@amalgm/core 0.1.5 → 0.1.6

package/PURPOSE.md

@@ -91,6 +91,11 @@ source until each module is cut over.
     read names one declared service, reads at most the configured tail bound,
     and applies the shared redaction law before any content crosses the
     gateway; arbitrary paths and unbounded files are not diagnostic inputs.
+16. **One machine-local vault owns user credentials.** Every credential is
+    encrypted before persistence, every public view contains only a hint and
+    fingerprint, and plaintext leaves solely through explicit resolution.
+    Compatibility APIs share this vault; they never create a second secret
+    file or cloud authority.
 
 ## Five surfaces, one behavior
 

package/dist/adapters/index.d.ts

@@ -10,4 +10,5 @@
 export type { ClockIsoPort, ClockMsPort, RandomHexPort, Sha256HexPort, ResolvePathPort, } from '../identity/ports.js';
 export type { TimingSafeEqualPort } from '../transport/auth.js';
 export type { HmacHexPort } from '../transport/ingress.js';
+export type { CredentialCipherPort, CredentialStorePort } from '../identity/credentials/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,YAAY,EACV,YAAY,EACZ,WAAW,EACX,aAAa,EACb,aAAa,EACb,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChE,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,YAAY,EACV,YAAY,EACZ,WAAW,EACX,aAAa,EACb,aAAa,EACb,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChE,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/identity/credentials/api.d.ts

@@ -0,0 +1,3 @@
+import { CredentialVault } from './vault.js';
+export declare function createCredentialsApi(vault: CredentialVault): (request: Request) => Promise<Response>;
+//# sourceMappingURL=api.d.ts.map

package/dist/identity/credentials/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../src/identity/credentials/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAO7C,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,eAAe,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAmCpG"}

package/dist/identity/credentials/api.js

@@ -0,0 +1,61 @@
+import { CredentialVault } from './vault.js';
+export function createCredentialsApi(vault) {
+    return async (request) => {
+        const pathname = new URL(request.url).pathname;
+        if (pathname !== '/credentials' && pathname !== '/user-api-keys')
+            return json(404, { error: 'not found' });
+        try {
+            if (pathname === '/credentials') {
+                if (request.method === 'GET')
+                    return json(200, { credentials: vault.list() });
+                const body = await requestBody(request);
+                if (request.method === 'POST') {
+                    return json(200, { credential: vault.upsert({
+                            ...(typeof body.id === 'string' ? { id: body.id } : {}),
+                            ...(typeof body.name === 'string' ? { name: body.name } : {}),
+                            ...(typeof body.providerKind === 'string' ? { providerKind: body.providerKind } : {}),
+                            ...(typeof body.baseUrl === 'string' ? { baseUrl: body.baseUrl } : {}),
+                            key: typeof body.key === 'string' ? body.key : '',
+                        }) });
+                }
+                if (request.method === 'DELETE')
+                    return json(200, vault.delete(typeof body.id === 'string' ? body.id : ''));
+                return methodNotAllowed('GET, POST, DELETE');
+            }
+            const body = await requestBody(request);
+            if (request.method === 'POST') {
+                const saved = vault.putHarnessKey(body.harnessId, body.apiKey);
+                return json(200, { keyHint: saved.keyHint });
+            }
+            if (request.method === 'DELETE') {
+                return json(200, vault.deleteHarnessKeys(body.harnessId));
+            }
+            return methodNotAllowed('POST, DELETE');
+        }
+        catch (error) {
+            return json(400, { error: error instanceof Error ? error.message : 'Invalid credential request' });
+        }
+    };
+}
+async function requestBody(request) {
+    const text = await request.text();
+    if (!text)
+        return {};
+    const value = JSON.parse(text);
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('request body must be an object');
+    return value;
+}
+function methodNotAllowed(allow) {
+    return new Response(JSON.stringify({ error: 'method not allowed' }), {
+        status: 405,
+        headers: { 'content-type': 'application/json', 'cache-control': 'no-store', allow },
+    });
+}
+function json(status, body) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { 'content-type': 'application/json', 'cache-control': 'no-store' },
+    });
+}
+//# sourceMappingURL=api.js.map

package/dist/identity/credentials/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../../src/identity/credentials/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAO7C,MAAM,UAAU,oBAAoB,CAAC,KAAsB;IACzD,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC/C,IAAI,QAAQ,KAAK,cAAc,IAAI,QAAQ,KAAK,gBAAgB;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAE3G,IAAI,CAAC;YACH,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;gBAChC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;oBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC9E,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;gBACxC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC9B,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC;4BAC1C,GAAG,CAAC,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BACvD,GAAG,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BAC7D,GAAG,CAAC,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAsC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BAC/G,GAAG,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BACtE,GAAG,EAAE,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;yBAClD,CAAC,EAAE,CAAC,CAAC;gBACR,CAAC;gBACD,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC5G,OAAO,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;YAC/C,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC/D,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/C,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,gBAAgB,CAAC,cAAc,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B,EAAE,CAAC,CAAC;QACrG,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAgB;IACzC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACnH,OAAO,KAAa,CAAC;AACvB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE;QACnE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,KAAK,EAAE;KACpF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,IAAa;IACzC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE;KAC7E,CAAC,CAAC;AACL,CAAC"}

package/dist/identity/credentials/index.d.ts

@@ -0,0 +1,4 @@
+export { createCredentialsApi } from './api.js';
+export { CredentialVault, DEFAULT_BASE_URL, inferProviderKind, normalizeBaseUrl } from './vault.js';
+export type * from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/identity/credentials/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/credentials/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACpG,mBAAmB,YAAY,CAAC"}

package/dist/identity/credentials/index.js

@@ -0,0 +1,3 @@
+export { createCredentialsApi } from './api.js';
+export { CredentialVault, DEFAULT_BASE_URL, inferProviderKind, normalizeBaseUrl } from './vault.js';
+//# sourceMappingURL=index.js.map

package/dist/identity/credentials/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/credentials/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}

package/dist/identity/credentials/types.d.ts

@@ -0,0 +1,52 @@
+export type CredentialProviderKind = 'anthropic_compatible' | 'openai_compatible' | 'ai_gateway';
+export type ByokHarnessId = 'claude_code' | 'codex' | 'opencode' | 'pi';
+export interface CredentialSummary {
+    readonly id: string;
+    readonly name: string;
+    readonly providerKind: CredentialProviderKind;
+    readonly keyHint: string;
+    readonly tokenFingerprint: string;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+}
+export interface StoredCredential extends CredentialSummary {
+    readonly baseUrl: string;
+    readonly encryptedKey: unknown;
+    readonly slot?: string;
+}
+export interface CredentialStoreDocument {
+    readonly version: 1;
+    readonly credentials: readonly StoredCredential[];
+}
+export interface CredentialStorePort {
+    read(): unknown;
+    write(document: CredentialStoreDocument): void;
+}
+export interface CredentialCipherPort {
+    encrypt(secret: string): unknown;
+    decrypt(envelope: unknown): string;
+    fingerprint(secret: string): string;
+}
+export interface CredentialVaultPorts {
+    readonly store: CredentialStorePort;
+    readonly cipher: CredentialCipherPort;
+    readonly now: () => string;
+    readonly randomId: () => string;
+}
+export interface UpsertCredentialInput {
+    readonly id?: string;
+    readonly name?: string;
+    readonly key: string;
+    readonly providerKind?: CredentialProviderKind;
+    readonly baseUrl?: string;
+}
+export interface ResolveCredentialInput {
+    readonly credentialId?: string;
+    readonly harness?: ByokHarnessId;
+    readonly providerKind?: CredentialProviderKind;
+}
+export interface ResolvedCredential extends CredentialSummary {
+    readonly baseUrl: string;
+    readonly key: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/identity/credentials/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/identity/credentials/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,sBAAsB,GAC9B,sBAAsB,GACtB,mBAAmB,GACnB,YAAY,CAAC;AAEjB,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,OAAO,GAAG,UAAU,GAAG,IAAI,CAAC;AAExE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,IAAI,OAAO,CAAC;IAChB,KAAK,CAAC,QAAQ,EAAE,uBAAuB,GAAG,IAAI,CAAC;CAChD;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,OAAO,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IACnC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,YAAY,CAAC,EAAE,sBAAsB,CAAC;IAC/C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,sBAAsB,CAAC;CAChD;AAED,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB"}

package/dist/identity/credentials/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/identity/credentials/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/identity/credentials/types.ts"],"names":[],"mappings":""}

package/dist/identity/credentials/vault.d.ts

@@ -0,0 +1,31 @@
+import type { CredentialProviderKind, CredentialSummary, CredentialVaultPorts, ResolveCredentialInput, ResolvedCredential, UpsertCredentialInput } from './types.js';
+/**
+ * Engine reference:
+ * - runtime/scripts/chat-core/credentials/store.js
+ * - runtime/scripts/amalgm-mcp/credentials/rest.js
+ * - runtime/scripts/amalgm-mcp/user-api-keys/rest.js
+ */
+declare const DEFAULT_BASE_URL: Record<CredentialProviderKind, string>;
+declare function inferProviderKind(input: {
+    readonly baseUrl?: string;
+    readonly key?: string;
+}): CredentialProviderKind;
+declare function normalizeBaseUrl(baseUrl: unknown, providerKind: CredentialProviderKind): string;
+export declare class CredentialVault {
+    #private;
+    constructor(ports: CredentialVaultPorts);
+    list(): CredentialSummary[];
+    upsert(input: UpsertCredentialInput): CredentialSummary;
+    delete(id: string): {
+        readonly ok: true;
+        readonly deleted: boolean;
+    };
+    putHarnessKey(harnessId: unknown, apiKey: unknown): CredentialSummary;
+    deleteHarnessKeys(harnessId?: unknown): {
+        readonly ok: true;
+        readonly deleted: number;
+    };
+    resolve(input?: ResolveCredentialInput): ResolvedCredential | null;
+}
+export { DEFAULT_BASE_URL, inferProviderKind, normalizeBaseUrl };
+//# sourceMappingURL=vault.d.ts.map

package/dist/identity/credentials/vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../../src/identity/credentials/vault.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,sBAAsB,EAEtB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAElB,qBAAqB,EACtB,MAAM,YAAY,CAAC;AAEpB;;;;;GAKG;AAEH,QAAA,MAAM,gBAAgB,EAAE,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAI5D,CAAC;AAsCF,iBAAS,iBAAiB,CAAC,KAAK,EAAE;IAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,sBAAsB,CAM9G;AAED,iBAAS,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,sBAAsB,GAAG,MAAM,CAMxF;AA2DD,qBAAa,eAAe;;gBAGd,KAAK,EAAE,oBAAoB;IAIvC,IAAI,IAAI,iBAAiB,EAAE;IAM3B,MAAM,CAAC,KAAK,EAAE,qBAAqB,GAAG,iBAAiB;IAIvD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG;QAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;KAAE;IAQpE,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,iBAAiB;IAcrE,iBAAiB,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG;QAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE;IAQvF,OAAO,CAAC,KAAK,GAAE,sBAA2B,GAAG,kBAAkB,GAAG,IAAI;CAoDvE;AAED,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/identity/credentials/vault.js

@@ -0,0 +1,214 @@
+/**
+ * Engine reference:
+ * - runtime/scripts/chat-core/credentials/store.js
+ * - runtime/scripts/amalgm-mcp/credentials/rest.js
+ * - runtime/scripts/amalgm-mcp/user-api-keys/rest.js
+ */
+const DEFAULT_BASE_URL = {
+    anthropic_compatible: 'https://api.anthropic.com',
+    openai_compatible: 'https://api.openai.com/v1',
+    ai_gateway: 'https://ai-gateway.vercel.sh/v1',
+};
+const HARNESS = {
+    claude_code: { name: 'Anthropic', providerKind: 'anthropic_compatible' },
+    codex: { name: 'OpenAI', providerKind: 'openai_compatible' },
+    opencode: { name: 'Vercel AI Gateway', providerKind: 'ai_gateway' },
+    pi: { name: 'OpenAI', providerKind: 'openai_compatible' },
+};
+const PROVIDERS_FOR_HARNESS = {
+    claude_code: ['anthropic_compatible'],
+    codex: ['openai_compatible'],
+    opencode: ['ai_gateway', 'openai_compatible', 'anthropic_compatible'],
+    pi: [],
+};
+function required(value, label) {
+    const text = typeof value === 'string' ? value.trim() : '';
+    if (!text)
+        throw new Error(`${label} is required`);
+    return text;
+}
+function provider(value) {
+    return value === 'anthropic_compatible'
+        || value === 'openai_compatible'
+        || value === 'ai_gateway'
+        ? value
+        : null;
+}
+function harness(value) {
+    if (value === 'claude_code' || value === 'codex' || value === 'opencode' || value === 'pi')
+        return value;
+    throw new Error(`Unsupported BYOK harness: ${String(value || '')}`);
+}
+function inferProviderKind(input) {
+    const url = String(input.baseUrl || '').toLowerCase();
+    const key = String(input.key || '').trim();
+    if (url.includes('anthropic') || key.startsWith('sk-ant-'))
+        return 'anthropic_compatible';
+    if (url.includes('ai-gateway.vercel') || url.includes('gateway.vercel') || key.startsWith('v0_'))
+        return 'ai_gateway';
+    return 'openai_compatible';
+}
+function normalizeBaseUrl(baseUrl, providerKind) {
+    const value = String(baseUrl || DEFAULT_BASE_URL[providerKind]).trim() || DEFAULT_BASE_URL[providerKind];
+    const url = new URL(value);
+    if (url.protocol !== 'http:' && url.protocol !== 'https:')
+        throw new Error('baseUrl must use http or https');
+    if (url.username || url.password)
+        throw new Error('baseUrl cannot contain credentials');
+    return value.replace(/\/+$/, '');
+}
+function defaultName(providerKind, baseUrl) {
+    if (providerKind === 'anthropic_compatible')
+        return 'Anthropic';
+    if (providerKind === 'ai_gateway')
+        return 'Vercel AI Gateway';
+    try {
+        return new URL(baseUrl).hostname.replace(/^api\./, '') || 'OpenAI Compatible';
+    }
+    catch {
+        return 'OpenAI Compatible';
+    }
+}
+function keyHint(key) {
+    return `...${key.slice(-4)}`;
+}
+function summary(record) {
+    return {
+        id: record.id,
+        name: record.name,
+        providerKind: record.providerKind,
+        keyHint: record.keyHint,
+        tokenFingerprint: record.tokenFingerprint,
+        createdAt: record.createdAt,
+        updatedAt: record.updatedAt,
+    };
+}
+function storedCredential(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return null;
+    const record = value;
+    const providerKind = provider(record.providerKind);
+    if (!providerKind)
+        return null;
+    const id = typeof record.id === 'string' ? record.id.trim() : '';
+    const name = typeof record.name === 'string' ? record.name.trim() : '';
+    const baseUrl = typeof record.baseUrl === 'string' ? record.baseUrl.trim() : '';
+    const hint = typeof record.keyHint === 'string' ? record.keyHint.trim() : '';
+    const fingerprint = typeof record.tokenFingerprint === 'string' ? record.tokenFingerprint.trim() : '';
+    const createdAt = typeof record.createdAt === 'string' ? record.createdAt.trim() : '';
+    const updatedAt = typeof record.updatedAt === 'string' ? record.updatedAt.trim() : '';
+    if (!id || !name || !baseUrl || !hint || !fingerprint || !createdAt || !updatedAt || !('encryptedKey' in record))
+        return null;
+    return {
+        id, name, providerKind, baseUrl,
+        keyHint: hint,
+        tokenFingerprint: fingerprint,
+        encryptedKey: record.encryptedKey,
+        createdAt,
+        updatedAt,
+        ...(typeof record.slot === 'string' && record.slot.trim() ? { slot: record.slot.trim() } : {}),
+    };
+}
+function document(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return { version: 1, credentials: [] };
+    const records = value.credentials;
+    if (!Array.isArray(records))
+        return { version: 1, credentials: [] };
+    return { version: 1, credentials: records.map(storedCredential).filter((record) => record !== null) };
+}
+export class CredentialVault {
+    #ports;
+    constructor(ports) {
+        this.#ports = ports;
+    }
+    list() {
+        return document(this.#ports.store.read()).credentials
+            .map(summary)
+            .sort((left, right) => left.createdAt.localeCompare(right.createdAt) || left.id.localeCompare(right.id));
+    }
+    upsert(input) {
+        return summary(this.#save(input));
+    }
+    delete(id) {
+        const target = required(id, 'id');
+        const current = document(this.#ports.store.read());
+        const credentials = current.credentials.filter((record) => record.id !== target);
+        this.#ports.store.write({ version: 1, credentials });
+        return { ok: true, deleted: credentials.length !== current.credentials.length };
+    }
+    putHarnessKey(harnessId, apiKey) {
+        const id = harness(harnessId);
+        const descriptor = HARNESS[id];
+        const current = document(this.#ports.store.read());
+        const existing = current.credentials.find((record) => record.slot === `harness:${id}`);
+        return summary(this.#save({
+            ...(existing ? { id: existing.id } : {}),
+            name: descriptor.name,
+            providerKind: descriptor.providerKind,
+            baseUrl: DEFAULT_BASE_URL[descriptor.providerKind],
+            key: required(apiKey, 'apiKey'),
+        }, `harness:${id}`));
+    }
+    deleteHarnessKeys(harnessId) {
+        const slot = harnessId === undefined ? null : `harness:${harness(harnessId)}`;
+        const current = document(this.#ports.store.read());
+        const credentials = current.credentials.filter((record) => slot ? record.slot !== slot : !record.slot?.startsWith('harness:'));
+        this.#ports.store.write({ version: 1, credentials });
+        return { ok: true, deleted: current.credentials.length - credentials.length };
+    }
+    resolve(input = {}) {
+        const current = document(this.#ports.store.read());
+        const allowed = input.providerKind
+            ? [input.providerKind]
+            : input.harness
+                ? PROVIDERS_FOR_HARNESS[harness(input.harness)]
+                : [];
+        const record = input.credentialId
+            ? current.credentials.find((candidate) => candidate.id === input.credentialId)
+            : allowed.length
+                ? current.credentials.find((candidate) => allowed.includes(candidate.providerKind))
+                : undefined;
+        if (!record)
+            return null;
+        if (allowed.length && !allowed.includes(record.providerKind)) {
+            throw new Error(`Credential ${record.name || record.id} is not compatible with ${input.harness || input.providerKind}`);
+        }
+        return { ...summary(record), baseUrl: record.baseUrl, key: this.#ports.cipher.decrypt(record.encryptedKey) };
+    }
+    #save(input, slot) {
+        const key = required(input.key, 'key');
+        const explicitProviderKind = input.providerKind === undefined ? null : provider(input.providerKind);
+        if (input.providerKind !== undefined && !explicitProviderKind) {
+            throw new Error(`Unsupported credential provider: ${String(input.providerKind)}`);
+        }
+        const providerKind = explicitProviderKind || inferProviderKind({
+            ...(input.baseUrl === undefined ? {} : { baseUrl: input.baseUrl }),
+            key,
+        });
+        const baseUrl = normalizeBaseUrl(input.baseUrl, providerKind);
+        const now = this.#ports.now();
+        const current = document(this.#ports.store.read());
+        const id = input.id ? required(input.id, 'id') : this.#ports.randomId();
+        const existing = current.credentials.find((record) => record.id === id);
+        const record = {
+            id,
+            name: String(input.name || '').trim() || defaultName(providerKind, baseUrl),
+            providerKind,
+            baseUrl,
+            keyHint: keyHint(key),
+            tokenFingerprint: this.#ports.cipher.fingerprint(key),
+            encryptedKey: this.#ports.cipher.encrypt(key),
+            createdAt: existing?.createdAt || now,
+            updatedAt: now,
+            ...(slot ? { slot } : existing?.slot ? { slot: existing.slot } : {}),
+        };
+        this.#ports.store.write({
+            version: 1,
+            credentials: [...current.credentials.filter((candidate) => candidate.id !== id), record],
+        });
+        return record;
+    }
+}
+export { DEFAULT_BASE_URL, inferProviderKind, normalizeBaseUrl };
+//# sourceMappingURL=vault.js.map

package/dist/identity/credentials/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../../src/identity/credentials/vault.ts"],"names":[],"mappings":"AAYA;;;;;GAKG;AAEH,MAAM,gBAAgB,GAA2C;IAC/D,oBAAoB,EAAE,2BAA2B;IACjD,iBAAiB,EAAE,2BAA2B;IAC9C,UAAU,EAAE,iCAAiC;CAC9C,CAAC;AAEF,MAAM,OAAO,GAGR;IACH,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,sBAAsB,EAAE;IACxE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,mBAAmB,EAAE;IAC5D,QAAQ,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,YAAY,EAAE,YAAY,EAAE;IACnE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,mBAAmB,EAAE;CAC1D,CAAC;AAEF,MAAM,qBAAqB,GAA6D;IACtF,WAAW,EAAE,CAAC,sBAAsB,CAAC;IACrC,KAAK,EAAE,CAAC,mBAAmB,CAAC;IAC5B,QAAQ,EAAE,CAAC,YAAY,EAAE,mBAAmB,EAAE,sBAAsB,CAAC;IACrE,EAAE,EAAE,EAAE;CACP,CAAC;AAEF,SAAS,QAAQ,CAAC,KAAc,EAAE,KAAa;IAC7C,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,sBAAsB;WAClC,KAAK,KAAK,mBAAmB;WAC7B,KAAK,KAAK,YAAY;QACzB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACzG,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAA2D;IACpF,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACtD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,sBAAsB,CAAC;IAC1F,IAAI,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IACtH,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgB,EAAE,YAAoC;IAC9E,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,IAAI,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,gBAAgB,CAAC,YAAY,CAAC,CAAC;IACzG,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC7G,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxF,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,WAAW,CAAC,YAAoC,EAAE,OAAe;IACxE,IAAI,YAAY,KAAK,sBAAsB;QAAE,OAAO,WAAW,CAAC;IAChE,IAAI,YAAY,KAAK,YAAY;QAAE,OAAO,mBAAmB,CAAC;IAC9D,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,mBAAmB,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,mBAAmB,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,OAAO,CAAC,MAAwB;IACvC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACnD,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,EAAE,GAAG,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtG,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,cAAc,IAAI,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9H,OAAO;QACL,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO;QAC/B,OAAO,EAAE,IAAI;QACb,gBAAgB,EAAE,WAAW;QAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,SAAS;QACT,SAAS;QACT,GAAG,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/F,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACxG,MAAM,OAAO,GAAI,KAAmC,CAAC,WAAW,CAAC;IACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACpE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAA8B,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,CAAC;AACpI,CAAC;AAED,MAAM,OAAO,eAAe;IACjB,MAAM,CAAuB;IAEtC,YAAY,KAA2B;QACrC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,IAAI;QACF,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW;aAClD,GAAG,CAAC,OAAO,CAAC;aACZ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7G,CAAC;IAED,MAAM,CAAC,KAA4B;QACjC,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,CAAC,EAAU;QACf,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;QACjF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;IAClF,CAAC;IAED,aAAa,CAAC,SAAkB,EAAE,MAAe;QAC/C,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,EAAE,CAAC,CAAC;QACvF,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YACxB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,OAAO,EAAE,gBAAgB,CAAC,UAAU,CAAC,YAAY,CAAC;YAClD,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;SAChC,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;IACvB,CAAC;IAED,iBAAiB,CAAC,SAAmB;QACnC,MAAM,IAAI,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9E,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/H,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC;IAChF,CAAC;IAED,OAAO,CAAC,QAAgC,EAAE;QACxC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY;YAChC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;YACtB,CAAC,CAAC,KAAK,CAAC,OAAO;gBACb,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC/C,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY;YAC/B,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,YAAY,CAAC;YAC9E,CAAC,CAAC,OAAO,CAAC,MAAM;gBACd,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;gBACnF,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,cAAc,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE,2BAA2B,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;QAC1H,CAAC;QACD,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;IAC/G,CAAC;IAED,KAAK,CAAC,KAA4B,EAAE,IAAa;QAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvC,MAAM,oBAAoB,GAAG,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACpG,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,YAAY,GAAG,oBAAoB,IAAI,iBAAiB,CAAC;YAC7D,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAClE,GAAG;SACJ,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACxE,MAAM,MAAM,GAAqB;YAC/B,EAAE;YACF,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,WAAW,CAAC,YAAY,EAAE,OAAO,CAAC;YAC3E,YAAY;YACZ,OAAO;YACP,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC;YACrB,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC;YACrD,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YAC7C,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,GAAG;YACrC,SAAS,EAAE,GAAG;YACd,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;YACtB,OAAO,EAAE,CAAC;YACV,WAAW,EAAE,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC;SACzF,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/identity/index.d.ts

@@ -10,6 +10,7 @@ export * from './labels.js';
 export * from './layout.js';
 export * from './product-state.js';
 export * from './local/index.js';
+export * from './credentials/index.js';
 export * from './ids.js';
 export * from './auth-records.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/identity/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,UAAU,CAAC;AACzB,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,UAAU,CAAC;AACzB,cAAc,mBAAmB,CAAC"}

package/dist/identity/index.js

@@ -10,6 +10,7 @@ export * from './labels.js';
 export * from './layout.js';
 export * from './product-state.js';
 export * from './local/index.js';
+export * from './credentials/index.js';
 export * from './ids.js';
 export * from './auth-records.js';
 //# sourceMappingURL=index.js.map

package/dist/identity/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,UAAU,CAAC;AACzB,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,UAAU,CAAC;AACzB,cAAc,mBAAmB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amalgm/core",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "The Amalgm kernel SDK — identity, transport, supervision, and host capability contracts behind host-injected adapters.",
   "type": "module",
   "license": "UNLICENSED",
@@ -24,6 +24,10 @@
       "types": "./dist/identity/local/index.d.ts",
       "default": "./dist/identity/local/index.js"
     },
+    "./credentials": {
+      "types": "./dist/identity/credentials/index.d.ts",
+      "default": "./dist/identity/credentials/index.js"
+    },
     "./transport": {
       "types": "./dist/transport/index.d.ts",
       "default": "./dist/transport/index.js"