{
  "manifest_version": 1,
  "release_date_utc": "2026-10-06",
  "package": {
    "id": "store.væult",
    "name": "væult",
    "version": "0.1.0",
    "license": "MIT",
    "boundary": "OPENSOURCEWARE_BOUNDARY.md"
  },
  "artifact": {
    "path": "væult.py",
    "size_bytes": 16033,
    "sha256": "fe18c549b12d2bbd25d73c14c4a1f39f18b8785f57fb51612313080b7e4cb954",
    "lines": 393,
    "single_file": true,
    "line_endings": "LF",
    "hash_note": "sha256 is over the SHIPPED (LF) artifact — git normalizes CRLF on commit, so a Windows checkout will differ until renormalized. Verify the download, not the working copy."
  },
  "runtime": {
    "python": ">=3.10",
    "hard_dependencies": [
      "cryptography"
    ],
    "optional_dependencies": [
      "qrcode",
      "pillow",
      "pyzbar"
    ],
    "network": false
  },
  "crypto": {
    "kdf": "scrypt",
    "kdf_params": {
      "n": 32768,
      "r": 8,
      "p": 1
    },
    "cipher": "AES-256-GCM",
    "aead": true,
    "nonce_bits": 96,
    "name_binding": "AAD"
  },
  "commands": [
    "init",
    "set",
    "get",
    "list",
    "rm",
    "export",
    "verify",
    "qr",
    "qr-show",
    "qr-open"
  ],
  "env": {
    "VAEULT_PATH": "vault file location (default: <root>/secrets/privateclient/privateclient.væult)",
    "VAEULT_PASSPHRASE": "non-interactive unlock for scripts (never persisted)",
    "VAEULT_VALUE": "non-interactive value for `set` (never persisted)"
  },
  "verification": {
    "compile": "pass",
    "self_test": "pass",
    "neutral_path": "pass",
    "no_network": "pass",
    "qr_roundtrip": "pass",
    "wrong_passphrase_refused": "pass"
  },
  "consumers": [
    "plugins/privateclient-vault (Hermes desktop pane)",
    "any local agent via the GLOCAL secret-source contract"
  ],
  "custody": {
    "secrets_local_only": true,
    "qr_carries": "sealed envelope (ciphertext), never plaintext",
    "crosses_network": "never"
  }
}