRegistry, } from "../vault-core/index.js";
 export { createVaultClient, type VaultClient, type CreateVaultClientOptions, type VaultIdentity, type VaultSigner, type VaultAuditQueryInput, type OwnerDefineSecretTargetsInput, type VaultExportSecretInput, type VaultGrantCapabilityInput, type VaultRegisterFlowInput, type VaultRegisterAgentInput, type OwnerSecretTargetBinding, type OwnerStoreSecretInput, type OwnerWriteSecretInput, } from "../clients/owner/index.js";
 export { createAgentClient, type AgentClient, type CreateAgentClientOptions, type AgentIdentity, type AgentCapabilityEnvelope, type AgentDispatchIntent, type AgentDispatchTransport, type AgentSigner, } from "../clients/agent/index.js";

package/dist/runtime/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,GAKhB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,mBAAmB,GAEpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,qCAAqC,EACrC,oBAAoB,EACpB,cAAc,EACd,0BAA0B,EAC1B,8BAA8B,EAC9B,+BAA+B,GAKhC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,WAAW,EACX,YAAY,EACZ,UAAU,GAOX,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,kCAAkC,EAGlC,mBAAmB,EACnB,qCAAqC,EACrC,sBAAsB,EACtB,sBAAsB,EACtB,kCAAkC,EAIlC,oCAAoC,EACpC,uBAAuB,EACvB,oCAAoC,EACpC,iCAAiC,EACjC,2CAA2C,EAC3C,qCAAqC,EACrC,6BAA6B,EAC7B,0BAA0B,EAC1B,4BAA4B,EAC5B,+BAA+B,EAC/B,oBAAoB,EACpB,6BAA6B,EAC7B,0BAA0B,EAC1B,oCAAoC,EACpC,8BAA8B,EAC9B,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,EAChB,6BAA6B,EAC7B,qBAAqB,EACrB,wBAAwB,EACxB,iBAAiB,EACjB,2BAA2B,EAE3B,2BAA2B,EAC3B,WAAW,GA+CZ,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,iBAAiB,GAclB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,iBAAiB,GAQlB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,kBAAkB,EAClB,2BAA2B,EAC3B,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC9B,uBAAuB,GAWxB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,GAKhB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,mBAAmB,GAEpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,qCAAqC,EACrC,oBAAoB,EACpB,cAAc,EACd,0BAA0B,EAC1B,8BAA8B,EAC9B,+BAA+B,GAIhC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,WAAW,EACX,YAAY,EACZ,UAAU,GAOX,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,kCAAkC,EAGlC,mBAAmB,EACnB,qCAAqC,EACrC,sBAAsB,EACtB,sBAAsB,EACtB,kCAAkC,EAIlC,oCAAoC,EACpC,uBAAuB,EACvB,oCAAoC,EACpC,iCAAiC,EACjC,2CAA2C,EAC3C,qCAAqC,EACrC,6BAA6B,EAC7B,0BAA0B,EAC1B,4BAA4B,EAC5B,+BAA+B,EAC/B,oBAAoB,EACpB,6BAA6B,EAC7B,0BAA0B,EAC1B,oCAAoC,EACpC,8BAA8B,EAC9B,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,EAChB,6BAA6B,EAC7B,qBAAqB,EACrB,wBAAwB,EACxB,iBAAiB,EACjB,2BAA2B,EAE3B,2BAA2B,EAC3B,WAAW,GA+CZ,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,iBAAiB,GAclB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,iBAAiB,GAQlB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,kBAAkB,EAClB,2BAA2B,EAC3B,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC9B,uBAAuB,GAWxB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/runtime/private-vault.d.ts

@@ -3,6 +3,7 @@ import { type CreatedIdentity } from "./identity.js";
 export interface IdentityPrivateVaultProfile {
     identityId: string;
     publicKey: string;
+    nickname?: string;
     parentIdentityId?: string;
     childIndex?: number;
 }
@@ -17,29 +18,28 @@ export interface IdentityPrivateVaultChildrenState {
     nextChildIndex: number;
     children: IdentityPrivateVaultChildRecord[];
 }
-export interface IdentityPublicProfile {
-    identityId: string;
-    publicKey: string;
-    nickname?: string;
-    parentIdentityId?: string;
-}
 type IdentityPrivateVaultAccess = CreatedIdentity | string;
 export declare function identityPrivateVaultPrefix(identityId: string): string;
 export declare function identityPrivateVaultProfileKey(identityId: string): string;
+export declare function identityPrivateVaultPublicSealedKey(identityId: string): string;
 export declare function identityPrivateVaultChildrenKey(identityId: string): string;
-export declare function identityPrivateVaultPublicProfileKey(identityId: string): string;
+/**
+ * Derives a key that is publicly available to anyone who knows the identityId.
+ */
+export declare function deriveIdentityPrivateVaultPublicWorkingKey(identityId: string): string;
 export declare function ensureIdentityPrivateVault(storage: IStorageProvider, identity: CreatedIdentity): Promise<void>;
 export declare function readIdentityPrivateVaultProfile(storage: IStorageProvider, identityOrPrivateKey: IdentityPrivateVaultAccess): Promise<IdentityPrivateVaultProfile | null>;
 /**
- * Unified metadata reader for identities.
- * Handles both open discovery (identityId only) and authorized read (privateKey).
+ * Metadata reader for identities.
+ * Discovery info (nickname) can be read with just identityId.
+ * Full profile requires privateKey.
  */
-export declare function readIdentityMetadata(storage: IStorageProvider, identityId: string, privateKey?: string): Promise<IdentityPrivateVaultProfile | IdentityPublicProfile | null>;
+export declare function readIdentityMetadata(storage: IStorageProvider, identityId: string, privateKey?: string): Promise<IdentityPrivateVaultProfile | any | null>;
 export declare function readIdentityPrivateVaultChildrenState(storage: IStorageProvider, identityOrPrivateKey: IdentityPrivateVaultAccess): Promise<IdentityPrivateVaultChildrenState>;
 export declare function writeIdentityPrivateVaultChildrenState(storage: IStorageProvider, identityOrPrivateKey: IdentityPrivateVaultAccess, state: IdentityPrivateVaultChildrenState): Promise<void>;
 export declare function withIdentityPrivateVaultLock<T>(storage: IStorageProvider, identityOrPrivateKey: IdentityPrivateVaultAccess, task: () => Promise<T>): Promise<T>;
 /**
- * Lists all identities in the workspace with their public discovery metadata.
+ * Lists all identities in the workspace with their discovery metadata.
  */
-export declare function listIdentities(storage: IStorageProvider): Promise<IdentityPublicProfile[]>;
+export declare function listIdentities(storage: IStorageProvider): Promise<any[]>;
 export {};

package/dist/runtime/private-vault.js

@@ -1,7 +1,6 @@
 import { createHash } from "node:crypto";
 import { SealedJsonRepository } from "../sealed/index.js";
 import { restoreIdentity } from "./identity.js";
-import { writeVerifiableMetadata, readVerifiableMetadata } from "./verifiable-metadata.js";
 const PRIVATE_VAULT_PREFIX = "identities";
 const PRIVATE_VAULT_LOCK_SUFFIX = ".lock";
 export function identityPrivateVaultPrefix(identityId) {
@@ -10,12 +9,12 @@ export function identityPrivateVaultPrefix(identityId) {
 export function identityPrivateVaultProfileKey(identityId) {
     return `${identityPrivateVaultPrefix(identityId)}/sealed/profile.sealed`;
 }
+export function identityPrivateVaultPublicSealedKey(identityId) {
+    return `${identityPrivateVaultPrefix(identityId)}/sealed/public.sealed`;
+}
 export function identityPrivateVaultChildrenKey(identityId) {
     return `${identityPrivateVaultPrefix(identityId)}/sealed/children.sealed`;
 }
-export function identityPrivateVaultPublicProfileKey(identityId) {
-    return `${identityPrivateVaultPrefix(identityId)}/public/profile.json`;
-}
 function lockKey(identityId) {
     return `${identityPrivateVaultPrefix(identityId)}/sealed/locks/vault${PRIVATE_VAULT_LOCK_SUFFIX}`;
 }
@@ -34,30 +33,38 @@ function deriveIdentityPrivateVaultKey(identity) {
         .update(identity.privateKey)
         .digest("base64url");
 }
+/**
+ * Derives a key that is publicly available to anyone who knows the identityId.
+ */
+export function deriveIdentityPrivateVaultPublicWorkingKey(identityId) {
+    return createHash("sha256")
+        .update("cbio:identity-public-metadata:v1")
+        .update("\n")
+        .update(identityId)
+        .digest("base64url");
+}
 export async function ensureIdentityPrivateVault(storage, identity) {
     const profileKey = identityPrivateVaultProfileKey(identity.identityId);
     const profileRepo = new SealedJsonRepository(storage, profileKey, deriveIdentityPrivateVaultKey(identity));
     const existingProfile = await profileRepo.read(null);
-    // Read current public profile to preserve nickname if needed
-    const publicPath = identityPrivateVaultPublicProfileKey(identity.identityId);
-    const publicRaw = await storage.read(publicPath);
-    const existingPublic = publicRaw ? JSON.parse(publicRaw.toString()) : null;
     const profile = {
         identityId: identity.identityId,
         publicKey: identity.publicKey,
+        nickname: identity.nickname || existingProfile?.nickname,
         parentIdentityId: identity.parentIdentityId || existingProfile?.parentIdentityId,
         childIndex: identity.childIndex ?? existingProfile?.childIndex,
     };
-    // Profile data in sealed area (excluding nickname)
+    // 1. Write Private Sealed Profile
     await profileRepo.write(profile, "identity_private_vault_profile");
-    // Write Signed Public Profile for Discovery
-    const publicProfile = {
+    // 2. Write Public Sealed Metadata for Discovery (Encrypted for integrity, but publicly readable)
+    const publicSealedKey = identityPrivateVaultPublicSealedKey(identity.identityId);
+    const publicRepo = new SealedJsonRepository(storage, publicSealedKey, deriveIdentityPrivateVaultPublicWorkingKey(identity.identityId));
+    await publicRepo.write({
         identityId: profile.identityId,
         publicKey: profile.publicKey,
-        nickname: identity.nickname || existingPublic?.payload.nickname,
+        nickname: profile.nickname,
         parentIdentityId: profile.parentIdentityId,
-    };
-    await writeVerifiableMetadata(storage, publicPath, publicProfile, identity.privateKey);
+    }, "identity_public_metadata");
     const childrenKey = identityPrivateVaultChildrenKey(identity.identityId);
     if (!(await storage.has(childrenKey))) {
         const emptyState = {
@@ -74,13 +81,14 @@ export async function readIdentityPrivateVaultProfile(storage, identityOrPrivate
     return repo.read(null);
 }
 /**
- * Unified metadata reader for identities.
- * Handles both open discovery (identityId only) and authorized read (privateKey).
+ * Metadata reader for identities.
+ * Discovery info (nickname) can be read with just identityId.
+ * Full profile requires privateKey.
  */
 export async function readIdentityMetadata(storage, identityId, privateKey) {
-    const publicPath = identityPrivateVaultPublicProfileKey(identityId);
-    const publicProfile = await readVerifiableMetadata(storage, publicPath).catch(() => null);
-    // If private key is provided, try to read and merge the full sealed profile
+    const publicSealedKey = identityPrivateVaultPublicSealedKey(identityId);
+    const publicRepo = new SealedJsonRepository(storage, publicSealedKey, deriveIdentityPrivateVaultPublicWorkingKey(identityId));
+    const publicMetadata = await publicRepo.read(null).catch(() => null);
     if (privateKey) {
         try {
             const identity = restoreIdentity(privateKey);
@@ -88,19 +96,16 @@ export async function readIdentityMetadata(storage, identityId, privateKey) {
                 throw new Error("identityId mismatch");
             }
             const sealed = await readIdentityPrivateVaultProfile(storage, identity);
-            if (sealed) {
-                return {
-                    ...publicProfile, // Spread public profile (contains nickname)
-                    ...sealed, // Spread sealed profile (contains keys/metadata)
-                };
-            }
+            return {
+                ...(publicMetadata || {}),
+                ...(sealed || {}),
+            };
         }
         catch (e) {
-            // Fallback to public if decryption fails
             console.warn(`[IdentityMetadata] Decryption failed for ${identityId}:`, e);
         }
     }
-    return publicProfile;
+    return publicMetadata;
 }
 export async function readIdentityPrivateVaultChildrenState(storage, identityOrPrivateKey) {
     const identity = normalizeIdentityAccess(identityOrPrivateKey);
@@ -124,7 +129,7 @@ export async function withIdentityPrivateVaultLock(storage, identityOrPrivateKey
     return task();
 }
 /**
- * Lists all identities in the workspace with their public discovery metadata.
+ * Lists all identities in the workspace with their discovery metadata.
  */
 export async function listIdentities(storage) {
     if (!storage.list) {
@@ -133,7 +138,6 @@ export async function listIdentities(storage) {
     const ids = await storage.list(PRIVATE_VAULT_PREFIX);
     const results = [];
     for (const id of ids) {
-        // Skip non-identity directories or lock files if any
         if (id.endsWith(PRIVATE_VAULT_LOCK_SUFFIX))
             continue;
         const profile = await readIdentityMetadata(storage, id);

package/dist/runtime/private-vault.js.map

@@ -1 +1 @@
-{"version":3,"file":"private-vault.js","sourceRoot":"","sources":["../../src/runtime/private-vault.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAwB,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAA2B,MAAM,0BAA0B,CAAC;AAEpH,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAC1C,MAAM,yBAAyB,GAAG,OAAO,CAAC;AA+B1C,MAAM,UAAU,0BAA0B,CAAC,UAAkB;IAC3D,OAAO,GAAG,oBAAoB,IAAI,UAAU,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,UAAkB;IAC/D,OAAO,GAAG,0BAA0B,CAAC,UAAU,CAAC,wBAAwB,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,UAAkB;IAChE,OAAO,GAAG,0BAA0B,CAAC,UAAU,CAAC,yBAAyB,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,UAAkB;IACrE,OAAO,GAAG,0BAA0B,CAAC,UAAU,CAAC,sBAAsB,CAAC;AACzE,CAAC;AAED,SAAS,OAAO,CAAC,UAAkB;IACjC,OAAO,GAAG,0BAA0B,CAAC,UAAU,CAAC,sBAAsB,yBAAyB,EAAE,CAAC;AACpG,CAAC;AAED,SAAS,uBAAuB,CAAC,oBAAgD;IAC/E,IAAI,OAAO,oBAAoB,KAAK,QAAQ,EAAE,CAAC;QAC7C,OAAO,eAAe,CAAC,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED,SAAS,6BAA6B,CAAC,QAAyB;IAC9D,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,gCAAgC,CAAC;SACxC,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;SAC3B,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;SAC3B,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAAyB,EACzB,QAAyB;IAEzB,MAAM,UAAU,GAAG,8BAA8B,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,IAAI,oBAAoB,CAC1C,OAAO,EACP,UAAU,EACV,6BAA6B,CAAC,QAAQ,CAAC,CACxC,CAAC;IAEF,MAAM,eAAe,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,IAAW,CAAC,CAAC;IAE5D,6DAA6D;IAC7D,MAAM,UAAU,GAAG,oCAAoC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,SAAS,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,CAA+C,CAAC,CAAC,CAAC,IAAI,CAAC;IAE1H,MAAM,OAAO,GAAgC;QAC3C,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,IAAI,eAAe,EAAE,gBAAgB;QAChF,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,eAAe,EAAE,UAAU;KAC/D,CAAC;IAEF,mDAAmD;IACnD,MAAM,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,gCAAgC,CAAC,CAAC;IAEnE,4CAA4C;IAC5C,MAAM,aAAa,GAA0B;QAC3C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,cAAc,EAAE,OAAO,CAAC,QAAQ;QAC/D,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;KAC3C,CAAC;IACF,MAAM,uBAAuB,CAC3B,OAAO,EACP,UAAU,EACV,aAAa,EACb,QAAQ,CAAC,UAAU,CACpB,CAAC;IAEF,MAAM,WAAW,GAAG,+BAA+B,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACtC,MAAM,UAAU,GAAsC;YACpD,cAAc,EAAE,CAAC;YACjB,QAAQ,EAAE,EAAE;SACb,CAAC;QACF,MAAM,YAAY,GAAG,IAAI,oBAAoB,CAC3C,OAAO,EACP,WAAW,EACX,6BAA6B,CAAC,QAAQ,CAAC,CACxC,CAAC;QACF,MAAM,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,iCAAiC,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,OAAyB,EACzB,oBAAgD;IAEhD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,oBAAoB,CACnC,OAAO,EACP,8BAA8B,CAAC,QAAQ,CAAC,UAAU,CAAC,EACnD,6BAA6B,CAAC,QAAQ,CAAC,CACxC,CAAC;IACF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAW,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAyB,EACzB,UAAkB,EAClB,UAAmB;IAEnB,MAAM,UAAU,GAAG,oCAAoC,CAAC,UAAU,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAChD,OAAO,EACP,UAAU,CACX,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAEpB,4EAA4E;IAC5E,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;YAC7C,IAAI,QAAQ,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACzC,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACxE,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO;oBACL,GAAG,aAAa,EAAE,4CAA4C;oBAC9D,GAAG,MAAM,EAAS,iDAAiD;iBAC7D,CAAC;YACX,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,yCAAyC;YACzC,OAAO,CAAC,IAAI,CAAC,4CAA4C,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,OAAyB,EACzB,oBAAgD;IAEhD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,oBAAoB,CACnC,OAAO,EACP,+BAA+B,CAAC,QAAQ,CAAC,UAAU,CAAC,EACpD,6BAA6B,CAAC,QAAQ,CAAC,CACxC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IACpE,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC/D,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;KAChC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,OAAyB,EACzB,oBAAgD,EAChD,KAAwC;IAExC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,oBAAoB,CACnC,OAAO,EACP,+BAA+B,CAAC,QAAQ,CAAC,UAAU,CAAC,EACpD,6BAA6B,CAAC,QAAQ,CAAC,CACxC,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAyB,EACzB,oBAAgD,EAChD,IAAsB;IAEtB,MAAM,QAAQ,GAAG,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAyB;IAC5D,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACrD,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,qDAAqD;QACrD,IAAI,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;YAAE,SAAS;QAErD,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,OAAgC,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"private-vault.js","sourceRoot":"","sources":["../../src/runtime/private-vault.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAwB,MAAM,eAAe,CAAC;AAEtE,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAC1C,MAAM,yBAAyB,GAAG,OAAO,CAAC;AA0B1C,MAAM,UAAU,0BAA0B,CAAC,UAAkB;IAC3D,OAAO,GAAG,oBAAoB,IAAI,UAAU,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,UAAkB;IAC/D,OAAO,GAAG,0BAA0B,CAAC,UAAU,CAAC,wBAAwB,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,UAAkB;IACpE,OAAO,GAAG,0BAA0B,CAAC,UAAU,CAAC,uBAAuB,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,UAAkB;IAChE,OAAO,GAAG,0BAA0B,CAAC,UAAU,CAAC,yBAAyB,CAAC;AAC5E,CAAC;AAED,SAAS,OAAO,CAAC,UAAkB;IACjC,OAAO,GAAG,0BAA0B,CAAC,UAAU,CAAC,sBAAsB,yBAAyB,EAAE,CAAC;AACpG,CAAC;AAED,SAAS,uBAAuB,CAAC,oBAAgD;IAC/E,IAAI,OAAO,oBAAoB,KAAK,QAAQ,EAAE,CAAC;QAC7C,OAAO,eAAe,CAAC,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED,SAAS,6BAA6B,CAAC,QAAyB;IAC9D,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,gCAAgC,CAAC;SACxC,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;SAC3B,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;SAC3B,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0CAA0C,CAAC,UAAkB;IAC3E,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,kCAAkC,CAAC;SAC1C,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAAyB,EACzB,QAAyB;IAEzB,MAAM,UAAU,GAAG,8BAA8B,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,IAAI,oBAAoB,CAC1C,OAAO,EACP,UAAU,EACV,6BAA6B,CAAC,QAAQ,CAAC,CACxC,CAAC;IAEF,MAAM,eAAe,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,IAAW,CAAC,CAAC;IAE5D,MAAM,OAAO,GAAgC;QAC3C,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,eAAe,EAAE,QAAQ;QACxD,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,IAAI,eAAe,EAAE,gBAAgB;QAChF,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,eAAe,EAAE,UAAU;KAC/D,CAAC;IAEF,kCAAkC;IAClC,MAAM,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,gCAAgC,CAAC,CAAC;IAEnE,iGAAiG;IACjG,MAAM,eAAe,GAAG,mCAAmC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,IAAI,oBAAoB,CACzC,OAAO,EACP,eAAe,EACf,0CAA0C,CAAC,QAAQ,CAAC,UAAU,CAAC,CAChE,CAAC;IACF,MAAM,UAAU,CAAC,KAAK,CAAC;QACrB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;KAC3C,EAAE,0BAA0B,CAAC,CAAC;IAE/B,MAAM,WAAW,GAAG,+BAA+B,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACtC,MAAM,UAAU,GAAsC;YACpD,cAAc,EAAE,CAAC;YACjB,QAAQ,EAAE,EAAE;SACb,CAAC;QACF,MAAM,YAAY,GAAG,IAAI,oBAAoB,CAC3C,OAAO,EACP,WAAW,EACX,6BAA6B,CAAC,QAAQ,CAAC,CACxC,CAAC;QACF,MAAM,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,iCAAiC,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,OAAyB,EACzB,oBAAgD;IAEhD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,oBAAoB,CACnC,OAAO,EACP,8BAA8B,CAAC,QAAQ,CAAC,UAAU,CAAC,EACnD,6BAA6B,CAAC,QAAQ,CAAC,CACxC,CAAC;IACF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAW,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAyB,EACzB,UAAkB,EAClB,UAAmB;IAEnB,MAAM,eAAe,GAAG,mCAAmC,CAAC,UAAU,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,IAAI,oBAAoB,CACzC,OAAO,EACP,eAAe,EACf,0CAA0C,CAAC,UAAU,CAAC,CACvD,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAE5E,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;YAC7C,IAAI,QAAQ,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACzC,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACxE,OAAO;gBACL,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;gBACzB,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;aAClB,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,4CAA4C,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,OAAyB,EACzB,oBAAgD;IAEhD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,oBAAoB,CACnC,OAAO,EACP,+BAA+B,CAAC,QAAQ,CAAC,UAAU,CAAC,EACpD,6BAA6B,CAAC,QAAQ,CAAC,CACxC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IACpE,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC/D,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;KAChC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,OAAyB,EACzB,oBAAgD,EAChD,KAAwC;IAExC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,oBAAoB,CACnC,OAAO,EACP,+BAA+B,CAAC,QAAQ,CAAC,UAAU,CAAC,EACpD,6BAA6B,CAAC,QAAQ,CAAC,CACxC,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAyB,EACzB,oBAAgD,EAChD,IAAsB;IAEtB,MAAM,QAAQ,GAAG,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAyB;IAC5D,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACrD,MAAM,OAAO,GAAU,EAAE,CAAC;IAC1B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,IAAI,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;YAAE,SAAS;QAErD,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/runtime/vault-metadata.d.ts

@@ -1,14 +1,18 @@
 import type { IStorageProvider } from "../storage/provider.js";
 export interface VaultProfile {
-    sealed: Record<string, any>;
-    public: Record<string, any> & {
+    sealedPublic: Record<string, any> & {
         nickname?: string;
     };
+    sealedPrivate: Record<string, any>;
 }
-export declare const VAULT_PUBLIC_PROFILE_KEY = "vault/public/profile.json";
 /**
- * Reads only the public (plaintext) metadata of a vault. No key required.
+ * Derives a key that is publicly available to anyone who knows the vaultId.
+ * Used to encrypt 'public' metadata to prevent JSON tampering on disk.
  */
-export declare function readVaultPublicMetadata(storage: IStorageProvider): Promise<Record<string, any>>;
-export declare function writeVaultProfile(storage: IStorageProvider, profile: VaultProfile, vaultWorkingKey: string): Promise<void>;
-export declare function readVaultProfile(storage: IStorageProvider, vaultWorkingKey: string): Promise<VaultProfile | null>;
+export declare function deriveVaultPublicWorkingKey(vaultId: string): string;
+/**
+ * Reads the 'public' metadata of a vault. Requires vaultId but no private key.
+ */
+export declare function readVaultPublicMetadata(storage: IStorageProvider, vaultId: string): Promise<Record<string, any>>;
+export declare function writeVaultProfile(storage: IStorageProvider, profile: VaultProfile, vaultWorkingKey: string, vaultId: string): Promise<void>;
+export declare function readVaultProfile(storage: IStorageProvider, vaultWorkingKey: string, vaultId: string): Promise<VaultProfile | null>;

package/dist/runtime/vault-metadata.js

@@ -1,31 +1,46 @@
+import { createHash } from "node:crypto";
 import { SealedJsonRepository } from "../sealed/index.js";
 const VAULT_SEALED_PROFILE_KEY = "vault/sealed/profile.sealed";
-export const VAULT_PUBLIC_PROFILE_KEY = "vault/public/profile.json";
-import { readVerifiableMetadata } from "./verifiable-metadata.js";
+const VAULT_PUBLIC_SEALED_PROFILE_KEY = "vault/sealed/public.sealed";
 /**
- * Reads only the public (plaintext) metadata of a vault. No key required.
+ * Derives a key that is publicly available to anyone who knows the vaultId.
+ * Used to encrypt 'public' metadata to prevent JSON tampering on disk.
  */
-export async function readVaultPublicMetadata(storage) {
-    const data = await readVerifiableMetadata(storage, VAULT_PUBLIC_PROFILE_KEY).catch(() => null);
+export function deriveVaultPublicWorkingKey(vaultId) {
+    return createHash("sha256")
+        .update("cbio:vault-public-metadata:v1")
+        .update("\n")
+        .update(vaultId)
+        .digest("base64url");
+}
+/**
+ * Reads the 'public' metadata of a vault. Requires vaultId but no private key.
+ */
+export async function readVaultPublicMetadata(storage, vaultId) {
+    const publicWorkingKey = deriveVaultPublicWorkingKey(vaultId);
+    const repo = new SealedJsonRepository(storage, VAULT_PUBLIC_SEALED_PROFILE_KEY, publicWorkingKey);
+    const data = await repo.read(null).catch(() => null);
     return data || {};
 }
-export async function writeVaultProfile(storage, profile, vaultWorkingKey) {
-    // 1. Write Sealed Profile
-    const repo = new SealedJsonRepository(storage, VAULT_SEALED_PROFILE_KEY, vaultWorkingKey);
-    await repo.write(profile.sealed, "vault_profile_sealed");
-    // NOTE: Public profile writing is handled separately via writeVerifiableMetadata
-    // by the component that holds the owner's private key (e.g., bootstrap.ts).
+export async function writeVaultProfile(storage, profile, vaultWorkingKey, vaultId) {
+    // 1. Write Private Sealed Profile
+    const privateRepo = new SealedJsonRepository(storage, VAULT_SEALED_PROFILE_KEY, vaultWorkingKey);
+    await privateRepo.write(profile.sealedPrivate, "vault_profile_private");
+    // 2. Write Public Sealed Profile (encrypted for format protection, but publicly-read via side-channel)
+    const publicWorkingKey = deriveVaultPublicWorkingKey(vaultId);
+    const publicRepo = new SealedJsonRepository(storage, VAULT_PUBLIC_SEALED_PROFILE_KEY, publicWorkingKey);
+    await publicRepo.write(profile.sealedPublic, "vault_profile_public");
 }
-export async function readVaultProfile(storage, vaultWorkingKey) {
-    const repo = new SealedJsonRepository(storage, VAULT_SEALED_PROFILE_KEY, vaultWorkingKey);
-    const sealed = await repo.read(null);
-    if (!sealed) {
+export async function readVaultProfile(storage, vaultWorkingKey, vaultId) {
+    const privateRepo = new SealedJsonRepository(storage, VAULT_SEALED_PROFILE_KEY, vaultWorkingKey);
+    const sealedPrivate = await privateRepo.read(null);
+    if (!sealedPrivate) {
         return null;
     }
-    const publicData = await readVaultPublicMetadata(storage);
+    const sealedPublic = await readVaultPublicMetadata(storage, vaultId);
     return {
-        sealed,
-        public: publicData,
+        sealedPublic,
+        sealedPrivate,
     };
 }
 //# sourceMappingURL=vault-metadata.js.map

package/dist/runtime/vault-metadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"vault-metadata.js","sourceRoot":"","sources":["../../src/runtime/vault-metadata.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAO1D,MAAM,wBAAwB,GAAG,6BAA6B,CAAC;AAC/D,MAAM,CAAC,MAAM,wBAAwB,GAAG,2BAA2B,CAAC;AAEpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAyB;IAEzB,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAsB,OAAO,EAAE,wBAAwB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACpH,OAAO,IAAI,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAyB,EACzB,OAAqB,EACrB,eAAuB;IAEvB,0BAA0B;IAC1B,MAAM,IAAI,GAAG,IAAI,oBAAoB,CAAsB,OAAO,EAAE,wBAAwB,EAAE,eAAe,CAAC,CAAC;IAC/G,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAEzD,iFAAiF;IACjF,4EAA4E;AAC9E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAyB,EACzB,eAAuB;IAEvB,MAAM,IAAI,GAAG,IAAI,oBAAoB,CAAsB,OAAO,EAAE,wBAAwB,EAAE,eAAe,CAAC,CAAC;IAC/G,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAW,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAE1D,OAAO;QACL,MAAM;QACN,MAAM,EAAE,UAAU;KACnB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"vault-metadata.js","sourceRoot":"","sources":["../../src/runtime/vault-metadata.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAO1D,MAAM,wBAAwB,GAAG,6BAA6B,CAAC;AAC/D,MAAM,+BAA+B,GAAG,4BAA4B,CAAC;AAErE;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAAe;IACzD,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,+BAA+B,CAAC;SACvC,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,OAAO,CAAC;SACf,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAyB,EACzB,OAAe;IAEf,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAI,oBAAoB,CAAsB,OAAO,EAAE,+BAA+B,EAAE,gBAAgB,CAAC,CAAC;IACvH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC5D,OAAO,IAAI,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAyB,EACzB,OAAqB,EACrB,eAAuB,EACvB,OAAe;IAEf,kCAAkC;IAClC,MAAM,WAAW,GAAG,IAAI,oBAAoB,CAAsB,OAAO,EAAE,wBAAwB,EAAE,eAAe,CAAC,CAAC;IACtH,MAAM,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAC;IAExE,uGAAuG;IACvG,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,IAAI,oBAAoB,CAAsB,OAAO,EAAE,+BAA+B,EAAE,gBAAgB,CAAC,CAAC;IAC7H,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAyB,EACzB,eAAuB,EACvB,OAAe;IAEf,MAAM,WAAW,GAAG,IAAI,oBAAoB,CAAsB,OAAO,EAAE,wBAAwB,EAAE,eAAe,CAAC,CAAC;IACtH,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,IAAW,CAAC,CAAC;IAC1D,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAErE,OAAO;QACL,YAAY;QACZ,aAAa;KACd,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@the-ai-company/cbio-node-runtime",
-  "version": "1.34.0",
+  "version": "1.36.0",
   "description": "Node.js runtime for cbio identity and credential vault. Library only, no CLI or TUI.",
   "type": "module",
   "main": "./dist/runtime/index.js",

package/dist/runtime/verifiable-metadata.d.ts

@@ -1,18 +0,0 @@
-import type { IStorageProvider } from "../storage/provider.js";
-/**
- * A verifiable envelope for public metadata.
- * Proves that the data was signed by the rightful owner.
- */
-export interface VerifiableMetadata<T> {
-    payload: T;
-    signature: string;
-    signer: string;
-}
-/**
- * Signs and writes a payload to storage as a verifiable metadata envelope.
- */
-export declare function writeVerifiableMetadata<T>(storage: IStorageProvider, path: string, payload: T, privateKey: string): Promise<void>;
-/**
- * Reads and optionally verifies a verifiable metadata envelope from storage.
- */
-export declare function readVerifiableMetadata<T>(storage: IStorageProvider, path: string, expectedSigner?: string): Promise<T | null>;

package/dist/runtime/verifiable-metadata.js

@@ -1,72 +0,0 @@
-import { signPayload, verifySignature, derivePublicKey } from "../protocol/crypto.js";
-/**
- * Hardcoded field order for canonical JSON stringification.
- * This ensures that even if different environments parse/stringify,
- * the signature check string is always identical.
- */
-function canonicalStringify(obj) {
-    if (!obj || typeof obj !== "object" || Array.isArray(obj)) {
-        return JSON.stringify(obj);
-    }
-    const keys = Object.keys(obj).sort();
-    const parts = [];
-    for (const key of keys) {
-        const value = obj[key];
-        if (value === undefined)
-            continue;
-        // Recursive canonical for nested objects if any (mostly for publicMetadata)
-        parts.push(`${JSON.stringify(key)}:${canonicalStringify(value)}`);
-    }
-    return `{${parts.join(",")}}`;
-}
-/**
- * Signs and writes a payload to storage as a verifiable metadata envelope.
- */
-export async function writeVerifiableMetadata(storage, path, payload, privateKey) {
-    const payloadStr = canonicalStringify(payload);
-    const signature = await signPayload(privateKey, payloadStr);
-    const signer = derivePublicKey(privateKey);
-    // Self-verify check
-    const isCorrect = await verifySignature(signer, payloadStr, signature);
-    if (!isCorrect) {
-        throw new Error(`[VerifiableMetadata] SDK Integrity Failure: Generated signature is invalid for the payload. 
-Payload: ${payloadStr}
-Signer: ${signer}
-Signature: ${signature}`);
-    }
-    const envelope = {
-        payload,
-        signature,
-        signer,
-    };
-    await storage.write(path, Buffer.from(JSON.stringify(envelope, null, 2)));
-}
-/**
- * Reads and optionally verifies a verifiable metadata envelope from storage.
- */
-export async function readVerifiableMetadata(storage, path, expectedSigner) {
-    const raw = await storage.read(path);
-    if (!raw)
-        return null;
-    try {
-        const envelope = JSON.parse(raw.toString());
-        // If expectedSigner is provided, we MUST verify
-        if (expectedSigner && envelope.signer !== expectedSigner) {
-            return null; // Signer mismatch
-        }
-        const payloadStr = canonicalStringify(envelope.payload);
-        const isValid = await verifySignature(envelope.signer, payloadStr, envelope.signature);
-        if (!isValid) {
-            console.warn(`[VerifiableMetadata] Invalid signature at ${path}`);
-            console.warn(`[VerifiableMetadata] Signer: ${envelope.signer}`);
-            console.warn(`[VerifiableMetadata] Payload String: ${payloadStr}`);
-            console.warn(`[VerifiableMetadata] Signature: ${envelope.signature}`);
-            return null;
-        }
-        return envelope.payload;
-    }
-    catch (e) {
-        return null;
-    }
-}
-//# sourceMappingURL=verifiable-metadata.js.map

package/dist/runtime/verifiable-metadata.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"verifiable-metadata.js","sourceRoot":"","sources":["../../src/runtime/verifiable-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAatF;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,GAAQ;IAClC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAElC,4EAA4E;QAC5E,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAyB,EACzB,IAAY,EACZ,OAAU,EACV,UAAkB;IAElB,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAE3C,oBAAoB;IACpB,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IACvE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC;WACT,UAAU;UACX,MAAM;aACH,SAAS,EAAE,CAAC,CAAC;IACxB,CAAC;IAED,MAAM,QAAQ,GAA0B;QACtC,OAAO;QACP,SAAS;QACT,MAAM;KACP,CAAC;IAEF,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAyB,EACzB,IAAY,EACZ,cAAuB;IAEvB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAA0B,CAAC;QAErE,gDAAgD;QAChD,IAAI,cAAc,IAAI,QAAQ,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC,CAAC,kBAAkB;QACjC,CAAC;QAED,MAAM,UAAU,GAAG,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QAEvF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,6CAA6C,IAAI,EAAE,CAAC,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,gCAAgC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,wCAAwC,UAAU,EAAE,CAAC,CAAC;YACnE,OAAO,CAAC,IAAI,CAAC,mCAAmC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACtE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,QAAQ,CAAC,OAAO,CAAC;IAC1B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}