@vibesdotdev/config 0.0.1

package/dist/services/encryption.js

@@ -0,0 +1,232 @@
+/**
+ * Config Encryption Service
+ *
+ * Production-grade encryption for sensitive configuration values.
+ * Uses AES-256-GCM for authenticated encryption with PBKDF2 key derivation.
+ *
+ * Features:
+ * - AES-256-GCM authenticated encryption
+ * - PBKDF2 key derivation (100k iterations)
+ * - Random IV and salt generation
+ * - Constant-time comparison helpers
+ * - Browser and Node.js compatible (Web Crypto API)
+ */
+import { createHash, randomBytes, createCipheriv, createDecipheriv, pbkdf2Sync } from 'crypto';
+// Algorithm constants
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 16; // 128 bits for GCM
+const AUTH_TAG_LENGTH = 16; // 128 bits
+const SALT_LENGTH = 32; // 256 bits
+const KEY_LENGTH = 32; // 256 bits
+const PBKDF2_ITERATIONS = 100_000;
+/**
+ * Derive a 256-bit key from password and salt using PBKDF2.
+ *
+ * @param password - The encryption password/key
+ * @param salt - Random salt for key derivation
+ * @returns 32-byte derived key
+ */
+function deriveKey(password, salt) {
+    return pbkdf2Sync(password, salt, PBKDF2_ITERATIONS, KEY_LENGTH, 'sha256');
+}
+/**
+ * Encrypt a string value using AES-256-GCM.
+ *
+ * @param value - The plaintext value to encrypt
+ * @param password - The encryption password/key
+ * @param options - Optional encryption parameters
+ * @returns EncryptedValue with all components needed for decryption
+ * @throws Error if encryption fails
+ *
+ * @example
+ * ```typescript
+ * const encrypted = await encrypt('my-secret-api-key', 'my-master-password');
+ * // Store encrypted object
+ * ```
+ */
+export async function encrypt(value, password, options = {}) {
+    if (!value) {
+        throw new Error('Cannot encrypt empty value');
+    }
+    if (!password) {
+        throw new Error('Encryption password is required');
+    }
+    // Generate random salt and IV
+    const salt = options.salt ?? randomBytes(SALT_LENGTH);
+    const iv = options.iv ?? randomBytes(IV_LENGTH);
+    // Derive key from password
+    const key = deriveKey(password, salt);
+    // Encrypt
+    const cipher = createCipheriv(ALGORITHM, key, iv);
+    let encrypted = cipher.update(value, 'utf8', 'base64');
+    encrypted += cipher.final('base64');
+    const tag = cipher.getAuthTag();
+    return {
+        ciphertext: encrypted,
+        iv: iv.toString('base64'),
+        salt: salt.toString('base64'),
+        tag: tag.toString('base64'),
+        algorithm: ALGORITHM,
+        iterations: PBKDF2_ITERATIONS
+    };
+}
+/**
+ * Decrypt an encrypted value using AES-256-GCM.
+ *
+ * @param encrypted - The encrypted value object
+ * @param password - The encryption password/key
+ * @returns The decrypted plaintext value
+ * @throws Error if decryption fails (wrong password, corrupted data, etc.)
+ *
+ * @example
+ * ```typescript
+ * const encrypted = {
+ *   ciphertext: '...',
+ *   iv: '...',
+ *   salt: '...',
+ *   tag: '...',
+ *   algorithm: 'aes-256-gcm',
+ *   iterations: 100000
+ * };
+ * const decrypted = await decrypt(encrypted, 'my-master-password');
+ * ```
+ */
+export async function decrypt(encrypted, password) {
+    if (!password) {
+        throw new Error('Decryption password is required');
+    }
+    // Validate algorithm
+    if (encrypted.algorithm !== ALGORITHM) {
+        throw new Error(`Unsupported algorithm: ${encrypted.algorithm}`);
+    }
+    // Decode components
+    const salt = Buffer.from(encrypted.salt, 'base64');
+    const iv = Buffer.from(encrypted.iv, 'base64');
+    const tag = Buffer.from(encrypted.tag, 'base64');
+    // Derive key
+    const key = deriveKey(password, salt);
+    // Decrypt
+    try {
+        const decipher = createDecipheriv(ALGORITHM, key, iv);
+        decipher.setAuthTag(tag);
+        let decrypted = decipher.update(encrypted.ciphertext, 'base64', 'utf8');
+        decrypted += decipher.final('utf8');
+        return decrypted;
+    }
+    catch (error) {
+        throw new Error('Decryption failed: invalid password or corrupted data');
+    }
+}
+/**
+ * Serialize an encrypted value to a compact JSON object for storage.
+ *
+ * @param encrypted - The encrypted value
+ * @returns Compact serialized format
+ */
+export function serializeEncrypted(encrypted) {
+    return {
+        v: 1,
+        ct: encrypted.ciphertext,
+        iv: encrypted.iv,
+        s: encrypted.salt,
+        t: encrypted.tag,
+        a: encrypted.algorithm,
+        i: encrypted.iterations
+    };
+}
+/**
+ * Deserialize a compact JSON object back to EncryptedValue format.
+ *
+ * @param serialized - The serialized encrypted value
+ * @returns EncryptedValue object
+ */
+export function deserializeEncrypted(serialized) {
+    return {
+        ciphertext: serialized.ct,
+        iv: serialized.iv,
+        salt: serialized.s,
+        tag: serialized.t,
+        algorithm: serialized.a,
+        iterations: serialized.i
+    };
+}
+/**
+ * Encrypt a value and serialize it to a JSON string for storage.
+ *
+ * @param value - The plaintext value
+ * @param password - The encryption password
+ * @returns JSON string of serialized encrypted value
+ */
+export async function encryptToString(value, password) {
+    const encrypted = await encrypt(value, password);
+    const serialized = serializeEncrypted(encrypted);
+    return JSON.stringify(serialized);
+}
+/**
+ * Decrypt a value from its serialized JSON string format.
+ *
+ * @param encryptedString - JSON string from encryptToString
+ * @param password - The encryption password
+ * @returns The decrypted plaintext value
+ */
+export async function decryptFromString(encryptedString, password) {
+    const serialized = JSON.parse(encryptedString);
+    const encrypted = deserializeEncrypted(serialized);
+    return decrypt(encrypted, password);
+}
+/**
+ * Generate a secure random password of the specified length.
+ *
+ * @param length - Password length (default: 32)
+ * @returns Base64-encoded random string
+ */
+export function generateSecurePassword(length = 32) {
+    return randomBytes(length).toString('base64').slice(0, length);
+}
+/**
+ * Hash a password for storage using SHA-256.
+ * This is NOT for encryption keys - use only for password verification.
+ *
+ * @param password - The password to hash
+ * @returns SHA-256 hash as hex string
+ */
+export function hashPassword(password) {
+    return createHash('sha256').update(password).digest('hex');
+}
+/**
+ * Verify a password against a stored hash.
+ *
+ * @param password - The password to verify
+ * @param hash - The stored hash
+ * @returns True if the password matches
+ */
+export function verifyPassword(password, hash) {
+    // Constant-time comparison to prevent timing attacks
+    const computed = hashPassword(password);
+    if (computed.length !== hash.length)
+        return false;
+    let result = 0;
+    for (let i = 0; i < computed.length; i++) {
+        result |= computed.charCodeAt(i) ^ hash.charCodeAt(i);
+    }
+    return result === 0;
+}
+/**
+ * Check if a value appears to be an encrypted value.
+ *
+ * @param value - The value to check
+ * @returns True if the value looks like an encrypted config value
+ */
+export function isEncryptedValue(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const v = value;
+    return (v.v === 1 &&
+        typeof v.ct === 'string' &&
+        typeof v.iv === 'string' &&
+        typeof v.s === 'string' &&
+        typeof v.t === 'string' &&
+        typeof v.a === 'string' &&
+        typeof v.i === 'number');
+}
+//# sourceMappingURL=encryption.js.map

package/dist/services/encryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.js","sourceRoot":"","sources":["../../src/services/encryption.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAE/F,sBAAsB;AACtB,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,mBAAmB;AACzC,MAAM,eAAe,GAAG,EAAE,CAAC,CAAC,WAAW;AACvC,MAAM,WAAW,GAAG,EAAE,CAAC,CAAC,WAAW;AACnC,MAAM,UAAU,GAAG,EAAE,CAAC,CAAC,WAAW;AAClC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAMlC;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,QAAgB,EAAE,IAAY;IAChD,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC5B,KAAa,EACb,QAAgB,EAChB,UAA6B,EAAE;IAE/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACpD,CAAC;IAED,8BAA8B;IAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC,WAAW,CAAC,CAAC;IACtD,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC;IAEhD,2BAA2B;IAC3B,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAEtC,UAAU;IACV,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEhC,OAAO;QACN,UAAU,EAAE,SAAS;QACrB,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7B,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3B,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE,iBAAiB;KAC7B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,SAAyB,EAAE,QAAgB;IACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACpD,CAAC;IAED,qBAAqB;IACrB,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,0BAA0B,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,oBAAoB;IACpB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAEjD,aAAa;IACb,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAEtC,UAAU;IACV,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACtD,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxE,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,SAAS,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC1E,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAyB;IAC3D,OAAO;QACN,CAAC,EAAE,CAAC;QACJ,EAAE,EAAE,SAAS,CAAC,UAAU;QACxB,EAAE,EAAE,SAAS,CAAC,EAAE;QAChB,CAAC,EAAE,SAAS,CAAC,IAAI;QACjB,CAAC,EAAE,SAAS,CAAC,GAAG;QAChB,CAAC,EAAE,SAAS,CAAC,SAAS;QACtB,CAAC,EAAE,SAAS,CAAC,UAAU;KACvB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAoC;IACxE,OAAO;QACN,UAAU,EAAE,UAAU,CAAC,EAAE;QACzB,EAAE,EAAE,UAAU,CAAC,EAAE;QACjB,IAAI,EAAE,UAAU,CAAC,CAAC;QAClB,GAAG,EAAE,UAAU,CAAC,CAAC;QACjB,SAAS,EAAE,UAAU,CAAC,CAAC;QACvB,UAAU,EAAE,UAAU,CAAC,CAAC;KACxB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa,EAAE,QAAgB;IACpE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,eAAuB,EAAE,QAAgB;IAChF,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAA6B,CAAC;IAC3E,MAAM,SAAS,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAM,GAAG,EAAE;IACjD,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC5C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,IAAY;IAC5D,qDAAqD;IACrD,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAElD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,MAAM,KAAK,CAAC,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,KAAiC,CAAC;IAC5C,OAAO,CACN,CAAC,CAAC,CAAC,KAAK,CAAC;QACT,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ;QACvB,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ;QACvB,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ;QACvB,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,CACvB,CAAC;AACH,CAAC"}

package/dist/services/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Config Services
+ *
+ * Higher-level services built on top of the config infrastructure.
+ */
+export { configLoaderDescriptor } from './loader/loader.descriptor.ts';
+export type { ConfigLoaderInterface, LoadResult, SaveResult } from './loader/loader.descriptor.ts';
+export { createConfigAccessor, createSyncConfigAccessor } from './config-accessor.ts';
+export type { ConfigAccessor, ConfigAccessorInterface } from './config-accessor.ts';
+export { encrypt, decrypt, serializeEncrypted, deserializeEncrypted, encryptToString, decryptFromString, generateSecurePassword, hashPassword, verifyPassword, isEncryptedValue } from './encryption.ts';
+export type { EncryptedValue, SerializedEncryptedValue, EncryptionOptions } from './encryption.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/services/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/services/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH,OAAO,EACN,sBAAsB,EACtB,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAE,qBAAqB,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAEnG,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACtF,YAAY,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAEpF,OAAO,EACN,OAAO,EACP,OAAO,EACP,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,cAAc,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/services/index.js

@@ -0,0 +1,16 @@
+/**
+ * Config Services
+ *
+ * Higher-level services built on top of the config infrastructure.
+ */
+// Runtime-scoped config loader (replaces unified-loader.ts)
+//
+// IMPORTANT: do not re-export the consumer/cloud/local-first loader impls here.
+// They are runtime-scoped and loaded lazily via dynamic import() in
+// config.plugin.ts. Re-exporting them statically would let bundlers
+// (e.g. workerd/cloudflare) walk the barrel and pull consumer-only code
+// (localdb adapter) into worker bundles where it cannot resolve.
+export { configLoaderDescriptor } from "./loader/loader.descriptor.js";
+export { createConfigAccessor, createSyncConfigAccessor } from "./config-accessor.js";
+export { encrypt, decrypt, serializeEncrypted, deserializeEncrypted, encryptToString, decryptFromString, generateSecurePassword, hashPassword, verifyPassword, isEncryptedValue } from "./encryption.js";
+//# sourceMappingURL=index.js.map

package/dist/services/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/services/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,4DAA4D;AAC5D,EAAE;AACF,gFAAgF;AAChF,oEAAoE;AACpE,oEAAoE;AACpE,wEAAwE;AACxE,iEAAiE;AACjE,OAAO,EACN,sBAAsB,EACtB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAGtF,OAAO,EACN,OAAO,EACP,OAAO,EACP,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,MAAM,iBAAiB,CAAC"}

package/dist/services/loader/loader.descriptor.d.ts

@@ -0,0 +1,103 @@
+/**
+ * Config Loader Descriptor
+ *
+ * Defines the config/loader kind for runtime-scoped configuration loading.
+ * Each implementation is single-purpose: local-only, cloud-only, or hybrid via runtime composition.
+ *
+ * This replaces the monolithic UnifiedConfigLoader with separate runtime-scoped implementations.
+ */
+import * as z from 'zod/v4';
+import type { ConfigManifest } from '../../manifest/types.ts';
+/**
+ * Load result schema - returned by all loader implementations
+ */
+export declare const LoadResultSchema: z.ZodObject<{
+    data: z.ZodNullable<z.ZodUnknown>;
+    source: z.ZodEnum<{
+        cloud: "cloud";
+        default: "default";
+        local: "local";
+        cache: "cache";
+    }>;
+    inSync: z.ZodBoolean;
+    lastSyncedAt: z.ZodNullable<z.ZodDate>;
+    syncError: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type LoadResult<T = unknown> = {
+    data: T | null;
+    source: 'local' | 'cloud' | 'cache' | 'default';
+    inSync: boolean;
+    lastSyncedAt: Date | null;
+    syncError?: string;
+};
+/**
+ * Save result schema
+ */
+export declare const SaveResultSchema: z.ZodObject<{
+    success: z.ZodBoolean;
+    direction: z.ZodEnum<{
+        push: "push";
+        pull: "pull";
+        none: "none";
+    }>;
+    changesApplied: z.ZodNumber;
+    error: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type SaveResult = {
+    success: boolean;
+    direction: 'push' | 'pull' | 'none';
+    changesApplied: number;
+    error?: string;
+};
+/**
+ * Config loader interface - implemented by all scoped implementations
+ */
+export interface ConfigLoaderInterface {
+    /** Load configuration for a manifest */
+    load<T>(manifest: ConfigManifest): Promise<LoadResult<T>>;
+    /** Save configuration for a manifest */
+    save<T>(manifest: ConfigManifest, data: T): Promise<SaveResult>;
+    /** Sync configuration between sources (if applicable) */
+    sync?(manifest: ConfigManifest, direction?: 'push' | 'pull' | 'auto'): Promise<SaveResult>;
+}
+/**
+ * Config loader descriptor
+ *
+ * The config/loader kind provides scoped implementations for loading and saving configuration.
+ * Implementations are selected by the runtime based on scope constraints:
+ * - consumer + { storage: 'local' } → LocalConfigLoader (localDB only)
+ * - cloud + { storage: 'cloud' } → CloudConfigLoader (cloud API only)
+ * - consumer + { storage: 'local-first' } → LocalFirstLoader (runtime-composed hybrid)
+ *
+ * @example
+ * ```typescript
+ * const loader = await runtime.query('config/loader').resolve();
+ * const result = await loader.load(manifest);
+ * ```
+ */
+export declare const configLoaderDescriptor: {
+    kind: "config/loader";
+    id: string;
+    name: string;
+    description: string;
+    schemas: {
+        input: z.ZodObject<{
+            manifest: z.ZodCustom<ConfigManifest<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>, ConfigManifest<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>>;
+        }, z.core.$strip>;
+        output: z.ZodObject<{
+            data: z.ZodNullable<z.ZodUnknown>;
+            source: z.ZodEnum<{
+                cloud: "cloud";
+                default: "default";
+                local: "local";
+                cache: "cache";
+            }>;
+            inSync: z.ZodBoolean;
+            lastSyncedAt: z.ZodNullable<z.ZodDate>;
+            syncError: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+    };
+    enabled: true;
+};
+export default configLoaderDescriptor;
+//# sourceMappingURL=loader.descriptor.d.ts.map

package/dist/services/loader/loader.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.descriptor.d.ts","sourceRoot":"","sources":["../../../src/services/loader/loader.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAE9D;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;iBAM3B,CAAC;AAEH,MAAM,MAAM,UAAU,CAAC,CAAC,GAAG,OAAO,IAAI;IACrC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;IACf,MAAM,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;IAChD,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;iBAK3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,wCAAwC;IACxC,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1D,wCAAwC;IACxC,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAEhE,yDAAyD;IACzD,IAAI,CAAC,CAAC,QAAQ,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC3F;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;CAejC,CAAC;AAEH,eAAe,sBAAsB,CAAC"}

package/dist/services/loader/loader.descriptor.js

@@ -0,0 +1,60 @@
+/**
+ * Config Loader Descriptor
+ *
+ * Defines the config/loader kind for runtime-scoped configuration loading.
+ * Each implementation is single-purpose: local-only, cloud-only, or hybrid via runtime composition.
+ *
+ * This replaces the monolithic UnifiedConfigLoader with separate runtime-scoped implementations.
+ */
+import { createRuntimeAsset } from '@vibesdotdev/runtime';
+import * as z from 'zod/v4';
+/**
+ * Load result schema - returned by all loader implementations
+ */
+export const LoadResultSchema = z.object({
+    data: z.unknown().nullable(),
+    source: z.enum(['local', 'cloud', 'cache', 'default']),
+    inSync: z.boolean(),
+    lastSyncedAt: z.date().nullable(),
+    syncError: z.string().optional()
+});
+/**
+ * Save result schema
+ */
+export const SaveResultSchema = z.object({
+    success: z.boolean(),
+    direction: z.enum(['push', 'pull', 'none']),
+    changesApplied: z.number(),
+    error: z.string().optional()
+});
+/**
+ * Config loader descriptor
+ *
+ * The config/loader kind provides scoped implementations for loading and saving configuration.
+ * Implementations are selected by the runtime based on scope constraints:
+ * - consumer + { storage: 'local' } → LocalConfigLoader (localDB only)
+ * - cloud + { storage: 'cloud' } → CloudConfigLoader (cloud API only)
+ * - consumer + { storage: 'local-first' } → LocalFirstLoader (runtime-composed hybrid)
+ *
+ * @example
+ * ```typescript
+ * const loader = await runtime.query('config/loader').resolve();
+ * const result = await loader.load(manifest);
+ * ```
+ */
+export const configLoaderDescriptor = createRuntimeAsset({
+    kind: 'config/loader',
+    id: 'config.loader.base',
+    name: 'Config Loader',
+    description: 'Runtime-scoped configuration loading and persistence',
+    // Schemas for validation
+    schemas: {
+        input: z.object({ manifest: z.custom() }),
+        output: LoadResultSchema
+    },
+    // No default implementation - runtime selects by scope
+    // Implementations register separately with their scope constraints
+    enabled: true
+});
+export default configLoaderDescriptor;
+//# sourceMappingURL=loader.descriptor.js.map

package/dist/services/loader/loader.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.descriptor.js","sourceRoot":"","sources":["../../../src/services/loader/loader.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACtD,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAUH;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAuBH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,kBAAkB,CAAC;IACxD,IAAI,EAAE,eAAe;IACrB,EAAE,EAAE,oBAAoB;IACxB,IAAI,EAAE,eAAe;IACrB,WAAW,EAAE,sDAAsD;IAEnE,yBAAyB;IACzB,OAAO,EAAE;QACR,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAkB,EAAE,CAAC;QACzD,MAAM,EAAE,gBAAgB;KACxB;IAED,uDAAuD;IACvD,mEAAmE;IACnE,OAAO,EAAE,IAAI;CACb,CAAC,CAAC;AAEH,eAAe,sBAAsB,CAAC"}

package/dist/services/loader/loader.impl.cloud.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Config Loader - Cloud Implementation
+ *
+ * Cloud-only configuration loading using cloud settings API.
+ * Single-purpose: handles cloud persistence only, no local branching.
+ *
+ * Scope: { hardware: ['cloud'], qualifiers: { storage: 'cloud' }}
+ *
+ * This replaces the branching logic in UnifiedConfigLoader with a pure
+ * runtime-selected implementation.
+ */
+import type { ConfigManifest } from '../../manifest/types.ts';
+import type { ConfigLoaderInterface, LoadResult, SaveResult } from './loader.descriptor.ts';
+/**
+ * Cloud Config Loader
+ *
+ * Single-purpose implementation for cloud-only configuration.
+ * Resolves cloud storage through the runtime - no internal adapter Maps.
+ * No syncDirection. No local storage logic.
+ */
+export declare class CloudConfigLoader implements ConfigLoaderInterface {
+    private runtime;
+    private store;
+    constructor();
+    /**
+     * Get cloud settings store from runtime
+     * Resolved dynamically to respect runtime scope
+     */
+    private getStore;
+    /**
+     * Wrap a storage adapter to CloudSettingsStore interface
+     */
+    private wrapAdapter;
+    /**
+     * Load configuration from cloud storage only
+     */
+    load<T>(manifest: ConfigManifest): Promise<LoadResult<T>>;
+    /**
+     * Save configuration to cloud storage only
+     */
+    save<T>(manifest: ConfigManifest, data: T): Promise<SaveResult>;
+    /**
+     * Delete configuration from cloud storage
+     */
+    delete(manifest: ConfigManifest): Promise<SaveResult>;
+}
+/**
+ * Runtime implementation registration
+ *
+ * Scope: cloud hardware with cloud storage qualifier.
+ * No syncDirection. No local storage. Single-purpose.
+ */
+declare const _default: import("@vibesdotdev/runtime").RuntimeImplementationWrapper<typeof CloudConfigLoader>;
+export default _default;
+//# sourceMappingURL=loader.impl.cloud.d.ts.map

package/dist/services/loader/loader.impl.cloud.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.impl.cloud.d.ts","sourceRoot":"","sources":["../../../src/services/loader/loader.impl.cloud.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAE9D,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAW5F;;;;;;GAMG;AACH,qBAAa,iBAAkB,YAAW,qBAAqB;IAC9D,OAAO,CAAC,OAAO,CAAe;IAC9B,OAAO,CAAC,KAAK,CAAmC;;IAMhD;;;OAGG;YACW,QAAQ;IAwBtB;;OAEG;IACH,OAAO,CAAC,WAAW;IAsBnB;;OAEG;IACG,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAiC/D;;OAEG;IACG,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;IA+BrE;;OAEG;IACG,MAAM,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC;CA8B3D;AAED;;;;;GAKG;;AACH,wBAQG"}