@vibesdotdev/secrets 0.0.1 → 1.0.0-rc.3

package/dist/domain/attestation/attestation.js

@@ -0,0 +1,104 @@
+import { localAttestationHandleSchema } from "../../schemas/domain/attestation/provider.schema.js";
+import { invalidClaim, readClaim, removeClaimIfSecret, writeClaim } from "./claim-files.js";
+export { INSECURE_CLAIM_REASONS, MAX_CLAIM_BYTES, assertRegularClaim, insecureClaim, invalidClaim, isInsecureClaimRefusal, isOversizeClaimRefusal, missingClaim, privately, readClaim, readClaimText, removeClaimIfSecret, removeTemporaryClaim, writeClaim } from "./claim-files.js";
+/**
+ * Local attestation provider implementation.
+ *
+ * Implements C034 / local attestation using the runtime's selected filesystem/adapter
+ * and owner-private file capabilities (C033).
+ */
+import {} from '@vibesdotdev/filesystem';
+import { CapabilityError, LOCAL_ATTESTATION_SECRET_PATTERN, LocalAttestationToken, constantTimeEqual } from '@vibesdotdev/kernel';
+import { createAttestationOptionsSchema } from "./schemas.js";
+import { LOCAL_ATTESTATION_CLAIM_PATH_INVALID } from "./token.js";
+/** A claim directory this module creates is the owner's alone (defence in depth beside the 0600 claim). */
+const CLAIM_DIRECTORY_MODE = 0o700;
+/**
+ * On `win32` POSIX modes carry no meaning: the claim relies on the profile
+ * directory's ACL, the platform as the runtime reports it.
+ */
+function relaysOnProfileAcl(runtime) {
+    return runtime.localEnvironment.getPlatform?.() === 'win32';
+}
+function claimPathInvalid(problem) {
+    return new CapabilityError('The attestation claim path is not a usable file path.', 'INVALID_INPUT', {
+        reason: LOCAL_ATTESTATION_CLAIM_PATH_INVALID,
+        retryable: false,
+        details: { problem }
+    });
+}
+/** The claim path, parsed: a non-empty path with no NUL; anything else is typed `INVALID_INPUT`, never a raw `ZodError`. */
+function parseClaimPath(claimPath) {
+    const parsed = createAttestationOptionsSchema.shape.claimPath.safeParse(claimPath);
+    if (!parsed.success)
+        throw claimPathInvalid(parsed.error.issues[0]?.code ?? 'invalid');
+    return parsed.data;
+}
+/** The claim path of the options a caller handed; options that are not an object with a path are the same typed refusal. */
+function claimPathOf(options) {
+    const parsed = createAttestationOptionsSchema.safeParse(options);
+    if (!parsed.success)
+        throw claimPathInvalid(parsed.error.issues[0]?.code ?? 'invalid');
+    return parsed.data.claimPath;
+}
+export function randomSecret() {
+    const bytes = crypto.getRandomValues(new Uint8Array(32));
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+async function resolveFileSystemAdapter(runtime) {
+    if (!runtime.hasKind('filesystem/adapter')) {
+        throw new CapabilityError('No filesystem/adapter kind is registered on this runtime.', 'UNAVAILABLE', {
+            reason: 'filesystem-adapter-not-registered',
+            retryable: false
+        });
+    }
+    return runtime.query('filesystem/adapter').resolve();
+}
+/**
+ * Start this server's attestation: generates a fresh secret, written atomically
+ * to a private claim file at `claimPath`, replacing (rotating) any previous start's claim.
+ */
+export async function createLocalAttestation(options, runtime) {
+    // A malformed options object is the same typed refusal as a malformed path.
+    const claimPath = claimPathOf(options);
+    const adapter = await resolveFileSystemAdapter(runtime);
+    const profileAcl = relaysOnProfileAcl(runtime);
+    // Ensure parent directory exists.
+    const parentDir = adapter.dirname(claimPath);
+    await adapter.mkdir(parentDir, { recursive: true, mode: CLAIM_DIRECTORY_MODE });
+    const secret = randomSecret();
+    await writeClaim(adapter, claimPath, `${secret}\n`, profileAcl);
+    let live = true;
+    return localAttestationHandleSchema.parse({
+        claimPath,
+        verify(presented) {
+            return live && presented !== undefined && constantTimeEqual(presented, secret);
+        },
+        async dispose() {
+            if (!live)
+                return;
+            // The claim stays this start's, and verifiable, until it is actually removed: a removal
+            // that fails (permissions, a busy file) leaves `live` set so a later dispose can retry.
+            await removeClaimIfSecret(adapter, claimPath, secret, profileAcl);
+            live = false;
+        }
+    });
+}
+/**
+ * Read the attestation claim written by a same-user server at `claimPath`.
+ * Refuses `local-attestation-claim-insecure` for a non-private claim,
+ * `local-attestation-claim-missing` (UNAVAILABLE, retryable: true) when missing,
+ * and `local-attestation-claim-invalid` for content that is not a secret.
+ */
+export async function readLocalAttestation(claimPath, runtime) {
+    const parsedPath = parseClaimPath(claimPath);
+    const adapter = await resolveFileSystemAdapter(runtime);
+    const content = (await readClaim(adapter, parsedPath, relaysOnProfileAcl(runtime))).trim();
+    if (!LOCAL_ATTESTATION_SECRET_PATTERN.test(content))
+        throw invalidClaim(parsedPath);
+    return new LocalAttestationToken(content);
+}
+//# sourceMappingURL=attestation.js.map

package/dist/domain/attestation/attestation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation.js","sourceRoot":"","sources":["../../../src/domain/attestation/attestation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAA8B,MAAM,qDAAqD,CAAC;AAC/H,OAAO,EAAE,YAAY,EAAC,SAAS,EAAC,mBAAmB,EAAC,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEzF,OAAO,EAAE,sBAAsB,EAAC,eAAe,EAAC,kBAAkB,EAAC,aAAa,EAAC,YAAY,EAAC,sBAAsB,EAAC,sBAAsB,EAAC,YAAY,EAAC,SAAS,EAAC,SAAS,EAAC,aAAa,EAAC,mBAAmB,EAAC,oBAAoB,EAAC,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACzQ;;;;;GAKG;AAEH,OAAO,EAEN,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACP,eAAe,EACf,gCAAgC,EAChC,qBAAqB,EACrB,iBAAiB,EAEhB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACP,8BAA8B,EAE7B,MAAM,cAAc,CAAC;AACtB,OAAO,EACP,oCAAoC,EACnC,MAAM,YAAY,CAAC;AAEpB,2GAA2G;AAC3G,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAEnC;;;GAGG;AACH,SAAS,kBAAkB,CAAC,OAAmB;IAC9C,OAAO,OAAO,CAAC,gBAAgB,CAAC,WAAW,EAAE,EAAE,KAAK,OAAO,CAAC;AAC7D,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACxC,OAAO,IAAI,eAAe,CAAC,uDAAuD,EAAE,eAAe,EAAE;QACpG,MAAM,EAAE,oCAAoC;QAC5C,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE,OAAO,EAAE;KACpB,CAAC,CAAC;AACJ,CAAC;AAED,4HAA4H;AAC5H,SAAS,cAAc,CAAC,SAAgD;IACvE,MAAM,MAAM,GAAG,8BAA8B,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACnF,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,SAAS,CAAC,CAAC;IACvF,OAAO,MAAM,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,4HAA4H;AAC5H,SAAS,WAAW,CAAC,OAAiC;IACrD,MAAM,MAAM,GAAG,8BAA8B,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,SAAS,CAAC,CAAC;IACvF,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,YAAY;IAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,KAAK,UAAU,wBAAwB,CACtC,OAAmB;IAEnB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,eAAe,CAAC,2DAA2D,EAAE,aAAa,EAAE;YACrG,MAAM,EAAE,mCAAmC;YAC3C,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAA0D,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAC/G,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,OAAiC,EACjC,OAAmB;IAEnB,4EAA4E;IAC5E,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAE/C,kCAAkC;IAClC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAEhF,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,UAAU,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,EAAE,UAAU,CAAC,CAAC;IAEhE,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,OAAO,4BAA4B,CAAC,KAAK,CAAC;QACzC,SAAS;QACT,MAAM,CAAC,SAA6B;YACnC,OAAO,IAAI,IAAI,SAAS,KAAK,SAAS,IAAI,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAChF,CAAC;QACD,KAAK,CAAC,OAAO;YACZ,IAAI,CAAC,IAAI;gBAAE,OAAO;YAClB,wFAAwF;YACxF,wFAAwF;YACxF,MAAM,mBAAmB,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YAClE,IAAI,GAAG,KAAK,CAAC;QACd,CAAC;KACD,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,SAAiB,EACjB,OAAmB;IAEnB,MAAM,UAAU,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,CAAC,MAAM,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3F,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,YAAY,CAAC,UAAU,CAAC,CAAC;IAEpF,OAAO,IAAI,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC"}

package/dist/domain/attestation/attestation.kind.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Secrets attestation runtime kind definition (C034).
+ *
+ * Exposes the `secrets/attestation` kind for runtime query and dependency resolution.
+ */
+import { type SecretsAttestationDescriptor } from './schemas.ts';
+export declare const SECRETS_ATTESTATION_KIND = "secrets/attestation";
+export declare const defaultSecretsAttestationDescriptor: SecretsAttestationDescriptor;
+export declare const secretsAttestationKind: import("@vibesdotdev/kernel").RuntimeKindDescriptorRecord<{
+    createAttestation: import("zod/v4/core").$InferOuterFunctionType<import("zod/v4").ZodTuple<readonly [import("zod/v4").ZodObject<{
+        claimPath: import("zod/v4").ZodString;
+    }, import("zod/v4/core").$strip>], null>, import("zod/v4").ZodPromise<import("zod/v4").ZodObject<{
+        claimPath: import("zod/v4").ZodString;
+        verify: import("zod/v4").ZodFunction<import("zod/v4").ZodTuple<readonly [import("zod/v4").ZodOptional<import("zod/v4").ZodString>], null>, import("zod/v4").ZodBoolean>;
+        dispose: import("zod/v4").ZodFunction<import("zod/v4").ZodTuple<readonly [], null>, import("zod/v4").ZodPromise<import("zod/v4").ZodVoid>>;
+    }, import("zod/v4/core").$strip>>>;
+    readAttestation: import("zod/v4/core").$InferOuterFunctionType<import("zod/v4").ZodTuple<readonly [import("zod/v4").ZodString], null>, import("zod/v4").ZodPromise<import("zod/v4").ZodInstanceOf<import("@vibesdotdev/kernel").LocalAttestationToken>>>;
+    createLocalAttestation: import("zod/v4/core").$InferOuterFunctionType<import("zod/v4").ZodTuple<readonly [import("zod/v4").ZodObject<{
+        claimPath: import("zod/v4").ZodString;
+    }, import("zod/v4/core").$strip>], null>, import("zod/v4").ZodPromise<import("zod/v4").ZodObject<{
+        claimPath: import("zod/v4").ZodString;
+        verify: import("zod/v4").ZodFunction<import("zod/v4").ZodTuple<readonly [import("zod/v4").ZodOptional<import("zod/v4").ZodString>], null>, import("zod/v4").ZodBoolean>;
+        dispose: import("zod/v4").ZodFunction<import("zod/v4").ZodTuple<readonly [], null>, import("zod/v4").ZodPromise<import("zod/v4").ZodVoid>>;
+    }, import("zod/v4/core").$strip>>>;
+    readLocalAttestation: import("zod/v4/core").$InferOuterFunctionType<import("zod/v4").ZodTuple<readonly [import("zod/v4").ZodString], null>, import("zod/v4").ZodPromise<import("zod/v4").ZodInstanceOf<import("@vibesdotdev/kernel").LocalAttestationToken>>>;
+}>;
+//# sourceMappingURL=attestation.kind.d.ts.map

package/dist/domain/attestation/attestation.kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation.kind.d.ts","sourceRoot":"","sources":["../../../src/domain/attestation/attestation.kind.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAEP,KAAK,4BAA4B,EAChC,MAAM,cAAc,CAAC;AAEtB,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAE9D,eAAO,MAAM,mCAAmC,EAAE,4BAKjD,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;EAOjC,CAAC"}

package/dist/domain/attestation/attestation.kind.js

@@ -0,0 +1,20 @@
+/**
+ * Secrets attestation runtime kind definition (C034).
+ *
+ * Exposes the `secrets/attestation` kind for runtime query and dependency resolution.
+ */
+import { createRuntimeKind } from '@vibesdotdev/kernel/factory/kind';
+import { SecretsAttestationDescriptorSchema } from "./schemas.js";
+export const SECRETS_ATTESTATION_KIND = 'secrets/attestation';
+export const defaultSecretsAttestationDescriptor = {
+    id: 'secrets-attestation-local',
+    kind: SECRETS_ATTESTATION_KIND,
+    priority: 50,
+    description: 'Local filesystem-backed secrets attestation provider'
+};
+export const secretsAttestationKind = createRuntimeKind({
+    id: SECRETS_ATTESTATION_KIND,
+    descriptorSchema: SecretsAttestationDescriptorSchema,
+    contexts: []
+});
+//# sourceMappingURL=attestation.kind.js.map

package/dist/domain/attestation/attestation.kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation.kind.js","sourceRoot":"","sources":["../../../src/domain/attestation/attestation.kind.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAErE,OAAO,EACP,kCAAkC,EAEjC,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAE9D,MAAM,CAAC,MAAM,mCAAmC,GAAiC;IAChF,EAAE,EAAE,2BAA2B;IAC/B,IAAI,EAAE,wBAAwB;IAC9B,QAAQ,EAAE,EAAE;IACZ,WAAW,EAAE,sDAAsD;CACnE,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,iBAAiB,CAGrD;IACD,EAAE,EAAE,wBAAwB;IAC5B,gBAAgB,EAAE,kCAAkC;IACpD,QAAQ,EAAE,EAAE;CACZ,CAAC,CAAC"}

package/dist/domain/attestation/attestation.plugin.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Secrets Attestation Runtime Plugin (C034).
+ *
+ * Registers the `secrets/attestation` kind, default descriptor, and local loader.
+ */
+export declare const secretsAttestationPlugin: import("@vibesdotdev/kernel").RuntimePlugin;
+export default secretsAttestationPlugin;
+//# sourceMappingURL=attestation.plugin.d.ts.map

package/dist/domain/attestation/attestation.plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation.plugin.d.ts","sourceRoot":"","sources":["../../../src/domain/attestation/attestation.plugin.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAWH,eAAO,MAAM,wBAAwB,6CAoBnC,CAAC;AAEH,eAAe,wBAAwB,CAAC"}

package/dist/domain/attestation/attestation.plugin.js

@@ -0,0 +1,26 @@
+/**
+ * Secrets Attestation Runtime Plugin (C034).
+ *
+ * Registers the `secrets/attestation` kind, default descriptor, and local loader.
+ */
+import { createRuntimeImplementation, createRuntimePlugin } from '@vibesdotdev/kernel';
+import { SECRETS_ATTESTATION_KIND, defaultSecretsAttestationDescriptor, secretsAttestationKind } from "./attestation.kind.js";
+import { LocalSecretsAttestationProvider } from "./attestation.provider.js";
+export const secretsAttestationPlugin = createRuntimePlugin({
+    id: 'secrets-attestation',
+    name: 'Secrets Attestation',
+    description: 'Local filesystem-backed secrets attestation provider',
+    dependencies: [],
+    // SAFETY: secretsAttestationKind conforms to RuntimeKindDescriptorRecord schema.
+    kinds: [secretsAttestationKind],
+    descriptors: [defaultSecretsAttestationDescriptor],
+    async onRegister(runtime) {
+        runtime.registerLoader(SECRETS_ATTESTATION_KIND, defaultSecretsAttestationDescriptor.id, async () => createRuntimeImplementation({
+            kind: SECRETS_ATTESTATION_KIND,
+            id: defaultSecretsAttestationDescriptor.id,
+            implementation: new LocalSecretsAttestationProvider(runtime)
+        }));
+    }
+});
+export default secretsAttestationPlugin;
+//# sourceMappingURL=attestation.plugin.js.map

package/dist/domain/attestation/attestation.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation.plugin.js","sourceRoot":"","sources":["../../../src/domain/attestation/attestation.plugin.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,2BAA2B,EAAC,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAEtF,OAAO,EACP,wBAAwB,EACxB,mCAAmC,EACnC,sBAAsB,EACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AAE5E,MAAM,CAAC,MAAM,wBAAwB,GAAG,mBAAmB,CAAC;IAC3D,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EAAE,sDAAsD;IACnE,YAAY,EAAE,EAAE;IAChB,iFAAiF;IACjF,KAAK,EAAE,CAAC,sBAAqD,CAAC;IAC9D,WAAW,EAAE,CAAC,mCAAmC,CAAC;IAClD,KAAK,CAAC,UAAU,CAAC,OAAO;QACvB,OAAO,CAAC,cAAc,CACrB,wBAAwB,EACxB,mCAAmC,CAAC,EAAE,EACtC,KAAK,IAAI,EAAE,CACV,2BAA2B,CAAC;YAC3B,IAAI,EAAE,wBAAwB;YAC9B,EAAE,EAAE,mCAAmC,CAAC,EAAE;YAC1C,cAAc,EAAE,IAAI,+BAA+B,CAAC,OAAO,CAAC;SAC5D,CAAC,CACH,CAAC;IACH,CAAC;CACD,CAAC,CAAC;AAEH,eAAe,wBAAwB,CAAC"}

package/dist/domain/attestation/attestation.provider.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Local secrets attestation provider implementation and helper (C034).
+ */
+import type { LocalAttestationToken } from '@vibesdotdev/kernel';
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import { type LocalAttestationHandle } from './attestation.ts';
+import type { SecretsAttestationProvider } from './provider.interface.ts';
+import type { CreateAttestationOptions } from './schemas.ts';
+export declare class LocalSecretsAttestationProvider implements SecretsAttestationProvider {
+    private readonly runtime;
+    constructor(runtime: RuntimeRef);
+    createAttestation(options: CreateAttestationOptions): Promise<LocalAttestationHandle>;
+    readAttestation(claimPath: string): Promise<LocalAttestationToken>;
+    createLocalAttestation(options: CreateAttestationOptions): Promise<LocalAttestationHandle>;
+    readLocalAttestation(claimPath: string): Promise<LocalAttestationToken>;
+}
+/**
+ * Resolve the active secrets attestation capability from the handed runtime.
+ * Consumers (like runtime-rpc) use this helper instead of importing file primitives
+ * or taking a direct package dependency.
+ */
+export declare function getSecretsAttestation(runtime: RuntimeRef): Promise<SecretsAttestationProvider>;
+//# sourceMappingURL=attestation.provider.d.ts.map

package/dist/domain/attestation/attestation.provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation.provider.d.ts","sourceRoot":"","sources":["../../../src/domain/attestation/attestation.provider.ts"],"names":[],"mappings":"AACA;;GAEG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtE,OAAO,EAGP,KAAK,sBAAsB,EAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,KAAK,EAAE,wBAAwB,EAA+B,MAAM,cAAc,CAAC;AAE1F,qBAAa,+BAAgC,YAAW,0BAA0B;IACrE,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,UAAU;IAE1C,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAIrF,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAIlE,sBAAsB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAI1F,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAG7E;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAC1C,OAAO,EAAE,UAAU,GACjB,OAAO,CAAC,0BAA0B,CAAC,CAyBrC"}

package/dist/domain/attestation/attestation.provider.js

@@ -0,0 +1,46 @@
+import { secretsAttestationProviderSchema } from "../../schemas/domain/attestation/provider.schema.js";
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { SECRETS_ATTESTATION_KIND } from "./attestation.kind.js";
+import { createLocalAttestation, readLocalAttestation } from "./attestation.js";
+export class LocalSecretsAttestationProvider {
+    runtime;
+    constructor(runtime) {
+        this.runtime = runtime;
+    }
+    async createAttestation(options) {
+        return createLocalAttestation(options, this.runtime);
+    }
+    async readAttestation(claimPath) {
+        return readLocalAttestation(claimPath, this.runtime);
+    }
+    async createLocalAttestation(options) {
+        return createLocalAttestation(options, this.runtime);
+    }
+    async readLocalAttestation(claimPath) {
+        return readLocalAttestation(claimPath, this.runtime);
+    }
+}
+/**
+ * Resolve the active secrets attestation capability from the handed runtime.
+ * Consumers (like runtime-rpc) use this helper instead of importing file primitives
+ * or taking a direct package dependency.
+ */
+export async function getSecretsAttestation(runtime) {
+    if (!runtime.hasKind(SECRETS_ATTESTATION_KIND)) {
+        throw new CapabilityError(`No ${SECRETS_ATTESTATION_KIND} kind is registered on this runtime.`, 'UNAVAILABLE', {
+            reason: 'secrets-attestation-not-registered',
+            retryable: false
+        });
+    }
+    const provider = (await runtime
+        .query(SECRETS_ATTESTATION_KIND)
+        .resolve());
+    if (!secretsAttestationProviderSchema.safeParse(provider).success) {
+        throw new CapabilityError(`Failed to resolve ${SECRETS_ATTESTATION_KIND} provider.`, 'UNAVAILABLE', {
+            reason: 'secrets-attestation-unavailable',
+            retryable: false
+        });
+    }
+    return provider;
+}
+//# sourceMappingURL=attestation.provider.js.map

package/dist/domain/attestation/attestation.provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation.provider.js","sourceRoot":"","sources":["../../../src/domain/attestation/attestation.provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,qDAAqD,CAAC;AAMvG,OAAO,EAAE,eAAe,EAAkB,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EACP,sBAAsB,EACtB,oBAAoB,EAEnB,MAAM,kBAAkB,CAAC;AAI1B,MAAM,OAAO,+BAA+B;IACd;IAA7B,YAA6B,OAAmB;QAAnB,YAAO,GAAP,OAAO,CAAY;IAAI,CAAC;IAErD,KAAK,CAAC,iBAAiB,CAAC,OAAiC;QACxD,OAAO,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB;QACtC,OAAO,oBAAoB,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,OAAiC;QAC7D,OAAO,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,SAAiB;QAC3C,OAAO,oBAAoB,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;CACD;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,OAAmB;IAEnB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,wBAAwB,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,eAAe,CACxB,MAAM,wBAAwB,sCAAsC,EACpE,aAAa,EACb;YACC,MAAM,EAAE,oCAAoC;YAC5C,SAAS,EAAE,KAAK;SAChB,CACD,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAO;SAC7B,KAAK,CAA2D,wBAAwB,CAAC;SACzF,OAAO,EAAE,CAAC,CAAC;IACb,IAAI,CAAC,gCAAgC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;QACnE,MAAM,IAAI,eAAe,CACxB,qBAAqB,wBAAwB,YAAY,EACzD,aAAa,EACb;YACC,MAAM,EAAE,iCAAiC;YACzC,SAAS,EAAE,KAAK;SAChB,CACD,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC"}

package/dist/domain/attestation/claim-files.d.ts

@@ -0,0 +1,34 @@
+import { type FileSystemAdapterInterface } from '@vibesdotdev/filesystem';
+import { CapabilityError, type CaughtFailure } from '@vibesdotdev/kernel';
+/** A secret is 43 characters: the claim is read as at most this many bytes. */
+export declare const MAX_CLAIM_BYTES = 1024;
+/** The filesystem refusals that mean the claim or its directory is not private. */
+export declare const INSECURE_CLAIM_REASONS: ReadonlySet<string>;
+export declare function insecureClaim(claimPath: string, why: string, cause?: Error): CapabilityError;
+export declare function isInsecureClaimRefusal(error: Error): boolean;
+export declare function isOversizeClaimRefusal(error: Error): boolean;
+/**
+ * Run an owner-private operation on the claim. The filesystem's refusals
+ * become this owner's typed ones (not private; larger than any secret, so an
+ * invalid claim); any other failure is not this owner's to name and propagates.
+ */
+export declare function privately<T>(claimPath: string, operation: () => Promise<T>): Promise<T>;
+export declare function invalidClaim(claimPath: string, cause?: Error): CapabilityError;
+export declare function missingClaim(claimPath: string, cause?: Error): CapabilityError;
+/** A claim kept where POSIX modes mean nothing: it must still be a regular file, never a link. */
+export declare function assertRegularClaim(adapter: FileSystemAdapterInterface, claimPath: string): Promise<boolean>;
+/** Publish `data` at `claimPath` atomically: owner-private on POSIX, a same-directory rename on win32. */
+export declare function writeClaim(adapter: FileSystemAdapterInterface, claimPath: string, data: string, profileAcl: boolean): Promise<void>;
+/**
+ * Remove a temporary claim file after the write or rename that made it failed.
+ * A removal that itself fails is reported typed with the original failure as its
+ * cause: a secret left on disk is never silent.
+ */
+export declare function removeTemporaryClaim(adapter: FileSystemAdapterInterface, claimPath: string, temporary: string, original: CaughtFailure): Promise<void>;
+/** The claim's text, where POSIX modes mean nothing: the adapter, asked for utf8, answers text. */
+export declare function readClaimText(adapter: FileSystemAdapterInterface, claimPath: string): Promise<string>;
+/** The claim's text; `local-attestation-claim-missing` when there is no claim. */
+export declare function readClaim(adapter: FileSystemAdapterInterface, claimPath: string, profileAcl: boolean): Promise<string>;
+/** Remove the claim only while it still holds `secret`, so a newer start's claim is never removed. */
+export declare function removeClaimIfSecret(adapter: FileSystemAdapterInterface, claimPath: string, secret: string, profileAcl: boolean): Promise<void>;
+//# sourceMappingURL=claim-files.d.ts.map

package/dist/domain/attestation/claim-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-files.d.ts","sourceRoot":"","sources":["../../../src/domain/attestation/claim-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAIP,KAAK,0BAA0B,EAC9B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACP,eAAe,EAGf,KAAK,aAAa,EACjB,MAAM,qBAAqB,CAAC;AAU7B,+EAA+E;AAC/E,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC,mFAAmF;AACnF,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAKrD,CAAC;AAEH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,eAAe,CAQ5F;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAE5D;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAE5D;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAQ7F;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,eAAe,CAO9E;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,eAAe,CAO9E;AAED,kGAAkG;AAClG,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,0BAA0B,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAKjH;AAED,0GAA0G;AAC1G,wBAAsB,UAAU,CAC/B,OAAO,EAAE,0BAA0B,EACnC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,OAAO,GACjB,OAAO,CAAC,IAAI,CAAC,CAiBf;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACzC,OAAO,EAAE,0BAA0B,EACnC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,aAAa,GACrB,OAAO,CAAC,IAAI,CAAC,CAef;AAED,mGAAmG;AACnG,wBAAsB,aAAa,CAAC,OAAO,EAAE,0BAA0B,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAI3G;AAED,kFAAkF;AAClF,wBAAsB,SAAS,CAC9B,OAAO,EAAE,0BAA0B,EACnC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,OAAO,GACjB,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,sGAAsG;AACtG,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,0BAA0B,EACnC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,OAAO,GACjB,OAAO,CAAC,IAAI,CAAC,CAQf"}

package/dist/domain/attestation/claim-files.js

@@ -0,0 +1,149 @@
+import { readFilePrivate, removeFilePrivateIfContent, writeFilePrivate } from '@vibesdotdev/filesystem';
+import { CapabilityError, constantTimeEqual, isCapabilityError } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+import { outcomeOf } from "../../support/file-failure.js";
+import { randomSecret } from "./attestation.js";
+import { LOCAL_ATTESTATION_CLAIM_INSECURE, LOCAL_ATTESTATION_CLAIM_INVALID, LOCAL_ATTESTATION_CLAIM_MISSING } from "./token.js";
+/** A secret is 43 characters: the claim is read as at most this many bytes. */
+export const MAX_CLAIM_BYTES = 1024;
+/** The filesystem refusals that mean the claim or its directory is not private. */
+export const INSECURE_CLAIM_REASONS = new Set([
+    'filesystem-private-parent-shared',
+    'filesystem-private-symlink',
+    'filesystem-private-not-file',
+    'filesystem-private-file-shared'
+]);
+export function insecureClaim(claimPath, why, cause) {
+    return new CapabilityError(`The attestation claim at ${claimPath} is not private: ${why}.`, 'PERMISSION_DENIED', {
+        cause,
+        reason: LOCAL_ATTESTATION_CLAIM_INSECURE,
+        retryable: false,
+        details: { claimPath },
+        recoveryHint: 'Remove the claim and restart its owner; a claim must be a 0600 regular file owned by this user.'
+    });
+}
+export function isInsecureClaimRefusal(error) {
+    return isCapabilityError(error) && error.reason !== undefined && INSECURE_CLAIM_REASONS.has(error.reason);
+}
+export function isOversizeClaimRefusal(error) {
+    return isCapabilityError(error) && error.reason === 'filesystem-private-too-large';
+}
+/**
+ * Run an owner-private operation on the claim. The filesystem's refusals
+ * become this owner's typed ones (not private; larger than any secret, so an
+ * invalid claim); any other failure is not this owner's to name and propagates.
+ */
+export async function privately(claimPath, operation) {
+    try {
+        return await operation();
+    }
+    catch (error) {
+        if (error instanceof Error && isInsecureClaimRefusal(error))
+            throw insecureClaim(claimPath, error.message, error);
+        if (error instanceof Error && isOversizeClaimRefusal(error))
+            throw invalidClaim(claimPath, error);
+        throw error;
+    }
+}
+export function invalidClaim(claimPath, cause) {
+    return new CapabilityError(`The attestation claim at ${claimPath} holds no valid secret.`, 'INTERNAL', {
+        cause,
+        reason: LOCAL_ATTESTATION_CLAIM_INVALID,
+        retryable: false,
+        details: { claimPath }
+    });
+}
+export function missingClaim(claimPath, cause) {
+    return new CapabilityError(`No attestation claim exists at ${claimPath}.`, 'UNAVAILABLE', {
+        cause,
+        reason: LOCAL_ATTESTATION_CLAIM_MISSING,
+        retryable: true,
+        details: { claimPath }
+    });
+}
+/** A claim kept where POSIX modes mean nothing: it must still be a regular file, never a link. */
+export async function assertRegularClaim(adapter, claimPath) {
+    if (!(await adapter.exists(claimPath)))
+        return false;
+    const stats = await adapter.stat(claimPath);
+    if (stats.kind !== 'file' || stats.isSymlink)
+        throw insecureClaim(claimPath, 'it is not a regular file');
+    return true;
+}
+/** Publish `data` at `claimPath` atomically: owner-private on POSIX, a same-directory rename on win32. */
+export async function writeClaim(adapter, claimPath, data, profileAcl) {
+    if (!profileAcl) {
+        await privately(claimPath, () => writeFilePrivate(adapter, claimPath, data, 'utf8'));
+        return;
+    }
+    await assertRegularClaim(adapter, claimPath);
+    const temporary = `${claimPath}.${randomSecret().slice(0, 12)}.tmp`;
+    // The temporary file holds the secret: whichever step fails (the write may leave it partly
+    // written, the rename leaves it whole), it is removed before the failure propagates.
+    const published = await outcomeOf(async () => {
+        await adapter.writeFile(temporary, data, 'utf8');
+        await adapter.rename(temporary, claimPath);
+    });
+    if (!published.ok) {
+        await removeTemporaryClaim(adapter, claimPath, temporary, published.failure);
+        throw published.failure;
+    }
+}
+/**
+ * Remove a temporary claim file after the write or rename that made it failed.
+ * A removal that itself fails is reported typed with the original failure as its
+ * cause: a secret left on disk is never silent.
+ */
+export async function removeTemporaryClaim(adapter, claimPath, temporary, original) {
+    const removal = await outcomeOf(async () => {
+        if (await adapter.exists(temporary))
+            await adapter.remove(temporary);
+    });
+    if (removal.ok)
+        return;
+    throw new CapabilityError(`The attestation claim at ${claimPath} could not be written, and its temporary file ${temporary} could not be removed.`, 'UNAVAILABLE', {
+        reason: 'local-attestation-claim-unwritable',
+        retryable: false,
+        cause: original,
+        details: { claimPath, temporary, cleanup: CapabilityError.from(removal.failure).reason }
+    });
+}
+/** The claim's text, where POSIX modes mean nothing: the adapter, asked for utf8, answers text. */
+export async function readClaimText(adapter, claimPath) {
+    const text = z.string().safeParse(await adapter.readFile(claimPath, 'utf8'));
+    if (!text.success)
+        throw invalidClaim(claimPath);
+    return text.data;
+}
+/** The claim's text; `local-attestation-claim-missing` when there is no claim. */
+export async function readClaim(adapter, claimPath, profileAcl) {
+    if (profileAcl) {
+        if (!(await assertRegularClaim(adapter, claimPath)))
+            throw missingClaim(claimPath);
+        return readClaimText(adapter, claimPath);
+    }
+    try {
+        const raw = await privately(claimPath, () => readFilePrivate(adapter, claimPath, MAX_CLAIM_BYTES));
+        return new TextDecoder().decode(raw);
+    }
+    catch (error) {
+        if (error instanceof Error && isCapabilityError(error) &&
+            (error.reason === 'filesystem-private-missing' || error.code === 'NOT_FOUND')) {
+            throw missingClaim(claimPath, error);
+        }
+        throw error;
+    }
+}
+/** Remove the claim only while it still holds `secret`, so a newer start's claim is never removed. */
+export async function removeClaimIfSecret(adapter, claimPath, secret, profileAcl) {
+    if (!profileAcl) {
+        const expected = new TextEncoder().encode(`${secret}\n`);
+        await privately(claimPath, () => removeFilePrivateIfContent(adapter, claimPath, expected));
+        return;
+    }
+    if (!(await assertRegularClaim(adapter, claimPath)))
+        return;
+    if (constantTimeEqual((await readClaimText(adapter, claimPath)).trim(), secret))
+        await adapter.remove(claimPath);
+}
+//# sourceMappingURL=claim-files.js.map

package/dist/domain/attestation/claim-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-files.js","sourceRoot":"","sources":["../../../src/domain/attestation/claim-files.ts"],"names":[],"mappings":"AAAA,OAAO,EACP,eAAe,EACf,0BAA0B,EAC1B,gBAAgB,EAEf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACP,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EAEhB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACP,gCAAgC,EAChC,+BAA+B,EAC/B,+BAA+B,EAC9B,MAAM,YAAY,CAAC;AAEpB,+EAA+E;AAC/E,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AAEpC,mFAAmF;AACnF,MAAM,CAAC,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IAClE,kCAAkC;IAClC,4BAA4B;IAC5B,6BAA6B;IAC7B,gCAAgC;CAChC,CAAC,CAAC;AAEH,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,GAAW,EAAE,KAAa;IAC1E,OAAO,IAAI,eAAe,CAAC,4BAA4B,SAAS,oBAAoB,GAAG,GAAG,EAAE,mBAAmB,EAAE;QAChH,KAAK;QACL,MAAM,EAAE,gCAAgC;QACxC,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE,SAAS,EAAE;QACtB,YAAY,EAAE,iGAAiG;KAC/G,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAY;IAClD,OAAO,iBAAiB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC3G,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAY;IAClD,OAAO,iBAAiB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,8BAA8B,CAAC;AACpF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAI,SAAiB,EAAE,SAA2B;IAChF,IAAI,CAAC;QACJ,OAAO,MAAM,SAAS,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,KAAK,IAAI,sBAAsB,CAAC,KAAK,CAAC;YAAE,MAAM,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAClH,IAAI,KAAK,YAAY,KAAK,IAAI,sBAAsB,CAAC,KAAK,CAAC;YAAE,MAAM,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAClG,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,KAAa;IAC5D,OAAO,IAAI,eAAe,CAAC,4BAA4B,SAAS,yBAAyB,EAAE,UAAU,EAAE;QACtG,KAAK;QACL,MAAM,EAAE,+BAA+B;QACvC,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE,SAAS,EAAE;KACtB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,KAAa;IAC5D,OAAO,IAAI,eAAe,CAAC,kCAAkC,SAAS,GAAG,EAAE,aAAa,EAAE;QACzF,KAAK;QACL,MAAM,EAAE,+BAA+B;QACvC,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,EAAE,SAAS,EAAE;KACtB,CAAC,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAmC,EAAE,SAAiB;IAC9F,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS;QAAE,MAAM,aAAa,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;IACzG,OAAO,IAAI,CAAC;AACb,CAAC;AAED,0GAA0G;AAC1G,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,OAAmC,EACnC,SAAiB,EACjB,IAAY,EACZ,UAAmB;IAEnB,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,MAAM,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACrF,OAAO;IACR,CAAC;IACD,MAAM,kBAAkB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,GAAG,SAAS,IAAI,YAAY,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC;IACpE,2FAA2F;IAC3F,qFAAqF;IACrF,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;QAC5C,MAAM,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,oBAAoB,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;QAC7E,MAAM,SAAS,CAAC,OAAO,CAAC;IACzB,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,OAAmC,EACnC,SAAiB,EACjB,SAAiB,EACjB,QAAuB;IAEvB,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;QAC1C,IAAI,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;YAAE,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,EAAE;QAAE,OAAO;IACvB,MAAM,IAAI,eAAe,CACxB,4BAA4B,SAAS,iDAAiD,SAAS,wBAAwB,EACvH,aAAa,EACb;QACC,MAAM,EAAE,oCAAoC;QAC5C,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE;KACxF,CACD,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAmC,EAAE,SAAiB;IACzF,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,MAAM,YAAY,CAAC,SAAS,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,OAAmC,EACnC,SAAiB,EACjB,UAAmB;IAEnB,IAAI,UAAU,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC,MAAM,kBAAkB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAAE,MAAM,YAAY,CAAC,SAAS,CAAC,CAAC;QACnF,OAAO,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC;QACnG,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,KAAK,IAAI,iBAAiB,CAAC,KAAK,CAAC;YACrD,CAAC,KAAK,CAAC,MAAM,KAAK,4BAA4B,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,EAAE,CAAC;YAChF,MAAM,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAmC,EACnC,SAAiB,EACjB,MAAc,EACd,UAAmB;IAEnB,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC;QACzD,MAAM,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,0BAA0B,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC3F,OAAO;IACR,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,kBAAkB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAAE,OAAO;IAC5D,IAAI,iBAAiB,CAAC,CAAC,MAAM,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC;QAAE,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAClH,CAAC"}

package/dist/domain/attestation/index.d.ts

@@ -0,0 +1,8 @@
+export { LOCAL_ATTESTATION_CLAIM_INSECURE, LOCAL_ATTESTATION_CLAIM_INVALID, LOCAL_ATTESTATION_CLAIM_MISSING, LOCAL_ATTESTATION_CLAIM_PATH_INVALID } from './token.ts';
+export { SecretsAttestationDescriptorSchema, createAttestationOptionsSchema, type CreateAttestationOptions, type SecretsAttestationDescriptor } from './schemas.ts';
+export { createLocalAttestation, readLocalAttestation, type LocalAttestationHandle } from './attestation.ts';
+export type { SecretsAttestationProvider } from './provider.interface.ts';
+export { SECRETS_ATTESTATION_KIND, defaultSecretsAttestationDescriptor, secretsAttestationKind } from './attestation.kind.ts';
+export { LocalSecretsAttestationProvider, getSecretsAttestation } from './attestation.provider.ts';
+export { secretsAttestationPlugin, default as secretsAttestationPluginDefault } from './attestation.plugin.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/domain/attestation/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/domain/attestation/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACP,gCAAgC,EAAC,+BAA+B,EAAC,+BAA+B,EAAC,oCAAoC,EACpI,MAAM,YAAY,CAAC;AAEpB,OAAO,EACP,kCAAkC,EAAC,8BAA8B,EAAC,KAAK,wBAAwB,EAC/F,KAAK,4BAA4B,EAChC,MAAM,cAAc,CAAC;AAEtB,OAAO,EACP,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,sBAAsB,EAC1B,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EACZ,0BAA0B,EACzB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACP,wBAAwB,EACxB,mCAAmC,EACnC,sBAAsB,EACrB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACP,+BAA+B,EAC/B,qBAAqB,EACpB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACP,wBAAwB,EACxB,OAAO,IAAI,+BAA+B,EACzC,MAAM,yBAAyB,CAAC"}

package/dist/domain/attestation/index.js

@@ -0,0 +1,7 @@
+export { LOCAL_ATTESTATION_CLAIM_INSECURE, LOCAL_ATTESTATION_CLAIM_INVALID, LOCAL_ATTESTATION_CLAIM_MISSING, LOCAL_ATTESTATION_CLAIM_PATH_INVALID } from "./token.js";
+export { SecretsAttestationDescriptorSchema, createAttestationOptionsSchema } from "./schemas.js";
+export { createLocalAttestation, readLocalAttestation } from "./attestation.js";
+export { SECRETS_ATTESTATION_KIND, defaultSecretsAttestationDescriptor, secretsAttestationKind } from "./attestation.kind.js";
+export { LocalSecretsAttestationProvider, getSecretsAttestation } from "./attestation.provider.js";
+export { secretsAttestationPlugin, default as secretsAttestationPluginDefault } from "./attestation.plugin.js";
+//# sourceMappingURL=index.js.map

package/dist/domain/attestation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/domain/attestation/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACP,gCAAgC,EAAC,+BAA+B,EAAC,+BAA+B,EAAC,oCAAoC,EACpI,MAAM,YAAY,CAAC;AAEpB,OAAO,EACP,kCAAkC,EAAC,8BAA8B,EAEhE,MAAM,cAAc,CAAC;AAEtB,OAAO,EACP,sBAAsB,EACtB,oBAAoB,EAEnB,MAAM,kBAAkB,CAAC;AAM1B,OAAO,EACP,wBAAwB,EACxB,mCAAmC,EACnC,sBAAsB,EACrB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACP,+BAA+B,EAC/B,qBAAqB,EACpB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACP,wBAAwB,EACxB,OAAO,IAAI,+BAA+B,EACzC,MAAM,yBAAyB,CAAC"}

package/dist/domain/attestation/provider.interface.d.ts

@@ -0,0 +1,2 @@
+export type { LocalAttestationHandle, SecretsAttestationProvider } from '../../schemas/domain/attestation/provider.schema.ts';
+//# sourceMappingURL=provider.interface.d.ts.map

package/dist/domain/attestation/provider.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.interface.d.ts","sourceRoot":"","sources":["../../../src/domain/attestation/provider.interface.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,sBAAsB,EAAC,0BAA0B,EAAE,MAAM,qDAAqD,CAAC"}

package/dist/domain/attestation/provider.interface.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=provider.interface.js.map

package/dist/domain/attestation/provider.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.interface.js","sourceRoot":"","sources":["../../../src/domain/attestation/provider.interface.ts"],"names":[],"mappings":""}

package/dist/domain/attestation/schemas.d.ts

@@ -0,0 +1,2 @@
+export * from '../../schemas/domain/attestation/attestation.schema.ts';
+//# sourceMappingURL=schemas.d.ts.map

package/dist/domain/attestation/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../src/domain/attestation/schemas.ts"],"names":[],"mappings":"AAAA,cAAc,wDAAwD,CAAC"}

package/dist/domain/attestation/schemas.js

@@ -0,0 +1,2 @@
+export * from "../../schemas/domain/attestation/attestation.schema.js";
+//# sourceMappingURL=schemas.js.map

package/dist/domain/attestation/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../src/domain/attestation/schemas.ts"],"names":[],"mappings":"AAAA,cAAc,wDAAwD,CAAC"}

package/dist/domain/attestation/token.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Local attestation claim refusal constants.
+ *
+ * Per C058, the token class, reveal and verify primitives reside in `@vibesdotdev/kernel`.
+ */
+/** A claim that is not a private regular file owned by this user. */
+export declare const LOCAL_ATTESTATION_CLAIM_INSECURE = "local-attestation-claim-insecure";
+/** No claim at the path (no server running there). */
+export declare const LOCAL_ATTESTATION_CLAIM_MISSING = "local-attestation-claim-missing";
+/** A claim whose content is not a secret this module wrote. */
+export declare const LOCAL_ATTESTATION_CLAIM_INVALID = "local-attestation-claim-invalid";
+/** A claim path that is not a usable file path (empty, not a string, or holding a NUL). */
+export declare const LOCAL_ATTESTATION_CLAIM_PATH_INVALID = "local-attestation-claim-path-invalid";
+//# sourceMappingURL=token.d.ts.map

package/dist/domain/attestation/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/domain/attestation/token.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,qEAAqE;AACrE,eAAO,MAAM,gCAAgC,qCAAqC,CAAC;AACnF,sDAAsD;AACtD,eAAO,MAAM,+BAA+B,oCAAoC,CAAC;AACjF,+DAA+D;AAC/D,eAAO,MAAM,+BAA+B,oCAAoC,CAAC;AACjF,2FAA2F;AAC3F,eAAO,MAAM,oCAAoC,yCAAyC,CAAC"}

package/dist/domain/attestation/token.js

@@ -0,0 +1,14 @@
+/**
+ * Local attestation claim refusal constants.
+ *
+ * Per C058, the token class, reveal and verify primitives reside in `@vibesdotdev/kernel`.
+ */
+/** A claim that is not a private regular file owned by this user. */
+export const LOCAL_ATTESTATION_CLAIM_INSECURE = 'local-attestation-claim-insecure';
+/** No claim at the path (no server running there). */
+export const LOCAL_ATTESTATION_CLAIM_MISSING = 'local-attestation-claim-missing';
+/** A claim whose content is not a secret this module wrote. */
+export const LOCAL_ATTESTATION_CLAIM_INVALID = 'local-attestation-claim-invalid';
+/** A claim path that is not a usable file path (empty, not a string, or holding a NUL). */
+export const LOCAL_ATTESTATION_CLAIM_PATH_INVALID = 'local-attestation-claim-path-invalid';
+//# sourceMappingURL=token.js.map

package/dist/domain/attestation/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/domain/attestation/token.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,gCAAgC,GAAG,kCAAkC,CAAC;AACnF,sDAAsD;AACtD,MAAM,CAAC,MAAM,+BAA+B,GAAG,iCAAiC,CAAC;AACjF,+DAA+D;AAC/D,MAAM,CAAC,MAAM,+BAA+B,GAAG,iCAAiC,CAAC;AACjF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,oCAAoC,GAAG,sCAAsC,CAAC"}

package/dist/domain/client/authenticated-request.d.ts

@@ -0,0 +1,4 @@
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import { type AuthenticatedRequestInputInput } from '../../schemas/transport/authenticated-request.schema.ts';
+export declare function sendAuthenticatedRequest(runtime: VibesRuntime, input: AuthenticatedRequestInputInput): Promise<Response>;
+//# sourceMappingURL=authenticated-request.d.ts.map

package/dist/domain/client/authenticated-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticated-request.d.ts","sourceRoot":"","sources":["../../../src/domain/client/authenticated-request.ts"],"names":[],"mappings":"AACA,OAAO,EAAqG,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAE3J,OAAO,EAAmC,KAAK,8BAA8B,EAA6D,MAAM,yDAAyD,CAAC;AAyM1M,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,8BAA8B,GAAG,OAAO,CAAC,QAAQ,CAAC,CA+J9H"}