@vibesdotdev/security 0.0.0-stage → 1.0.0-rc.4

package/dist/cli/shield.deps.scan.impl.consumer.js

@@ -0,0 +1,35 @@
+/**
+ * Shield Deps Scan CLI Command Implementation (consumer)
+ *
+ * Resolves the registered `security/dep-scanner` service, scans the given
+ * lockfile, and prints the DepScanReport as JSON.
+ *
+ * Output and diagnostics go through the handed runtime's host text output (see
+ * `./report-output.ts`), and the exit code is requested rather than taken, so a
+ * CI gate's stdout is never truncated.
+ */
+import * as z from 'zod/v4';
+import { requestCLIExit } from '@vibesdotdev/cli/providers';
+import { readLockfile } from "./read-lockfile.js";
+import { writeDepScanReport, writeDiagnostic } from "./report-output.js";
+export default {
+    async execute(args, opts, context) {
+        const parsedPath = z.string().min(1).safeParse(args.path);
+        const { runtime } = context;
+        if (!parsedPath.success) {
+            await writeDiagnostic(runtime, 'shield deps scan: missing required <path> argument');
+            requestCLIExit(2);
+            return;
+        }
+        const path = parsedPath.data;
+        if (!runtime.hasKind('security/dep-scanner') || runtime.query('security/dep-scanner').enabled().descriptors().length === 0) {
+            await writeDiagnostic(runtime, 'shield deps scan: no dep scanner registered');
+            requestCLIExit(2);
+            return;
+        }
+        const scanner = await runtime.query('security/dep-scanner').enabled().resolve();
+        const manifest = await readLockfile(runtime, path);
+        await writeDepScanReport(runtime, await scanner.scan(manifest));
+    },
+};
+//# sourceMappingURL=shield.deps.scan.impl.consumer.js.map

package/dist/cli/shield.deps.scan.impl.consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shield.deps.scan.impl.consumer.js","sourceRoot":"","sources":["../../src/cli/shield.deps.scan.impl.consumer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGzE,eAAe;IACd,KAAK,CAAC,OAAO,CAAC,IAAkD,EAAE,IAAkD,EAAE,OAAwC;QAC7J,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAC5B,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,eAAe,CAAC,OAAO,EAAE,oDAAoD,CAAC,CAAC;YACrF,cAAc,CAAC,CAAC,CAAC,CAAC;YAClB,OAAO;QACR,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAE7B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5H,MAAM,eAAe,CAAC,OAAO,EAAE,6CAA6C,CAAC,CAAC;YAC9E,cAAc,CAAC,CAAC,CAAC,CAAC;YAClB,OAAO;QACR,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,CAA0C,sBAAsB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC;QACzH,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnD,MAAM,kBAAkB,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjE,CAAC;CACD,CAAC"}

package/dist/helpers/constant-time.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Constant-time string equality for secrets and tokens.
+ *
+ * Does not short-circuit on length mismatch (length is still observable for
+ * empty/unequal sizes via total work, but the matched-prefix length of the
+ * secret is not leaked via early exit). Runtime-agnostic — no Node `crypto`
+ * or Buffer — so it is safe on workerd and browsers.
+ *
+ * Prefer this over local copies of `timingSafeEqual` / `tokensMatch` that
+ * early-return on `a.length !== b.length`.
+ */
+export declare function constantTimeEqual(a: string, b: string): boolean;
+/**
+ * Constant-time equality for equal-or-unequal byte arrays (hashes, digests).
+ * Same length-oracle discipline as {@link constantTimeEqual}.
+ */
+export declare function constantTimeEqualBytes(a: Uint8Array, b: Uint8Array): boolean;
+//# sourceMappingURL=constant-time.d.ts.map

package/dist/helpers/constant-time.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constant-time.d.ts","sourceRoot":"","sources":["../../src/helpers/constant-time.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAmB/D;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAY5E"}

package/dist/helpers/constant-time.js

@@ -0,0 +1,49 @@
+/**
+ * Constant-time string equality for secrets and tokens.
+ *
+ * Does not short-circuit on length mismatch (length is still observable for
+ * empty/unequal sizes via total work, but the matched-prefix length of the
+ * secret is not leaked via early exit). Runtime-agnostic — no Node `crypto`
+ * or Buffer — so it is safe on workerd and browsers.
+ *
+ * Prefer this over local copies of `timingSafeEqual` / `tokensMatch` that
+ * early-return on `a.length !== b.length`.
+ */
+export function constantTimeEqual(a, b) {
+    const aBytes = new TextEncoder().encode(a);
+    const bBytes = new TextEncoder().encode(b);
+    // Mismatched length is a guaranteed non-match, but still iterate so
+    // timing does not reveal the matched-prefix length of either string.
+    let mismatch = aBytes.length === bBytes.length ? 0 : 1;
+    const len = aBytes.length;
+    // When b is empty, avoid modulo-by-zero; any non-empty a already mismatches.
+    if (bBytes.length === 0) {
+        return len === 0 && mismatch === 0;
+    }
+    for (let i = 0; i < len; i++) {
+        mismatch |= aBytes[i] ^ bBytes[i % bBytes.length];
+    }
+    // Also walk remaining b bytes when a is shorter so work scales with both.
+    for (let i = len; i < bBytes.length; i++) {
+        mismatch |= bBytes[i];
+    }
+    return mismatch === 0;
+}
+/**
+ * Constant-time equality for equal-or-unequal byte arrays (hashes, digests).
+ * Same length-oracle discipline as {@link constantTimeEqual}.
+ */
+export function constantTimeEqualBytes(a, b) {
+    let mismatch = a.length === b.length ? 0 : 1;
+    if (b.length === 0) {
+        return a.length === 0 && mismatch === 0;
+    }
+    for (let i = 0; i < a.length; i++) {
+        mismatch |= a[i] ^ b[i % b.length];
+    }
+    for (let i = a.length; i < b.length; i++) {
+        mismatch |= b[i];
+    }
+    return mismatch === 0;
+}
+//# sourceMappingURL=constant-time.js.map

package/dist/helpers/constant-time.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constant-time.js","sourceRoot":"","sources":["../../src/helpers/constant-time.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAS,EAAE,CAAS;IACrD,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3C,oEAAoE;IACpE,qEAAqE;IACrE,IAAI,QAAQ,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,GAAG,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACnD,CAAC;IACD,0EAA0E;IAC1E,KAAK,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,CAAa,EAAE,CAAa;IAClE,IAAI,QAAQ,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC;IACzC,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAC;AACvB,CAAC"}

package/dist/helpers/filename-sanitizer.d.ts

@@ -0,0 +1,2 @@
+export declare function sanitizeFilename(name: string, replacement?: string): string;
+//# sourceMappingURL=filename-sanitizer.d.ts.map

package/dist/helpers/filename-sanitizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filename-sanitizer.d.ts","sourceRoot":"","sources":["../../src/helpers/filename-sanitizer.ts"],"names":[],"mappings":"AAGA,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,SAAM,GAAG,MAAM,CAaxE"}

package/dist/helpers/filename-sanitizer.js

@@ -0,0 +1,18 @@
+const FORBIDDEN_PUNCTUATION = '<>:"/\\|?*';
+const RESERVED_NAMES = /^(con|prn|aux|nul|com[0-9]|lpt[0-9])(\.|$)/i;
+export function sanitizeFilename(name, replacement = '_') {
+    let sanitized = '';
+    for (let i = 0; i < name.length; i++) {
+        const ch = name[i] ?? '';
+        const code = name.charCodeAt(i);
+        if (code <= 0x1f || FORBIDDEN_PUNCTUATION.includes(ch)) {
+            sanitized += replacement;
+        }
+        else {
+            sanitized += ch;
+        }
+    }
+    sanitized = sanitized.replace(RESERVED_NAMES, replacement);
+    return sanitized.trim().slice(0, 255);
+}
+//# sourceMappingURL=filename-sanitizer.js.map

package/dist/helpers/filename-sanitizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filename-sanitizer.js","sourceRoot":"","sources":["../../src/helpers/filename-sanitizer.ts"],"names":[],"mappings":"AAAA,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAC3C,MAAM,cAAc,GAAG,6CAA6C,CAAC;AAErE,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,WAAW,GAAG,GAAG;IAC/D,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,IAAI,IAAI,IAAI,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACxD,SAAS,IAAI,WAAW,CAAC;QAC1B,CAAC;aAAM,CAAC;YACP,SAAS,IAAI,EAAE,CAAC;QACjB,CAAC;IACF,CAAC;IACD,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAC3D,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACvC,CAAC"}

package/dist/helpers/forwardable-auth-headers.d.ts

@@ -0,0 +1,8 @@
+import type { ForwardableAuthHeaders } from '../schemas/contracts/misc.ts';
+export type { ForwardableAuthHeaders } from '../schemas/contracts/misc.ts';
+/**
+ * Select only credentials that a verified surface may forward to another Vibes
+ * app. Unrelated cookies and malformed bearer values never cross an app boundary.
+ */
+export declare function selectForwardableAuthHeaders(headers: Record<string, string> | undefined): ForwardableAuthHeaders;
+//# sourceMappingURL=forwardable-auth-headers.d.ts.map

package/dist/helpers/forwardable-auth-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forwardable-auth-headers.d.ts","sourceRoot":"","sources":["../../src/helpers/forwardable-auth-headers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC3E,YAAY,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAe3E;;;GAGG;AACH,wBAAgB,4BAA4B,CAC3C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GACzC,sBAAsB,CAwBxB"}

package/dist/helpers/forwardable-auth-headers.js

@@ -0,0 +1,44 @@
+const FORWARDABLE_AUTH_COOKIES = new Set([
+    'vibes.jwt',
+    'better-auth.session_token',
+    '__Secure-better-auth.session_token',
+    '__Host-better-auth.session_token'
+]);
+function readHeader(headers, name) {
+    if (!headers)
+        return undefined;
+    const entry = Object.entries(headers).find(([key]) => key.toLowerCase() === name);
+    const value = entry?.[1]?.trim();
+    return value && !/[\r\n]/.test(value) ? value : undefined;
+}
+/**
+ * Select only credentials that a verified surface may forward to another Vibes
+ * app. Unrelated cookies and malformed bearer values never cross an app boundary.
+ */
+export function selectForwardableAuthHeaders(headers) {
+    const authorization = readHeader(headers, 'authorization');
+    const jwt = authorization?.match(/^Bearer\s+(\S+)$/i)?.[1];
+    const rawCookie = readHeader(headers, 'cookie');
+    const cookies = [];
+    if (rawCookie) {
+        for (const part of rawCookie.split(';')) {
+            const separator = part.indexOf('=');
+            if (separator <= 0)
+                continue;
+            const name = part.slice(0, separator).trim();
+            const value = part.slice(separator + 1).trim();
+            if (FORWARDABLE_AUTH_COOKIES.has(name) && value.length > 0 && !/[;\r\n]/.test(value)) {
+                cookies.push(`${name}=${value}`);
+            }
+        }
+    }
+    const result = {};
+    if (cookies.length > 0) {
+        result.cookie = cookies.join('; ');
+    }
+    if (jwt) {
+        result.jwt = jwt;
+    }
+    return result;
+}
+//# sourceMappingURL=forwardable-auth-headers.js.map

package/dist/helpers/forwardable-auth-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forwardable-auth-headers.js","sourceRoot":"","sources":["../../src/helpers/forwardable-auth-headers.ts"],"names":[],"mappings":"AAEA,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACxC,WAAW;IACX,2BAA2B;IAC3B,oCAAoC;IACpC,kCAAkC;CAClC,CAAC,CAAC;AAEH,SAAS,UAAU,CAAC,OAA2C,EAAE,IAAY;IAC5E,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACjC,OAAO,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAC3C,OAA2C;IAE3C,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,aAAa,EAAE,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,SAAS,EAAE,CAAC;QACf,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,SAAS,IAAI,CAAC;gBAAE,SAAS;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/C,IAAI,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtF,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;YAClC,CAAC;QACF,CAAC;IACF,CAAC;IACD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,GAAG,EAAE,CAAC;QACT,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;IAClB,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC"}

package/dist/helpers/index.d.ts

@@ -0,0 +1,7 @@
+export { matchesPattern, findMatches } from './pattern-matcher.ts';
+export { isIpInRange, isIpPrivate } from './ip-range.ts';
+export { extensionToMime, mimeToExtensions } from './mime-classifier.ts';
+export { sanitizeFilename } from './filename-sanitizer.ts';
+export { constantTimeEqual, constantTimeEqualBytes } from './constant-time.ts';
+export { selectForwardableAuthHeaders, type ForwardableAuthHeaders } from './forwardable-auth-headers.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/helpers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/helpers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EACN,4BAA4B,EAC5B,KAAK,sBAAsB,EAC3B,MAAM,+BAA+B,CAAC"}

package/dist/helpers/index.js

@@ -0,0 +1,7 @@
+export { matchesPattern, findMatches } from "./pattern-matcher.js";
+export { isIpInRange, isIpPrivate } from "./ip-range.js";
+export { extensionToMime, mimeToExtensions } from "./mime-classifier.js";
+export { sanitizeFilename } from "./filename-sanitizer.js";
+export { constantTimeEqual, constantTimeEqualBytes } from "./constant-time.js";
+export { selectForwardableAuthHeaders } from "./forwardable-auth-headers.js";
+//# sourceMappingURL=index.js.map

package/dist/helpers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/helpers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EACN,4BAA4B,EAE5B,MAAM,+BAA+B,CAAC"}

package/dist/helpers/ip-range.d.ts

@@ -0,0 +1,3 @@
+export declare function isIpInRange(ip: string, start: string, end: string): boolean;
+export declare function isIpPrivate(ip: string): boolean;
+//# sourceMappingURL=ip-range.d.ts.map

package/dist/helpers/ip-range.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-range.d.ts","sourceRoot":"","sources":["../../src/helpers/ip-range.ts"],"names":[],"mappings":"AAyCA,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAQ3E;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAQ/C"}

package/dist/helpers/ip-range.js

@@ -0,0 +1,55 @@
+import * as z from 'zod/v4';
+/**
+ * IPv4 dotted-quad membership.
+ *
+ * A range check is a decision about an address a caller did not choose, so it
+ * only ever matches an address it could read. Anything that is not four decimal
+ * octets in 0-255 — an empty string, `garbage`, `1.2.3`, a hex or octal literal,
+ * a value with surrounding space — is in no range at all. Coercing such a value
+ * to `0.0.0.0` would report it as a member of any range that starts there.
+ */
+const OCTET_PATTERN = /^(?:0|[1-9][0-9]{0,2})$/;
+const DOTTED_QUAD_SCHEMA = z.string().superRefine((address, context) => {
+    const octets = address.split('.');
+    if (octets.length !== 4) {
+        context.addIssue({
+            code: 'custom',
+            message: 'An IPv4 address is exactly four dot-separated octets'
+        });
+        return;
+    }
+    for (const [index, octet] of octets.entries()) {
+        if (!OCTET_PATTERN.test(octet) || Number(octet) > 255) {
+            context.addIssue({
+                code: 'custom',
+                path: [index],
+                message: `Octet ${index} is not a decimal number in 0-255`
+            });
+        }
+    }
+});
+/** The address as a 32-bit number, or undefined when it is not a dotted quad. */
+function ipToNumber(ip) {
+    if (!DOTTED_QUAD_SCHEMA.safeParse(ip).success)
+        return undefined;
+    const [first, second, third, fourth] = ip.split('.').map(Number);
+    return ((first << 24) | (second << 16) | (third << 8) | fourth) >>> 0;
+}
+export function isIpInRange(ip, start, end) {
+    const address = ipToNumber(ip);
+    const from = ipToNumber(start);
+    const to = ipToNumber(end);
+    // An address or a bound that does not parse is in no range. A membership
+    // question about a value the matcher could not read has no true answer.
+    if (address === undefined || from === undefined || to === undefined)
+        return false;
+    return address >= from && address <= to;
+}
+export function isIpPrivate(ip) {
+    return (isIpInRange(ip, '10.0.0.0', '10.255.255.255') ||
+        isIpInRange(ip, '172.16.0.0', '172.31.255.255') ||
+        isIpInRange(ip, '192.168.0.0', '192.168.255.255') ||
+        ip === '127.0.0.1' ||
+        ip === '::1');
+}
+//# sourceMappingURL=ip-range.js.map

package/dist/helpers/ip-range.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-range.js","sourceRoot":"","sources":["../../src/helpers/ip-range.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B;;;;;;;;GAQG;AAEH,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAEhD,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IACtE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,QAAQ,CAAC;YAChB,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,sDAAsD;SAC/D,CAAC,CAAC;QACH,OAAO;IACR,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC;YACvD,OAAO,CAAC,QAAQ,CAAC;gBAChB,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,KAAK,CAAC;gBACb,OAAO,EAAE,SAAS,KAAK,mCAAmC;aAC1D,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;AACF,CAAC,CAAC,CAAC;AAEH,iFAAiF;AACjF,SAAS,UAAU,CAAC,EAAU;IAC7B,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAChE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjE,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAU,EAAE,KAAa,EAAE,GAAW;IACjE,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC3B,yEAAyE;IACzE,wEAAwE;IACxE,IAAI,OAAO,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAClF,OAAO,OAAO,IAAI,IAAI,IAAI,OAAO,IAAI,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAU;IACrC,OAAO,CACN,WAAW,CAAC,EAAE,EAAE,UAAU,EAAE,gBAAgB,CAAC;QAC7C,WAAW,CAAC,EAAE,EAAE,YAAY,EAAE,gBAAgB,CAAC;QAC/C,WAAW,CAAC,EAAE,EAAE,aAAa,EAAE,iBAAiB,CAAC;QACjD,EAAE,KAAK,WAAW;QAClB,EAAE,KAAK,KAAK,CACZ,CAAC;AACH,CAAC"}

package/dist/helpers/mime-classifier.d.ts

@@ -0,0 +1,3 @@
+export declare function extensionToMime(ext: string): string | null;
+export declare function mimeToExtensions(mime: string): string[];
+//# sourceMappingURL=mime-classifier.d.ts.map

package/dist/helpers/mime-classifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mime-classifier.d.ts","sourceRoot":"","sources":["../../src/helpers/mime-classifier.ts"],"names":[],"mappings":"AAcA,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAO1D;AAID,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAKvD"}

package/dist/helpers/mime-classifier.js

@@ -0,0 +1,29 @@
+const MIME_MAP = {
+    'text/plain': ['txt', 'md', 'csv'],
+    'text/html': ['html', 'htm'],
+    'application/json': ['json'],
+    'image/png': ['png'],
+    'image/jpeg': ['jpg', 'jpeg'],
+    'application/pdf': ['pdf'],
+    'text/css': ['css'],
+    'text/javascript': ['js', 'mjs'],
+    'application/typescript': ['ts', 'mts'],
+    'text/xml': ['xml'],
+    'application/xml': ['xml'],
+};
+export function extensionToMime(ext) {
+    for (const [mime, exts] of Object.entries(MIME_MAP)) {
+        if (exts.includes(ext.toLowerCase())) {
+            return mime;
+        }
+    }
+    return null;
+}
+const EXTENSION_LOOKUP = new Map(Object.entries(MIME_MAP));
+export function mimeToExtensions(mime) {
+    // A copy: the table is module state, and handing a caller the live array
+    // would let one `push` rewrite the classifier for every later caller.
+    const extensions = EXTENSION_LOOKUP.get(mime);
+    return extensions === undefined ? [] : [...extensions];
+}
+//# sourceMappingURL=mime-classifier.js.map

package/dist/helpers/mime-classifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mime-classifier.js","sourceRoot":"","sources":["../../src/helpers/mime-classifier.ts"],"names":[],"mappings":"AAAA,MAAM,QAAQ,GAAG;IAChB,YAAY,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC;IAClC,WAAW,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;IAC5B,kBAAkB,EAAE,CAAC,MAAM,CAAC;IAC5B,WAAW,EAAE,CAAC,KAAK,CAAC;IACpB,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;IAC7B,iBAAiB,EAAE,CAAC,KAAK,CAAC;IAC1B,UAAU,EAAE,CAAC,KAAK,CAAC;IACnB,iBAAiB,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;IAChC,wBAAwB,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;IACvC,UAAU,EAAE,CAAC,KAAK,CAAC;IACnB,iBAAiB,EAAE,CAAC,KAAK,CAAC;CACS,CAAC;AAErC,MAAM,UAAU,eAAe,CAAC,GAAW;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAmB,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;AAE7E,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC5C,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC;AACxD,CAAC"}

package/dist/helpers/pattern-matcher.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Pattern matching over untrusted text.
+ *
+ * Both entry points work on a copy of the caller's `RegExp`. A `/g` or `/y`
+ * pattern carries `lastIndex` between calls, so matching the caller's own
+ * object would make a repeated identical question alternate between answers.
+ */
+export declare function matchesPattern(input: string, pattern: RegExp): boolean;
+export declare function findMatches(input: string, pattern: RegExp): Array<{
+    match: string;
+    index: number;
+}>;
+//# sourceMappingURL=pattern-matcher.d.ts.map

package/dist/helpers/pattern-matcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pattern-matcher.d.ts","sourceRoot":"","sources":["../../src/helpers/pattern-matcher.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,wBAAgB,WAAW,CAC1B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GACb,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAYzC"}

package/dist/helpers/pattern-matcher.js

@@ -0,0 +1,29 @@
+/**
+ * Pattern matching over untrusted text.
+ *
+ * Both entry points work on a copy of the caller's `RegExp`. A `/g` or `/y`
+ * pattern carries `lastIndex` between calls, so matching the caller's own
+ * object would make a repeated identical question alternate between answers.
+ */
+/** A copy of `pattern`, so the caller's `lastIndex` can never leak between calls. */
+function copyPattern(pattern) {
+    return new RegExp(pattern.source, pattern.flags);
+}
+export function matchesPattern(input, pattern) {
+    return copyPattern(pattern).test(input);
+}
+export function findMatches(input, pattern) {
+    const results = [];
+    const re = copyPattern(pattern);
+    let match;
+    while ((match = re.exec(input)) !== null) {
+        results.push({ match: match[0], index: match.index });
+        // A zero-length match leaves `lastIndex` where it already was, so a
+        // pattern that can match empty would spin on the same index forever.
+        // Advancing one code unit past it is what makes the walk terminate.
+        if (match[0].length === 0)
+            re.lastIndex = match.index + 1;
+    }
+    return results;
+}
+//# sourceMappingURL=pattern-matcher.js.map

package/dist/helpers/pattern-matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pattern-matcher.js","sourceRoot":"","sources":["../../src/helpers/pattern-matcher.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,qFAAqF;AACrF,SAAS,WAAW,CAAC,OAAe;IACnC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,OAAe;IAC5D,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,WAAW,CAC1B,KAAa,EACb,OAAe;IAEf,MAAM,OAAO,GAA4C,EAAE,CAAC;IAC5D,MAAM,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QACtD,oEAAoE;QACpE,qEAAqE;QACrE,oEAAoE;QACpE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,EAAE,CAAC,SAAS,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC"}

package/dist/implementations/cli-types.d.ts

@@ -0,0 +1,2 @@
+export type { CLIGroupAssetDescriptor, CLICommandAssetDescriptor } from '@vibesdotdev/cli/schemas/descriptors';
+//# sourceMappingURL=cli-types.d.ts.map

package/dist/implementations/cli-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-types.d.ts","sourceRoot":"","sources":["../../src/implementations/cli-types.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC"}

package/dist/implementations/cli-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cli-types.js.map

package/dist/implementations/cli-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-types.js","sourceRoot":"","sources":["../../src/implementations/cli-types.ts"],"names":[],"mappings":""}

package/dist/implementations/encryption.d.ts

@@ -0,0 +1,21 @@
+import { type EncryptionKeyRuntime } from './keys.ts';
+export { boundEncryptionKeyHex, readOrCreateKeyFile, resolveEncryptionKeyHexForBase, SECRET_ENCRYPTION_KEY_CREDENTIAL } from './keys.ts';
+import { type EncryptedSecret } from '../schemas/encryption.ts';
+export declare function encryptStringWithKey(data: string, keyHex: string): Uint8Array;
+export declare function decryptToStringWithKey(data: Uint8Array, keyHex: string): string;
+export declare function generateEncryptionKey(): string;
+export declare class SecretEncryption {
+    private readonly runtime;
+    constructor(runtime: EncryptionKeyRuntime);
+    private key;
+    encryptBytes(data: Uint8Array): Promise<Uint8Array>;
+    decryptBytes(encrypted: Uint8Array): Promise<Uint8Array>;
+    encryptString(data: string): Promise<Uint8Array>;
+    decryptToString(data: Uint8Array): Promise<string>;
+    encrypt(value: string): Promise<EncryptedSecret>;
+    decrypt(data: EncryptedSecret): Promise<string>;
+    encryptForStorage(value: string): Promise<string>;
+    decryptFromStorage(stored: string): Promise<string>;
+    static generateKey(): string;
+}
+//# sourceMappingURL=encryption.d.ts.map

package/dist/implementations/encryption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../src/implementations/encryption.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2B,KAAK,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAC/E,OAAO,EACN,qBAAqB,EACrB,mBAAmB,EACnB,8BAA8B,EAC9B,gCAAgC,EAChC,MAAM,WAAW,CAAC;AACnB,OAAO,EAA8G,KAAK,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAuG5K,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAE7E;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE/E;AA8BD,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,qBAAa,gBAAgB;IAChB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,oBAAoB;IAE1D,OAAO,CAAC,GAAG;IAIL,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAInD,YAAY,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAIxD,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAIhD,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAIlD,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAIhD,OAAO,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC;IAI/C,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKjD,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAWzD,MAAM,CAAC,WAAW,IAAI,MAAM;CAG5B"}

package/dist/implementations/encryption.js

@@ -0,0 +1,154 @@
+import { fromHex, toHex, fromBase64, toBase64 } from '@vibesdotdev/crypto/encoding';
+import { CapabilityError, CaughtFailureSchema } from '@vibesdotdev/kernel';
+import { resolveEncryptionKeyHex } from "./keys.js";
+export { boundEncryptionKeyHex, readOrCreateKeyFile, resolveEncryptionKeyHexForBase, SECRET_ENCRYPTION_KEY_CREDENTIAL } from "./keys.js";
+import { parseEncryptionKey, parseCiphertext, BinaryCiphertextSchema, EncryptedSecretSchema, StoredCiphertextSchema } from "../schemas/encryption.js";
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 16;
+const TAG_LENGTH = 16;
+const KEY_LENGTH = 32;
+const STORAGE_AAD = new TextEncoder().encode('secret');
+let _nodeCrypto = null;
+function nodeCrypto() {
+    if (_nodeCrypto)
+        return _nodeCrypto;
+    const loaded = globalThis.process?.getBuiltinModule?.('node:crypto');
+    if (!loaded) {
+        throw new CapabilityError('node:crypto is unavailable in this runtime.', 'UNAVAILABLE', {
+            reason: 'crypto-unavailable',
+            retryable: false
+        });
+    }
+    _nodeCrypto = loaded;
+    return loaded;
+}
+function keyFromHex(hex) {
+    return fromHex(parseEncryptionKey(hex));
+}
+const runtimeKeys = new WeakMap();
+/** One key resolution per runtime; a refused resolution is not cached, so a later bind is seen. */
+function keyFor(runtime) {
+    let key = runtimeKeys.get(runtime);
+    if (!key) {
+        key = resolveEncryptionKeyHex(runtime).then(keyFromHex);
+        runtimeKeys.set(runtime, key);
+        key.catch(() => {
+            if (runtimeKeys.get(runtime) === key)
+                runtimeKeys.delete(runtime);
+        });
+    }
+    return key;
+}
+function concatBytes(...parts) {
+    const result = new Uint8Array(parts.reduce((length, part) => length + part.byteLength, 0));
+    let offset = 0;
+    for (const part of parts) {
+        result.set(part, offset);
+        offset += part.byteLength;
+    }
+    return result;
+}
+function encryptBytesWith(key, data) {
+    const { createCipheriv, randomBytes } = nodeCrypto();
+    const iv = randomBytes(IV_LENGTH);
+    const cipher = createCipheriv(ALGORITHM, key, iv);
+    return concatBytes(iv, cipher.update(data), cipher.final(), cipher.getAuthTag());
+}
+function ciphertextInvalid(cause) {
+    return new CapabilityError('The encrypted data failed authentication: it is malformed, truncated or tampered with.', 'INVALID_INPUT', { reason: 'ciphertext-invalid', retryable: false, cause: CaughtFailureSchema.parse(cause) });
+}
+function decryptBytesWith(key, encrypted) {
+    parseCiphertext(BinaryCiphertextSchema, encrypted);
+    const driver = nodeCrypto();
+    const iv = encrypted.slice(0, IV_LENGTH);
+    const tag = encrypted.slice(encrypted.byteLength - TAG_LENGTH);
+    const ciphertext = encrypted.slice(IV_LENGTH, encrypted.byteLength - TAG_LENGTH);
+    try {
+        const decipher = driver.createDecipheriv(ALGORITHM, key, iv);
+        decipher.setAuthTag(tag);
+        return concatBytes(decipher.update(ciphertext), decipher.final());
+    }
+    catch (error) {
+        throw ciphertextInvalid(error);
+    }
+}
+export function encryptStringWithKey(data, keyHex) {
+    return encryptBytesWith(keyFromHex(keyHex), new TextEncoder().encode(data));
+}
+export function decryptToStringWithKey(data, keyHex) {
+    return new TextDecoder().decode(decryptBytesWith(keyFromHex(keyHex), data));
+}
+function encryptSecretWith(key, value) {
+    const { createCipheriv, randomBytes } = nodeCrypto();
+    const iv = randomBytes(IV_LENGTH);
+    const cipher = createCipheriv(ALGORITHM, key, iv);
+    cipher.setAAD(STORAGE_AAD);
+    const encrypted = concatBytes(cipher.update(new TextEncoder().encode(value)), cipher.final());
+    const tag = cipher.getAuthTag();
+    return {
+        iv: toBase64(iv),
+        tag: toBase64(tag),
+        encrypted: toBase64(encrypted)
+    };
+}
+function decryptSecretWith(key, data) {
+    data = parseCiphertext(EncryptedSecretSchema, data);
+    const driver = nodeCrypto();
+    try {
+        const decipher = driver.createDecipheriv(ALGORITHM, key, fromBase64(data.iv));
+        decipher.setAAD(STORAGE_AAD);
+        decipher.setAuthTag(fromBase64(data.tag));
+        return decipher.update(fromBase64(data.encrypted), undefined, 'utf8') + decipher.final('utf8');
+    }
+    catch (error) {
+        throw ciphertextInvalid(error);
+    }
+}
+export function generateEncryptionKey() {
+    return toHex(nodeCrypto().randomBytes(KEY_LENGTH));
+}
+export class SecretEncryption {
+    runtime;
+    constructor(runtime) {
+        this.runtime = runtime;
+    }
+    key() {
+        return keyFor(this.runtime);
+    }
+    async encryptBytes(data) {
+        return encryptBytesWith(await this.key(), data);
+    }
+    async decryptBytes(encrypted) {
+        return decryptBytesWith(await this.key(), encrypted);
+    }
+    async encryptString(data) {
+        return this.encryptBytes(new TextEncoder().encode(data));
+    }
+    async decryptToString(data) {
+        return new TextDecoder().decode(await this.decryptBytes(data));
+    }
+    async encrypt(value) {
+        return encryptSecretWith(await this.key(), value);
+    }
+    async decrypt(data) {
+        return decryptSecretWith(await this.key(), data);
+    }
+    async encryptForStorage(value) {
+        const secret = encryptSecretWith(await this.key(), value);
+        return `${secret.iv}:${secret.tag}:${secret.encrypted}`;
+    }
+    async decryptFromStorage(stored) {
+        parseCiphertext(StoredCiphertextSchema, stored);
+        const [iv, tag, encrypted, ...extra] = stored.split(':');
+        if (iv === undefined || tag === undefined || encrypted === undefined || extra.length > 0) {
+            throw new CapabilityError('Invalid encrypted value format', 'INVALID_INPUT', {
+                reason: 'ciphertext-invalid'
+            });
+        }
+        return decryptSecretWith(await this.key(), { iv, tag, encrypted });
+    }
+    static generateKey() {
+        return generateEncryptionKey();
+    }
+}
+//# sourceMappingURL=encryption.js.map

package/dist/implementations/encryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.js","sourceRoot":"","sources":["../../src/implementations/encryption.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,uBAAuB,EAA6B,MAAM,WAAW,CAAC;AAC/E,OAAO,EACN,qBAAqB,EACrB,mBAAmB,EACnB,8BAA8B,EAC9B,gCAAgC,EAChC,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,sBAAsB,EAAwB,MAAM,0BAA0B,CAAC;AAE5K,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAwBvD,IAAI,WAAW,GAA4B,IAAI,CAAC;AAChD,SAAS,UAAU;IAClB,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IACpC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE,gBAAgB,EAAE,CAAC,aAAa,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CAAC,6CAA6C,EAAE,aAAa,EAAE;YACvF,MAAM,EAAE,oBAAoB;YAC5B,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,WAAW,GAAG,MAAM,CAAC;IACrB,OAAO,MAAM,CAAC;AACf,CAAC;AACD,SAAS,UAAU,CAAC,GAAW;IAC9B,OAAO,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;AACzC,CAAC;AACD,MAAM,WAAW,GAAG,IAAI,OAAO,EAA+B,CAAC;AAE/D,mGAAmG;AACnG,SAAS,MAAM,CAAC,OAA6B;IAC5C,IAAI,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,GAAG,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxD,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC9B,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;YACd,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG;gBAAE,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,SAAS,WAAW,CAAC,GAAG,KAAmB;IAC1C,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzB,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAe,EAAE,IAAgB;IAC1D,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,UAAU,EAAE,CAAC;IACrD,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAElD,OAAO,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACxC,OAAO,IAAI,eAAe,CACzB,wFAAwF,EACxF,eAAe,EACf,EAAE,MAAM,EAAE,oBAAoB,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAC3F,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAe,EAAE,SAAqB;IAC/D,eAAe,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,GAAG,UAAU,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,UAAU,GAAG,UAAU,CAAC,CAAC;IAEjF,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7D,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;AACF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,MAAc;IAChE,OAAO,gBAAgB,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAgB,EAAE,MAAc;IACtE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAe,EAAE,KAAa;IACxD,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,UAAU,EAAE,CAAC;IACrD,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAE3B,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9F,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO;QACN,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC;QAChB,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC;QAClB,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;KAC9B,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAe,EAAE,IAAqB;IAChE,IAAI,GAAG,eAAe,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9E,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC7B,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;AACF,CAAC;AAED,MAAM,UAAU,qBAAqB;IACpC,OAAO,KAAK,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,OAAO,gBAAgB;IACC;IAA7B,YAA6B,OAA6B;QAA7B,YAAO,GAAP,OAAO,CAAsB;IAAG,CAAC;IAEtD,GAAG;QACV,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAgB;QAClC,OAAO,gBAAgB,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,SAAqB;QACvC,OAAO,gBAAgB,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAY;QAC/B,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,IAAgB;QACrC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,iBAAiB,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAqB;QAClC,OAAO,iBAAiB,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACpC,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;QAC1D,OAAO,GAAG,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,MAAc;QACtC,eAAe,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzD,IAAI,EAAE,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1F,MAAM,IAAI,eAAe,CAAC,gCAAgC,EAAE,eAAe,EAAE;gBAC5E,MAAM,EAAE,oBAAoB;aAC5B,CAAC,CAAC;QACJ,CAAC;QACD,OAAO,iBAAiB,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,CAAC,WAAW;QACjB,OAAO,qBAAqB,EAAE,CAAC;IAChC,CAAC;CACD"}