run402-mcp/sdk/dist/node/vault-member-bundle.d.ts

MCP server for Run402 — full-stack backend infrastructure for AI agents: Postgres, auth, storage, serverless functions and atomic deploys. Paid with x402/MPP. Includes $0.03 image generation.

import type { VaultMirrorBackend } from "./vault-mirror-backend.js";
export declare const VAULT_MEMBER_BUNDLE_FORMAT: "r402s-member-recovery-bundle/v1";
/** The mirrored-prefix sidecar directory recovery/verify scan for bundles. */
export declare const VAULT_MEMBER_BUNDLE_MIRROR_PREFIX: "member-recovery-bundles/";
/**
 * The seal-time ceremony host every wrapper in existence was sealed under
 * (`location.hostname` of the sealing console page). Used only when neither
 * the bundle nor the caller names one — the swrap2 context binds it, so a
 * wrong value fails closed as `WRAPPER_DID_NOT_OPEN`, never a silent
 * wrong-key open.
 */
export declare const VAULT_DEFAULT_SOURCE_WRAPPER_RP_ID: "console.run402.com";
export interface VaultMemberBundleWrapper {
    wrapper_id: string;
    kind: "webauthn_prf" | "recovery_code";
    format_version: string;
    credential_subject: string | null;
    /** The `swrap2_...` blob string itself. */
    wrapper_ciphertext: string;
    blob_sha256: string;
    created_at: string;
}
/** `r402s-member-recovery-bundle/v1` — exactly what the gateway export returns (plus the console download's client-stamped `rp_id`, when present). */
export interface VaultMemberRecoveryBundle {
    format: typeof VAULT_MEMBER_BUNDLE_FORMAT;
    exported_at?: string;
    principal_id: string;
    encryption_key_id: string;
    ek_fingerprint: string;
    /** Canonical base64url raw 32-byte X25519 member public key. */
    public_key: string;
    suite: string;
    custody_scheme: string;
    wrappers: VaultMemberBundleWrapper[];
    /** Seal-time ceremony host, when the exporting surface knew it (the console download stamps `location.hostname`). */
    rp_id?: string;
    note?: string;
}
/** Parse + shape-check a member recovery bundle (a JSON string or an already-parsed value). Typed refusal, never a silent partial. */
export declare function parseMemberRecoveryBundle(input: unknown, context?: string): VaultMemberRecoveryBundle;
export interface VaultMemberUnwrapResult {
    /** X25519 private scalar, lowercase hex — feed straight into the recovery identity. */
    private_key_hex: string;
    /** Raw 32-byte member public key (derived from the scalar and verified against the bundle). */
    public_key: Uint8Array;
    /** `ek_` fingerprint (verified against the bundle). */
    fingerprint: string;
    /** Which wrapper opened. */
    wrapper_id: string;
    /** The rp_id the successful context was built with (explicit > bundle > default). */
    rp_id_used: string;
}
/**
 * Open a member recovery bundle with the source recovery code, offline.
 *
 * Tries every `recovery_code` wrapper in the bundle (the AEAD authenticates,
 * so a wrong open fails closed — nothing is ever trusted un-verified), then
 * proves validity at use: derives the FULL public key from the recovered
 * scalar and compares it byte-for-byte against the bundle's published
 * `public_key` (and the `ek_` fingerprint). `webauthn_prf` wrappers are
 * deliberately not an input here — a raw PRF output is not portable key
 * material.
 */
export declare function unwrapMemberRecoveryBundle(input: {
    bundle: VaultMemberRecoveryBundle;
    source_recovery_code: string;
    /** Seal-time ceremony host override; default = bundle.rp_id, then {@link VAULT_DEFAULT_SOURCE_WRAPPER_RP_ID}. */
    rp_id?: string;
}): VaultMemberUnwrapResult;
/** One mirrored bundle sidecar, reported keylessly — an UNVERIFIED availability hint (nothing about it is authenticated). */
export interface VaultMemberBundleHint {
    key: string;
    /** Parsed identity when the sidecar is readable; null when it exists but does not parse as a v1 bundle. */
    ek_fingerprint: string | null;
    principal_id: string | null;
    wrapper_kinds: string[];
    parse_error: string | null;
}
/**
 * List `member-recovery-bundles/*.json` sidecars in a mirrored prefix,
 * best-effort — the keyless-verify "availability hints" and recovery's
 * bundle auto-discovery both read this. Never throws: an unreadable or
 * malformed sidecar is reported with its parse error, not skipped silently.
 */
export declare function discoverMemberBundles(backend: VaultMirrorBackend): Promise<Array<VaultMemberBundleHint & {
    bundle: VaultMemberRecoveryBundle | null;
}>>;
//# sourceMappingURL=vault-member-bundle.d.ts.map