@amalgm/core 0.1.4 → 0.1.6

package/PURPOSE.md

@@ -87,6 +87,15 @@ source until each module is cut over.
     the host supplies the native spawn, path, clock, randomness, and timer
     effects. A reconnect attaches to the same process rather than creating
     hidden replacement state.
+15. **Diagnostics are bounded evidence, never a secret channel.** A diagnostic
+    read names one declared service, reads at most the configured tail bound,
+    and applies the shared redaction law before any content crosses the
+    gateway; arbitrary paths and unbounded files are not diagnostic inputs.
+16. **One machine-local vault owns user credentials.** Every credential is
+    encrypted before persistence, every public view contains only a hint and
+    fingerprint, and plaintext leaves solely through explicit resolution.
+    Compatibility APIs share this vault; they never create a second secret
+    file or cloud authority.
 
 ## Five surfaces, one behavior
 

package/dist/adapters/index.d.ts

@@ -10,4 +10,5 @@
 export type { ClockIsoPort, ClockMsPort, RandomHexPort, Sha256HexPort, ResolvePathPort, } from '../identity/ports.js';
 export type { TimingSafeEqualPort } from '../transport/auth.js';
 export type { HmacHexPort } from '../transport/ingress.js';
+export type { CredentialCipherPort, CredentialStorePort } from '../identity/credentials/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,YAAY,EACV,YAAY,EACZ,WAAW,EACX,aAAa,EACb,aAAa,EACb,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChE,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,YAAY,EACV,YAAY,EACZ,WAAW,EACX,aAAa,EACb,aAAa,EACb,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChE,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/identity/credentials/api.d.ts

@@ -0,0 +1,3 @@
+import { CredentialVault } from './vault.js';
+export declare function createCredentialsApi(vault: CredentialVault): (request: Request) => Promise<Response>;
+//# sourceMappingURL=api.d.ts.map

package/dist/identity/credentials/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../src/identity/credentials/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAO7C,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,eAAe,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAmCpG"}

package/dist/identity/credentials/api.js

@@ -0,0 +1,61 @@
+import { CredentialVault } from './vault.js';
+export function createCredentialsApi(vault) {
+    return async (request) => {
+        const pathname = new URL(request.url).pathname;
+        if (pathname !== '/credentials' && pathname !== '/user-api-keys')
+            return json(404, { error: 'not found' });
+        try {
+            if (pathname === '/credentials') {
+                if (request.method === 'GET')
+                    return json(200, { credentials: vault.list() });
+                const body = await requestBody(request);
+                if (request.method === 'POST') {
+                    return json(200, { credential: vault.upsert({
+                            ...(typeof body.id === 'string' ? { id: body.id } : {}),
+                            ...(typeof body.name === 'string' ? { name: body.name } : {}),
+                            ...(typeof body.providerKind === 'string' ? { providerKind: body.providerKind } : {}),
+                            ...(typeof body.baseUrl === 'string' ? { baseUrl: body.baseUrl } : {}),
+                            key: typeof body.key === 'string' ? body.key : '',
+                        }) });
+                }
+                if (request.method === 'DELETE')
+                    return json(200, vault.delete(typeof body.id === 'string' ? body.id : ''));
+                return methodNotAllowed('GET, POST, DELETE');
+            }
+            const body = await requestBody(request);
+            if (request.method === 'POST') {
+                const saved = vault.putHarnessKey(body.harnessId, body.apiKey);
+                return json(200, { keyHint: saved.keyHint });
+            }
+            if (request.method === 'DELETE') {
+                return json(200, vault.deleteHarnessKeys(body.harnessId));
+            }
+            return methodNotAllowed('POST, DELETE');
+        }
+        catch (error) {
+            return json(400, { error: error instanceof Error ? error.message : 'Invalid credential request' });
+        }
+    };
+}
+async function requestBody(request) {
+    const text = await request.text();
+    if (!text)
+        return {};
+    const value = JSON.parse(text);
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('request body must be an object');
+    return value;
+}
+function methodNotAllowed(allow) {
+    return new Response(JSON.stringify({ error: 'method not allowed' }), {
+        status: 405,
+        headers: { 'content-type': 'application/json', 'cache-control': 'no-store', allow },
+    });
+}
+function json(status, body) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { 'content-type': 'application/json', 'cache-control': 'no-store' },
+    });
+}
+//# sourceMappingURL=api.js.map

package/dist/identity/credentials/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../../src/identity/credentials/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAO7C,MAAM,UAAU,oBAAoB,CAAC,KAAsB;IACzD,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC/C,IAAI,QAAQ,KAAK,cAAc,IAAI,QAAQ,KAAK,gBAAgB;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAE3G,IAAI,CAAC;YACH,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;gBAChC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;oBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC9E,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;gBACxC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC9B,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC;4BAC1C,GAAG,CAAC,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BACvD,GAAG,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BAC7D,GAAG,CAAC,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAsC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BAC/G,GAAG,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BACtE,GAAG,EAAE,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;yBAClD,CAAC,EAAE,CAAC,CAAC;gBACR,CAAC;gBACD,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC5G,OAAO,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;YAC/C,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC/D,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/C,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,gBAAgB,CAAC,cAAc,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B,EAAE,CAAC,CAAC;QACrG,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAgB;IACzC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACnH,OAAO,KAAa,CAAC;AACvB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE;QACnE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,KAAK,EAAE;KACpF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,IAAa;IACzC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE;KAC7E,CAAC,CAAC;AACL,CAAC"}

package/dist/identity/credentials/index.d.ts

@@ -0,0 +1,4 @@
+export { createCredentialsApi } from './api.js';
+export { CredentialVault, DEFAULT_BASE_URL, inferProviderKind, normalizeBaseUrl } from './vault.js';
+export type * from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/identity/credentials/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/credentials/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACpG,mBAAmB,YAAY,CAAC"}

package/dist/identity/credentials/index.js

@@ -0,0 +1,3 @@
+export { createCredentialsApi } from './api.js';
+export { CredentialVault, DEFAULT_BASE_URL, inferProviderKind, normalizeBaseUrl } from './vault.js';
+//# sourceMappingURL=index.js.map

package/dist/identity/credentials/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/credentials/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}

package/dist/identity/credentials/types.d.ts

@@ -0,0 +1,52 @@
+export type CredentialProviderKind = 'anthropic_compatible' | 'openai_compatible' | 'ai_gateway';
+export type ByokHarnessId = 'claude_code' | 'codex' | 'opencode' | 'pi';
+export interface CredentialSummary {
+    readonly id: string;
+    readonly name: string;
+    readonly providerKind: CredentialProviderKind;
+    readonly keyHint: string;
+    readonly tokenFingerprint: string;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+}
+export interface StoredCredential extends CredentialSummary {
+    readonly baseUrl: string;
+    readonly encryptedKey: unknown;
+    readonly slot?: string;
+}
+export interface CredentialStoreDocument {
+    readonly version: 1;
+    readonly credentials: readonly StoredCredential[];
+}
+export interface CredentialStorePort {
+    read(): unknown;
+    write(document: CredentialStoreDocument): void;
+}
+export interface CredentialCipherPort {
+    encrypt(secret: string): unknown;
+    decrypt(envelope: unknown): string;
+    fingerprint(secret: string): string;
+}
+export interface CredentialVaultPorts {
+    readonly store: CredentialStorePort;
+    readonly cipher: CredentialCipherPort;
+    readonly now: () => string;
+    readonly randomId: () => string;
+}
+export interface UpsertCredentialInput {
+    readonly id?: string;
+    readonly name?: string;
+    readonly key: string;
+    readonly providerKind?: CredentialProviderKind;
+    readonly baseUrl?: string;
+}
+export interface ResolveCredentialInput {
+    readonly credentialId?: string;
+    readonly harness?: ByokHarnessId;
+    readonly providerKind?: CredentialProviderKind;
+}
+export interface ResolvedCredential extends CredentialSummary {
+    readonly baseUrl: string;
+    readonly key: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/identity/credentials/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/identity/credentials/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,sBAAsB,GAC9B,sBAAsB,GACtB,mBAAmB,GACnB,YAAY,CAAC;AAEjB,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,OAAO,GAAG,UAAU,GAAG,IAAI,CAAC;AAExE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,IAAI,OAAO,CAAC;IAChB,KAAK,CAAC,QAAQ,EAAE,uBAAuB,GAAG,IAAI,CAAC;CAChD;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,OAAO,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IACnC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,YAAY,CAAC,EAAE,sBAAsB,CAAC;IAC/C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,sBAAsB,CAAC;CAChD;AAED,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB"}

package/dist/identity/credentials/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/identity/credentials/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/identity/credentials/types.ts"],"names":[],"mappings":""}

package/dist/identity/credentials/vault.d.ts

@@ -0,0 +1,31 @@
+import type { CredentialProviderKind, CredentialSummary, CredentialVaultPorts, ResolveCredentialInput, ResolvedCredential, UpsertCredentialInput } from './types.js';
+/**
+ * Engine reference:
+ * - runtime/scripts/chat-core/credentials/store.js
+ * - runtime/scripts/amalgm-mcp/credentials/rest.js
+ * - runtime/scripts/amalgm-mcp/user-api-keys/rest.js
+ */
+declare const DEFAULT_BASE_URL: Record<CredentialProviderKind, string>;
+declare function inferProviderKind(input: {
+    readonly baseUrl?: string;
+    readonly key?: string;
+}): CredentialProviderKind;
+declare function normalizeBaseUrl(baseUrl: unknown, providerKind: CredentialProviderKind): string;
+export declare class CredentialVault {
+    #private;
+    constructor(ports: CredentialVaultPorts);
+    list(): CredentialSummary[];
+    upsert(input: UpsertCredentialInput): CredentialSummary;
+    delete(id: string): {
+        readonly ok: true;
+        readonly deleted: boolean;
+    };
+    putHarnessKey(harnessId: unknown, apiKey: unknown): CredentialSummary;
+    deleteHarnessKeys(harnessId?: unknown): {
+        readonly ok: true;
+        readonly deleted: number;
+    };
+    resolve(input?: ResolveCredentialInput): ResolvedCredential | null;
+}
+export { DEFAULT_BASE_URL, inferProviderKind, normalizeBaseUrl };
+//# sourceMappingURL=vault.d.ts.map

package/dist/identity/credentials/vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../../src/identity/credentials/vault.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,sBAAsB,EAEtB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAElB,qBAAqB,EACtB,MAAM,YAAY,CAAC;AAEpB;;;;;GAKG;AAEH,QAAA,MAAM,gBAAgB,EAAE,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAI5D,CAAC;AAsCF,iBAAS,iBAAiB,CAAC,KAAK,EAAE;IAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,sBAAsB,CAM9G;AAED,iBAAS,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,sBAAsB,GAAG,MAAM,CAMxF;AA2DD,qBAAa,eAAe;;gBAGd,KAAK,EAAE,oBAAoB;IAIvC,IAAI,IAAI,iBAAiB,EAAE;IAM3B,MAAM,CAAC,KAAK,EAAE,qBAAqB,GAAG,iBAAiB;IAIvD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG;QAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;KAAE;IAQpE,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,iBAAiB;IAcrE,iBAAiB,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG;QAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE;IAQvF,OAAO,CAAC,KAAK,GAAE,sBAA2B,GAAG,kBAAkB,GAAG,IAAI;CAoDvE;AAED,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/identity/credentials/vault.js

@@ -0,0 +1,214 @@
+/**
+ * Engine reference:
+ * - runtime/scripts/chat-core/credentials/store.js
+ * - runtime/scripts/amalgm-mcp/credentials/rest.js
+ * - runtime/scripts/amalgm-mcp/user-api-keys/rest.js
+ */
+const DEFAULT_BASE_URL = {
+    anthropic_compatible: 'https://api.anthropic.com',
+    openai_compatible: 'https://api.openai.com/v1',
+    ai_gateway: 'https://ai-gateway.vercel.sh/v1',
+};
+const HARNESS = {
+    claude_code: { name: 'Anthropic', providerKind: 'anthropic_compatible' },
+    codex: { name: 'OpenAI', providerKind: 'openai_compatible' },
+    opencode: { name: 'Vercel AI Gateway', providerKind: 'ai_gateway' },
+    pi: { name: 'OpenAI', providerKind: 'openai_compatible' },
+};
+const PROVIDERS_FOR_HARNESS = {
+    claude_code: ['anthropic_compatible'],
+    codex: ['openai_compatible'],
+    opencode: ['ai_gateway', 'openai_compatible', 'anthropic_compatible'],
+    pi: [],
+};
+function required(value, label) {
+    const text = typeof value === 'string' ? value.trim() : '';
+    if (!text)
+        throw new Error(`${label} is required`);
+    return text;
+}
+function provider(value) {
+    return value === 'anthropic_compatible'
+        || value === 'openai_compatible'
+        || value === 'ai_gateway'
+        ? value
+        : null;
+}
+function harness(value) {
+    if (value === 'claude_code' || value === 'codex' || value === 'opencode' || value === 'pi')
+        return value;
+    throw new Error(`Unsupported BYOK harness: ${String(value || '')}`);
+}
+function inferProviderKind(input) {
+    const url = String(input.baseUrl || '').toLowerCase();
+    const key = String(input.key || '').trim();
+    if (url.includes('anthropic') || key.startsWith('sk-ant-'))
+        return 'anthropic_compatible';
+    if (url.includes('ai-gateway.vercel') || url.includes('gateway.vercel') || key.startsWith('v0_'))
+        return 'ai_gateway';
+    return 'openai_compatible';
+}
+function normalizeBaseUrl(baseUrl, providerKind) {
+    const value = String(baseUrl || DEFAULT_BASE_URL[providerKind]).trim() || DEFAULT_BASE_URL[providerKind];
+    const url = new URL(value);
+    if (url.protocol !== 'http:' && url.protocol !== 'https:')
+        throw new Error('baseUrl must use http or https');
+    if (url.username || url.password)
+        throw new Error('baseUrl cannot contain credentials');
+    return value.replace(/\/+$/, '');
+}
+function defaultName(providerKind, baseUrl) {
+    if (providerKind === 'anthropic_compatible')
+        return 'Anthropic';
+    if (providerKind === 'ai_gateway')
+        return 'Vercel AI Gateway';
+    try {
+        return new URL(baseUrl).hostname.replace(/^api\./, '') || 'OpenAI Compatible';
+    }
+    catch {
+        return 'OpenAI Compatible';
+    }
+}
+function keyHint(key) {
+    return `...${key.slice(-4)}`;
+}
+function summary(record) {
+    return {
+        id: record.id,
+        name: record.name,
+        providerKind: record.providerKind,
+        keyHint: record.keyHint,
+        tokenFingerprint: record.tokenFingerprint,
+        createdAt: record.createdAt,
+        updatedAt: record.updatedAt,
+    };
+}
+function storedCredential(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return null;
+    const record = value;
+    const providerKind = provider(record.providerKind);
+    if (!providerKind)
+        return null;
+    const id = typeof record.id === 'string' ? record.id.trim() : '';
+    const name = typeof record.name === 'string' ? record.name.trim() : '';
+    const baseUrl = typeof record.baseUrl === 'string' ? record.baseUrl.trim() : '';
+    const hint = typeof record.keyHint === 'string' ? record.keyHint.trim() : '';
+    const fingerprint = typeof record.tokenFingerprint === 'string' ? record.tokenFingerprint.trim() : '';
+    const createdAt = typeof record.createdAt === 'string' ? record.createdAt.trim() : '';
+    const updatedAt = typeof record.updatedAt === 'string' ? record.updatedAt.trim() : '';
+    if (!id || !name || !baseUrl || !hint || !fingerprint || !createdAt || !updatedAt || !('encryptedKey' in record))
+        return null;
+    return {
+        id, name, providerKind, baseUrl,
+        keyHint: hint,
+        tokenFingerprint: fingerprint,
+        encryptedKey: record.encryptedKey,
+        createdAt,
+        updatedAt,
+        ...(typeof record.slot === 'string' && record.slot.trim() ? { slot: record.slot.trim() } : {}),
+    };
+}
+function document(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return { version: 1, credentials: [] };
+    const records = value.credentials;
+    if (!Array.isArray(records))
+        return { version: 1, credentials: [] };
+    return { version: 1, credentials: records.map(storedCredential).filter((record) => record !== null) };
+}
+export class CredentialVault {
+    #ports;
+    constructor(ports) {
+        this.#ports = ports;
+    }
+    list() {
+        return document(this.#ports.store.read()).credentials
+            .map(summary)
+            .sort((left, right) => left.createdAt.localeCompare(right.createdAt) || left.id.localeCompare(right.id));
+    }
+    upsert(input) {
+        return summary(this.#save(input));
+    }
+    delete(id) {
+        const target = required(id, 'id');
+        const current = document(this.#ports.store.read());
+        const credentials = current.credentials.filter((record) => record.id !== target);
+        this.#ports.store.write({ version: 1, credentials });
+        return { ok: true, deleted: credentials.length !== current.credentials.length };
+    }
+    putHarnessKey(harnessId, apiKey) {
+        const id = harness(harnessId);
+        const descriptor = HARNESS[id];
+        const current = document(this.#ports.store.read());
+        const existing = current.credentials.find((record) => record.slot === `harness:${id}`);
+        return summary(this.#save({
+            ...(existing ? { id: existing.id } : {}),
+            name: descriptor.name,
+            providerKind: descriptor.providerKind,
+            baseUrl: DEFAULT_BASE_URL[descriptor.providerKind],
+            key: required(apiKey, 'apiKey'),
+        }, `harness:${id}`));
+    }
+    deleteHarnessKeys(harnessId) {
+        const slot = harnessId === undefined ? null : `harness:${harness(harnessId)}`;
+        const current = document(this.#ports.store.read());
+        const credentials = current.credentials.filter((record) => slot ? record.slot !== slot : !record.slot?.startsWith('harness:'));
+        this.#ports.store.write({ version: 1, credentials });
+        return { ok: true, deleted: current.credentials.length - credentials.length };
+    }
+    resolve(input = {}) {
+        const current = document(this.#ports.store.read());
+        const allowed = input.providerKind
+            ? [input.providerKind]
+            : input.harness
+                ? PROVIDERS_FOR_HARNESS[harness(input.harness)]
+                : [];
+        const record = input.credentialId
+            ? current.credentials.find((candidate) => candidate.id === input.credentialId)
+            : allowed.length
+                ? current.credentials.find((candidate) => allowed.includes(candidate.providerKind))
+                : undefined;
+        if (!record)
+            return null;
+        if (allowed.length && !allowed.includes(record.providerKind)) {
+            throw new Error(`Credential ${record.name || record.id} is not compatible with ${input.harness || input.providerKind}`);
+        }
+        return { ...summary(record), baseUrl: record.baseUrl, key: this.#ports.cipher.decrypt(record.encryptedKey) };
+    }
+    #save(input, slot) {
+        const key = required(input.key, 'key');
+        const explicitProviderKind = input.providerKind === undefined ? null : provider(input.providerKind);
+        if (input.providerKind !== undefined && !explicitProviderKind) {
+            throw new Error(`Unsupported credential provider: ${String(input.providerKind)}`);
+        }
+        const providerKind = explicitProviderKind || inferProviderKind({
+            ...(input.baseUrl === undefined ? {} : { baseUrl: input.baseUrl }),
+            key,
+        });
+        const baseUrl = normalizeBaseUrl(input.baseUrl, providerKind);
+        const now = this.#ports.now();
+        const current = document(this.#ports.store.read());
+        const id = input.id ? required(input.id, 'id') : this.#ports.randomId();
+        const existing = current.credentials.find((record) => record.id === id);
+        const record = {
+            id,
+            name: String(input.name || '').trim() || defaultName(providerKind, baseUrl),
+            providerKind,
+            baseUrl,
+            keyHint: keyHint(key),
+            tokenFingerprint: this.#ports.cipher.fingerprint(key),
+            encryptedKey: this.#ports.cipher.encrypt(key),
+            createdAt: existing?.createdAt || now,
+            updatedAt: now,
+            ...(slot ? { slot } : existing?.slot ? { slot: existing.slot } : {}),
+        };
+        this.#ports.store.write({
+            version: 1,
+            credentials: [...current.credentials.filter((candidate) => candidate.id !== id), record],
+        });
+        return record;
+    }
+}
+export { DEFAULT_BASE_URL, inferProviderKind, normalizeBaseUrl };
+//# sourceMappingURL=vault.js.map

package/dist/identity/credentials/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../../src/identity/credentials/vault.ts"],"names":[],"mappings":"AAYA;;;;;GAKG;AAEH,MAAM,gBAAgB,GAA2C;IAC/D,oBAAoB,EAAE,2BAA2B;IACjD,iBAAiB,EAAE,2BAA2B;IAC9C,UAAU,EAAE,iCAAiC;CAC9C,CAAC;AAEF,MAAM,OAAO,GAGR;IACH,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,sBAAsB,EAAE;IACxE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,mBAAmB,EAAE;IAC5D,QAAQ,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,YAAY,EAAE,YAAY,EAAE;IACnE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,mBAAmB,EAAE;CAC1D,CAAC;AAEF,MAAM,qBAAqB,GAA6D;IACtF,WAAW,EAAE,CAAC,sBAAsB,CAAC;IACrC,KAAK,EAAE,CAAC,mBAAmB,CAAC;IAC5B,QAAQ,EAAE,CAAC,YAAY,EAAE,mBAAmB,EAAE,sBAAsB,CAAC;IACrE,EAAE,EAAE,EAAE;CACP,CAAC;AAEF,SAAS,QAAQ,CAAC,KAAc,EAAE,KAAa;IAC7C,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,sBAAsB;WAClC,KAAK,KAAK,mBAAmB;WAC7B,KAAK,KAAK,YAAY;QACzB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACzG,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAA2D;IACpF,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACtD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,sBAAsB,CAAC;IAC1F,IAAI,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IACtH,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgB,EAAE,YAAoC;IAC9E,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,IAAI,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,gBAAgB,CAAC,YAAY,CAAC,CAAC;IACzG,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC7G,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxF,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,WAAW,CAAC,YAAoC,EAAE,OAAe;IACxE,IAAI,YAAY,KAAK,sBAAsB;QAAE,OAAO,WAAW,CAAC;IAChE,IAAI,YAAY,KAAK,YAAY;QAAE,OAAO,mBAAmB,CAAC;IAC9D,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,mBAAmB,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,mBAAmB,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,OAAO,CAAC,MAAwB;IACvC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACnD,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,EAAE,GAAG,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtG,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,cAAc,IAAI,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9H,OAAO;QACL,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO;QAC/B,OAAO,EAAE,IAAI;QACb,gBAAgB,EAAE,WAAW;QAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,SAAS;QACT,SAAS;QACT,GAAG,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/F,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACxG,MAAM,OAAO,GAAI,KAAmC,CAAC,WAAW,CAAC;IACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACpE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAA8B,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,CAAC;AACpI,CAAC;AAED,MAAM,OAAO,eAAe;IACjB,MAAM,CAAuB;IAEtC,YAAY,KAA2B;QACrC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,IAAI;QACF,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW;aAClD,GAAG,CAAC,OAAO,CAAC;aACZ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7G,CAAC;IAED,MAAM,CAAC,KAA4B;QACjC,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,CAAC,EAAU;QACf,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;QACjF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;IAClF,CAAC;IAED,aAAa,CAAC,SAAkB,EAAE,MAAe;QAC/C,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,EAAE,CAAC,CAAC;QACvF,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YACxB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,OAAO,EAAE,gBAAgB,CAAC,UAAU,CAAC,YAAY,CAAC;YAClD,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;SAChC,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;IACvB,CAAC;IAED,iBAAiB,CAAC,SAAmB;QACnC,MAAM,IAAI,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9E,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/H,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC;IAChF,CAAC;IAED,OAAO,CAAC,QAAgC,EAAE;QACxC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY;YAChC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;YACtB,CAAC,CAAC,KAAK,CAAC,OAAO;gBACb,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC/C,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY;YAC/B,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,YAAY,CAAC;YAC9E,CAAC,CAAC,OAAO,CAAC,MAAM;gBACd,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;gBACnF,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,cAAc,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE,2BAA2B,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;QAC1H,CAAC;QACD,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;IAC/G,CAAC;IAED,KAAK,CAAC,KAA4B,EAAE,IAAa;QAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvC,MAAM,oBAAoB,GAAG,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACpG,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,YAAY,GAAG,oBAAoB,IAAI,iBAAiB,CAAC;YAC7D,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAClE,GAAG;SACJ,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACxE,MAAM,MAAM,GAAqB;YAC/B,EAAE;YACF,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,WAAW,CAAC,YAAY,EAAE,OAAO,CAAC;YAC3E,YAAY;YACZ,OAAO;YACP,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC;YACrB,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC;YACrD,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YAC7C,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,GAAG;YACrC,SAAS,EAAE,GAAG;YACd,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;YACtB,OAAO,EAAE,CAAC;YACV,WAAW,EAAE,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC;SACzF,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/identity/index.d.ts

@@ -10,6 +10,7 @@ export * from './labels.js';
 export * from './layout.js';
 export * from './product-state.js';
 export * from './local/index.js';
+export * from './credentials/index.js';
 export * from './ids.js';
 export * from './auth-records.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/identity/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,UAAU,CAAC;AACzB,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,UAAU,CAAC;AACzB,cAAc,mBAAmB,CAAC"}

package/dist/identity/index.js

@@ -10,6 +10,7 @@ export * from './labels.js';
 export * from './layout.js';
 export * from './product-state.js';
 export * from './local/index.js';
+export * from './credentials/index.js';
 export * from './ids.js';
 export * from './auth-records.js';
 //# sourceMappingURL=index.js.map

package/dist/identity/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,UAAU,CAAC;AACzB,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,UAAU,CAAC;AACzB,cAAc,mBAAmB,CAAC"}

package/dist/transport/diagnostics.d.ts

@@ -0,0 +1,48 @@
+/** Engine parity reference: amalgm-engine/runtime/scripts/local-gateway.js:77-96,427-560. */
+export declare const DEFAULT_DIAGNOSTIC_LOG_TAIL_BYTES: number;
+export declare const MAX_DIAGNOSTIC_LOG_TAIL_BYTES: number;
+export declare const MAX_DIAGNOSTIC_LOG_LINES = 5000;
+export declare const DIAGNOSTIC_LOG_FILES: {
+    readonly daemon: "daemon.log";
+    readonly 'chat-server': "chat-server.log";
+    readonly 'local-gateway': "local-gateway.log";
+    readonly 'amalgm-mcp': "amalgm-mcp.log";
+    readonly 'port-monitor': "port-monitor.log";
+};
+export declare const DIAGNOSTIC_LOG_ALIASES: Readonly<Record<string, DiagnosticLogService>>;
+export type DiagnosticLogService = keyof typeof DIAGNOSTIC_LOG_FILES;
+export interface DiagnosticLogTail {
+    readonly path: string;
+    readonly size: number;
+    readonly mtime: string;
+    readonly bytes: number;
+    readonly content: string;
+    readonly byteTruncated: boolean;
+}
+export type DiagnosticLogReadResult = {
+    readonly kind: 'found';
+    readonly tail: DiagnosticLogTail;
+} | {
+    readonly kind: 'not_found';
+    readonly path: string;
+} | {
+    readonly kind: 'not_file';
+    readonly path: string;
+} | {
+    readonly kind: 'error';
+    readonly path: string;
+    readonly message: string;
+};
+export interface DiagnosticLogHost {
+    readTail(filename: string, maxBytes: number): Promise<DiagnosticLogReadResult>;
+}
+export declare function diagnosticLogServices(): DiagnosticLogService[];
+export declare function normalizeDiagnosticLogService(value: unknown): string;
+export declare function parseDiagnosticTailBytes(value: unknown): number;
+export declare function parseDiagnosticLineLimit(value: unknown): number | null;
+export declare function applyDiagnosticLineLimit(content: string, lineLimit: number | null): {
+    readonly content: string;
+    readonly lineTruncated: boolean;
+};
+export declare function createDiagnosticsApi(host: DiagnosticLogHost): (request: Request) => Promise<Response>;
+//# sourceMappingURL=diagnostics.d.ts.map

package/dist/transport/diagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics.d.ts","sourceRoot":"","sources":["../../src/transport/diagnostics.ts"],"names":[],"mappings":"AAEA,6FAA6F;AAC7F,eAAO,MAAM,iCAAiC,QAAa,CAAC;AAC5D,eAAO,MAAM,6BAA6B,QAAkB,CAAC;AAC7D,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C,eAAO,MAAM,oBAAoB;;;;;;CAMvB,CAAC;AAEX,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAQjF,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,MAAM,OAAO,oBAAoB,CAAC;AAErE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAChF;AAED,wBAAgB,qBAAqB,IAAI,oBAAoB,EAAE,CAE9D;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAKpE;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAI/D;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAItE;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAAG,IAAI,GACvB;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAA;CAAE,CAK/D;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAiDrG"}

package/dist/transport/diagnostics.js

@@ -0,0 +1,106 @@
+import { redactSecrets } from './admission.js';
+/** Engine parity reference: amalgm-engine/runtime/scripts/local-gateway.js:77-96,427-560. */
+export const DEFAULT_DIAGNOSTIC_LOG_TAIL_BYTES = 256 * 1024;
+export const MAX_DIAGNOSTIC_LOG_TAIL_BYTES = 2 * 1024 * 1024;
+export const MAX_DIAGNOSTIC_LOG_LINES = 5000;
+export const DIAGNOSTIC_LOG_FILES = {
+    daemon: 'daemon.log',
+    'chat-server': 'chat-server.log',
+    'local-gateway': 'local-gateway.log',
+    'amalgm-mcp': 'amalgm-mcp.log',
+    'port-monitor': 'port-monitor.log',
+};
+export const DIAGNOSTIC_LOG_ALIASES = {
+    chat: 'chat-server',
+    mcp: 'amalgm-mcp',
+    gateway: 'local-gateway',
+    events: 'daemon',
+    'event-tunnel': 'daemon',
+    'chat-tunnel': 'daemon',
+    tunnel: 'daemon',
+};
+export function diagnosticLogServices() {
+    return Object.keys(DIAGNOSTIC_LOG_FILES);
+}
+export function normalizeDiagnosticLogService(value) {
+    let service = String(value || 'daemon').trim().toLowerCase();
+    if (service.endsWith('.log'))
+        service = service.slice(0, -4);
+    service = service.replace(/[^a-z0-9_-]/g, '');
+    return DIAGNOSTIC_LOG_ALIASES[service] || service;
+}
+export function parseDiagnosticTailBytes(value) {
+    const parsed = Number.parseInt(String(value || ''), 10);
+    if (!Number.isFinite(parsed) || parsed < 0)
+        return DEFAULT_DIAGNOSTIC_LOG_TAIL_BYTES;
+    return Math.min(parsed, MAX_DIAGNOSTIC_LOG_TAIL_BYTES);
+}
+export function parseDiagnosticLineLimit(value) {
+    const parsed = Number.parseInt(String(value || ''), 10);
+    if (!Number.isFinite(parsed) || parsed <= 0)
+        return null;
+    return Math.min(parsed, MAX_DIAGNOSTIC_LOG_LINES);
+}
+export function applyDiagnosticLineLimit(content, lineLimit) {
+    if (!lineLimit)
+        return { content, lineTruncated: false };
+    const lines = String(content).split(/\r?\n/);
+    if (lines.length <= lineLimit)
+        return { content, lineTruncated: false };
+    return { content: lines.slice(-lineLimit).join('\n'), lineTruncated: true };
+}
+export function createDiagnosticsApi(host) {
+    return async (request) => {
+        const url = new URL(request.url);
+        if (request.method === 'GET' && url.pathname === '/diagnostics') {
+            return json(200, {
+                service: 'diagnostics',
+                logs: diagnosticLogServices(),
+                defaultTailBytes: DEFAULT_DIAGNOSTIC_LOG_TAIL_BYTES,
+                maxTailBytes: MAX_DIAGNOSTIC_LOG_TAIL_BYTES,
+                maxLines: MAX_DIAGNOSTIC_LOG_LINES,
+            });
+        }
+        if (url.pathname !== '/diagnostics/logs')
+            return json(404, { error: 'Unknown diagnostics route' });
+        if (request.method !== 'GET') {
+            return new Response(null, { status: 405, headers: { allow: 'GET' } });
+        }
+        const service = normalizeDiagnosticLogService(url.searchParams.get('service') || url.searchParams.get('name'));
+        const filename = DIAGNOSTIC_LOG_FILES[service];
+        if (!filename) {
+            return json(400, {
+                error: 'Unknown diagnostic log service',
+                availableServices: diagnosticLogServices(),
+            });
+        }
+        const lineLimit = parseDiagnosticLineLimit(url.searchParams.get('lines'));
+        const result = await host.readTail(filename, parseDiagnosticTailBytes(url.searchParams.get('tailBytes')));
+        if (result.kind === 'not_found') {
+            return json(404, { service, path: result.path, exists: false, error: 'Diagnostic log file not found' });
+        }
+        if (result.kind === 'not_file') {
+            return json(400, { service, error: 'Diagnostic log path is not a file' });
+        }
+        if (result.kind === 'error')
+            return json(500, { service, error: result.message });
+        const limited = applyDiagnosticLineLimit(result.tail.content, lineLimit);
+        return json(200, {
+            service,
+            path: result.tail.path,
+            exists: true,
+            size: result.tail.size,
+            mtime: result.tail.mtime,
+            tailBytes: result.tail.bytes,
+            truncated: result.tail.byteTruncated || limited.lineTruncated,
+            content: redactSecrets(limited.content),
+        });
+    };
+}
+function json(status, body) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { 'content-type': 'application/json', 'cache-control': 'no-store' },
+    });
+}
+//# sourceMappingURL=diagnostics.js.map

package/dist/transport/diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../../src/transport/diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,6FAA6F;AAC7F,MAAM,CAAC,MAAM,iCAAiC,GAAG,GAAG,GAAG,IAAI,CAAC;AAC5D,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC7D,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,MAAM,EAAE,YAAY;IACpB,aAAa,EAAE,iBAAiB;IAChC,eAAe,EAAE,mBAAmB;IACpC,YAAY,EAAE,gBAAgB;IAC9B,cAAc,EAAE,kBAAkB;CAC1B,CAAC;AAEX,MAAM,CAAC,MAAM,sBAAsB,GAAmD;IACpF,IAAI,EAAE,aAAa;IACnB,GAAG,EAAE,YAAY;IACjB,OAAO,EAAE,eAAe;IACxB,MAAM,EAAE,QAAQ;IAChB,cAAc,EAAE,QAAQ;IACxB,aAAa,EAAE,QAAQ;IACvB,MAAM,EAAE,QAAQ;CACjB,CAAC;AAuBF,MAAM,UAAU,qBAAqB;IACnC,OAAO,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAA2B,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,IAAI,OAAO,GAAG,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7D,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7D,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC9C,OAAO,sBAAsB,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;QAAE,OAAO,iCAAiC,CAAC;IACrF,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,OAAe,EACf,SAAwB;IAExB,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IACxE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAuB;IAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC,GAAG,EAAE;gBACf,OAAO,EAAE,aAAa;gBACtB,IAAI,EAAE,qBAAqB,EAAE;gBAC7B,gBAAgB,EAAE,iCAAiC;gBACnD,YAAY,EAAE,6BAA6B;gBAC3C,QAAQ,EAAE,wBAAwB;aACnC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,mBAAmB;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACnG,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7B,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,OAAO,GAAG,6BAA6B,CAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAChE,CAAC;QACF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAA+B,CAAC,CAAC;QACvE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,IAAI,CAAC,GAAG,EAAE;gBACf,KAAK,EAAE,gCAAgC;gBACvC,iBAAiB,EAAE,qBAAqB,EAAE;aAC3C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,wBAAwB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC1G,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAElF,MAAM,OAAO,GAAG,wBAAwB,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC,GAAG,EAAE;YACf,OAAO;YACP,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;YACtB,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;YACtB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;YACxB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;YAC5B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa;YAC7D,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC;SACxC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,IAAa;IACzC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE;KAC7E,CAAC,CAAC;AACL,CAAC"}

package/dist/transport/index.d.ts

@@ -18,6 +18,7 @@ export * from './routing.js';
 export * from './shipped-routes.js';
 export * from './state/index.js';
 export * from './pty/index.js';
+export * from './diagnostics.js';
 export * from './admission.js';
 export * from './ingress.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/transport/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/transport/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/transport/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC"}

package/dist/transport/index.js

@@ -18,6 +18,7 @@ export * from './routing.js';
 export * from './shipped-routes.js';
 export * from './state/index.js';
 export * from './pty/index.js';
+export * from './diagnostics.js';
 export * from './admission.js';
 export * from './ingress.js';
 //# sourceMappingURL=index.js.map

package/dist/transport/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/transport/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/transport/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amalgm/core",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "The Amalgm kernel SDK — identity, transport, supervision, and host capability contracts behind host-injected adapters.",
   "type": "module",
   "license": "UNLICENSED",
@@ -24,6 +24,10 @@
       "types": "./dist/identity/local/index.d.ts",
       "default": "./dist/identity/local/index.js"
     },
+    "./credentials": {
+      "types": "./dist/identity/credentials/index.d.ts",
+      "default": "./dist/identity/credentials/index.js"
+    },
     "./transport": {
       "types": "./dist/transport/index.d.ts",
       "default": "./dist/transport/index.js"
@@ -36,6 +40,10 @@
       "types": "./dist/transport/pty/index.d.ts",
       "default": "./dist/transport/pty/index.js"
     },
+    "./diagnostics": {
+      "types": "./dist/transport/diagnostics.d.ts",
+      "default": "./dist/transport/diagnostics.js"
+    },
     "./supervision": {
       "types": "./dist/supervision/index.d.ts",
       "default": "./dist/supervision/index.js"