@amalgm/core 0.1.5 → 0.1.7

package/PURPOSE.md

@@ -91,6 +91,14 @@ source until each module is cut over.
     read names one declared service, reads at most the configured tail bound,
     and applies the shared redaction law before any content crosses the
     gateway; arbitrary paths and unbounded files are not diagnostic inputs.
+16. **One machine-local vault owns user credentials.** Every credential is
+    encrypted before persistence, every public view contains only a hint and
+    fingerprint, and plaintext leaves solely through explicit resolution.
+    Compatibility APIs share this vault; they never create a second secret
+    file or cloud authority.
+17. **Retirement is explicit subtraction.** Every retired Engine prefix stays
+    named as evidence but is absent from the active route table, so dead
+    compatibility surfaces cannot masquerade as unfinished product work.
 
 ## Five surfaces, one behavior
 

package/dist/adapters/index.d.ts

@@ -10,4 +10,5 @@
 export type { ClockIsoPort, ClockMsPort, RandomHexPort, Sha256HexPort, ResolvePathPort, } from '../identity/ports.js';
 export type { TimingSafeEqualPort } from '../transport/auth.js';
 export type { HmacHexPort } from '../transport/ingress.js';
+export type { CredentialCipherPort, CredentialStorePort } from '../identity/credentials/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,YAAY,EACV,YAAY,EACZ,WAAW,EACX,aAAa,EACb,aAAa,EACb,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChE,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,YAAY,EACV,YAAY,EACZ,WAAW,EACX,aAAa,EACb,aAAa,EACb,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChE,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/identity/credentials/api.d.ts

@@ -0,0 +1,3 @@
+import { CredentialVault } from './vault.js';
+export declare function createCredentialsApi(vault: CredentialVault): (request: Request) => Promise<Response>;
+//# sourceMappingURL=api.d.ts.map

package/dist/identity/credentials/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../src/identity/credentials/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAO7C,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,eAAe,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAmCpG"}

package/dist/identity/credentials/api.js

@@ -0,0 +1,61 @@
+import { CredentialVault } from './vault.js';
+export function createCredentialsApi(vault) {
+    return async (request) => {
+        const pathname = new URL(request.url).pathname;
+        if (pathname !== '/credentials' && pathname !== '/user-api-keys')
+            return json(404, { error: 'not found' });
+        try {
+            if (pathname === '/credentials') {
+                if (request.method === 'GET')
+                    return json(200, { credentials: vault.list() });
+                const body = await requestBody(request);
+                if (request.method === 'POST') {
+                    return json(200, { credential: vault.upsert({
+                            ...(typeof body.id === 'string' ? { id: body.id } : {}),
+                            ...(typeof body.name === 'string' ? { name: body.name } : {}),
+                            ...(typeof body.providerKind === 'string' ? { providerKind: body.providerKind } : {}),
+                            ...(typeof body.baseUrl === 'string' ? { baseUrl: body.baseUrl } : {}),
+                            key: typeof body.key === 'string' ? body.key : '',
+                        }) });
+                }
+                if (request.method === 'DELETE')
+                    return json(200, vault.delete(typeof body.id === 'string' ? body.id : ''));
+                return methodNotAllowed('GET, POST, DELETE');
+            }
+            const body = await requestBody(request);
+            if (request.method === 'POST') {
+                const saved = vault.putHarnessKey(body.harnessId, body.apiKey);
+                return json(200, { keyHint: saved.keyHint });
+            }
+            if (request.method === 'DELETE') {
+                return json(200, vault.deleteHarnessKeys(body.harnessId));
+            }
+            return methodNotAllowed('POST, DELETE');
+        }
+        catch (error) {
+            return json(400, { error: error instanceof Error ? error.message : 'Invalid credential request' });
+        }
+    };
+}
+async function requestBody(request) {
+    const text = await request.text();
+    if (!text)
+        return {};
+    const value = JSON.parse(text);
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('request body must be an object');
+    return value;
+}
+function methodNotAllowed(allow) {
+    return new Response(JSON.stringify({ error: 'method not allowed' }), {
+        status: 405,
+        headers: { 'content-type': 'application/json', 'cache-control': 'no-store', allow },
+    });
+}
+function json(status, body) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { 'content-type': 'application/json', 'cache-control': 'no-store' },
+    });
+}
+//# sourceMappingURL=api.js.map

package/dist/identity/credentials/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../../src/identity/credentials/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAO7C,MAAM,UAAU,oBAAoB,CAAC,KAAsB;IACzD,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC/C,IAAI,QAAQ,KAAK,cAAc,IAAI,QAAQ,KAAK,gBAAgB;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAE3G,IAAI,CAAC;YACH,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;gBAChC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;oBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC9E,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;gBACxC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC9B,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC;4BAC1C,GAAG,CAAC,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BACvD,GAAG,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BAC7D,GAAG,CAAC,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAsC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BAC/G,GAAG,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BACtE,GAAG,EAAE,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;yBAClD,CAAC,EAAE,CAAC,CAAC;gBACR,CAAC;gBACD,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC5G,OAAO,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;YAC/C,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC/D,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/C,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,gBAAgB,CAAC,cAAc,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B,EAAE,CAAC,CAAC;QACrG,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAgB;IACzC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACnH,OAAO,KAAa,CAAC;AACvB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE;QACnE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,KAAK,EAAE;KACpF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,IAAa;IACzC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE;KAC7E,CAAC,CAAC;AACL,CAAC"}

package/dist/identity/credentials/index.d.ts

@@ -0,0 +1,4 @@
+export { createCredentialsApi } from './api.js';
+export { CredentialVault, DEFAULT_BASE_URL, inferProviderKind, normalizeBaseUrl } from './vault.js';
+export type * from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/identity/credentials/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/credentials/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACpG,mBAAmB,YAAY,CAAC"}

package/dist/identity/credentials/index.js

@@ -0,0 +1,3 @@
+export { createCredentialsApi } from './api.js';
+export { CredentialVault, DEFAULT_BASE_URL, inferProviderKind, normalizeBaseUrl } from './vault.js';
+//# sourceMappingURL=index.js.map

package/dist/identity/credentials/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/credentials/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}

package/dist/identity/credentials/types.d.ts

@@ -0,0 +1,52 @@
+export type CredentialProviderKind = 'anthropic_compatible' | 'openai_compatible' | 'ai_gateway';
+export type ByokHarnessId = 'claude_code' | 'codex' | 'opencode' | 'pi';
+export interface CredentialSummary {
+    readonly id: string;
+    readonly name: string;
+    readonly providerKind: CredentialProviderKind;
+    readonly keyHint: string;
+    readonly tokenFingerprint: string;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+}
+export interface StoredCredential extends CredentialSummary {
+    readonly baseUrl: string;
+    readonly encryptedKey: unknown;
+    readonly slot?: string;
+}
+export interface CredentialStoreDocument {
+    readonly version: 1;
+    readonly credentials: readonly StoredCredential[];
+}
+export interface CredentialStorePort {
+    read(): unknown;
+    write(document: CredentialStoreDocument): void;
+}
+export interface CredentialCipherPort {
+    encrypt(secret: string): unknown;
+    decrypt(envelope: unknown): string;
+    fingerprint(secret: string): string;
+}
+export interface CredentialVaultPorts {
+    readonly store: CredentialStorePort;
+    readonly cipher: CredentialCipherPort;
+    readonly now: () => string;
+    readonly randomId: () => string;
+}
+export interface UpsertCredentialInput {
+    readonly id?: string;
+    readonly name?: string;
+    readonly key: string;
+    readonly providerKind?: CredentialProviderKind;
+    readonly baseUrl?: string;
+}
+export interface ResolveCredentialInput {
+    readonly credentialId?: string;
+    readonly harness?: ByokHarnessId;
+    readonly providerKind?: CredentialProviderKind;
+}
+export interface ResolvedCredential extends CredentialSummary {
+    readonly baseUrl: string;
+    readonly key: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/identity/credentials/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/identity/credentials/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,sBAAsB,GAC9B,sBAAsB,GACtB,mBAAmB,GACnB,YAAY,CAAC;AAEjB,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,OAAO,GAAG,UAAU,GAAG,IAAI,CAAC;AAExE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,IAAI,OAAO,CAAC;IAChB,KAAK,CAAC,QAAQ,EAAE,uBAAuB,GAAG,IAAI,CAAC;CAChD;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,OAAO,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IACnC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,YAAY,CAAC,EAAE,sBAAsB,CAAC;IAC/C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,sBAAsB,CAAC;CAChD;AAED,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB"}

package/dist/identity/credentials/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/identity/credentials/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/identity/credentials/types.ts"],"names":[],"mappings":""}

package/dist/identity/credentials/vault.d.ts

@@ -0,0 +1,31 @@
+import type { CredentialProviderKind, CredentialSummary, CredentialVaultPorts, ResolveCredentialInput, ResolvedCredential, UpsertCredentialInput } from './types.js';
+/**
+ * Engine reference:
+ * - runtime/scripts/chat-core/credentials/store.js
+ * - runtime/scripts/amalgm-mcp/credentials/rest.js
+ * - runtime/scripts/amalgm-mcp/user-api-keys/rest.js
+ */
+declare const DEFAULT_BASE_URL: Record<CredentialProviderKind, string>;
+declare function inferProviderKind(input: {
+    readonly baseUrl?: string;
+    readonly key?: string;
+}): CredentialProviderKind;
+declare function normalizeBaseUrl(baseUrl: unknown, providerKind: CredentialProviderKind): string;
+export declare class CredentialVault {
+    #private;
+    constructor(ports: CredentialVaultPorts);
+    list(): CredentialSummary[];
+    upsert(input: UpsertCredentialInput): CredentialSummary;
+    delete(id: string): {
+        readonly ok: true;
+        readonly deleted: boolean;
+    };
+    putHarnessKey(harnessId: unknown, apiKey: unknown): CredentialSummary;
+    deleteHarnessKeys(harnessId?: unknown): {
+        readonly ok: true;
+        readonly deleted: number;
+    };
+    resolve(input?: ResolveCredentialInput): ResolvedCredential | null;
+}
+export { DEFAULT_BASE_URL, inferProviderKind, normalizeBaseUrl };
+//# sourceMappingURL=vault.d.ts.map

package/dist/identity/credentials/vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../../src/identity/credentials/vault.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,sBAAsB,EAEtB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAElB,qBAAqB,EACtB,MAAM,YAAY,CAAC;AAEpB;;;;;GAKG;AAEH,QAAA,MAAM,gBAAgB,EAAE,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAI5D,CAAC;AAsCF,iBAAS,iBAAiB,CAAC,KAAK,EAAE;IAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,sBAAsB,CAM9G;AAED,iBAAS,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,sBAAsB,GAAG,MAAM,CAMxF;AA2DD,qBAAa,eAAe;;gBAGd,KAAK,EAAE,oBAAoB;IAIvC,IAAI,IAAI,iBAAiB,EAAE;IAM3B,MAAM,CAAC,KAAK,EAAE,qBAAqB,GAAG,iBAAiB;IAIvD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG;QAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;KAAE;IAQpE,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,iBAAiB;IAcrE,iBAAiB,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG;QAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE;IAQvF,OAAO,CAAC,KAAK,GAAE,sBAA2B,GAAG,kBAAkB,GAAG,IAAI;CAoDvE;AAED,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/identity/credentials/vault.js

@@ -0,0 +1,214 @@
+/**
+ * Engine reference:
+ * - runtime/scripts/chat-core/credentials/store.js
+ * - runtime/scripts/amalgm-mcp/credentials/rest.js
+ * - runtime/scripts/amalgm-mcp/user-api-keys/rest.js
+ */
+const DEFAULT_BASE_URL = {
+    anthropic_compatible: 'https://api.anthropic.com',
+    openai_compatible: 'https://api.openai.com/v1',
+    ai_gateway: 'https://ai-gateway.vercel.sh/v1',
+};
+const HARNESS = {
+    claude_code: { name: 'Anthropic', providerKind: 'anthropic_compatible' },
+    codex: { name: 'OpenAI', providerKind: 'openai_compatible' },
+    opencode: { name: 'Vercel AI Gateway', providerKind: 'ai_gateway' },
+    pi: { name: 'OpenAI', providerKind: 'openai_compatible' },
+};
+const PROVIDERS_FOR_HARNESS = {
+    claude_code: ['anthropic_compatible'],
+    codex: ['openai_compatible'],
+    opencode: ['ai_gateway', 'openai_compatible', 'anthropic_compatible'],
+    pi: [],
+};
+function required(value, label) {
+    const text = typeof value === 'string' ? value.trim() : '';
+    if (!text)
+        throw new Error(`${label} is required`);
+    return text;
+}
+function provider(value) {
+    return value === 'anthropic_compatible'
+        || value === 'openai_compatible'
+        || value === 'ai_gateway'
+        ? value
+        : null;
+}
+function harness(value) {
+    if (value === 'claude_code' || value === 'codex' || value === 'opencode' || value === 'pi')
+        return value;
+    throw new Error(`Unsupported BYOK harness: ${String(value || '')}`);
+}
+function inferProviderKind(input) {
+    const url = String(input.baseUrl || '').toLowerCase();
+    const key = String(input.key || '').trim();
+    if (url.includes('anthropic') || key.startsWith('sk-ant-'))
+        return 'anthropic_compatible';
+    if (url.includes('ai-gateway.vercel') || url.includes('gateway.vercel') || key.startsWith('v0_'))
+        return 'ai_gateway';
+    return 'openai_compatible';
+}
+function normalizeBaseUrl(baseUrl, providerKind) {
+    const value = String(baseUrl || DEFAULT_BASE_URL[providerKind]).trim() || DEFAULT_BASE_URL[providerKind];
+    const url = new URL(value);
+    if (url.protocol !== 'http:' && url.protocol !== 'https:')
+        throw new Error('baseUrl must use http or https');
+    if (url.username || url.password)
+        throw new Error('baseUrl cannot contain credentials');
+    return value.replace(/\/+$/, '');
+}
+function defaultName(providerKind, baseUrl) {
+    if (providerKind === 'anthropic_compatible')
+        return 'Anthropic';
+    if (providerKind === 'ai_gateway')
+        return 'Vercel AI Gateway';
+    try {
+        return new URL(baseUrl).hostname.replace(/^api\./, '') || 'OpenAI Compatible';
+    }
+    catch {
+        return 'OpenAI Compatible';
+    }
+}
+function keyHint(key) {
+    return `...${key.slice(-4)}`;
+}
+function summary(record) {
+    return {
+        id: record.id,
+        name: record.name,
+        providerKind: record.providerKind,
+        keyHint: record.keyHint,
+        tokenFingerprint: record.tokenFingerprint,
+        createdAt: record.createdAt,
+        updatedAt: record.updatedAt,
+    };
+}
+function storedCredential(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return null;
+    const record = value;
+    const providerKind = provider(record.providerKind);
+    if (!providerKind)
+        return null;
+    const id = typeof record.id === 'string' ? record.id.trim() : '';
+    const name = typeof record.name === 'string' ? record.name.trim() : '';
+    const baseUrl = typeof record.baseUrl === 'string' ? record.baseUrl.trim() : '';
+    const hint = typeof record.keyHint === 'string' ? record.keyHint.trim() : '';
+    const fingerprint = typeof record.tokenFingerprint === 'string' ? record.tokenFingerprint.trim() : '';
+    const createdAt = typeof record.createdAt === 'string' ? record.createdAt.trim() : '';
+    const updatedAt = typeof record.updatedAt === 'string' ? record.updatedAt.trim() : '';
+    if (!id || !name || !baseUrl || !hint || !fingerprint || !createdAt || !updatedAt || !('encryptedKey' in record))
+        return null;
+    return {
+        id, name, providerKind, baseUrl,
+        keyHint: hint,
+        tokenFingerprint: fingerprint,
+        encryptedKey: record.encryptedKey,
+        createdAt,
+        updatedAt,
+        ...(typeof record.slot === 'string' && record.slot.trim() ? { slot: record.slot.trim() } : {}),
+    };
+}
+function document(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return { version: 1, credentials: [] };
+    const records = value.credentials;
+    if (!Array.isArray(records))
+        return { version: 1, credentials: [] };
+    return { version: 1, credentials: records.map(storedCredential).filter((record) => record !== null) };
+}
+export class CredentialVault {
+    #ports;
+    constructor(ports) {
+        this.#ports = ports;
+    }
+    list() {
+        return document(this.#ports.store.read()).credentials
+            .map(summary)
+            .sort((left, right) => left.createdAt.localeCompare(right.createdAt) || left.id.localeCompare(right.id));
+    }
+    upsert(input) {
+        return summary(this.#save(input));
+    }
+    delete(id) {
+        const target = required(id, 'id');
+        const current = document(this.#ports.store.read());
+        const credentials = current.credentials.filter((record) => record.id !== target);
+        this.#ports.store.write({ version: 1, credentials });
+        return { ok: true, deleted: credentials.length !== current.credentials.length };
+    }
+    putHarnessKey(harnessId, apiKey) {
+        const id = harness(harnessId);
+        const descriptor = HARNESS[id];
+        const current = document(this.#ports.store.read());
+        const existing = current.credentials.find((record) => record.slot === `harness:${id}`);
+        return summary(this.#save({
+            ...(existing ? { id: existing.id } : {}),
+            name: descriptor.name,
+            providerKind: descriptor.providerKind,
+            baseUrl: DEFAULT_BASE_URL[descriptor.providerKind],
+            key: required(apiKey, 'apiKey'),
+        }, `harness:${id}`));
+    }
+    deleteHarnessKeys(harnessId) {
+        const slot = harnessId === undefined ? null : `harness:${harness(harnessId)}`;
+        const current = document(this.#ports.store.read());
+        const credentials = current.credentials.filter((record) => slot ? record.slot !== slot : !record.slot?.startsWith('harness:'));
+        this.#ports.store.write({ version: 1, credentials });
+        return { ok: true, deleted: current.credentials.length - credentials.length };
+    }
+    resolve(input = {}) {
+        const current = document(this.#ports.store.read());
+        const allowed = input.providerKind
+            ? [input.providerKind]
+            : input.harness
+                ? PROVIDERS_FOR_HARNESS[harness(input.harness)]
+                : [];
+        const record = input.credentialId
+            ? current.credentials.find((candidate) => candidate.id === input.credentialId)
+            : allowed.length
+                ? current.credentials.find((candidate) => allowed.includes(candidate.providerKind))
+                : undefined;
+        if (!record)
+            return null;
+        if (allowed.length && !allowed.includes(record.providerKind)) {
+            throw new Error(`Credential ${record.name || record.id} is not compatible with ${input.harness || input.providerKind}`);
+        }
+        return { ...summary(record), baseUrl: record.baseUrl, key: this.#ports.cipher.decrypt(record.encryptedKey) };
+    }
+    #save(input, slot) {
+        const key = required(input.key, 'key');
+        const explicitProviderKind = input.providerKind === undefined ? null : provider(input.providerKind);
+        if (input.providerKind !== undefined && !explicitProviderKind) {
+            throw new Error(`Unsupported credential provider: ${String(input.providerKind)}`);
+        }
+        const providerKind = explicitProviderKind || inferProviderKind({
+            ...(input.baseUrl === undefined ? {} : { baseUrl: input.baseUrl }),
+            key,
+        });
+        const baseUrl = normalizeBaseUrl(input.baseUrl, providerKind);
+        const now = this.#ports.now();
+        const current = document(this.#ports.store.read());
+        const id = input.id ? required(input.id, 'id') : this.#ports.randomId();
+        const existing = current.credentials.find((record) => record.id === id);
+        const record = {
+            id,
+            name: String(input.name || '').trim() || defaultName(providerKind, baseUrl),
+            providerKind,
+            baseUrl,
+            keyHint: keyHint(key),
+            tokenFingerprint: this.#ports.cipher.fingerprint(key),
+            encryptedKey: this.#ports.cipher.encrypt(key),
+            createdAt: existing?.createdAt || now,
+            updatedAt: now,
+            ...(slot ? { slot } : existing?.slot ? { slot: existing.slot } : {}),
+        };
+        this.#ports.store.write({
+            version: 1,
+            credentials: [...current.credentials.filter((candidate) => candidate.id !== id), record],
+        });
+        return record;
+    }
+}
+export { DEFAULT_BASE_URL, inferProviderKind, normalizeBaseUrl };
+//# sourceMappingURL=vault.js.map

package/dist/identity/credentials/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../../src/identity/credentials/vault.ts"],"names":[],"mappings":"AAYA;;;;;GAKG;AAEH,MAAM,gBAAgB,GAA2C;IAC/D,oBAAoB,EAAE,2BAA2B;IACjD,iBAAiB,EAAE,2BAA2B;IAC9C,UAAU,EAAE,iCAAiC;CAC9C,CAAC;AAEF,MAAM,OAAO,GAGR;IACH,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,sBAAsB,EAAE;IACxE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,mBAAmB,EAAE;IAC5D,QAAQ,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,YAAY,EAAE,YAAY,EAAE;IACnE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,mBAAmB,EAAE;CAC1D,CAAC;AAEF,MAAM,qBAAqB,GAA6D;IACtF,WAAW,EAAE,CAAC,sBAAsB,CAAC;IACrC,KAAK,EAAE,CAAC,mBAAmB,CAAC;IAC5B,QAAQ,EAAE,CAAC,YAAY,EAAE,mBAAmB,EAAE,sBAAsB,CAAC;IACrE,EAAE,EAAE,EAAE;CACP,CAAC;AAEF,SAAS,QAAQ,CAAC,KAAc,EAAE,KAAa;IAC7C,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,sBAAsB;WAClC,KAAK,KAAK,mBAAmB;WAC7B,KAAK,KAAK,YAAY;QACzB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACzG,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAA2D;IACpF,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACtD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,sBAAsB,CAAC;IAC1F,IAAI,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IACtH,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgB,EAAE,YAAoC;IAC9E,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,IAAI,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,gBAAgB,CAAC,YAAY,CAAC,CAAC;IACzG,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC7G,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxF,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,WAAW,CAAC,YAAoC,EAAE,OAAe;IACxE,IAAI,YAAY,KAAK,sBAAsB;QAAE,OAAO,WAAW,CAAC;IAChE,IAAI,YAAY,KAAK,YAAY;QAAE,OAAO,mBAAmB,CAAC;IAC9D,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,mBAAmB,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,mBAAmB,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,OAAO,CAAC,MAAwB;IACvC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACnD,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,EAAE,GAAG,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtG,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,cAAc,IAAI,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9H,OAAO;QACL,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO;QAC/B,OAAO,EAAE,IAAI;QACb,gBAAgB,EAAE,WAAW;QAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,SAAS;QACT,SAAS;QACT,GAAG,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/F,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACxG,MAAM,OAAO,GAAI,KAAmC,CAAC,WAAW,CAAC;IACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACpE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAA8B,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,CAAC;AACpI,CAAC;AAED,MAAM,OAAO,eAAe;IACjB,MAAM,CAAuB;IAEtC,YAAY,KAA2B;QACrC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,IAAI;QACF,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW;aAClD,GAAG,CAAC,OAAO,CAAC;aACZ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7G,CAAC;IAED,MAAM,CAAC,KAA4B;QACjC,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,CAAC,EAAU;QACf,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;QACjF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;IAClF,CAAC;IAED,aAAa,CAAC,SAAkB,EAAE,MAAe;QAC/C,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,EAAE,CAAC,CAAC;QACvF,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YACxB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,OAAO,EAAE,gBAAgB,CAAC,UAAU,CAAC,YAAY,CAAC;YAClD,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;SAChC,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;IACvB,CAAC;IAED,iBAAiB,CAAC,SAAmB;QACnC,MAAM,IAAI,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9E,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/H,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC;IAChF,CAAC;IAED,OAAO,CAAC,QAAgC,EAAE;QACxC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY;YAChC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;YACtB,CAAC,CAAC,KAAK,CAAC,OAAO;gBACb,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC/C,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY;YAC/B,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,YAAY,CAAC;YAC9E,CAAC,CAAC,OAAO,CAAC,MAAM;gBACd,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;gBACnF,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,cAAc,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE,2BAA2B,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;QAC1H,CAAC;QACD,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;IAC/G,CAAC;IAED,KAAK,CAAC,KAA4B,EAAE,IAAa;QAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvC,MAAM,oBAAoB,GAAG,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACpG,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,YAAY,GAAG,oBAAoB,IAAI,iBAAiB,CAAC;YAC7D,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAClE,GAAG;SACJ,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACxE,MAAM,MAAM,GAAqB;YAC/B,EAAE;YACF,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,WAAW,CAAC,YAAY,EAAE,OAAO,CAAC;YAC3E,YAAY;YACZ,OAAO;YACP,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC;YACrB,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC;YACrD,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YAC7C,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,GAAG;YACrC,SAAS,EAAE,GAAG;YACd,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;YACtB,OAAO,EAAE,CAAC;YACV,WAAW,EAAE,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC;SACzF,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/identity/index.d.ts

@@ -10,6 +10,7 @@ export * from './labels.js';
 export * from './layout.js';
 export * from './product-state.js';
 export * from './local/index.js';
+export * from './credentials/index.js';
 export * from './ids.js';
 export * from './auth-records.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/identity/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,UAAU,CAAC;AACzB,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,UAAU,CAAC;AACzB,cAAc,mBAAmB,CAAC"}

package/dist/identity/index.js

@@ -10,6 +10,7 @@ export * from './labels.js';
 export * from './layout.js';
 export * from './product-state.js';
 export * from './local/index.js';
+export * from './credentials/index.js';
 export * from './ids.js';
 export * from './auth-records.js';
 //# sourceMappingURL=index.js.map

package/dist/identity/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,UAAU,CAAC;AACzB,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,UAAU,CAAC;AACzB,cAAc,mBAAmB,CAAC"}

package/dist/transport/index.d.ts

@@ -7,7 +7,8 @@
  *    codes.
  *  - routing: ONE routing table (axiom 4) — prefix classification,
  *    the port-mapping and target-port laws, denial contracts. The
- *    engine's shipped table contents live in shipped-routes.
+ *    decomposed target contents and explicit Engine retirements live in
+ *    shipped-routes.
  *  - admission: who gets routed to at all — app refs, the serving
  *    gate and the advertising breaker, preview-port admission, header
  *    hygiene, log redaction.

package/dist/transport/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/transport/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/transport/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC"}

package/dist/transport/index.js

@@ -7,7 +7,8 @@
  *    codes.
  *  - routing: ONE routing table (axiom 4) — prefix classification,
  *    the port-mapping and target-port laws, denial contracts. The
- *    engine's shipped table contents live in shipped-routes.
+ *    decomposed target contents and explicit Engine retirements live in
+ *    shipped-routes.
  *  - admission: who gets routed to at all — app refs, the serving
  *    gate and the advertising breaker, preview-port admission, header
  *    hygiene, log redaction.

package/dist/transport/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/transport/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/transport/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC"}

package/dist/transport/routing.d.ts

@@ -7,7 +7,7 @@
  * vice versa) is that drift cashing out. This module is the one
  * definition; the table CONTENTS are injected product configuration
  * (the kernel routes, it does not know what chat is — axiom 3), with
- * the engine's shipped lists exported from shipped-routes.ts.
+ * the decomposed target lists exported from shipped-routes.ts.
  *
  * The pipe never reads the mail: everything here classifies pathnames
  * and port numbers. Nothing inspects a payload.
@@ -23,7 +23,7 @@ export declare const RUNTIME_SERVICES: readonly ["gateway", "portMonitor", "mcp"
 /**
  * The one routing table. Buckets are prefix lists; gateway
  * additionally owns a set of exact paths. Contents are product
- * configuration — see shippedRouteTable for the engine's lists.
+ * configuration — see shippedRouteTable for the active target lists.
  */
 export interface RouteTable {
     readonly gatewayPrefixes: readonly string[];

package/dist/transport/routing.js

@@ -7,7 +7,7 @@
  * vice versa) is that drift cashing out. This module is the one
  * definition; the table CONTENTS are injected product configuration
  * (the kernel routes, it does not know what chat is — axiom 3), with
- * the engine's shipped lists exported from shipped-routes.ts.
+ * the decomposed target lists exported from shipped-routes.ts.
  *
  * The pipe never reads the mail: everything here classifies pathnames
  * and port numbers. Nothing inspects a payload.

package/dist/transport/shipped-routes.d.ts

@@ -1,6 +1,6 @@
 /**
- * The engine's shipped routing table, copied byte-for-byte from
- * tunnel-events.js:58-89 — the canonical of the three engine copies
+ * The decomposed runtime's active routing table, derived from the Engine
+ * table in tunnel-events.js:58-89 — the canonical of its three copies
  * (the other two: tunnel-chat.js:33-64, identical; local-gateway.js:
  * 133-176, which carries only the chat/mcp/portMonitor buckets
  * because the gateway dispatches its own routes before consulting a
@@ -9,13 +9,21 @@
  * under its own '/pty' handling).
  *
  * Counts, pinned by tests: 3 gateway prefixes, 5 gateway exact paths,
- * 3 port-monitor prefixes, 7 chat prefixes, 26 MCP prefixes.
+ * 3 port-monitor prefixes, 7 chat prefixes, 24 active MCP prefixes.
  *
  * This is product configuration riding in the kernel repo for the
  * cutover: the table SHAPE is core's; these CONTENTS belong to the
- * products that own the prefixes. A new runtime REST prefix goes here
- * (and, until cutover, in all three engine copies) or UI calls 404.
+ * products that own the prefixes. Engine compatibility prefixes which the
+ * target deliberately will not serve remain named below as retirement
+ * evidence instead of disappearing from history.
  */
 import type { RouteTable } from './routing.js';
+/**
+ * Present in the current Engine gateway, absent from the decomposed target:
+ * `/tasks` is the superseded SQLite scheduler facade; `/mcp-connections` is
+ * the superseded second registry now represented by Tools connection records
+ * plus credential references resolved by Core's machine-local vault.
+ */
+export declare const retiredEngineRoutePrefixes: readonly ["/tasks", "/mcp-connections"];
 export declare const shippedRouteTable: RouteTable;
 //# sourceMappingURL=shipped-routes.d.ts.map

package/dist/transport/shipped-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shipped-routes.d.ts","sourceRoot":"","sources":["../../src/transport/shipped-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,eAAO,MAAM,iBAAiB,EAAE,UAiC/B,CAAC"}
+{"version":3,"file":"shipped-routes.d.ts","sourceRoot":"","sources":["../../src/transport/shipped-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,yCAA0C,CAAC;AAElF,eAAO,MAAM,iBAAiB,EAAE,UA+B/B,CAAC"}

package/dist/transport/shipped-routes.js

@@ -1,6 +1,6 @@
 /**
- * The engine's shipped routing table, copied byte-for-byte from
- * tunnel-events.js:58-89 — the canonical of the three engine copies
+ * The decomposed runtime's active routing table, derived from the Engine
+ * table in tunnel-events.js:58-89 — the canonical of its three copies
  * (the other two: tunnel-chat.js:33-64, identical; local-gateway.js:
  * 133-176, which carries only the chat/mcp/portMonitor buckets
  * because the gateway dispatches its own routes before consulting a
@@ -9,13 +9,21 @@
  * under its own '/pty' handling).
  *
  * Counts, pinned by tests: 3 gateway prefixes, 5 gateway exact paths,
- * 3 port-monitor prefixes, 7 chat prefixes, 26 MCP prefixes.
+ * 3 port-monitor prefixes, 7 chat prefixes, 24 active MCP prefixes.
  *
  * This is product configuration riding in the kernel repo for the
  * cutover: the table SHAPE is core's; these CONTENTS belong to the
- * products that own the prefixes. A new runtime REST prefix goes here
- * (and, until cutover, in all three engine copies) or UI calls 404.
+ * products that own the prefixes. Engine compatibility prefixes which the
+ * target deliberately will not serve remain named below as retirement
+ * evidence instead of disappearing from history.
  */
+/**
+ * Present in the current Engine gateway, absent from the decomposed target:
+ * `/tasks` is the superseded SQLite scheduler facade; `/mcp-connections` is
+ * the superseded second registry now represented by Tools connection records
+ * plus credential references resolved by Core's machine-local vault.
+ */
+export const retiredEngineRoutePrefixes = ['/tasks', '/mcp-connections'];
 export const shippedRouteTable = {
     gatewayPrefixes: ['/__amalgm', '/diagnostics', '/pty'],
     gatewayExactPaths: ['/', '/healthz', '/runtime-state', '/pty/session', '/pty/resize'],
@@ -24,14 +32,12 @@ export const shippedRouteTable = {
     mcpPrefixes: [
         '/mcp',
         '/events',
-        '/tasks',
         '/automations',
         '/event-triggers',
         '/workspace',
         '/project-context',
         '/github',
         '/fs',
-        '/mcp-connections',
         '/toolbox',
         '/state',
         '/local',

package/dist/transport/shipped-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"shipped-routes.js","sourceRoot":"","sources":["../../src/transport/shipped-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAe;IAC3C,eAAe,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC;IACtD,iBAAiB,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,CAAC;IACrF,mBAAmB,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,eAAe,CAAC;IAC9D,YAAY,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,CAAC;IAC7F,WAAW,EAAE;QACX,MAAM;QACN,SAAS;QACT,QAAQ;QACR,cAAc;QACd,iBAAiB;QACjB,YAAY;QACZ,kBAAkB;QAClB,SAAS;QACT,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,QAAQ;QACR,QAAQ;QACR,cAAc;QACd,gBAAgB;QAChB,QAAQ;QACR,QAAQ;QACR,gBAAgB;QAChB,OAAO;QACP,YAAY;QACZ,SAAS;QACT,eAAe;QACf,gBAAgB;QAChB,SAAS;QACT,mBAAmB;QACnB,UAAU;KACX;CACF,CAAC"}
+{"version":3,"file":"shipped-routes.js","sourceRoot":"","sources":["../../src/transport/shipped-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAU,CAAC;AAElF,MAAM,CAAC,MAAM,iBAAiB,GAAe;IAC3C,eAAe,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC;IACtD,iBAAiB,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,CAAC;IACrF,mBAAmB,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,eAAe,CAAC;IAC9D,YAAY,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,CAAC;IAC7F,WAAW,EAAE;QACX,MAAM;QACN,SAAS;QACT,cAAc;QACd,iBAAiB;QACjB,YAAY;QACZ,kBAAkB;QAClB,SAAS;QACT,KAAK;QACL,UAAU;QACV,QAAQ;QACR,QAAQ;QACR,cAAc;QACd,gBAAgB;QAChB,QAAQ;QACR,QAAQ;QACR,gBAAgB;QAChB,OAAO;QACP,YAAY;QACZ,SAAS;QACT,eAAe;QACf,gBAAgB;QAChB,SAAS;QACT,mBAAmB;QACnB,UAAU;KACX;CACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amalgm/core",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "The Amalgm kernel SDK — identity, transport, supervision, and host capability contracts behind host-injected adapters.",
   "type": "module",
   "license": "UNLICENSED",
@@ -24,6 +24,10 @@
       "types": "./dist/identity/local/index.d.ts",
       "default": "./dist/identity/local/index.js"
     },
+    "./credentials": {
+      "types": "./dist/identity/credentials/index.d.ts",
+      "default": "./dist/identity/credentials/index.js"
+    },
     "./transport": {
       "types": "./dist/transport/index.d.ts",
       "default": "./dist/transport/index.js"