feat(B-0852.2a): wire-format envelope serializer + CredBundle plaintext schema (17 unit tests; pure functions)

[AceHack]

Summary

B-0852 sub-row .2 first slice — the on-disk wire format that B-0852.2b persist/restore CLIs will use to read/write `/esp/zeta-creds.enc`. Pure functions; no I/O.

Wire format (binary; v1 magic `ZCV1`)

Field	Type	Notes
magic	4 bytes	"ZCV1"
reserved	4 bytes	zero (future-version-bump)
salt_len + salt	u16 + bytes	from B-0852.1 envelope
iv_len + iv	u16 + bytes
tag_len + tag	u16 + bytes
ciphertext_len + ciphertext	u32 + bytes

Trailing bytes rejected in v1 (v2 will explicit-version-bump).

CredBundle plaintext schema (post-decryption)

```json
{
"schemaVersion": 1,
"globalCreds": { "": "" },
"personaCreds": { "": { "": "" } }
}
```

`personaScoped:false` manifest entries (B-0852.5) → `globalCreds`; `personaScoped:true` → `personaCreds[]`. Composes with B-0852.5 semantics.

Full pipeline (covered by integration test)

```
CredBundle → encodeBundle → encrypt (B-0852.1) → serializeEnvelope
→ [disk write/read simulation] →
parseEnvelope → decrypt → decodeBundle → CredBundle (byte-identical)
```

Test output

```
17 pass
0 fail
29 expect() calls
Ran 17 tests across 1 file. [1.67s]
```

scrypt N=2^17 dominates timing per B-0852.1 OWASP-recommended parameters.

Composes with

• B-0852.1 crypto module (merged PR feat(B-0852.1): TS crypto module — HKDF-SHA256 + AES-256-GCM for credential persistence (pure functions; 18 unit tests; smallest concrete substrate slice) #5411) — Envelope type producer/consumer
• B-0852.5 cred-manifest schema (merged PR feat(B-0852.5): declarative cred-manifest schema + validator — pure types + DEFAULT_MANIFEST (6 entries) + 21 unit tests (Aaron 2026-05-27 declarative discipline) #5414) — `personaScoped` semantics drive bundle layout
• B-0852.10 per-cred handlers (merged PR feat(B-0852.10): per-cred type handlers — parse <id>=<source> + resolve literal/@file/env:VAR + per-type validation (60 unit tests; pure TS) #5418) — value producers feed bundle maps
• B-0852.2b future — persist/restore CLIs consume this module

What this is NOT

• NOT the persist CLI (next slice; needs FS + passphrase prompt)
• NOT the restore CLI (next slice; same)
• NOT zflash `--bake-cred` integration (B-0852.9)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[Copilot]

Pull request overview

Adds the B-0852.2a “envelope framing” layer for credential persistence by defining (1) a binary on-disk wire format for the encrypted envelope produced by zeta-creds-crypto.ts, and (2) a JSON plaintext schema (CredBundle) for the decrypted inner payload. This fits into the installer toolchain as the serialization boundary that future persist/restore CLIs will consume.

Changes:

• Introduces serializeEnvelope / parseEnvelope for a length-prefixed binary envelope format with a ZCV1 header.
• Introduces CredBundle + encodeBundle / decodeBundle for base64-in-JSON plaintext encoding.
• Adds 17 unit tests covering round-trips and several framing/JSON error paths.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.

File	Description
tools/installer/zeta-creds-envelope.ts	Implements wire-format framing for crypto envelopes plus CredBundle JSON encoding/decoding.
tools/installer/zeta-creds-envelope.test.ts	Adds unit tests for envelope framing, bundle encode/decode, and full pipeline round-trip.