@cleocode/core 2026.6.11 → 2026.6.13

package/dist/llm/role-executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-executor.d.ts","sourceRoot":"","sources":["../../src/llm/role-executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EACV,eAAe,EAEhB,MAAM,gDAAgD,CAAC;AAQxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AA2BxD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,IAAI,IAAI,CAElD;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wDAAwD;IACxD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,KAAK,EAAE,eAAe,CAAC;IACvB,uDAAuD;IACvD,QAAQ,EAAE,cAAc,CAAC;IACzB,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC;CACf;AAKD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,QAAQ,EACd,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,qBAA0B,GAC/B,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAiHtC"}
+{"version":3,"file":"role-executor.d.ts","sourceRoot":"","sources":["../../src/llm/role-executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EACV,eAAe,EAEhB,MAAM,gDAAgD,CAAC;AAQxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AA2BxD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,IAAI,IAAI,CAElD;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wDAAwD;IACxD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,KAAK,EAAE,eAAe,CAAC;IACvB,uDAAuD;IACvD,QAAQ,EAAE,cAAc,CAAC;IACzB,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC;CACf;AAKD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,QAAQ,EACd,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,qBAA0B,GAC/B,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAmHtC"}

package/dist/llm/role-executor.js

@@ -91,7 +91,7 @@ const DEFAULT_MAX_TOKENS = 1024;
  */
 export async function executeForRole(role, systemPrompt, userContent, opts = {}) {
     const llm = await resolveLLMForRole(role, { projectRoot: opts.projectRoot });
-    if (!llm.credential?.apiKey) {
+    if (!llm.sealedCredential || !llm.credential) {
         // No usable credential for this role's resolved provider. Surface ONE
         // actionable re-auth hint per (role, provider) tuple instead of a silent
         // skip — the caller still degrades gracefully via the null return.
@@ -121,12 +121,15 @@ export async function executeForRole(role, systemPrompt, userContent, opts = {})
         // transport blocks that had each drifted from `session-factory` (the
         // anthropic block hardcoded the OAuth beta header; the others omitted it).
         const authType = llm.credential.authType === 'oauth' ? 'oauth' : 'api_key';
+        // E10 (T11753): materialize the plaintext from the sealed handle ONLY here,
+        // at the wire — immediately before building the transport. The token is used
+        // for the kimi-code diagnostic and the transport credential, then goes out
+        // of scope; it is never returned, logged, or serialized.
+        const token = (await llm.sealedCredential.fetch()).value;
         // Diagnostic (preserved): a non-`sk-kimi-`, non-OAuth key routed to
         // kimi-code will likely fail — the legacy Moonshot `mk-*` path lives on the
         // separate `moonshot` provider.
-        if (llm.provider === 'kimi-code' &&
-            authType !== 'oauth' &&
-            !isKimiCodeApiKey(llm.credential.apiKey)) {
+        if (llm.provider === 'kimi-code' && authType !== 'oauth' && !isKimiCodeApiKey(token)) {
             console.warn(`[role-executor] kimi-code credential is not sk-kimi- prefixed and not OAuth; ` +
                 `the request may fail. Configure a coding-plan key from kimi.com/code or ` +
                 `switch the provider to 'moonshot' for legacy mk- keys.`);
@@ -135,7 +138,7 @@ export async function executeForRole(role, systemPrompt, userContent, opts = {})
         const resolvedCredential = {
             provider: llm.provider,
             label: llm.credentialLabel ?? 'default',
-            token: llm.credential.apiKey,
+            token,
             authType,
             expiresAt: null,
             refreshToken: null,

package/dist/llm/role-executor.js.map

@@ -1 +1 @@
-{"version":3,"file":"role-executor.js","sourceRoot":"","sources":["../../src/llm/role-executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAQH,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAGvD;;;;;;;;GAQG;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;AAE/C;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,GAAW,EAAE,OAAe;IACnD,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO;IAC1C,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B;IACzC,oBAAoB,CAAC,KAAK,EAAE,CAAC;AAC/B,CAAC;AA0CD,uEAAuE;AACvE,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAc,EACd,YAAoB,EACpB,WAAmB,EACnB,OAA8B,EAAE;IAEhC,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAC5B,sEAAsE;QACtE,yEAAyE;QACzE,mEAAmE;QACnE,eAAe,CACb,GAAG,IAAI,IAAI,GAAG,CAAC,QAAQ,SAAS,EAChC,wBAAwB,IAAI,aAAa,GAAG,CAAC,QAAQ,0BAA0B;YAC7E,0CAA0C,GAAG,CAAC,QAAQ,sBAAsB;YAC5E,wBAAwB,IAAI,0DAA0D,CACzF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,eAAe,GAAG,GAAG,CAAC,eAAe,IAAI,WAAW,CAAC;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,IAAI,GAAG,CAAC,KAAK,CAAC;IAE9C,MAAM,OAAO,GAAqB;QAChC,KAAK;QACL,MAAM,EAAE,YAAY;QACpB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;QAClD,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,kBAAkB;QAC/C,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAC;IAEF,IAAI,CAAC;QACH,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,6EAA6E;QAC7E,6EAA6E;QAC7E,uEAAuE;QACvE,qEAAqE;QACrE,2EAA2E;QAC3E,MAAM,QAAQ,GAAwB,GAAG,CAAC,UAAU,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAEhG,oEAAoE;QACpE,4EAA4E;QAC5E,gCAAgC;QAChC,IACE,GAAG,CAAC,QAAQ,KAAK,WAAW;YAC5B,QAAQ,KAAK,OAAO;YACpB,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EACxC,CAAC;YACD,OAAO,CAAC,IAAI,CACV,+EAA+E;gBAC7E,0EAA0E;gBAC1E,wDAAwD,CAC3D,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACnD,MAAM,kBAAkB,GAAuB;YAC7C,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,KAAK,EAAE,GAAG,CAAC,eAAe,IAAI,SAAS;YACvC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM;YAC5B,QAAQ;YACR,SAAS,EAAE,IAAI;YACf,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,EAAE;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,IAAI;SACjB,CAAC;QACF,MAAM,SAAS,GAAG,WAAW,CAAC,4BAA4B,CACxD,GAAG,CAAC,QAAQ,EACZ,kBAAkB,EAClB,IAAI,CAAC,OAAO,CACb,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/C,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,GAAG,IAAI,IAAI,GAAG,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAC;QAE9D,4EAA4E;QAC5E,2EAA2E;QAC3E,uEAAuE;QACvE,uEAAuE;QACvE,qDAAqD;QACrD,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;YACxD,sEAAsE;YACtE,qEAAqE;YACrE,KAAK,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;iBAClC,aAAa,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,UAAU,IAAI,GAAG,CAAC;iBAChE,KAAK,CAAC,GAAG,EAAE;gBACV,uDAAuD;YACzD,CAAC,CAAC,CAAC;YACL,eAAe,CACb,QAAQ,EACR,wBAAwB,IAAI,aAAa,GAAG,CAAC,QAAQ,UAAU,KAAK,GAAG;gBACrE,eAAe,eAAe,eAAe,UAAU,CAAC,UAAU,IAAI,GAAG,UAAU;gBACnF,wEAAwE;gBACxE,wBAAwB,IAAI,2CAA2C,CAC1E,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,oEAAoE;YACpE,oEAAoE;YACpE,eAAe,CACb,QAAQ,EACR,wBAAwB,IAAI,aAAa,GAAG,CAAC,QAAQ,UAAU,KAAK,iBAAiB,OAAO,EAAE,CAC/F,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"role-executor.js","sourceRoot":"","sources":["../../src/llm/role-executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAQH,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAGvD;;;;;;;;GAQG;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;AAE/C;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,GAAW,EAAE,OAAe;IACnD,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO;IAC1C,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B;IACzC,oBAAoB,CAAC,KAAK,EAAE,CAAC;AAC/B,CAAC;AA0CD,uEAAuE;AACvE,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAc,EACd,YAAoB,EACpB,WAAmB,EACnB,OAA8B,EAAE;IAEhC,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;QAC7C,sEAAsE;QACtE,yEAAyE;QACzE,mEAAmE;QACnE,eAAe,CACb,GAAG,IAAI,IAAI,GAAG,CAAC,QAAQ,SAAS,EAChC,wBAAwB,IAAI,aAAa,GAAG,CAAC,QAAQ,0BAA0B;YAC7E,0CAA0C,GAAG,CAAC,QAAQ,sBAAsB;YAC5E,wBAAwB,IAAI,0DAA0D,CACzF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,eAAe,GAAG,GAAG,CAAC,eAAe,IAAI,WAAW,CAAC;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,IAAI,GAAG,CAAC,KAAK,CAAC;IAE9C,MAAM,OAAO,GAAqB;QAChC,KAAK;QACL,MAAM,EAAE,YAAY;QACpB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;QAClD,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,kBAAkB;QAC/C,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAC;IAEF,IAAI,CAAC;QACH,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,6EAA6E;QAC7E,6EAA6E;QAC7E,uEAAuE;QACvE,qEAAqE;QACrE,2EAA2E;QAC3E,MAAM,QAAQ,GAAwB,GAAG,CAAC,UAAU,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAEhG,4EAA4E;QAC5E,6EAA6E;QAC7E,2EAA2E;QAC3E,yDAAyD;QACzD,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;QAEzD,oEAAoE;QACpE,4EAA4E;QAC5E,gCAAgC;QAChC,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YACrF,OAAO,CAAC,IAAI,CACV,+EAA+E;gBAC7E,0EAA0E;gBAC1E,wDAAwD,CAC3D,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACnD,MAAM,kBAAkB,GAAuB;YAC7C,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,KAAK,EAAE,GAAG,CAAC,eAAe,IAAI,SAAS;YACvC,KAAK;YACL,QAAQ;YACR,SAAS,EAAE,IAAI;YACf,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,EAAE;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,IAAI;SACjB,CAAC;QACF,MAAM,SAAS,GAAG,WAAW,CAAC,4BAA4B,CACxD,GAAG,CAAC,QAAQ,EACZ,kBAAkB,EAClB,IAAI,CAAC,OAAO,CACb,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/C,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,GAAG,IAAI,IAAI,GAAG,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAC;QAE9D,4EAA4E;QAC5E,2EAA2E;QAC3E,uEAAuE;QACvE,uEAAuE;QACvE,qDAAqD;QACrD,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;YACxD,sEAAsE;YACtE,qEAAqE;YACrE,KAAK,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;iBAClC,aAAa,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,UAAU,IAAI,GAAG,CAAC;iBAChE,KAAK,CAAC,GAAG,EAAE;gBACV,uDAAuD;YACzD,CAAC,CAAC,CAAC;YACL,eAAe,CACb,QAAQ,EACR,wBAAwB,IAAI,aAAa,GAAG,CAAC,QAAQ,UAAU,KAAK,GAAG;gBACrE,eAAe,eAAe,eAAe,UAAU,CAAC,UAAU,IAAI,GAAG,UAAU;gBACnF,wEAAwE;gBACxE,wBAAwB,IAAI,2CAA2C,CAC1E,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,oEAAoE;YACpE,oEAAoE;YACpE,eAAe,CACb,QAAQ,EACR,wBAAwB,IAAI,aAAa,GAAG,CAAC,QAAQ,UAAU,KAAK,iBAAiB,OAAO,EAAE,CAC/F,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/llm/role-resolver.d.ts

@@ -26,9 +26,8 @@
  * @module llm/role-resolver
  */
 import type { Anthropic } from '@anthropic-ai/sdk';
-import type { ApiMode, ModelCaps, ResolutionSource, ResolveLLMForRoleOptions, RoleName } from '@cleocode/contracts';
+import type { ApiMode, CredentialMetadataWire, ModelCaps, ResolutionSource, ResolveLLMForRoleOptions, RoleName, SealedCredential } from '@cleocode/contracts';
 import type { OpenAI } from 'openai';
-import { type CredentialResult } from './credentials.js';
 import { IMPLICIT_FALLBACK_MODEL } from './fallback-model.js';
 import type { ModelTransport } from './types-config.js';
 /**
@@ -89,14 +88,24 @@ export type { ResolutionSource, ResolveLLMForRoleOptions };
  *
  * The contracts-level `ResolvedLLM` (from `@cleocode/contracts`) carries
  * `client: unknown` to stay SDK-free. This core variant tightens the same
- * envelope with the concrete SDK union (`LLMClient`) and the local
- * {@link CredentialResult} — same shape, narrower types.
+ * envelope with the concrete SDK union (`LLMClient`) — same shape, narrower
+ * `client` type.
  *
- * `client` is `null` only when `credential.apiKey` is also null — in which
+ * `client` is `null` only when {@link sealedCredential} is also null — in which
  * case the caller MUST fall back to its graceful-degradation path
  * (return null / skip / log warn).
  *
+ * ## E10 — no inline plaintext (T11753)
+ *
+ * The secret-bearing `credential.apiKey` field is **gone**. `credential` is now
+ * non-secret {@link CredentialMetadataWire} metadata (provider / source /
+ * authType) so callers can still branch on auth scheme and surface diagnostics.
+ * The plaintext token is reachable ONLY via {@link sealedCredential}'s `fetch()`
+ * at the wire (`transportForProvider` / `session-factory.ts`) or daemon
+ * worker-injection — it never crosses this envelope.
+ *
  * @task T9255
+ * @task T11753
  */
 export interface ResolvedLLM {
     /** LLM provider transport that was resolved. */
@@ -110,10 +119,24 @@ export interface ResolvedLLM {
      */
     client: LLMClient | null;
     /**
-     * Resolved credential. `null` when none of the 6 credential tiers
-     * produced a token. Callers MUST handle this case.
+     * Resolved credential **metadata** (provider / source / authType) — NO
+     * plaintext. `null` when none of the 6 credential tiers produced a token
+     * (paired with `sealedCredential === null`). Callers MUST handle this case
+     * and obtain the secret via {@link sealedCredential}.
+     *
+     * @task T11753
+     */
+    credential: CredentialMetadataWire | null;
+    /**
+     * Sealed credential handle — the canonical, on-demand credential surface
+     * (E10 · T11752 · T11753). `null` exactly when `credential` is `null`.
+     *
+     * The plaintext is materialized ONLY by `sealedCredential.fetch()` at the
+     * wire / daemon worker-injection — never returned up this envelope.
+     *
+     * @task T11753
      */
-    credential: CredentialResult | null;
+    sealedCredential: SealedCredential | null;
     /** Which config path produced this resolution. */
     source: ResolutionSource;
     /** When `roles[role].credentialLabel` was set, the label that was used. */
@@ -151,18 +174,27 @@ export interface ResolvedLLM {
  *
  * See module docs for the full resolution algorithm. Never throws — when
  * no credential is reachable the caller receives
- * `{ credential: null, client: null, ... }` and is responsible for its own
- * graceful-degradation path (the previous Phase 1 pattern was a `return null`
- * shortcut at the call-site).
+ * `{ credential: null, sealedCredential: null, client: null, ... }` and is
+ * responsible for its own graceful-degradation path (the previous Phase 1
+ * pattern was a `return null` shortcut at the call-site).
+ *
+ * E10 (T11753): the plaintext token never rides on the returned envelope.
+ * Materialize it ONLY at the wire by calling `llm.sealedCredential.fetch()`.
  *
  * @example
  * ```ts
  * const llm = await resolveLLMForRole('consolidation', { projectRoot });
- * if (!llm.credential?.apiKey || !llm.client) {
+ * if (!llm.sealedCredential || !llm.client) {
  *   return null; // graceful no-op
  * }
+ * // At the wire — the ONLY place the plaintext is materialized:
+ * const token = (await llm.sealedCredential.fetch()).value;
  * const response = await fetch('https://api.anthropic.com/v1/messages', {
- *   headers: { 'Content-Type': 'application/json', ...authHeaders(llm.credential) },
+ *   headers: {
+ *     'Content-Type': 'application/json',
+ *     ...authHeaders({ provider: llm.provider, apiKey: token,
+ *       source: llm.credential?.source, authType: llm.credential?.authType ?? 'api_key' }),
+ *   },
  *   body: JSON.stringify({ model: llm.model, ...rest }),
  * });
  * ```
@@ -172,6 +204,7 @@ export interface ResolvedLLM {
  * @returns A {@link ResolvedLLM} envelope; never throws.
  *
  * @task T9255
+ * @task T11753
  */
 export declare function resolveLLMForRole(role: RoleName, opts?: ResolveLLMForRoleOptions): Promise<ResolvedLLM>;
 /**
@@ -208,6 +241,5 @@ export declare function resolveLLMForRole(role: RoleName, opts?: ResolveLLMForRo
 export declare function resolveAnthropicForRole(role: RoleName, opts?: ResolveLLMForRoleOptions): Promise<{
     client: Pick<Anthropic, 'messages'>;
     model: string;
-    credential: CredentialResult;
 } | null>;
 //# sourceMappingURL=role-resolver.d.ts.map

package/dist/llm/role-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-resolver.d.ts","sourceRoot":"","sources":["../../src/llm/role-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EACV,OAAO,EAMP,SAAS,EACT,gBAAgB,EAChB,wBAAwB,EACxB,QAAQ,EACT,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAIrC,OAAO,EAAE,KAAK,gBAAgB,EAAsB,MAAM,kBAAkB,CAAC;AAE7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,uBAAuB,EAAE,CAAC;AAEnC;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,EAAE,cAA4B,CAAC;AAEtE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAE1D;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAKrE,YAAY,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,CAAC;AAE3D;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,WAAW;IAC1B,gDAAgD;IAChD,QAAQ,EAAE,cAAc,CAAC;IACzB,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB;;;OAGG;IACH,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,kDAAkD;IAClD,MAAM,EAAE,gBAAgB,CAAC;IACzB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB;;;;OAIG;IACH,QAAQ,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC;IACjD;;;OAGG;IACH,YAAY,CAAC,EAAE,SAAS,CAAC;CAC1B;AAoLD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,QAAQ,EACd,IAAI,CAAC,EAAE,wBAAwB,GAC9B,OAAO,CAAC,WAAW,CAAC,CAsEtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,QAAQ,EACd,IAAI,CAAC,EAAE,wBAAwB,GAC9B,OAAO,CAAC;IACT,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,gBAAgB,CAAC;CAC9B,GAAG,IAAI,CAAC,CAmBR"}
+{"version":3,"file":"role-resolver.d.ts","sourceRoot":"","sources":["../../src/llm/role-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EACV,OAAO,EAEP,sBAAsB,EAKtB,SAAS,EACT,gBAAgB,EAChB,wBAAwB,EACxB,QAAQ,EACR,gBAAgB,EAEjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAMrC,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAI9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,uBAAuB,EAAE,CAAC;AAEnC;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,EAAE,cAA4B,CAAC;AAEtE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAE1D;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAKrE,YAAY,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,WAAW;IAC1B,gDAAgD;IAChD,QAAQ,EAAE,cAAc,CAAC;IACzB,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB;;;;;;;OAOG;IACH,UAAU,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC1C;;;;;;;;OAQG;IACH,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC1C,kDAAkD;IAClD,MAAM,EAAE,gBAAgB,CAAC;IACzB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB;;;;OAIG;IACH,QAAQ,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC;IACjD;;;OAGG;IACH,YAAY,CAAC,EAAE,SAAS,CAAC;CAC1B;AAgTD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,QAAQ,EACd,IAAI,CAAC,EAAE,wBAAwB,GAC9B,OAAO,CAAC,WAAW,CAAC,CA2GtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,QAAQ,EACd,IAAI,CAAC,EAAE,wBAAwB,GAC9B,OAAO,CAAC;IACT,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACpC,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,IAAI,CAAC,CAwBR"}

package/dist/llm/role-resolver.js

@@ -31,6 +31,8 @@ import { CredentialPool } from './credential-pool.js';
 import { resolveCredentials } from './credentials.js';
 import { getCredentialByLabel, pickCredentialForProvider } from './credentials-store.js';
 import { IMPLICIT_FALLBACK_MODEL } from './fallback-model.js';
+import { makeSealedCredential, tokenPreview } from './sealed-credential.js';
+import { getRegisteredSystemDefault } from './system-of-use-registry.js';
 import { buildAnthropicClient } from './transports/anthropic-client-factory.js';
 /**
  * Implicit fallback model used when no role-specific and no `default` entry is
@@ -98,6 +100,90 @@ function resolveNamedProfile(llm, name, source) {
         source,
     };
 }
+/**
+ * Resolve a `llm.systems[systemKey]` {@link SystemBinding} into a
+ * {@link SelectedProviderModel}, or `undefined` when `systemKey` is unset, the
+ * key is absent, or the entry is structurally incomplete (neither a resolvable
+ * `profile` nor a complete inline `provider`+`model` tuple).
+ *
+ * A binding referencing a named profile wins over its inline tuple — mirroring
+ * {@link LlmRoleConfig.profile} precedence. The resolved profile keeps
+ * `source: 'system'` (not `'profile'`) so diagnostics attribute the resolution
+ * to the per-system override tier, while the profile's `credentialLabel` is
+ * preserved unless the binding pins its own.
+ *
+ * @param llm       - The LLM config block (may be undefined).
+ * @param systemKey - Encoded system-of-use key (may be undefined).
+ * @task T11748
+ */
+function resolveSystemBinding(llm, systemKey) {
+    if (!systemKey)
+        return undefined;
+    const binding = llm?.systems?.[systemKey];
+    if (!binding)
+        return undefined;
+    // 1. Binding pinned to a named profile (wins over the inline tuple).
+    const bindingProfile = resolveNamedProfile(llm, binding.profile, 'system');
+    if (bindingProfile) {
+        // The binding may override the profile's credential label.
+        return {
+            ...bindingProfile,
+            credentialLabel: binding.credentialLabel ?? bindingProfile.credentialLabel,
+        };
+    }
+    // 2. Inline provider/model tuple on the binding.
+    if (binding.provider && binding.model) {
+        return {
+            provider: binding.provider,
+            model: binding.model,
+            credentialLabel: binding.credentialLabel,
+            source: 'system',
+        };
+    }
+    // Structurally incomplete — fall through to the next tier.
+    return undefined;
+}
+/**
+ * Resolve the runtime-registered default for `systemKey` (registerSystemOfUse —
+ * T11751) into a {@link SelectedProviderModel}, or `undefined` when no system is
+ * registered under that key (or its default is structurally incomplete).
+ *
+ * Consulted ONLY after every user-config tier in {@link selectProviderModel} is
+ * exhausted — so a `registerSystemOfUse` default can NEVER override user config
+ * (`systems[key]` / `default` / `defaultProfile`). A registered binding that
+ * names a `profile` resolves it against `llm.profiles` (the profile wins over an
+ * inline tuple); the resolution is stamped `source: 'registered-default'` for
+ * diagnostics.
+ *
+ * @param llm       - The LLM config block (may be undefined).
+ * @param systemKey - Encoded system-of-use key (may be undefined).
+ * @task T11751
+ */
+function resolveRegisteredSystemDefault(llm, systemKey) {
+    const defaults = getRegisteredSystemDefault(systemKey);
+    if (!defaults)
+        return undefined;
+    // 1. Default pinned to a named profile (wins over the inline tuple).
+    const profile = resolveNamedProfile(llm, defaults.profile, 'registered-default');
+    if (profile) {
+        return {
+            ...profile,
+            credentialLabel: defaults.credentialLabel ?? profile.credentialLabel,
+        };
+    }
+    // 2. Inline provider/model tuple on the default.
+    if (defaults.provider && defaults.model) {
+        return {
+            provider: defaults.provider,
+            model: defaults.model,
+            credentialLabel: defaults.credentialLabel,
+            source: 'registered-default',
+        };
+    }
+    // Structurally incomplete (getRegisteredSystemDefault already filters these,
+    // but stay defensive) — fall through to implicit fallback.
+    return undefined;
+}
 /**
  * Pick provider/model/credentialLabel from the highest-priority configured
  * tier. Always returns a value because the implicit fallback is unconditional.
@@ -105,20 +191,35 @@ function resolveNamedProfile(llm, name, source) {
  * Resolution order:
  *   1. `roles[role].profile` → named profile (`source: 'profile'`)
  *   2. `roles[role]` inline `{provider, model}` (`source: 'role'`)
- *   3. `default` (`source: 'default'`)
- *   4. `defaultProfile` → named profile (`source: 'default-profile'`)
- *   5. implicit fallback (`source: 'implicit-fallback'`)
+ *   3. `systems[systemKey]` → per-system override (`source: 'system'`) — only
+ *      consulted when `systemKey` is set (threaded by `resolveLLMForSystem`).
+ *   4. `default` (`source: 'default'`)
+ *   5. `defaultProfile` → named profile (`source: 'default-profile'`)
+ *   6. `registerSystemOfUse` default (`source: 'registered-default'`) — runtime
+ *      registration, consulted strictly BELOW all user config (T11751).
+ *   7. implicit fallback (`source: 'implicit-fallback'`)
+ *
+ * Tiers 1–2 are the *explicit-arg* lane (per-role config / role override);
+ * tier 3 is the hermes *granular override* — consulted after the explicit
+ * choice but before the global base (`default` / `defaultProfile`), matching
+ * the E9 priority `explicit-arg → llm.systems[key] → llm.defaultProfile →
+ * registered-default → implicit fallback` (T11748 · T11751). The configurable
+ * `defaultProfile` is what lets background roles resolve to a user-selectable
+ * provider WITHOUT hardcoding the provider in code.
  *
- * The configurable `defaultProfile` is what lets background roles resolve to a
- * user-selectable provider WITHOUT hardcoding the provider in code.
+ * @param llm       - The LLM config block (may be undefined).
+ * @param role      - The role used for `roles[role]` lookup.
+ * @param systemKey - Optional encoded system-of-use key activating tiers 3 + 6.
+ * @task T11748 (`systems[systemKey]` tier)
+ * @task T11751 (`registered-default` tier)
  */
-function selectProviderModel(llm, role) {
+function selectProviderModel(llm, role, systemKey) {
     const roleEntry = llm?.roles?.[role];
-    // 1. Role pinned to a named profile.
+    // 1. Role pinned to a named profile (explicit-arg lane).
     const roleProfile = resolveNamedProfile(llm, roleEntry?.profile, 'profile');
     if (roleProfile)
         return roleProfile;
-    // 2. Role with an inline provider/model tuple (existing behaviour).
+    // 2. Role with an inline provider/model tuple (explicit-arg lane).
     if (roleEntry?.provider && roleEntry.model) {
         return {
             provider: roleEntry.provider,
@@ -127,7 +228,11 @@ function selectProviderModel(llm, role) {
             source: 'role',
         };
     }
-    // 3. Canonical default tuple.
+    // 3. Per-system override (hermes granular override) — beats the global base.
+    const systemBinding = resolveSystemBinding(llm, systemKey);
+    if (systemBinding)
+        return systemBinding;
+    // 4. Canonical default tuple.
     const defaultEntry = llm?.default;
     if (defaultEntry?.provider && defaultEntry.model) {
         return {
@@ -137,11 +242,17 @@ function selectProviderModel(llm, role) {
             source: 'default',
         };
     }
-    // 4. Configurable default profile binding (user-selectable; not hardcoded).
+    // 5. Configurable default profile binding (user-selectable; not hardcoded).
     const defaultProfile = resolveNamedProfile(llm, llm?.defaultProfile, 'default-profile');
     if (defaultProfile)
         return defaultProfile;
-    // 5. Implicit fallback (last resort).
+    // 6. Runtime-registered default (registerSystemOfUse — T11751) — consulted
+    // strictly BELOW every user-config tier above, so the user ALWAYS wins. A
+    // plugin/extension default only binds when the user configured nothing.
+    const registeredDefault = resolveRegisteredSystemDefault(llm, systemKey);
+    if (registeredDefault)
+        return registeredDefault;
+    // 7. Implicit fallback (last resort).
     return {
         provider: IMPLICIT_FALLBACK_PROVIDER,
         model: IMPLICIT_FALLBACK_MODEL,
@@ -230,18 +341,27 @@ async function resolveCredentialForRole(provider, credentialLabel, projectRoot)
  *
  * See module docs for the full resolution algorithm. Never throws — when
  * no credential is reachable the caller receives
- * `{ credential: null, client: null, ... }` and is responsible for its own
- * graceful-degradation path (the previous Phase 1 pattern was a `return null`
- * shortcut at the call-site).
+ * `{ credential: null, sealedCredential: null, client: null, ... }` and is
+ * responsible for its own graceful-degradation path (the previous Phase 1
+ * pattern was a `return null` shortcut at the call-site).
+ *
+ * E10 (T11753): the plaintext token never rides on the returned envelope.
+ * Materialize it ONLY at the wire by calling `llm.sealedCredential.fetch()`.
  *
  * @example
  * ```ts
  * const llm = await resolveLLMForRole('consolidation', { projectRoot });
- * if (!llm.credential?.apiKey || !llm.client) {
+ * if (!llm.sealedCredential || !llm.client) {
  *   return null; // graceful no-op
  * }
+ * // At the wire — the ONLY place the plaintext is materialized:
+ * const token = (await llm.sealedCredential.fetch()).value;
  * const response = await fetch('https://api.anthropic.com/v1/messages', {
- *   headers: { 'Content-Type': 'application/json', ...authHeaders(llm.credential) },
+ *   headers: {
+ *     'Content-Type': 'application/json',
+ *     ...authHeaders({ provider: llm.provider, apiKey: token,
+ *       source: llm.credential?.source, authType: llm.credential?.authType ?? 'api_key' }),
+ *   },
  *   body: JSON.stringify({ model: llm.model, ...rest }),
  * });
  * ```
@@ -251,6 +371,7 @@ async function resolveCredentialForRole(provider, credentialLabel, projectRoot)
  * @returns A {@link ResolvedLLM} envelope; never throws.
  *
  * @task T9255
+ * @task T11753
  */
 export async function resolveLLMForRole(role, opts) {
     const projectRoot = resolveOrCwd(opts?.projectRoot);
@@ -267,8 +388,11 @@ export async function resolveLLMForRole(role, opts) {
         config = undefined;
     }
     // Step 2 — pick provider/model/credentialLabel from the highest-priority tier.
+    // `opts.systemKey` (threaded by `resolveLLMForSystem`) activates the
+    // `llm.systems[key]` granular-override tier; role callers leave it unset and
+    // that tier is skipped — role resolution is unchanged (T11748).
     const llmBlock = readLlmBlock(config);
-    const { provider, model, credentialLabel, source } = selectProviderModel(llmBlock, role);
+    const { provider, model, credentialLabel, source } = selectProviderModel(llmBlock, role, opts?.systemKey);
     // Step 3 — resolve credential.
     const { credential, usedLabel } = await resolveCredentialForRole(provider, credentialLabel, projectRoot);
     // Step 4 — construct SDK client if we have a credential.
@@ -303,11 +427,40 @@ export async function resolveLLMForRole(role, opts) {
     // is surfaced from the resolved credential (or null when none).
     const authType = credential?.authType ?? null;
     const wire = deriveApiWire(provider, authType);
+    // Step 6 — E10 (T11753): seal the credential. The plaintext token is captured
+    // in the handle's `fetch()` closure but is NOT placed on the returned
+    // envelope. `credential` becomes non-secret metadata; consumers reach the
+    // secret ONLY via `sealedCredential.fetch()` at the wire. No-credential
+    // resolution yields `{ credential: null, sealedCredential: null }`.
+    let credentialMetadata = null;
+    let sealedCredential = null;
+    if (credential?.apiKey) {
+        const token = credential.apiKey;
+        const wireAuthType = credential.authType === 'oauth' ? 'oauth' : 'api_key';
+        credentialMetadata = {
+            provider: credential.provider,
+            source: credential.source,
+            authType: wireAuthType,
+        };
+        sealedCredential = makeSealedCredential({
+            provider: credential.provider,
+            account: usedLabel ?? 'default',
+            // Non-secret redacted preview (≤ last 4 chars) computed ONCE at seal time
+            // — the only token-derived string allowed on a log/envelope/diagnostic
+            // (E10 · T11754 · AC3). The full plaintext is NOT retained for it.
+            tokenPreview: tokenPreview(token, wireAuthType),
+            // The already-resolved plaintext is captured in this closure and handed
+            // out ONLY when a wire boundary invokes fetch(); it is never surfaced on
+            // the envelope. T11754 swaps this thunk for an on-demand vault decrypt.
+            resolveToken: () => token,
+        });
+    }
     return {
         provider,
         model,
         client,
-        credential,
+        credential: credentialMetadata,
+        sealedCredential,
         source,
         credentialLabel: usedLabel,
         apiMode: wire.apiMode,
@@ -356,7 +509,13 @@ export async function resolveAnthropicForRole(role, opts) {
     }
     if (llm.provider !== 'anthropic')
         return null;
-    if (!llm.credential?.apiKey || !llm.client)
+    // E10 (T11753): gate on the sealed handle's presence — its existence is the
+    // post-resolution "a usable credential was found" signal, replacing the
+    // removed inline `credential.apiKey` truthiness check. The Anthropic SDK
+    // `client` was already wired from the plaintext inside `resolveLLMForRole`
+    // (the one allowed `new Anthropic(...)` chokepoint), so the secret does not
+    // need to cross this boundary again.
+    if (!llm.sealedCredential || !llm.client)
         return null;
     // Safe narrowing: provider === 'anthropic' and direct Anthropic construction
     // in resolveLLMForRole guarantees the client is an Anthropic SDK instance.
@@ -366,7 +525,6 @@ export async function resolveAnthropicForRole(role, opts) {
     return {
         client: llm.client,
         model: llm.model,
-        credential: llm.credential,
     };
 }
 //# sourceMappingURL=role-resolver.js.map

package/dist/llm/role-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"role-resolver.js","sourceRoot":"","sources":["../../src/llm/role-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAgBH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAyB,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACzF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAGhF;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,uBAAuB,EAAE,CAAC;AAEnC;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAmB,WAAW,CAAC;AAEtE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAuF1D;;;GAGG;AACH,SAAS,YAAY,CAAC,MAA8B;IAClD,OAAO,MAAM,EAAE,GAAG,CAAC;AACrB,CAAC;AAUD;;;;;;;;;GASG;AACH,SAAS,mBAAmB,CAC1B,GAA0B,EAC1B,IAAwB,EACxB,MAAwB;IAExB,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,OAAO,GAAiC,GAAG,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC;IACpE,IAAI,CAAC,OAAO,EAAE,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC3D,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAA0B;QAC5C,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,mBAAmB,CAAC,GAA0B,EAAE,IAAc;IACrE,MAAM,SAAS,GAA8B,GAAG,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC;IAEhE,qCAAqC;IACrC,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC5E,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,oEAAoE;IACpE,IAAI,SAAS,EAAE,QAAQ,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;QAC3C,OAAO;YACL,QAAQ,EAAE,SAAS,CAAC,QAA0B;YAC9C,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,eAAe,EAAE,SAAS,CAAC,eAAe;YAC1C,MAAM,EAAE,MAAM;SACf,CAAC;IACJ,CAAC;IAED,8BAA8B;IAC9B,MAAM,YAAY,GAAiC,GAAG,EAAE,OAAO,CAAC;IAChE,IAAI,YAAY,EAAE,QAAQ,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;QACjD,OAAO;YACL,QAAQ,EAAE,YAAY,CAAC,QAA0B;YACjD,KAAK,EAAE,YAAY,CAAC,KAAK;YACzB,eAAe,EAAE,SAAS;YAC1B,MAAM,EAAE,SAAS;SAClB,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,MAAM,cAAc,GAAG,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC;IACxF,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC;IAE1C,sCAAsC;IACtC,OAAO;QACL,QAAQ,EAAE,0BAA0B;QACpC,KAAK,EAAE,uBAAuB;QAC9B,eAAe,EAAE,SAAS;QAC1B,MAAM,EAAE,mBAAmB;KAC5B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,wBAAwB,CACrC,QAAwB,EACxB,eAAmC,EACnC,WAAmB;IAEnB,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,wEAAwE;IACxE,6EAA6E;IAC7E,iEAAiE;IACjE,IAAI,CAAC;QACH,MAAM,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC,mBAAmB,EAAE,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;IAED,8EAA8E;IAC9E,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,sEAAsE;QACtE,kEAAkE;QAClE,IAAI,MAAM,EAAE,WAAW,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YACvE,OAAO;gBACL,UAAU,EAAE;oBACV,QAAQ;oBACR,MAAM,EAAE,MAAM,CAAC,WAAW;oBAC1B,MAAM,EAAE,WAAW;oBACnB,QAAQ,EAAE,YAAY;iBACvB;gBACD,SAAS,EAAE,MAAM,CAAC,KAAK;aACxB,CAAC;QACJ,CAAC;QACD,uEAAuE;QACvE,mEAAmE;QACnE,oEAAoE;QACpE,wEAAwE;IAC1E,CAAC;SAAM,CAAC;QACN,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,QAAQ,EAAE;YACvD,QAAQ,EAAE,sBAAsB;SACjC,CAAC,CAAC;QACH,IAAI,MAAM,EAAE,WAAW,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YACvE,OAAO;gBACL,UAAU,EAAE;oBACV,QAAQ;oBACR,MAAM,EAAE,MAAM,CAAC,WAAW;oBAC1B,MAAM,EAAE,WAAW;oBACnB,QAAQ,EAAE,YAAY;iBACvB;gBACD,SAAS,EAAE,MAAM,CAAC,KAAK;aACxB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,uEAAuE;IACvE,0EAA0E;IAC1E,8EAA8E;IAC9E,MAAM,IAAI,GAAG,kBAAkB,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAc,EACd,IAA+B;IAE/B,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAEpD,qEAAqE;IACrE,2EAA2E;IAC3E,wEAAwE;IACxE,qEAAqE;IACrE,IAAI,MAA8B,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;QACpD,MAAM,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;IAED,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAEzF,+BAA+B;IAC/B,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAwB,CAC9D,QAAQ,EACR,eAAe,EACf,WAAW,CACZ,CAAC;IAEF,yDAAyD;IACzD,EAAE;IACF,+DAA+D;IAC/D,yEAAyE;IACzE,8EAA8E;IAC9E,8EAA8E;IAC9E,gEAAgE;IAChE,8DAA8D;IAC9D,6CAA6C;IAC7C,IAAI,MAAM,GAAqB,IAAI,CAAC;IACpC,IAAI,UAAU,EAAE,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;gBAC7B,MAAM,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;YAC5C,CAAC;YACD,mEAAmE;YACnE,6EAA6E;YAC7E,wEAAwE;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,0DAA0D;YAC1D,qDAAqD;YACrD,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,gEAAgE;IAChE,MAAM,QAAQ,GAA2C,UAAU,EAAE,QAAQ,IAAI,IAAI,CAAC;IACtF,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAE/C,OAAO;QACL,QAAQ;QACR,KAAK;QACL,MAAM;QACN,UAAU;QACV,MAAM;QACN,eAAe,EAAE,SAAS;QAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAc,EACd,IAA+B;IAM/B,IAAI,GAAgB,CAAC;IACrB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACxD,6EAA6E;IAC7E,2EAA2E;IAC3E,uEAAuE;IACvE,6EAA6E;IAC7E,yBAAyB;IACzB,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAmB;QAC/B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,UAAU,EAAE,GAAG,CAAC,UAAU;KAC3B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"role-resolver.js","sourceRoot":"","sources":["../../src/llm/role-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAmBH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAyB,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACzF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAGhF;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,uBAAuB,EAAE,CAAC;AAEnC;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAmB,WAAW,CAAC;AAEtE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AA+G1D;;;GAGG;AACH,SAAS,YAAY,CAAC,MAA8B;IAClD,OAAO,MAAM,EAAE,GAAG,CAAC;AACrB,CAAC;AAUD;;;;;;;;;GASG;AACH,SAAS,mBAAmB,CAC1B,GAA0B,EAC1B,IAAwB,EACxB,MAAwB;IAExB,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,OAAO,GAAiC,GAAG,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC;IACpE,IAAI,CAAC,OAAO,EAAE,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC3D,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAA0B;QAC5C,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,oBAAoB,CAC3B,GAA0B,EAC1B,SAA6B;IAE7B,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,OAAO,GAA8B,GAAG,EAAE,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAE/B,qEAAqE;IACrE,MAAM,cAAc,GAAG,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3E,IAAI,cAAc,EAAE,CAAC;QACnB,2DAA2D;QAC3D,OAAO;YACL,GAAG,cAAc;YACjB,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,cAAc,CAAC,eAAe;SAC3E,CAAC;IACJ,CAAC;IAED,iDAAiD;IACjD,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACtC,OAAO;YACL,QAAQ,EAAE,OAAO,CAAC,QAA0B;YAC5C,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,MAAM,EAAE,QAAQ;SACjB,CAAC;IACJ,CAAC;IAED,2DAA2D;IAC3D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,8BAA8B,CACrC,GAA0B,EAC1B,SAA6B;IAE7B,MAAM,QAAQ,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEhC,qEAAqE;IACrE,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;IACjF,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;YACL,GAAG,OAAO;YACV,eAAe,EAAE,QAAQ,CAAC,eAAe,IAAI,OAAO,CAAC,eAAe;SACrE,CAAC;IACJ,CAAC;IAED,iDAAiD;IACjD,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACxC,OAAO;YACL,QAAQ,EAAE,QAAQ,CAAC,QAA0B;YAC7C,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,eAAe,EAAE,QAAQ,CAAC,eAAe;YACzC,MAAM,EAAE,oBAAoB;SAC7B,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,2DAA2D;IAC3D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,SAAS,mBAAmB,CAC1B,GAA0B,EAC1B,IAAc,EACd,SAAkB;IAElB,MAAM,SAAS,GAA8B,GAAG,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC;IAEhE,yDAAyD;IACzD,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC5E,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,mEAAmE;IACnE,IAAI,SAAS,EAAE,QAAQ,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;QAC3C,OAAO;YACL,QAAQ,EAAE,SAAS,CAAC,QAA0B;YAC9C,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,eAAe,EAAE,SAAS,CAAC,eAAe;YAC1C,MAAM,EAAE,MAAM;SACf,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,MAAM,aAAa,GAAG,oBAAoB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC3D,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,8BAA8B;IAC9B,MAAM,YAAY,GAAiC,GAAG,EAAE,OAAO,CAAC;IAChE,IAAI,YAAY,EAAE,QAAQ,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;QACjD,OAAO;YACL,QAAQ,EAAE,YAAY,CAAC,QAA0B;YACjD,KAAK,EAAE,YAAY,CAAC,KAAK;YACzB,eAAe,EAAE,SAAS;YAC1B,MAAM,EAAE,SAAS;SAClB,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,MAAM,cAAc,GAAG,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC;IACxF,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC;IAE1C,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,iBAAiB,GAAG,8BAA8B,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACzE,IAAI,iBAAiB;QAAE,OAAO,iBAAiB,CAAC;IAEhD,sCAAsC;IACtC,OAAO;QACL,QAAQ,EAAE,0BAA0B;QACpC,KAAK,EAAE,uBAAuB;QAC9B,eAAe,EAAE,SAAS;QAC1B,MAAM,EAAE,mBAAmB;KAC5B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,wBAAwB,CACrC,QAAwB,EACxB,eAAmC,EACnC,WAAmB;IAEnB,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,wEAAwE;IACxE,6EAA6E;IAC7E,iEAAiE;IACjE,IAAI,CAAC;QACH,MAAM,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC,mBAAmB,EAAE,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;IAED,8EAA8E;IAC9E,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,sEAAsE;QACtE,kEAAkE;QAClE,IAAI,MAAM,EAAE,WAAW,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YACvE,OAAO;gBACL,UAAU,EAAE;oBACV,QAAQ;oBACR,MAAM,EAAE,MAAM,CAAC,WAAW;oBAC1B,MAAM,EAAE,WAAW;oBACnB,QAAQ,EAAE,YAAY;iBACvB;gBACD,SAAS,EAAE,MAAM,CAAC,KAAK;aACxB,CAAC;QACJ,CAAC;QACD,uEAAuE;QACvE,mEAAmE;QACnE,oEAAoE;QACpE,wEAAwE;IAC1E,CAAC;SAAM,CAAC;QACN,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,QAAQ,EAAE;YACvD,QAAQ,EAAE,sBAAsB;SACjC,CAAC,CAAC;QACH,IAAI,MAAM,EAAE,WAAW,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YACvE,OAAO;gBACL,UAAU,EAAE;oBACV,QAAQ;oBACR,MAAM,EAAE,MAAM,CAAC,WAAW;oBAC1B,MAAM,EAAE,WAAW;oBACnB,QAAQ,EAAE,YAAY;iBACvB;gBACD,SAAS,EAAE,MAAM,CAAC,KAAK;aACxB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,uEAAuE;IACvE,0EAA0E;IAC1E,8EAA8E;IAC9E,MAAM,IAAI,GAAG,kBAAkB,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAc,EACd,IAA+B;IAE/B,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAEpD,qEAAqE;IACrE,2EAA2E;IAC3E,wEAAwE;IACxE,qEAAqE;IACrE,IAAI,MAA8B,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;QACpD,MAAM,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;IAED,+EAA+E;IAC/E,qEAAqE;IACrE,6EAA6E;IAC7E,gEAAgE;IAChE,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,mBAAmB,CACtE,QAAQ,EACR,IAAI,EACJ,IAAI,EAAE,SAAS,CAChB,CAAC;IAEF,+BAA+B;IAC/B,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAwB,CAC9D,QAAQ,EACR,eAAe,EACf,WAAW,CACZ,CAAC;IAEF,yDAAyD;IACzD,EAAE;IACF,+DAA+D;IAC/D,yEAAyE;IACzE,8EAA8E;IAC9E,8EAA8E;IAC9E,gEAAgE;IAChE,8DAA8D;IAC9D,6CAA6C;IAC7C,IAAI,MAAM,GAAqB,IAAI,CAAC;IACpC,IAAI,UAAU,EAAE,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;gBAC7B,MAAM,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;YAC5C,CAAC;YACD,mEAAmE;YACnE,6EAA6E;YAC7E,wEAAwE;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,0DAA0D;YAC1D,qDAAqD;YACrD,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,gEAAgE;IAChE,MAAM,QAAQ,GAA2C,UAAU,EAAE,QAAQ,IAAI,IAAI,CAAC;IACtF,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAE/C,8EAA8E;IAC9E,sEAAsE;IACtE,0EAA0E;IAC1E,wEAAwE;IACxE,oEAAoE;IACpE,IAAI,kBAAkB,GAAkC,IAAI,CAAC;IAC7D,IAAI,gBAAgB,GAA4B,IAAI,CAAC;IACrD,IAAI,UAAU,EAAE,MAAM,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,MAAM,YAAY,GAAwB,UAAU,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAChG,kBAAkB,GAAG;YACnB,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,YAAY;SACvB,CAAC;QACF,gBAAgB,GAAG,oBAAoB,CAAC;YACtC,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,OAAO,EAAE,SAAS,IAAI,SAAS;YAC/B,0EAA0E;YAC1E,uEAAuE;YACvE,mEAAmE;YACnE,YAAY,EAAE,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC;YAC/C,wEAAwE;YACxE,yEAAyE;YACzE,wEAAwE;YACxE,YAAY,EAAE,GAAG,EAAE,CAAC,KAAK;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,QAAQ;QACR,KAAK;QACL,MAAM;QACN,UAAU,EAAE,kBAAkB;QAC9B,gBAAgB;QAChB,MAAM;QACN,eAAe,EAAE,SAAS;QAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAc,EACd,IAA+B;IAK/B,IAAI,GAAgB,CAAC;IACrB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9C,4EAA4E;IAC5E,wEAAwE;IACxE,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,qCAAqC;IACrC,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACtD,6EAA6E;IAC7E,2EAA2E;IAC3E,uEAAuE;IACvE,6EAA6E;IAC7E,yBAAyB;IACzB,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAmB;QAC/B,KAAK,EAAE,GAAG,CAAC,KAAK;KACjB,CAAC;AACJ,CAAC"}

package/dist/llm/sealed-credential.d.ts

@@ -0,0 +1,125 @@
+/**
+ * Sealed credential handle — runtime implementation (E10 · T11753).
+ *
+ * The {@link SealedCredential} **type** lives in `@cleocode/contracts`
+ * (`llm/sealed-credential.ts`, types-only for Gate 10 purity). Its `fetch()` is
+ * a function-TYPED interface field; the concrete body — the on-demand
+ * materialization of the plaintext token — lives HERE in `@cleocode/core`.
+ *
+ * ## Why this module exists
+ *
+ * Before E10, {@link import('./role-resolver.js').resolveLLMForRole} returned
+ * the resolved credential's plaintext `apiKey` **inline** on its envelope. That
+ * bare secret string travelled up the entire resolution call stack
+ * (`resolveLLMForRole` → `resolveLLMForSystem` → consumers) where any layer that
+ * merely *routed* it to the wire could accidentally log it, serialize it into a
+ * LAFS envelope, or copy it into a diagnostic.
+ *
+ * {@link makeSealedCredential} inverts that. The resolver builds an opaque
+ * {@link SealedCredential} handle whose `fetch()` closure captures a
+ * `resolveToken` thunk. The plaintext is materialized **only** when a wire
+ * boundary (`transportForProvider` / `session-factory.ts`) or daemon
+ * worker-injection invokes `fetch()`. Between the resolver and those boundaries,
+ * NO layer holds a plaintext secret — it holds a handle.
+ *
+ * ## The brand chokepoint
+ *
+ * {@link brandDecryptedToken} is the SOLE place a {@link DecryptedToken} is
+ * minted from a raw string. Because `DecryptedToken` is a phantom-branded type
+ * (contracts), a plain `string` cannot be widened into one anywhere else — so an
+ * audit of "who mints a token" reduces to "who calls `brandDecryptedToken`",
+ * and that is exclusively this module (invoked inside `fetch()`).
+ *
+ * @module llm/sealed-credential
+ * @task T11753
+ * @epic T11746
+ * @see ADR-072 §Type lock-in
+ */
+import type { ProviderId, SealedCredential } from '@cleocode/contracts';
+/**
+ * Build the non-secret, redacted preview of a credential string.
+ *
+ * SECURITY: this is the SOLE token→preview redaction chokepoint for the sealed
+ * handle. It reveals at most the last 4 characters of the token plus an
+ * auth-scheme marker (`oat-…` for OAuth, `…` otherwise) — never enough to
+ * reconstruct the secret. It is computed ONCE at seal time and stored on the
+ * handle's {@link SealedCredential.tokenPreview}; the full plaintext is NOT
+ * retained for it.
+ *
+ * The preview is the ONLY credential-derived string that may cross a
+ * logging/diagnostic/envelope boundary (E10 · T11754 · AC3); everything else
+ * goes through {@link SealedCredential.fetch} at the wire and is discarded.
+ *
+ * @param token - The plaintext secret (read transiently; not retained).
+ * @param authType - Auth scheme, used only to pick the cosmetic prefix.
+ * @returns A redacted preview safe to log and serialize.
+ * @task T11754
+ */
+export declare function tokenPreview(token: string, authType: 'api_key' | 'oauth'): string;
+/**
+ * Parameters for {@link makeSealedCredential}.
+ *
+ * @task T11753
+ */
+export interface MakeSealedCredentialParams {
+    /** Provider this handle targets (e.g. `'anthropic'`). */
+    readonly provider: ProviderId;
+    /**
+     * Account / store-label this handle resolves against (e.g. `'default'`,
+     * `'work'`). Names *which* credential without revealing its secret — safe to
+     * log and serialize.
+     */
+    readonly account: string;
+    /**
+     * Non-secret redacted preview (e.g. `'…6789'` / `'oat-…6789'`) computed once
+     * by the resolver via {@link tokenPreview}. Carried on the handle so
+     * diagnostics can *name* the credential without invoking {@link SealedCredential.fetch}.
+     * NEVER the full token.
+     *
+     * @task T11754
+     */
+    readonly tokenPreview: string;
+    /**
+     * On-demand plaintext resolver. Invoked ONLY inside {@link SealedCredential.fetch}
+     * — i.e. at the wire / daemon worker-injection boundary. May be synchronous
+     * (today's in-process credential pool, which already holds the plaintext) or
+     * asynchronous (a future vault / daemon round-trip per T11754). Returns the
+     * raw plaintext string; {@link makeSealedCredential} brands it.
+     *
+     * MUST throw if the credential is unreachable so the caller's existing
+     * graceful-degradation path fires identically to the pre-E10 `apiKey === null`
+     * check.
+     */
+    readonly resolveToken: () => string | Promise<string>;
+}
+/**
+ * Build a {@link SealedCredential} handle from a provider/account and an
+ * on-demand token resolver.
+ *
+ * The returned handle carries ONLY the non-secret `provider` + `account`
+ * inline. Its `fetch()` closure captures {@link MakeSealedCredentialParams.resolveToken}
+ * and brands the result — the plaintext exists transiently inside `fetch()` and
+ * is NEVER attached to the handle object, so the handle can be logged or
+ * serialized without leaking the secret.
+ *
+ * @example
+ * ```ts
+ * // In the resolver — capture the already-resolved token in the closure but do
+ * // NOT place it on the returned envelope:
+ * const sealed = makeSealedCredential({
+ *   provider: 'anthropic',
+ *   account: usedLabel ?? 'default',
+ *   tokenPreview: tokenPreview(token, authType), // non-secret; safe to log
+ *   resolveToken: () => token, // captured, not surfaced
+ * });
+ * // At the wire — the ONLY place fetch() runs (via authHeadersFromSealed):
+ * const headers = await authHeadersFromSealed(sealed, authType);
+ * // the plaintext never escapes authHeadersFromSealed; only headers come out.
+ * ```
+ *
+ * @param params - Provider, account label, and the on-demand token resolver.
+ * @returns An opaque sealed-credential handle.
+ * @task T11753
+ */
+export declare function makeSealedCredential(params: MakeSealedCredentialParams): SealedCredential;
+//# sourceMappingURL=sealed-credential.d.ts.map

package/dist/llm/sealed-credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealed-credential.d.ts","sourceRoot":"","sources":["../../src/llm/sealed-credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAkB,UAAU,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAExF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,GAAG,OAAO,GAAG,MAAM,CAKjF;AA0BD;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACzC,yDAAyD;IACzD,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACvD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,0BAA0B,GAAG,gBAAgB,CAezF"}