@ai-ecoverse/slicc-agent 3.52.0 → 4.0.0

package/dist/types/mcp/credentials.d.ts

@@ -1,15 +1,17 @@
-import type { CredentialStore } from '@earendil-works/pi-ai';
 import { type McpServerConfig } from './config.ts';
 export declare const MCP_CREDENTIAL_PREFIX = "mcp:";
+export interface McpRecords {
+    mcp(server: string, name?: string): {
+        placeholder: string;
+    } | undefined;
+}
 export declare function credentialKey(server: string, url: string): Promise<string>;
 export declare function secretNames(config: McpServerConfig): string[];
 export type Resolved = {
     ok: true;
     headers: Record<string, string>;
-    secrets: string[];
 } | {
     ok: false;
     missing: string[];
 };
-export declare function resolveHeaders(server: string, config: McpServerConfig, credentials: CredentialStore): Promise<Resolved>;
-export declare function scrub(text: string, secrets: readonly string[]): string;
+export declare function resolveHeaders(server: string, config: McpServerConfig, records: McpRecords): Resolved;

package/dist/types/mcp/oauth.d.ts

@@ -1,6 +1,6 @@
-import type { CredentialStore } from '@earendil-works/pi-ai';
 import type { AuthProvider, McpFetch } from '@earendil-works/pi-mcp';
 import { authorizeMcp, McpOAuthAuthorizationRequiredError, type McpOAuthState } from '@earendil-works/pi-mcp/oauth';
+import type { PlainStore } from '../secrets/store.ts';
 import type { McpSignIn } from '../services.ts';
 import type { McpServerConfig } from './config.ts';
 type Provider = Parameters<typeof authorizeMcp>[0];
@@ -25,7 +25,7 @@ export declare class StoredOAuth implements Provider {
     #private;
     readonly redirectUrl: string;
     readonly clientMetadata: Provider['clientMetadata'];
-    constructor(server: OAuthServer, credentials: CredentialStore, redirectUrl: string);
+    constructor(server: OAuthServer, store: PlainStore, redirectUrl: string);
     get serverUrl(): string;
     load(): Promise<McpOAuthState>;
     update(change: (state: McpOAuthState) => McpOAuthState): Promise<void>;
@@ -47,6 +47,7 @@ export type { McpSignIn } from '../services.ts';
 export declare function beginSignIn(provider: StoredOAuth, server: OAuthServer, options: {
     fetch: McpFetch;
     resourceMetadataUrl?: URL;
+    register(tokenUrl: string): Promise<void>;
 }): Promise<McpSignIn>;
 export interface Callback {
     code?: string;

package/dist/types/mcp/runtime.d.ts

@@ -1,20 +1,35 @@
 import type { Context } from '@earendil-works/chord';
-import type { CredentialStore } from '@earendil-works/pi-ai';
 import type { Registry } from '@earendil-works/pi-durable';
 import type { ExecutionEnv } from '@earendil-works/pi-durable/env';
 import type { LickEvent, Licks } from '../licks/licks.ts';
+import type { McpServerSource } from '../secrets/endpoints.ts';
+import type { PlainStore } from '../secrets/store.ts';
 import { type McpAccounts } from './accounts.ts';
 import { McpCatalog } from './catalog.ts';
 import { type McpConfigProblem } from './config.ts';
 import { McpServerConnection } from './connection.ts';
+import { type McpRecords } from './credentials.ts';
 export declare const MCP_LOG_MAX_BYTES: number;
 export { configPath, logPath, shown } from './paths.ts';
+export interface McpVault {
+    records: McpRecords & {
+        refresh(context: Context): Promise<void>;
+        state: {
+            subscribe(listener: () => void): () => void;
+        };
+    };
+    fetch(server: string, base: typeof fetch): typeof fetch;
+    grant(server: string, base: typeof fetch): typeof fetch;
+    servers(list: readonly McpServerSource[]): Promise<void>;
+    token(server: string, url: string): Promise<void>;
+}
 export interface McpAttach {
     licks: Licks;
     env: ExecutionEnv;
     home: string;
     agentDir?: string;
-    credentials: CredentialStore;
+    store: PlainStore;
+    vault: McpVault;
     fetch: typeof fetch;
     version: string;
     reloadMs: number;
@@ -31,14 +46,13 @@ export interface ServerStatus {
 export type { McpAccounts } from './accounts.ts';
 export interface McpRuntime extends McpAccounts {
     status(): ServerStatus[];
-    secrets(): string[];
     reload(context: Context): Promise<void>;
     close(context: Context): Promise<void>;
 }
 export declare function problemLick(problem: McpConfigProblem, home: string, dir?: string): LickEvent;
 export declare function stateLick(connection: McpServerConnection, cors: boolean): LickEvent | undefined;
 export declare function connectedLick(connection: McpServerConnection): LickEvent;
-export declare function logLine(server: string, params: unknown, secrets: readonly string[], at: Date): string;
+export declare function logLine(server: string, params: unknown, at: Date): string;
 export declare function attachMcp(catalog: McpCatalog, options: McpAttach, context: Context): Promise<McpRuntime>;
 export declare function startMcp(registry: Registry, options: McpAttach, context: Context): Promise<{
     catalog: McpCatalog;

package/dist/types/models/index.d.ts

@@ -11,6 +11,8 @@ export interface ModelsOptions {
     agents: Agents;
     settings: Pick<AgentSettings, 'state'>;
     catalog: Pick<Models, 'getProviders' | 'getModels'>;
+    locked?: () => boolean;
 }
+export declare const LOCKED_NOTE = "the vault is locked: unlock it to use these accounts";
 export declare function closest(wanted: string, ids: readonly string[], count?: number): string[];
 export declare function modelsCommand(options: ModelsOptions): (argv: readonly string[], caller: string | null, context: Context) => Promise<Answer>;

package/dist/types/monitor/index.d.ts

@@ -47,7 +47,6 @@ export interface MonitorOptions {
         name: string;
         uid: number;
     }[]>;
-    secrets?: () => readonly string[];
     now?: () => number;
     timers?: Timers;
     ttlMs?: number;

package/dist/types/monitor/redact.d.ts

@@ -1,5 +1,5 @@
 export declare const TEXT_MAX = 160;
 export declare function cut(text: string, max?: number): string;
-export declare function redacted(text: string, secrets: readonly string[]): string;
-export declare function commandLine(argv: readonly string[], secrets: readonly string[]): string;
+export declare function redacted(text: string): string;
+export declare function commandLine(argv: readonly string[]): string;
 export declare function program(argv: readonly string[]): string;

package/dist/types/secrets/credentials.d.ts

@@ -0,0 +1,5 @@
+import type { CredentialStore } from '@earendil-works/pi-ai';
+import type { VaultRecords } from './records.ts';
+export declare const KEYS_IN_VAULT = "model keys are kept in seven's vault: enter them in Settings \u203A Accounts";
+export type FieldsOf = (providerId: string) => Readonly<Record<string, string>> | undefined;
+export declare function vaultCredentials(records: Pick<VaultRecords, 'model' | 'state'>, env?: FieldsOf): CredentialStore;

package/dist/types/secrets/endpoints.d.ts

@@ -0,0 +1,27 @@
+import type { McpServerEntry, ModelEndpoint } from '@ai-ecoverse/slicc-vault';
+import type { ModelRoute } from './fetch.ts';
+import type { AgentRecord } from './records.ts';
+import type { Vault } from './vault.ts';
+export declare const BEDROCK_ENDPOINTS: string[];
+export declare function modelUrl(raw: string): boolean;
+export declare function mcpUrl(raw: string): boolean;
+export declare function pattern(base: string): RegExp;
+export interface ModelBases {
+    provider: string;
+    urls: readonly string[];
+}
+export declare function modelRoute(bases: () => readonly ModelBases[], records: () => readonly AgentRecord[]): ModelRoute;
+export declare function modelEndpoints(bases: readonly ModelBases[]): ModelEndpoint[];
+export interface McpServerSource {
+    server: string;
+    url: string;
+    names: readonly string[];
+}
+export declare function mcpEndpoints(servers: readonly McpServerSource[], tokens: ReadonlyMap<string, string>): McpServerEntry[];
+export interface Endpoints {
+    models(bases: readonly ModelBases[]): Promise<void>;
+    servers(servers: readonly McpServerSource[]): Promise<void>;
+    token(server: string, url: string): Promise<void>;
+    close(): void;
+}
+export declare function vaultEndpoints(vault: Pick<Vault, 'state' | 'connected' | 'endpoints'>): Endpoints;

package/dist/types/secrets/fetch.d.ts

@@ -0,0 +1,13 @@
+import type { OutgoingRequest } from '@ai-ecoverse/slicc-vault';
+import { type Vault } from './vault.ts';
+type Fetch = typeof fetch;
+type Port = Pick<Vault, 'connected' | 'needed' | 'model' | 'mcp' | 'refresh' | 'grant'>;
+export type ModelRoute = (request: Request) => string | null | undefined;
+export declare function absent(vault: Pick<Vault, 'connected' | 'needed'>): boolean;
+export declare function refusal(error: unknown): Response;
+export declare function safeError(error: unknown, original: OutgoingRequest, ready: OutgoingRequest): DOMException | TypeError;
+export declare function vaultFetch(vault: Port, inner: Fetch, route: ModelRoute): Fetch;
+export declare function mcpFetch(vault: Port, inner: Fetch, server: string): Fetch;
+export declare const NO_VAULT_SIGN_IN = "MCP sign-in needs seven's vault: update seven";
+export declare function grantFetch(vault: Port, server: string, base: Fetch): Fetch;
+export {};

package/dist/types/secrets/records.d.ts

@@ -0,0 +1,13 @@
+import type { AgentRecord } from '@ai-ecoverse/slicc-vault';
+import { type Context, type MutableReplicatedState } from '@earendil-works/chord';
+import type { Vault } from './vault.ts';
+export type { AgentRecord } from '@ai-ecoverse/slicc-vault';
+export interface VaultRecords {
+    readonly state: MutableReplicatedState<AgentRecord[]>;
+    refresh(context: Context): Promise<void>;
+    model(provider: string): AgentRecord | undefined;
+    mcp(server: string, name?: string): AgentRecord | undefined;
+    close(): void;
+}
+type Source = Pick<Vault, 'state' | 'records' | 'connected' | 'needed'>;
+export declare function vaultRecords(vault: Source): VaultRecords;

package/dist/types/secrets/store.d.ts

@@ -0,0 +1,7 @@
+import type { ExecutionEnv } from '@earendil-works/pi-durable/env';
+export interface PlainStore {
+    get(key: string): Promise<unknown>;
+    set(key: string, value: unknown): Promise<void>;
+}
+export declare function memoryStore(): PlainStore;
+export declare function fileStore(env: ExecutionEnv, path: string): PlainStore;

package/dist/types/secrets/vault.d.ts

@@ -1,3 +1,4 @@
+import type { AgentRecord, ErrorCode, McpServerEntry, ModelEndpoint, OAuthConfig, OutgoingRequest } from '@ai-ecoverse/slicc-vault';
 import { type MutableReplicatedState } from '@earendil-works/chord';
 import type { Scrub, Scrubbable, ScrubStream } from './scrub.ts';
 export type ScrubPair = {
@@ -14,14 +15,43 @@ export interface VaultState {
 }
 export declare const WAITING_MS = 2000;
 export declare const WAITING = "waiting for the vault";
+export declare class VaultRefusal extends Error {
+    readonly code: ErrorCode | undefined;
+    constructor(code: ErrorCode | undefined, message: string);
+}
+export type RefreshTarget = {
+    server: string;
+} | {
+    provider: string;
+};
+export interface Granted {
+    response: string | Uint8Array;
+    records: {
+        kind: string;
+        name: string;
+        placeholder: string;
+    }[];
+    expiresAt?: number;
+}
+export interface EndpointSet {
+    model: ModelEndpoint[];
+    mcp: McpServerEntry[];
+}
 export declare class Vault implements Scrub {
     #private;
     readonly state: MutableReplicatedState<VaultState>;
     constructor(now?: () => number);
     get needed(): boolean;
-    connect(port: MessagePort | undefined, scrub: unknown): void;
+    get connected(): boolean;
+    connect(port: MessagePort | undefined, scrub: unknown, locked?: unknown): void;
     ready(): Promise<void>;
     texts<T extends Scrubbable>(texts: readonly T[]): Promise<T[]>;
+    model(provider: string | undefined, request: OutgoingRequest): Promise<OutgoingRequest>;
+    mcp(server: string, request: OutgoingRequest): Promise<OutgoingRequest>;
+    records(): Promise<AgentRecord[]>;
+    grant(server: string, response: string | Uint8Array, oauth: OAuthConfig, name?: string): Promise<Granted>;
+    refresh(target: RefreshTarget, name?: string): Promise<string>;
+    endpoints(set: EndpointSet): Promise<void>;
     stream(): ScrubStream;
 }
 export declare function holdText(state: VaultState): string | undefined;

package/dist/types/services.d.ts

@@ -278,6 +278,13 @@ export interface AccountState {
     needs: 'cors-free-transport' | null;
     group?: 'providers' | 'mcp';
     secret?: 'api-key' | 'token';
+    store?: 'vault';
+    fields?: AccountField[];
+}
+export interface AccountField {
+    name: string;
+    label: string;
+    required?: boolean;
 }
 export interface BudgetState {
     provider: string;
@@ -301,7 +308,7 @@ export interface SettingsState {
 }
 export interface AgentSettings {
     readonly state: ReplicatedState<SettingsState>;
-    connect(providerId: string, secret: string, region: string | null, context: Context): Promise<void>;
+    connect(providerId: string, secret: string | null, fields: Record<string, string> | null, context: Context): Promise<void>;
     disconnect(providerId: string, context: Context): Promise<void>;
     signIn(providerId: string, context: Context): Promise<SignIn | McpSignIn | null>;
 }

package/dist/types/settings.d.ts

@@ -2,19 +2,34 @@ import type { CredentialStore, Provider } from '@earendil-works/pi-ai';
 import { type MutableModels } from '@earendil-works/pi-ai/models';
 import { type Budget } from './adobe.ts';
 import type { McpAccounts } from './mcp/index.ts';
-import type { AgentSettings } from './services.ts';
+import type { VaultRecords } from './secrets/records.ts';
+import type { PlainStore } from './secrets/store.ts';
+import type { AccountField, AgentSettings } from './services.ts';
 export declare const BEDROCK = "amazon-bedrock";
 export declare const DEFAULT_MODEL: {
     provider: string;
     modelId: string;
 };
 export declare const DEFAULT_REGIONS: Readonly<Record<string, string>>;
+export declare const ACCOUNT_FIELDS: Readonly<Record<string, readonly AccountField[]>>;
+export declare const SIGN_IN_NEEDS_VAULT = "Adobe sign-in needs seven's vault: update seven";
+export declare const KEY_NEEDS_VAULT = "API keys are kept in seven's vault: update seven";
 export declare function sliccProviders(version?: string): Provider[];
 export declare function withDefaultRegions(credentials: CredentialStore): CredentialStore;
 export declare function createSliccModels(credentials: CredentialStore, providers?: Provider<import("@earendil-works/pi-ai").Api>[]): MutableModels;
+export interface ProviderFields {
+    get(providerId: string): Readonly<Record<string, string>> | undefined;
+    env(providerId: string): Readonly<Record<string, string>> | undefined;
+    set(providerId: string, fields: Record<string, string> | undefined): Promise<void>;
+}
+export declare function providerFields(store: PlainStore, providers: readonly Provider[]): Promise<ProviderFields>;
 export declare function shown<T>(run: () => Promise<T>): Promise<T>;
 export type UsageReader = (token: string) => Promise<Budget | null>;
-export declare function createAgentSettings(models: MutableModels, credentials: CredentialStore, providers?: Provider<import("@earendil-works/pi-ai").Api>[], options?: {
+export interface SettingsSources {
+    records: VaultRecords;
+    fields: ProviderFields;
+}
+export declare function createAgentSettings(models: MutableModels, sources: SettingsSources, providers?: Provider<import("@earendil-works/pi-ai").Api>[], options?: {
     usage?: UsageReader;
     every?: number;
     mcp?: McpAccounts;

package/dist/types/spectrum/settings-port.d.ts

@@ -3,9 +3,13 @@ import type { AgentSettings, SignIn } from '../services.ts';
 import type { AgentAdapter } from './agent-port.ts';
 import { Emitter } from './emitter.ts';
 export declare const SETTINGS_KEY = "slicc-agent.settings";
+export type Sealed = {
+    sealed: true;
+};
 export type Login = (providerId: string, signIn: () => Promise<SignIn | null>, options: {
     signal: AbortSignal;
-}) => Promise<string>;
+}) => Promise<string | Sealed>;
+export declare const SIGN_IN_NEEDS_VAULT = "Adobe sign-in needs seven's vault: update seven";
 export declare class SettingsAdapter extends Emitter<SettingsEvents> implements SettingsPort {
     #private;
     constructor(settings: AgentSettings, agent: AgentAdapter, storage: Pick<Storage, 'getItem' | 'setItem'> | null, login?: Login | null, mcp?: Login);
@@ -13,9 +17,7 @@ export declare class SettingsAdapter extends Emitter<SettingsEvents> implements
     update(patch: Partial<Settings>): void;
     models(): readonly ModelOption[];
     accounts(): readonly Account[];
-    connect(id: string, secret?: string, options?: {
-        region?: string;
-    }): Promise<void>;
+    connect(id: string, secret?: string, fields?: Record<string, string>): Promise<void>;
     cancel(id: string): void;
     disconnect(id: string): void;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-agent",
-  "version": "3.52.0",
+  "version": "4.0.0",
   "description": "SLICC's agent core on pi durable: an agent worker, session storage, remoting and pi extensions",
   "type": "module",
   "license": "Apache-2.0",
@@ -62,8 +62,9 @@
   },
   "devDependencies": {
     "@ai-ecoverse/slicc-kernel": "1.47.1",
+    "@ai-ecoverse/slicc-scrub": "1.0.0",
     "@ai-ecoverse/slicc-shared-web": "1.13.1",
-    "@ai-ecoverse/slicc-spectrum": "1.68.3",
+    "@ai-ecoverse/slicc-spectrum": "1.69.2",
     "@ai-ecoverse/wasm-bash": "5.3.0-18",
     "@ai-ecoverse/wasm-coreutils": "9.12.0-5",
     "@ai-ecoverse/wasm-git": "2.55.0-15",
@@ -79,6 +80,7 @@
   },
   "dependencies": {
     "@ai-ecoverse/slicc-browsers": "1.5.0",
+    "@ai-ecoverse/slicc-vault": "1.9.0",
     "@earendil-works/chord": "1.0.4",
     "@earendil-works/pi-ai": "1.0.4",
     "@earendil-works/pi-client": "1.0.4",
@@ -91,7 +93,7 @@
   },
   "peerDependencies": {
     "@ai-ecoverse/slicc-kernel": ">=1.47.1 <2",
-    "@ai-ecoverse/slicc-spectrum": "^1.39.0"
+    "@ai-ecoverse/slicc-spectrum": "^1.59.0"
   },
   "peerDependenciesMeta": {
     "@ai-ecoverse/slicc-spectrum": {

package/dist/credentials.js

@@ -1,100 +0,0 @@
-const CREDENTIALS_DATABASE = "slicc-agent-credentials";
-function request(operation) {
-  return new Promise((resolve, reject) => {
-    operation.onsuccess = () => resolve(operation.result);
-    operation.onerror = () => reject(operation.error);
-  });
-}
-function open(name) {
-  const opening = indexedDB.open(name, 1);
-  opening.onupgradeneeded = () => {
-    opening.result.createObjectStore("keys");
-    opening.result.createObjectStore("credentials");
-  };
-  return request(opening);
-}
-async function sealingKey(db) {
-  const keys = db.transaction("keys", "readonly").objectStore("keys");
-  const existing = await request(keys.get("aes"));
-  if (existing) return existing;
-  const key = await crypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, false, [
-    "encrypt",
-    "decrypt"
-  ]);
-  const store = db.transaction("keys", "readwrite").objectStore("keys");
-  await request(store.add(key, "aes")).catch(() => void 0);
-  return await request(
-    db.transaction("keys", "readonly").objectStore("keys").get("aes")
-  );
-}
-class EncryptedCredentialStore {
-  #db;
-  #key;
-  #chains = /* @__PURE__ */ new Map();
-  constructor(db, key) {
-    this.#db = db;
-    this.#key = key;
-  }
-  static async open(name = CREDENTIALS_DATABASE) {
-    const db = await open(name);
-    return new EncryptedCredentialStore(db, await sealingKey(db));
-  }
-  #store(mode) {
-    return this.#db.transaction("credentials", mode).objectStore("credentials");
-  }
-  async read(providerId) {
-    const sealed = await request(this.#store("readonly").get(providerId));
-    if (!sealed) return void 0;
-    const plain = await crypto.subtle.decrypt(
-      { name: "AES-GCM", iv: sealed.iv },
-      this.#key,
-      sealed.data
-    );
-    return JSON.parse(new TextDecoder().decode(plain));
-  }
-  async list() {
-    const ids = await request(this.#store("readonly").getAllKeys());
-    const found = [];
-    for (const providerId of ids) {
-      const credential = await this.read(providerId);
-      if (credential) found.push({ providerId, type: credential.type });
-    }
-    return found;
-  }
-  #serial(providerId, operation) {
-    const result = (this.#chains.get(providerId) ?? Promise.resolve()).then(operation);
-    this.#chains.set(
-      providerId,
-      result.catch(() => void 0)
-    );
-    return result;
-  }
-  modify(providerId, fn) {
-    return this.#serial(providerId, async () => {
-      const current = await this.read(providerId);
-      const next = await fn(current);
-      if (next === void 0) return current;
-      const iv = crypto.getRandomValues(new Uint8Array(12));
-      const data = await crypto.subtle.encrypt(
-        { name: "AES-GCM", iv },
-        this.#key,
-        new TextEncoder().encode(JSON.stringify(next))
-      );
-      await request(this.#store("readwrite").put({ iv, data }, providerId));
-      return next;
-    });
-  }
-  delete(providerId) {
-    return this.#serial(providerId, async () => {
-      await request(this.#store("readwrite").delete(providerId));
-    });
-  }
-  close() {
-    this.#db.close();
-  }
-}
-export {
-  CREDENTIALS_DATABASE,
-  EncryptedCredentialStore
-};
-//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/credentials.ts"],
-  "sourcesContent": ["import type { Credential, CredentialInfo, CredentialStore } from '@earendil-works/pi-ai';\n\nexport const CREDENTIALS_DATABASE = 'slicc-agent-credentials';\n\ninterface Sealed {\n  iv: Uint8Array<ArrayBuffer>;\n  data: ArrayBuffer;\n}\n\nfunction request<T>(operation: IDBRequest<T>): Promise<T> {\n  return new Promise((resolve, reject) => {\n    operation.onsuccess = () => resolve(operation.result);\n    operation.onerror = () => reject(operation.error);\n  });\n}\n\nfunction open(name: string): Promise<IDBDatabase> {\n  const opening = indexedDB.open(name, 1);\n  opening.onupgradeneeded = () => {\n    opening.result.createObjectStore('keys');\n    opening.result.createObjectStore('credentials');\n  };\n  return request(opening);\n}\n\nasync function sealingKey(db: IDBDatabase): Promise<CryptoKey> {\n  const keys = db.transaction('keys', 'readonly').objectStore('keys');\n  const existing = (await request(keys.get('aes'))) as CryptoKey | undefined;\n  if (existing) return existing;\n  const key = await crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, false, [\n    'encrypt',\n    'decrypt',\n  ]);\n  const store = db.transaction('keys', 'readwrite').objectStore('keys');\n  await request(store.add(key, 'aes')).catch(() => undefined);\n  return (await request(\n    db.transaction('keys', 'readonly').objectStore('keys').get('aes')\n  )) as CryptoKey;\n}\n\nexport class EncryptedCredentialStore implements CredentialStore {\n  readonly #db: IDBDatabase;\n  readonly #key: CryptoKey;\n  readonly #chains = new Map<string, Promise<unknown>>();\n\n  private constructor(db: IDBDatabase, key: CryptoKey) {\n    this.#db = db;\n    this.#key = key;\n  }\n\n  static async open(name = CREDENTIALS_DATABASE): Promise<EncryptedCredentialStore> {\n    const db = await open(name);\n    return new EncryptedCredentialStore(db, await sealingKey(db));\n  }\n\n  #store(mode: IDBTransactionMode): IDBObjectStore {\n    return this.#db.transaction('credentials', mode).objectStore('credentials');\n  }\n\n  async read(providerId: string): Promise<Credential | undefined> {\n    const sealed = (await request(this.#store('readonly').get(providerId))) as Sealed | undefined;\n    if (!sealed) return undefined;\n    const plain = await crypto.subtle.decrypt(\n      { name: 'AES-GCM', iv: sealed.iv },\n      this.#key,\n      sealed.data\n    );\n    return JSON.parse(new TextDecoder().decode(plain)) as Credential;\n  }\n\n  async list(): Promise<readonly CredentialInfo[]> {\n    const ids = (await request(this.#store('readonly').getAllKeys())) as string[];\n    const found: CredentialInfo[] = [];\n    for (const providerId of ids) {\n      const credential = await this.read(providerId);\n      if (credential) found.push({ providerId, type: credential.type });\n    }\n    return found;\n  }\n\n  #serial<T>(providerId: string, operation: () => Promise<T>): Promise<T> {\n    const result = (this.#chains.get(providerId) ?? Promise.resolve()).then(operation);\n    this.#chains.set(\n      providerId,\n      result.catch(() => undefined)\n    );\n    return result;\n  }\n\n  modify(\n    providerId: string,\n    fn: (current: Credential | undefined) => Promise<Credential | undefined>\n  ): Promise<Credential | undefined> {\n    return this.#serial(providerId, async () => {\n      const current = await this.read(providerId);\n      const next = await fn(current);\n      if (next === undefined) return current;\n      const iv = crypto.getRandomValues(new Uint8Array(12));\n      const data = await crypto.subtle.encrypt(\n        { name: 'AES-GCM', iv },\n        this.#key,\n        new TextEncoder().encode(JSON.stringify(next))\n      );\n      await request(this.#store('readwrite').put({ iv, data } satisfies Sealed, providerId));\n      return next;\n    });\n  }\n\n  delete(providerId: string): Promise<void> {\n    return this.#serial(providerId, async () => {\n      await request(this.#store('readwrite').delete(providerId));\n    });\n  }\n\n  close(): void {\n    this.#db.close();\n  }\n}\n"],
-  "mappings": "AAEO,MAAM,uBAAuB;AAOpC,SAAS,QAAW,WAAsC;AACxD,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,cAAU,YAAY,MAAM,QAAQ,UAAU,MAAM;AACpD,cAAU,UAAU,MAAM,OAAO,UAAU,KAAK;AAAA,EAClD,CAAC;AACH;AAEA,SAAS,KAAK,MAAoC;AAChD,QAAM,UAAU,UAAU,KAAK,MAAM,CAAC;AACtC,UAAQ,kBAAkB,MAAM;AAC9B,YAAQ,OAAO,kBAAkB,MAAM;AACvC,YAAQ,OAAO,kBAAkB,aAAa;AAAA,EAChD;AACA,SAAO,QAAQ,OAAO;AACxB;AAEA,eAAe,WAAW,IAAqC;AAC7D,QAAM,OAAO,GAAG,YAAY,QAAQ,UAAU,EAAE,YAAY,MAAM;AAClE,QAAM,WAAY,MAAM,QAAQ,KAAK,IAAI,KAAK,CAAC;AAC/C,MAAI,SAAU,QAAO;AACrB,QAAM,MAAM,MAAM,OAAO,OAAO,YAAY,EAAE,MAAM,WAAW,QAAQ,IAAI,GAAG,OAAO;AAAA,IACnF;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,QAAQ,GAAG,YAAY,QAAQ,WAAW,EAAE,YAAY,MAAM;AACpE,QAAM,QAAQ,MAAM,IAAI,KAAK,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAC1D,SAAQ,MAAM;AAAA,IACZ,GAAG,YAAY,QAAQ,UAAU,EAAE,YAAY,MAAM,EAAE,IAAI,KAAK;AAAA,EAClE;AACF;AAEO,MAAM,yBAAoD;AAAA,EACtD;AAAA,EACA;AAAA,EACA,UAAU,oBAAI,IAA8B;AAAA,EAE7C,YAAY,IAAiB,KAAgB;AACnD,SAAK,MAAM;AACX,SAAK,OAAO;AAAA,EACd;AAAA,EAEA,aAAa,KAAK,OAAO,sBAAyD;AAChF,UAAM,KAAK,MAAM,KAAK,IAAI;AAC1B,WAAO,IAAI,yBAAyB,IAAI,MAAM,WAAW,EAAE,CAAC;AAAA,EAC9D;AAAA,EAEA,OAAO,MAA0C;AAC/C,WAAO,KAAK,IAAI,YAAY,eAAe,IAAI,EAAE,YAAY,aAAa;AAAA,EAC5E;AAAA,EAEA,MAAM,KAAK,YAAqD;AAC9D,UAAM,SAAU,MAAM,QAAQ,KAAK,OAAO,UAAU,EAAE,IAAI,UAAU,CAAC;AACrE,QAAI,CAAC,OAAQ,QAAO;AACpB,UAAM,QAAQ,MAAM,OAAO,OAAO;AAAA,MAChC,EAAE,MAAM,WAAW,IAAI,OAAO,GAAG;AAAA,MACjC,KAAK;AAAA,MACL,OAAO;AAAA,IACT;AACA,WAAO,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AAAA,EACnD;AAAA,EAEA,MAAM,OAA2C;AAC/C,UAAM,MAAO,MAAM,QAAQ,KAAK,OAAO,UAAU,EAAE,WAAW,CAAC;AAC/D,UAAM,QAA0B,CAAC;AACjC,eAAW,cAAc,KAAK;AAC5B,YAAM,aAAa,MAAM,KAAK,KAAK,UAAU;AAC7C,UAAI,WAAY,OAAM,KAAK,EAAE,YAAY,MAAM,WAAW,KAAK,CAAC;AAAA,IAClE;AACA,WAAO;AAAA,EACT;AAAA,EAEA,QAAW,YAAoB,WAAyC;AACtE,UAAM,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,QAAQ,QAAQ,GAAG,KAAK,SAAS;AACjF,SAAK,QAAQ;AAAA,MACX;AAAA,MACA,OAAO,MAAM,MAAM,MAAS;AAAA,IAC9B;AACA,WAAO;AAAA,EACT;AAAA,EAEA,OACE,YACA,IACiC;AACjC,WAAO,KAAK,QAAQ,YAAY,YAAY;AAC1C,YAAM,UAAU,MAAM,KAAK,KAAK,UAAU;AAC1C,YAAM,OAAO,MAAM,GAAG,OAAO;AAC7B,UAAI,SAAS,OAAW,QAAO;AAC/B,YAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACpD,YAAM,OAAO,MAAM,OAAO,OAAO;AAAA,QAC/B,EAAE,MAAM,WAAW,GAAG;AAAA,QACtB,KAAK;AAAA,QACL,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,IAAI,CAAC;AAAA,MAC/C;AACA,YAAM,QAAQ,KAAK,OAAO,WAAW,EAAE,IAAI,EAAE,IAAI,KAAK,GAAoB,UAAU,CAAC;AACrF,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAAA,EAEA,OAAO,YAAmC;AACxC,WAAO,KAAK,QAAQ,YAAY,YAAY;AAC1C,YAAM,QAAQ,KAAK,OAAO,WAAW,EAAE,OAAO,UAAU,CAAC;AAAA,IAC3D,CAAC;AAAA,EACH;AAAA,EAEA,QAAc;AACZ,SAAK,IAAI,MAAM;AAAA,EACjB;AACF;",
-  "names": []
-}

package/dist/types/credentials.d.ts

@@ -1,12 +0,0 @@
-import type { Credential, CredentialInfo, CredentialStore } from '@earendil-works/pi-ai';
-export declare const CREDENTIALS_DATABASE = "slicc-agent-credentials";
-export declare class EncryptedCredentialStore implements CredentialStore {
-    #private;
-    private constructor();
-    static open(name?: string): Promise<EncryptedCredentialStore>;
-    read(providerId: string): Promise<Credential | undefined>;
-    list(): Promise<readonly CredentialInfo[]>;
-    modify(providerId: string, fn: (current: Credential | undefined) => Promise<Credential | undefined>): Promise<Credential | undefined>;
-    delete(providerId: string): Promise<void>;
-    close(): void;
-}