@endora-commerce/mod-credentials 0.100.0

package/dist/backend/types/email-adapter.type.js

@@ -0,0 +1,49 @@
+/**
+ * Core `email_adapter` configuration type (feature 058, US1 / research §R2).
+ *
+ * Mirrors the newsletter SMTP/SES field set. Each provider declares exactly one
+ * secret field (`password` / `secretAccessKey` / `apiKey`); the rest are plain.
+ * Provider meaning (how mail is actually sent) is owned by the consumer.
+ */
+export const emailAdapterConfigurationType = {
+    code: 'email_adapter',
+    label: 'Email adapter',
+    ownerModule: 'credentials',
+    providers: [
+        {
+            code: 'smtp',
+            label: 'SMTP',
+            fields: [
+                { key: 'host', label: 'Host', kind: 'string', required: true, secret: false },
+                { key: 'port', label: 'Port', kind: 'number', required: true, secret: false },
+                { key: 'secure', label: 'Use TLS', kind: 'boolean', required: false, secret: false },
+                { key: 'username', label: 'Username', kind: 'string', required: false, secret: false },
+                { key: 'password', label: 'Password', kind: 'string', required: false, secret: true },
+            ],
+        },
+        {
+            code: 'amazon_ses',
+            label: 'Amazon SES',
+            fields: [
+                { key: 'region', label: 'Region', kind: 'string', required: true, secret: false },
+                { key: 'accessKeyId', label: 'Access key ID', kind: 'string', required: true, secret: false },
+                {
+                    key: 'secretAccessKey',
+                    label: 'Secret access key',
+                    kind: 'string',
+                    required: true,
+                    secret: true,
+                },
+            ],
+        },
+        {
+            code: 'sendgrid',
+            label: 'SendGrid',
+            fields: [
+                { key: 'apiKey', label: 'API Key', kind: 'string', required: true, secret: true },
+                { key: 'senderEmail', label: 'Sender email', kind: 'string', required: true, secret: false },
+            ],
+        },
+    ],
+};
+//# sourceMappingURL=email-adapter.type.js.map

package/dist/backend/types/email-adapter.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-adapter.type.js","sourceRoot":"","sources":["../../../src/backend/types/email-adapter.type.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAgC;IACxE,IAAI,EAAE,eAAe;IACrB,KAAK,EAAE,eAAe;IACtB,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE;QACT;YACE,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,MAAM;YACb,MAAM,EAAE;gBACN,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;gBAC7E,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;gBAC7E,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;gBACpF,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;gBACtF,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;aACtF;SACF;QACD;YACE,IAAI,EAAE,YAAY;YAClB,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE;gBACN,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;gBACjF,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;gBAC7F;oBACE,GAAG,EAAE,iBAAiB;oBACtB,KAAK,EAAE,mBAAmB;oBAC1B,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,IAAI;iBACb;aACF;SACF;QACD;YACE,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,UAAU;YACjB,MAAM,EAAE;gBACN,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;gBACjF,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;aAC7F;SACF;KACF;CACF,CAAC"}

package/dist/backend/types/llm.type.d.ts

@@ -0,0 +1,3 @@
+import type { ConfigurationTypeDescriptor } from '@endora-commerce/contracts';
+export declare const llmConfigurationType: ConfigurationTypeDescriptor;
+//# sourceMappingURL=llm.type.d.ts.map

package/dist/backend/types/llm.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm.type.d.ts","sourceRoot":"","sources":["../../../src/backend/types/llm.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAmB,MAAM,4BAA4B,CAAC;AA2B/F,eAAO,MAAM,oBAAoB,EAAE,2BAUlC,CAAC"}

package/dist/backend/types/llm.type.js

@@ -0,0 +1,35 @@
+/**
+ * Core `llm` configuration type (feature 058, US1 / research §R2).
+ *
+ * Provider codes align with the existing `prompt_actions.provider` enum
+ * (`anthropic | google | openai`) extended with `deepseek`. Every provider
+ * shares the same field set: a secret `apiKey`, a required `model`, and an
+ * optional `baseUrl` override. The credentials core stays type-agnostic — how a
+ * provider is actually called is owned by the consumer (Principle XIV).
+ */
+function llmFields() {
+    return [
+        { key: 'apiKey', label: 'API Key', kind: 'string', required: true, secret: true },
+        { key: 'model', label: 'Model', kind: 'string', required: true, secret: false },
+        {
+            key: 'baseUrl',
+            label: 'Base URL',
+            kind: 'string',
+            required: false,
+            secret: false,
+            placeholder: 'Optional — override the provider default endpoint',
+        },
+    ];
+}
+export const llmConfigurationType = {
+    code: 'llm',
+    label: 'LLM',
+    ownerModule: 'credentials',
+    providers: [
+        { code: 'openai', label: 'OpenAI (GPT)', fields: llmFields() },
+        { code: 'google', label: 'Google (Gemini)', fields: llmFields() },
+        { code: 'anthropic', label: 'Anthropic (Claude)', fields: llmFields() },
+        { code: 'deepseek', label: 'DeepSeek', fields: llmFields() },
+    ],
+};
+//# sourceMappingURL=llm.type.js.map

package/dist/backend/types/llm.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm.type.js","sourceRoot":"","sources":["../../../src/backend/types/llm.type.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,SAAS,SAAS;IAChB,OAAO;QACL,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;QACjF,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;QAC/E;YACE,GAAG,EAAE,SAAS;YACd,KAAK,EAAE,UAAU;YACjB,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,mDAAmD;SACjE;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAgC;IAC/D,IAAI,EAAE,KAAK;IACX,KAAK,EAAE,KAAK;IACZ,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE;QACT,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;QAC9D,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;QACjE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;QACvE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;KAC7D;CACF,CAAC"}

package/dist/manifest.d.ts

@@ -0,0 +1,176 @@
+/**
+ * Credentials module — feature 058.
+ *
+ * Reusable credential configurations: each an instance of a code-registered
+ * configuration type (LLM, email adapter, …). The core stores and validates
+ * declared field values (secrets encrypted at rest, masked on read) but never
+ * interprets provider meaning (Principle XIV). It owns NO settings — it
+ * *provides* the `credential_ref` value type consumed by other modules.
+ *
+ * Depends on `settings` for the reference/delete-integrity lookup (US2) and on
+ * the platform `_lifecycle` / `_i18n` modules for registration + translations.
+ */
+export declare const CREDENTIALS_READ_PERMISSION = "credentials:read";
+export declare const CREDENTIALS_WRITE_PERMISSION = "credentials:write";
+export declare const CREDENTIALS_ACTIVATION_SETTING_CODE = "credentials.enabled";
+export declare const manifest: {
+    id: string;
+    name: string;
+    version: string;
+    dependencies: string[];
+    description?: string | undefined;
+    acknowledgedDependencies?: {
+        moduleId: string;
+        port: string;
+        reason: string;
+    }[] | undefined;
+    nonBindingDependencies?: {
+        moduleId: string;
+        name: string;
+        kind: "contributes-to" | "degrades-without" | "refuses-without";
+        reason: string;
+        whenAbsent?: string | undefined;
+    }[] | undefined;
+    activation?: {
+        settingCode: string;
+        default: boolean;
+    } | {
+        nonDeactivatable: true;
+        reason: string;
+    } | undefined;
+    settings?: {
+        moduleCode: string;
+        groups: {
+            code: string;
+            name: string;
+            salesChannelCodes?: string[] | undefined;
+            isSystemProtected?: boolean | undefined;
+        }[];
+        settings: {
+            code: string;
+            name: string;
+            valueType: "string" | "number" | "boolean" | "json" | "string_list" | "secret" | "credential_ref";
+            defaultValue: unknown;
+            description?: string | undefined;
+            groupCode?: string | undefined;
+            previousDefaultValues?: unknown[] | undefined;
+            salesChannelCodes?: string[] | undefined;
+            enumOptions?: string[] | undefined;
+            configurationType?: string | undefined;
+            hidden?: boolean | undefined;
+        }[];
+    } | undefined;
+    i18n?: {
+        bundlesDir: string;
+    } | undefined;
+    docs?: false | {
+        dir: string;
+    } | undefined;
+    demo?: false | {
+        summary: string;
+        seed: (context: import("@endora-commerce/contracts").ModuleDemoContext<never>) => Promise<import("@endora-commerce/contracts").DemoSeedResult>;
+        reset: (context: import("@endora-commerce/contracts").ModuleDemoContext<never>) => Promise<import("@endora-commerce/contracts").DemoResetResult>;
+        after?: readonly string[] | undefined;
+        package?: string | undefined;
+    } | undefined;
+    actions?: {
+        id: string;
+        labelKey: string;
+        icon: "Plus" | "Sparkles" | "Settings" | "Search" | "Boxes" | "Layers" | "Menu" | "PlusCircle" | "PlusSquare" | "FilePlus" | "FolderPlus" | "Upload" | "FileUp" | "CloudUpload" | "Download" | "FileDown" | "FileText" | "BookOpen" | "Rss" | "Package" | "Tag" | "ShoppingCart" | "Receipt" | "CreditCard" | "Users" | "UserPlus" | "Inbox" | "ListChecks" | "ClipboardList" | "Image" | "Video" | "LayoutDashboard" | "PanelLeft" | "KeyRound" | "ShieldCheck" | "Edit" | "Archive" | "Box" | "Truck" | "CircleDollarSign" | "Activity" | "LineChart" | "Smartphone" | "Webhook" | "Scale" | "PlugZap" | "PercentDiamond" | "Newspaper" | "Languages" | "Eraser" | "Warehouse" | "TrendingDown" | "Bell" | "PackageOpen" | "Building2" | "Store" | "ClipboardCheck";
+        targetRoute: string;
+        keywords: string[];
+        weight: number;
+        descriptionKey?: string | undefined;
+        requiredPermission?: string | undefined;
+    }[] | undefined;
+    permissions?: {
+        code: string;
+        label: string;
+        module?: string | undefined;
+        description?: string | undefined;
+        requires?: string[] | undefined;
+    }[] | undefined;
+    transactionalEmails?: {
+        code: string;
+        name: string;
+        variables: {
+            key: string;
+            label: string;
+            sampleValue?: string | undefined;
+            description?: string | undefined;
+        }[];
+        description?: string | undefined;
+        group?: string | undefined;
+    }[] | undefined;
+    capabilities?: string[] | undefined;
+    exclusiveCapabilities?: {
+        key: string;
+        errorCode: string;
+    }[] | undefined;
+    errorCodes?: {
+        code: string;
+        tokens?: string[] | undefined;
+    }[] | undefined;
+    blocks?: {
+        name: string;
+        labelKey: string;
+        category: string;
+        contexts: ("invoice" | "email" | "cms" | "newsletter")[];
+        fields: Record<string, {
+            type: "number" | "object" | "array" | "text" | "textarea" | "select" | "radio" | "external" | "uuid" | "richtext";
+            label?: string | undefined;
+            required?: boolean | undefined;
+            options?: {
+                label: string;
+                value: string | number;
+            }[] | undefined;
+            refKind?: string | undefined;
+        }>;
+        descriptionKey?: string | undefined;
+        defaultProps?: Record<string, unknown> | undefined;
+        responsiveFields?: string[] | undefined;
+        previewIcon?: string | undefined;
+        weight?: number | undefined;
+    }[] | undefined;
+    blockCategories?: {
+        key: string;
+        titleKey: string;
+        contexts: ("invoice" | "email" | "cms" | "newsletter")[];
+        weight?: number | undefined;
+        visible?: boolean | undefined;
+    }[] | undefined;
+    env?: {
+        name: string;
+        describes: {
+            en: string;
+            pl: string;
+        };
+        requirement: {
+            kind: "required";
+        } | {
+            kind: "requiredWhen";
+            input: string;
+            equals: string;
+        } | {
+            kind: "optional";
+            without: {
+                en: string;
+                pl: string;
+            };
+        };
+        secret: boolean;
+        generable: boolean;
+        owner: {
+            kind: "platform";
+        } | {
+            kind: "application";
+            application: "admin" | "backend" | "storefront";
+        } | {
+            kind: "module";
+            moduleId: string;
+        };
+        consumers: ("admin" | "backend" | "storefront")[];
+        addressOf: "admin" | "backend" | "storefront" | null;
+    }[] | undefined;
+};
+//# sourceMappingURL=manifest.d.ts.map

package/dist/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AAEH,eAAO,MAAM,2BAA2B,qBAAqB,CAAC;AAC9D,eAAO,MAAM,4BAA4B,sBAAsB,CAAC;AAEhE,eAAO,MAAM,mCAAmC,wBAAwB,CAAC;AA+BzE,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2HnB,CAAC"}

package/dist/manifest.js

@@ -0,0 +1,167 @@
+import { defineModuleManifest, defineModuleSettingsManifest } from '@endora-commerce/contracts';
+/**
+ * Credentials module — feature 058.
+ *
+ * Reusable credential configurations: each an instance of a code-registered
+ * configuration type (LLM, email adapter, …). The core stores and validates
+ * declared field values (secrets encrypted at rest, masked on read) but never
+ * interprets provider meaning (Principle XIV). It owns NO settings — it
+ * *provides* the `credential_ref` value type consumed by other modules.
+ *
+ * Depends on `settings` for the reference/delete-integrity lookup (US2) and on
+ * the platform `_lifecycle` / `_i18n` modules for registration + translations.
+ */
+export const CREDENTIALS_READ_PERMISSION = 'credentials:read';
+export const CREDENTIALS_WRITE_PERMISSION = 'credentials:write';
+export const CREDENTIALS_ACTIVATION_SETTING_CODE = 'credentials.enabled';
+/**
+ * Feature 074 — the module's one Setting, and it exists to hold the operator's
+ * activation choice.
+ *
+ * The doc comment above still holds: this module owns no *configuration*. It
+ * provides the `credential_ref` value type other modules consume, and it stores
+ * their credential instances. The activation control is not configuration —
+ * it is the operator axis of Constitution XVII, which is a Setting row by
+ * construction — so declaring it here does not make this a settings-owning
+ * module.
+ */
+const settings = defineModuleSettingsManifest({
+    moduleCode: 'credentials',
+    groups: [{ code: 'credentials', name: 'Credentials' }],
+    settings: [
+        {
+            // Platform-wide, never channel-scoped: activation does not join the
+            // per-channel tier, and the reconciler's channel scope is additive-only.
+            code: CREDENTIALS_ACTIVATION_SETTING_CODE,
+            name: 'Credentials enabled',
+            description: 'Switches the credential store on or off: the Credentials screens, their API, and the resolution of a `credential_ref` setting by any module that references one. Nothing is dropped — every stored configuration and its encrypted secrets stay in the database and resolve again exactly as before when you switch it back on.',
+            groupCode: 'credentials',
+            valueType: 'boolean',
+            defaultValue: true,
+        },
+    ],
+});
+export const manifest = defineModuleManifest({
+    id: 'credentials',
+    name: 'Credentials',
+    description: 'Reusable credential configurations (LLM, email adapter, …) referenced by settings and resolved by consumers; secrets encrypted at rest and write-only at the boundary.',
+    version: '1.0.0',
+    dependencies: ['_i18n', '_lifecycle', 'auth', 'settings'],
+    settings,
+    // Feature 074 (Constitution XVII) — a control this module never had, so an
+    // operator could not decline it at all. It is the secret store for the
+    // integration surfaces; with those switched off it is dead weight, which is
+    // exactly the "additional capability" ruling 1 means. Default `true` so that
+    // merging this changes no deployment's state (FR-012).
+    activation: { settingCode: CREDENTIALS_ACTIVATION_SETTING_CODE, default: true },
+    /**
+     * Feature 090 Phase 3 — the six error codes the incumbent prefix chain routes
+     * to this module.
+     *
+     * The list is copied from the frozen capture
+     * (`backend/test/fixtures/error-code-routing/chain-answers.ts`), which records
+     * what `moduleIdForErrorCode` answered, and is not a judgement about where a
+     * code belongs. Reading the chain's *source* would have coincided here — the
+     * `CREDENTIAL_` branch is unshadowed and no later branch claims a
+     * `CREDENTIAL_`-prefixed code — but that is a conclusion of having read the
+     * whole chain, never a premise (trap T1), and the six below still come off the
+     * answer.
+     *
+     * **Three read like somebody else's and all three stay** (trap T2).
+     * `CREDENTIAL_TYPE_UNKNOWN` refuses a configuration *type* that no module has
+     * contributed to `ConfigurationTypeRegistry`, so the module a reader would
+     * blame is whichever one was supposed to register it; `CREDENTIAL_IN_USE` is
+     * decided entirely by a `settings` read — `listReferencesToConfiguration`,
+     * whose result is the refusal's `referencedBy` list; and
+     * `CREDENTIAL_VALIDATION_FAILED` is a field-level validation refusal of the
+     * shape `core` owns as `VALIDATION_FAILED`. All three are refusals *about a
+     * credential configuration*, which is the noun the chain follows (D-95.2).
+     *
+     * **The inverse is the larger half, and every code in it is somebody else's.**
+     * `INVALID_CREDENTIALS` is auth's sign-in failure and routes to `core` — the
+     * chain says so in its own comment above the `CREDENTIAL_` branch, because the
+     * plural noun is a password and not a stored configuration.
+     * `KSEF_CREDENTIAL_EXISTS` and `KSEF_CREDENTIAL_INVALID` route to `core` as
+     * well, which surprises twice over: not here, and not `ksef` either.
+     * `MFA_SOCIAL_LAST_CREDENTIAL` is `mfa`'s. And `SETTING_SECRET_KEY_MISSING` is
+     * `settings`' (!1133) although it is raised out of a secret codec that
+     * `@endora-commerce/platform`, this module and `ksef` each ship a byte-identical
+     * copy of — see `services/secret-value-codec.ts`, whose own header calls the
+     * duplication debt. This module raises one code it does not own in the other
+     * direction: `VERSION_CONFLICT`, in the optimistic-concurrency guard of
+     * `update-configuration.command.ts`, which routes to `core` and is not declared
+     * here. Re-routing any of this is out of scope (§6.5); disagreement belongs in
+     * `specs/082-error-code-ownership/rulings.md` §9.
+     *
+     * **All six are raised**, in both spellings (trap T12): `ERROR_CODES.<CODE>`
+     * and the bare quoted literal, over `packages`, `backend/src`, `admin` and
+     * `storefront`. Every raise is inside this package — twelve `HttpError`
+     * throws — so unlike `settings` and `invoices` this module's raise sites and
+     * its package coincide. No entry for the deferred-defect register. The
+     * thirteenth mention is not a throw and is worth naming, because a grep counts
+     * it as one: `ConfigurationTypeUnknown` in
+     * `services/configuration-type-registry.ts` carries
+     * `readonly code = ERROR_CODES.CREDENTIAL_TYPE_UNKNOWN` on a plain `Error`
+     * subclass, and that field is read by nothing — the envelope's error handler
+     * takes `code` off an `HttpError` and off nothing else. What makes the code
+     * reach a client is the `instanceof` catch in
+     * `commands/create-configuration.command.ts`, which rethrows as an `HttpError`
+     * by hand.
+     *
+     * **No `tokens`, derived rather than assumed.** `refusalToken`
+     * (`packages/platform/src/http/error-envelope.ts`) reads `details.code` off a
+     * free-form object and nothing else. Of the twelve throws, nine pass no
+     * fourth argument at all; the two `CREDENTIAL_VALIDATION_FAILED` raises pass
+     * the Zod-style `Array<{path, issue}>`, which `refusalToken` returns `null`
+     * for by construction; and the one `CREDENTIAL_IN_USE` raise passes
+     * `{ referencedBy }`, a free-form object with no `code` member. The runbook's
+     * §5 raise-site scan attributes the tree's ten token-carrying codes over 41
+     * sites to `core`, `invoices` and `carts`, naming none of these, and the
+     * bundles hold no `errors.<CODE>.<token>` key in the other direction.
+     */
+    errorCodes: [
+        { code: 'CREDENTIAL_CODE_TAKEN' },
+        { code: 'CREDENTIAL_IN_USE' },
+        { code: 'CREDENTIAL_NOT_FOUND' },
+        { code: 'CREDENTIAL_TYPE_IMMUTABLE' },
+        { code: 'CREDENTIAL_TYPE_UNKNOWN' },
+        { code: 'CREDENTIAL_VALIDATION_FAILED' },
+    ],
+    i18n: { bundlesDir: 'i18n' },
+    docs: { dir: 'docs' },
+    permissions: [
+        {
+            code: CREDENTIALS_READ_PERMISSION,
+            label: 'View credential configurations',
+            description: 'Allows viewing credential configurations and the configuration-type catalogue (secrets masked).',
+        },
+        {
+            code: CREDENTIALS_WRITE_PERMISSION,
+            label: 'Manage credential configurations',
+            description: 'Allows creating, editing, and deleting credential configurations, including writing secret fields.',
+        },
+    ],
+    actions: [
+        {
+            id: 'open-credentials',
+            labelKey: 'actions.openCredentials.label',
+            descriptionKey: 'actions.openCredentials.description',
+            icon: 'KeyRound',
+            targetRoute: '/credentials',
+            requiredPermission: CREDENTIALS_READ_PERMISSION,
+            keywords: ['credentials', 'secrets', 'api key', 'poświadczenia', 'sekrety', 'klucze'],
+            weight: 250,
+        },
+        {
+            id: 'new-credential',
+            labelKey: 'actions.newCredential.label',
+            descriptionKey: 'actions.newCredential.description',
+            icon: 'Plus',
+            targetRoute: '/credentials/new',
+            requiredPermission: CREDENTIALS_WRITE_PERMISSION,
+            keywords: ['credential', 'configuration', 'nowe poświadczenie', 'konfiguracja'],
+            weight: 251,
+        },
+    ],
+});
+//# sourceMappingURL=manifest.js.map

package/dist/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAEhG;;;;;;;;;;;GAWG;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,kBAAkB,CAAC;AAC9D,MAAM,CAAC,MAAM,4BAA4B,GAAG,mBAAmB,CAAC;AAEhE,MAAM,CAAC,MAAM,mCAAmC,GAAG,qBAAqB,CAAC;AAEzE;;;;;;;;;;GAUG;AACH,MAAM,QAAQ,GAAG,4BAA4B,CAAC;IAC5C,UAAU,EAAE,aAAa;IACzB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACtD,QAAQ,EAAE;QACR;YACE,oEAAoE;YACpE,yEAAyE;YACzE,IAAI,EAAE,mCAAmC;YACzC,IAAI,EAAE,qBAAqB;YAC3B,WAAW,EACT,iUAAiU;YACnU,SAAS,EAAE,aAAa;YACxB,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,IAAI;SACnB;KACF;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG,oBAAoB,CAAC;IAC3C,EAAE,EAAE,aAAa;IACjB,IAAI,EAAE,aAAa;IACnB,WAAW,EACT,wKAAwK;IAC1K,OAAO,EAAE,OAAO;IAChB,YAAY,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,CAAC;IACzD,QAAQ;IACR,2EAA2E;IAC3E,uEAAuE;IACvE,4EAA4E;IAC5E,6EAA6E;IAC7E,uDAAuD;IACvD,UAAU,EAAE,EAAE,WAAW,EAAE,mCAAmC,EAAE,OAAO,EAAE,IAAI,EAAE;IAC/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgEG;IACH,UAAU,EAAE;QACV,EAAE,IAAI,EAAE,uBAAuB,EAAE;QACjC,EAAE,IAAI,EAAE,mBAAmB,EAAE;QAC7B,EAAE,IAAI,EAAE,sBAAsB,EAAE;QAChC,EAAE,IAAI,EAAE,2BAA2B,EAAE;QACrC,EAAE,IAAI,EAAE,yBAAyB,EAAE;QACnC,EAAE,IAAI,EAAE,8BAA8B,EAAE;KACzC;IACD,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE;IAC5B,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;IACrB,WAAW,EAAE;QACX;YACE,IAAI,EAAE,2BAA2B;YACjC,KAAK,EAAE,gCAAgC;YACvC,WAAW,EAAE,iGAAiG;SAC/G;QACD;YACE,IAAI,EAAE,4BAA4B;YAClC,KAAK,EAAE,kCAAkC;YACzC,WAAW,EAAE,oGAAoG;SAClH;KACF;IACD,OAAO,EAAE;QACP;YACE,EAAE,EAAE,kBAAkB;YACtB,QAAQ,EAAE,+BAA+B;YACzC,cAAc,EAAE,qCAAqC;YACrD,IAAI,EAAE,UAAU;YAChB,WAAW,EAAE,cAAc;YAC3B,kBAAkB,EAAE,2BAA2B;YAC/C,QAAQ,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;YACrF,MAAM,EAAE,GAAG;SACZ;QACD;YACE,EAAE,EAAE,gBAAgB;YACpB,QAAQ,EAAE,6BAA6B;YACvC,cAAc,EAAE,mCAAmC;YACnD,IAAI,EAAE,MAAM;YACZ,WAAW,EAAE,kBAAkB;YAC/B,kBAAkB,EAAE,4BAA4B;YAChD,QAAQ,EAAE,CAAC,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,cAAc,CAAC;YAC/E,MAAM,EAAE,GAAG;SACZ;KACF;CACF,CAAC,CAAC"}

package/dist/migrations/20260721T011509_credentials_init.d.ts

@@ -0,0 +1,17 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Feature 058 — Credentials module (init).
+ *
+ * Creates `credential_configurations` — reusable, named instances of a
+ * code-registered configuration type. Secret field values are stored as
+ * AES-256-GCM envelopes inside the `values` JSONB bag; the type/provider codes
+ * are resolved against the in-process registry (no DB-level FK).
+ *
+ * `code` is globally unique (stable reference target). `type_code` is indexed
+ * for the "list by type" picker query.
+ */
+export declare class Migration20260721T011509CredentialsInit extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=20260721T011509_credentials_init.d.ts.map

package/dist/migrations/20260721T011509_credentials_init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260721T011509_credentials_init.d.ts","sourceRoot":"","sources":["../../src/migrations/20260721T011509_credentials_init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;GAUG;AACH,qBAAa,uCAAwC,SAAQ,SAAS;IACrD,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;IAuBnB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAGrC"}

package/dist/migrations/20260721T011509_credentials_init.js

@@ -0,0 +1,36 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Feature 058 — Credentials module (init).
+ *
+ * Creates `credential_configurations` — reusable, named instances of a
+ * code-registered configuration type. Secret field values are stored as
+ * AES-256-GCM envelopes inside the `values` JSONB bag; the type/provider codes
+ * are resolved against the in-process registry (no DB-level FK).
+ *
+ * `code` is globally unique (stable reference target). `type_code` is indexed
+ * for the "list by type" picker query.
+ */
+export class Migration20260721T011509CredentialsInit extends Migration {
+    async up() {
+        this.addSql(`
+      create table "credential_configurations" (
+        "id" uuid not null,
+        "code" varchar(128) not null,
+        "name" varchar(255) not null,
+        "type_code" varchar(64) not null,
+        "provider_code" varchar(64) not null,
+        "values" jsonb not null default '{}',
+        "version" int not null default 1,
+        "created_at" timestamptz not null,
+        "updated_at" timestamptz not null,
+        constraint "credential_configurations_pkey" primary key ("id")
+      );
+    `);
+        this.addSql(`alter table "credential_configurations" add constraint "credential_configurations_code_unique" unique ("code");`);
+        this.addSql(`create index "credential_configurations_type_code_idx" on "credential_configurations" ("type_code");`);
+    }
+    async down() {
+        this.addSql(`drop table if exists "credential_configurations" cascade;`);
+    }
+}
+//# sourceMappingURL=20260721T011509_credentials_init.js.map

package/dist/migrations/20260721T011509_credentials_init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260721T011509_credentials_init.js","sourceRoot":"","sources":["../../src/migrations/20260721T011509_credentials_init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;GAUG;AACH,MAAM,OAAO,uCAAwC,SAAQ,SAAS;IAC3D,KAAK,CAAC,EAAE;QACf,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;KAaX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CACT,iHAAiH,CAClH,CAAC;QACF,IAAI,CAAC,MAAM,CACT,sGAAsG,CACvG,CAAC;IACJ,CAAC;IAEQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,MAAM,CAAC,2DAA2D,CAAC,CAAC;IAC3E,CAAC;CACF"}

package/dist/migrations/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The `./migrations` subpath — every migration class this module owns, as one
+ * ordered `migrations` array.
+ *
+ * The array is what the platform reads when this module is **installed**:
+ * `src/packages/package-runtime.ts` takes `exported['migrations']` and refuses
+ * the package outright when it is absent (D-168).
+ *
+ * Listed in ascending timestamp, which is the order of this module's own
+ * migrations and of nothing else (feature 081): a manifest `dependencies` array
+ * is the only thing ordering this block against another module's.
+ *
+ * The **named** exports stay beside the array, and the asymmetry with
+ * `./backend` — which publishes an array and no named class (D-168) — is
+ * deliberate. `db/migrations-registry.generated.ts` imports each class by name
+ * from this specifier, and a migration class name is contract in a way an entity
+ * class name is not: `mikro_orm_migrations` persists it, so it is a string every
+ * already-migrated database holds.
+ *
+ * A class that is in neither the array nor the barrel is a migration that does
+ * not run: `migration:pending` reports nothing pending and the first symptom is
+ * a query against a table nobody created.
+ */
+import { Migration20260721T011509CredentialsInit } from './20260721T011509_credentials_init.js';
+export declare const migrations: (typeof Migration20260721T011509CredentialsInit)[];
+export { Migration20260721T011509CredentialsInit, };
+//# sourceMappingURL=index.d.ts.map

package/dist/migrations/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,uCAAuC,EAAE,MAAM,uCAAuC,CAAC;AAEhG,eAAO,MAAM,UAAU,oDAEtB,CAAC;AAEF,OAAO,EACL,uCAAuC,GACxC,CAAC"}

package/dist/migrations/index.js

@@ -0,0 +1,29 @@
+/**
+ * The `./migrations` subpath — every migration class this module owns, as one
+ * ordered `migrations` array.
+ *
+ * The array is what the platform reads when this module is **installed**:
+ * `src/packages/package-runtime.ts` takes `exported['migrations']` and refuses
+ * the package outright when it is absent (D-168).
+ *
+ * Listed in ascending timestamp, which is the order of this module's own
+ * migrations and of nothing else (feature 081): a manifest `dependencies` array
+ * is the only thing ordering this block against another module's.
+ *
+ * The **named** exports stay beside the array, and the asymmetry with
+ * `./backend` — which publishes an array and no named class (D-168) — is
+ * deliberate. `db/migrations-registry.generated.ts` imports each class by name
+ * from this specifier, and a migration class name is contract in a way an entity
+ * class name is not: `mikro_orm_migrations` persists it, so it is a string every
+ * already-migrated database holds.
+ *
+ * A class that is in neither the array nor the barrel is a migration that does
+ * not run: `migration:pending` reports nothing pending and the first symptom is
+ * a query against a table nobody created.
+ */
+import { Migration20260721T011509CredentialsInit } from './20260721T011509_credentials_init.js';
+export const migrations = [
+    Migration20260721T011509CredentialsInit,
+];
+export { Migration20260721T011509CredentialsInit, };
+//# sourceMappingURL=index.js.map

package/dist/migrations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,uCAAuC,EAAE,MAAM,uCAAuC,CAAC;AAEhG,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,uCAAuC;CACxC,CAAC;AAEF,OAAO,EACL,uCAAuC,GACxC,CAAC"}