@finchagentic/mcp 4.0.0

package/dist/local-memory.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getLocalMemoryConfig = getLocalMemoryConfig;
+exports.isLocalMemoryReachable = isLocalMemoryReachable;
+exports.localMemoryAdd = localMemoryAdd;
+exports.localMemorySearch = localMemorySearch;
+exports.localMemoryList = localMemoryList;
+exports.localMemoryDelete = localMemoryDelete;
+exports.localMemoryProfile = localMemoryProfile;
+const config_js_1 = require("./config.js");
+const DEFAULT_URL = "http://localhost:6767";
+const REACHABILITY_TIMEOUT_MS = 1500;
+const CALL_TIMEOUT_MS = 15000;
+// Returns config only when the user has explicitly opted into local memory
+// (memoryBackend: "local") and a key is present. Callers should still treat
+// a null return as "use Convex" - this never throws.
+function getLocalMemoryConfig() {
+    try {
+        const cfg = (0, config_js_1.readConfig)();
+        if (cfg.memoryBackend !== "local" || !cfg.supermemoryApiKey)
+            return null;
+        return { url: cfg.supermemoryUrl ?? DEFAULT_URL, apiKey: cfg.supermemoryApiKey };
+    }
+    catch {
+        return null;
+    }
+}
+// Requires a genuine 2xx, not just "something answered" - a stale/wrong
+// supermemoryApiKey returns 401 (server is up, but every real memory call
+// will fail the same way), and that must show as unhealthy, not healthy.
+async function isLocalMemoryReachable(cfg) {
+    try {
+        const res = await fetch(`${cfg.url}/v3/search`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", Authorization: `Bearer ${cfg.apiKey}` },
+            body: JSON.stringify({ q: "__finch_reachability_check__", limit: 1 }),
+            signal: AbortSignal.timeout(REACHABILITY_TIMEOUT_MS),
+        });
+        return res.ok;
+    }
+    catch {
+        return false;
+    }
+}
+async function localMemoryAdd(cfg, content, metadata, sourceUrl) {
+    const res = await fetch(`${cfg.url}/v3/documents`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Authorization: `Bearer ${cfg.apiKey}` },
+        body: JSON.stringify({ content, metadata, ...(sourceUrl ? { sourceUrl } : {}) }),
+        signal: AbortSignal.timeout(CALL_TIMEOUT_MS),
+    });
+    if (!res.ok)
+        throw new Error(`local supermemory add failed: HTTP ${res.status}`);
+    const data = await res.json();
+    return { id: data.id ?? data.documentId ?? "saved" };
+}
+async function localMemorySearch(cfg, query, limit) {
+    const res = await fetch(`${cfg.url}/v3/search`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Authorization: `Bearer ${cfg.apiKey}` },
+        body: JSON.stringify({ q: query, limit }),
+        signal: AbortSignal.timeout(CALL_TIMEOUT_MS),
+    });
+    if (!res.ok)
+        throw new Error(`local supermemory search failed: HTTP ${res.status}`);
+    const data = await res.json();
+    return (data.results ?? []).map((r) => ({
+        id: r.id ?? r.documentId ?? "",
+        content: r.content ?? r.chunks?.map((c) => c.content ?? "").join("\n") ?? "",
+        metadata: r.metadata ?? {},
+        score: r.score,
+    }));
+}
+// supermemory's search endpoint doubles as "list": a wildcard query returns
+// recent documents. No dedicated /list endpoint is documented for the local
+// server, so callers pass "*" and post-filter by tag client-side, matching
+// how the Convex-side /memory/list already does its own tag post-filter.
+async function localMemoryList(cfg, limit, tag) {
+    const rows = await localMemorySearch(cfg, "*", Math.max(limit * (tag ? 3 : 1), limit));
+    const filtered = tag ? rows.filter((r) => Array.isArray(r.metadata?.tags) && r.metadata.tags.includes(tag)) : rows;
+    return filtered.slice(0, limit);
+}
+// Delete endpoint isn't confirmed in the public self-hosting docs at the
+// time this was written - throws a distinct error so callers can surface a
+// clear "not supported locally yet" message instead of a generic failure.
+async function localMemoryDelete(cfg, id) {
+    const res = await fetch(`${cfg.url}/v3/documents/${encodeURIComponent(id)}`, {
+        method: "DELETE",
+        headers: { Authorization: `Bearer ${cfg.apiKey}` },
+        signal: AbortSignal.timeout(CALL_TIMEOUT_MS),
+    });
+    if (!res.ok)
+        throw new Error(`local supermemory delete failed: HTTP ${res.status}`);
+}
+// No dedicated count endpoint is documented for the local server, so this
+// approximates via a capped wildcard search - accurate up to `SAMPLE_LIMIT`,
+// reported as a floor ("200+") beyond that rather than a false exact count.
+const PROFILE_SAMPLE_LIMIT = 200;
+async function localMemoryProfile(cfg) {
+    const rows = await localMemorySearch(cfg, "*", PROFILE_SAMPLE_LIMIT);
+    return { total: rows.length, status: "ok", space: "local", approximate: rows.length >= PROFILE_SAMPLE_LIMIT };
+}

package/dist/local-vault.js

@@ -0,0 +1,454 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getLocalVaultConfig = getLocalVaultConfig;
+exports.localVaultSave = localVaultSave;
+exports.localVaultRead = localVaultRead;
+exports.localVaultList = localVaultList;
+exports.localVaultSearch = localVaultSearch;
+exports.localVaultHistory = localVaultHistory;
+exports.localVaultDiff = localVaultDiff;
+exports.localVaultExport = localVaultExport;
+exports.localVaultPin = localVaultPin;
+exports.localVaultDelete = localVaultDelete;
+exports.localVaultTag = localVaultTag;
+exports.localVaultLink = localVaultLink;
+exports.localVaultRelated = localVaultRelated;
+exports.localVaultStoreCredential = localVaultStoreCredential;
+exports.localVaultGetCredential = localVaultGetCredential;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const crypto = __importStar(require("crypto"));
+const config_js_1 = require("./config.js");
+// Fully-local, user-owned Noel-Vault backend. Mirrors the two-tier pattern of
+// local-memory.ts: when the user opts in (`vaultBackend: "local"`), the vault
+// tools store versioned artifacts on the user's own disk under
+// ~/.finch/vault/ - no Finch account, no Convex, no network, no cost to
+// the platform. Zero runtime dependencies (plain JSON + one content file per
+// version), same spirit as codebase-memory-mcp's local-first SQLite store.
+//
+// Every exported function returns objects shaped like the Convex /vault/*
+// responses so tools/vault.ts can swap the data source with a one-line branch
+// and reuse all of its existing rendering. Not-found cases THROW an Error whose
+// message contains "not found", matching how callConvex surfaces a 404 (the
+// vault handlers already catch and format that).
+const VAULT_DIR = path.join(os.homedir(), ".finch", "vault");
+// Local vault is enabled purely by config - it needs no server, just the
+// filesystem. Returns null (→ "use Convex") when the user hasn't opted in.
+function getLocalVaultConfig() {
+    try {
+        if ((0, config_js_1.readConfig)().vaultBackend !== "local")
+            return null;
+        return { dir: VAULT_DIR };
+    }
+    catch {
+        return null;
+    }
+}
+function now() { return Date.now(); }
+function ensureDir(cfg) {
+    fs.mkdirSync(path.join(cfg.dir, "data"), { recursive: true });
+}
+function indexPath(cfg) { return path.join(cfg.dir, "index.json"); }
+function readIndex(cfg) {
+    try {
+        const raw = fs.readFileSync(indexPath(cfg), "utf8");
+        const parsed = JSON.parse(raw);
+        return { entries: parsed.entries ?? {}, links: parsed.links ?? [] };
+    }
+    catch {
+        return { entries: {}, links: [] };
+    }
+}
+// Atomic write: temp file + rename, so a crash mid-write can't corrupt the
+// manifest every entry depends on.
+function writeIndex(cfg, idx) {
+    ensureDir(cfg);
+    const tmp = indexPath(cfg) + `.tmp-${process.pid}`;
+    fs.writeFileSync(tmp, JSON.stringify(idx, null, 2), "utf8");
+    fs.renameSync(tmp, indexPath(cfg));
+}
+function keyDir(key) {
+    return crypto.createHash("sha1").update(key).digest("hex").slice(0, 16);
+}
+function contentPath(cfg, dir, version) {
+    return path.join(cfg.dir, "data", dir, `v${version}`);
+}
+function readContent(cfg, dir, version) {
+    try {
+        return fs.readFileSync(contentPath(cfg, dir, version), "utf8");
+    }
+    catch {
+        return "";
+    }
+}
+function writeContent(cfg, dir, version, content) {
+    const d = path.join(cfg.dir, "data", dir);
+    fs.mkdirSync(d, { recursive: true });
+    fs.writeFileSync(contentPath(cfg, dir, version), content, "utf8");
+}
+function slugify(s) {
+    return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60) || "entry";
+}
+function notFound(key) {
+    return new Error(`Vault entry not found: ${key}`);
+}
+function localVaultSave(cfg, input) {
+    const idx = readIndex(cfg);
+    let key = input.key ?? `${input.type}/${slugify(input.title)}`;
+    // An auto-generated key can collide with an unrelated entry when two
+    // different titles slugify to the same thing. Only version-in-place when the
+    // key was explicit or the existing entry is the same title; otherwise
+    // disambiguate, so a different note never silently gets folded into this one.
+    if (!input.key && idx.entries[key] && idx.entries[key].title !== input.title) {
+        let n = 2;
+        while (idx.entries[`${key}-${n}`])
+            n++;
+        key = `${key}-${n}`;
+    }
+    // Parity with the hosted vault: [[wikilinks]] become graph edges, #tags are
+    // pulled into the entry's tag set.
+    const inlineTags = Array.from(new Set((input.content.match(/(?:^|\s)#([a-z0-9][a-z0-9_-]*)/gi) ?? []).map((t) => t.trim().replace(/^#/, "").toLowerCase())));
+    const wikilinks = Array.from(new Set((input.content.match(/\[\[([^\]]+)\]\]/g) ?? []).map((w) => w.slice(2, -2).trim())));
+    const tags = Array.from(new Set([...(input.tags ?? []), ...inlineTags]));
+    const existing = idx.entries[key];
+    const ts = now();
+    if (existing) {
+        const currentContent = readContent(cfg, existing.dir, existing.currentVersion);
+        if (currentContent === input.content) {
+            // No change - don't bump the version (matches hosted "Unchanged").
+            return { key, version: existing.currentVersion, changed: false, linksCreated: 0, linksMissing: [], inlineTagsExtracted: inlineTags.length };
+        }
+        const version = existing.currentVersion + 1;
+        writeContent(cfg, existing.dir, version, input.content);
+        existing.currentVersion = version;
+        existing.title = input.title;
+        existing.type = input.type;
+        existing.contentType = input.contentType ?? existing.contentType;
+        existing.agentId = input.agentId ?? existing.agentId;
+        existing.tags = Array.from(new Set([...existing.tags, ...tags]));
+        existing.updatedAt = ts;
+        existing.metadata = input.metadata ?? existing.metadata;
+        existing.versions.push({ version, commitMsg: input.commitMsg, agentId: input.agentId, size: Buffer.byteLength(input.content), createdAt: ts });
+        const linkResult = applyWikilinks(idx, key, wikilinks);
+        writeIndex(cfg, idx);
+        return { key, version, changed: true, ...linkResult, inlineTagsExtracted: inlineTags.length };
+    }
+    const dir = keyDir(key);
+    writeContent(cfg, dir, 1, input.content);
+    idx.entries[key] = {
+        key, dir, type: input.type, title: input.title, contentType: input.contentType,
+        agentId: input.agentId, tags, pinned: false, currentVersion: 1,
+        createdAt: ts, updatedAt: ts, metadata: input.metadata,
+        versions: [{ version: 1, commitMsg: input.commitMsg, agentId: input.agentId, size: Buffer.byteLength(input.content), createdAt: ts }],
+    };
+    const linkResult = applyWikilinks(idx, key, wikilinks);
+    writeIndex(cfg, idx);
+    return { key, version: 1, changed: true, ...linkResult, inlineTagsExtracted: inlineTags.length };
+}
+function applyWikilinks(idx, fromKey, targets) {
+    let linksCreated = 0;
+    const linksMissing = [];
+    for (const toKey of targets) {
+        if (!idx.entries[toKey]) {
+            linksMissing.push(toKey);
+            continue;
+        }
+        const dup = idx.links.find((l) => l.fromKey === fromKey && l.toKey === toKey && l.relation === "references");
+        if (!dup) {
+            idx.links.push({ fromKey, toKey, relation: "references" });
+            linksCreated++;
+        }
+    }
+    return { linksCreated, linksMissing };
+}
+// ── read ──────────────────────────────────────────────────────────────────────
+function localVaultRead(cfg, key) {
+    const idx = readIndex(cfg);
+    const e = idx.entries[key];
+    if (!e)
+        throw notFound(key);
+    const linkedKeys = idx.links.filter((l) => l.fromKey === key).map((l) => `${l.toKey} (${l.relation})`);
+    const backlinks = idx.links
+        .filter((l) => l.toKey === key)
+        .map((l) => ({ key: l.fromKey, title: idx.entries[l.fromKey]?.title }));
+    return {
+        key: e.key, title: e.title, type: e.type, version: e.currentVersion,
+        size: e.versions[e.versions.length - 1]?.size, tags: e.tags, isPinned: e.pinned,
+        agentId: e.agentId, updatedAt: e.updatedAt, content: readContent(cfg, e.dir, e.currentVersion),
+        linkedKeys, backlinks,
+    };
+}
+// ── list ──────────────────────────────────────────────────────────────────────
+function localVaultList(cfg, opts) {
+    const idx = readIndex(cfg);
+    let rows = Object.values(idx.entries).filter((e) => e.type !== "credential");
+    if (opts.type)
+        rows = rows.filter((e) => e.type === opts.type);
+    if (opts.agentId)
+        rows = rows.filter((e) => e.agentId === opts.agentId);
+    if (opts.pinned !== undefined)
+        rows = rows.filter((e) => e.pinned === opts.pinned);
+    rows.sort((a, b) => (Number(b.pinned) - Number(a.pinned)) || (b.updatedAt - a.updatedAt));
+    const entries = rows.slice(0, opts.limit ?? 50).map((e) => ({
+        key: e.key, title: e.title, type: e.type, version: e.currentVersion,
+        size: e.versions[e.versions.length - 1]?.size, updatedAt: e.updatedAt, isPinned: e.pinned,
+    }));
+    return { entries };
+}
+// ── search (full-text, local) ─────────────────────────────────────────────────
+function localVaultSearch(cfg, query, opts) {
+    const idx = readIndex(cfg);
+    const terms = query.toLowerCase().split(/\s+/).filter(Boolean);
+    const scored = [];
+    for (const e of Object.values(idx.entries)) {
+        if (e.type === "credential")
+            continue;
+        if (opts.type && e.type !== opts.type)
+            continue;
+        const content = readContent(cfg, e.dir, e.currentVersion);
+        const hay = `${e.title}\n${e.tags.join(" ")}\n${content}`.toLowerCase();
+        let score = 0;
+        for (const t of terms) {
+            if (e.title.toLowerCase().includes(t))
+                score += 3;
+            if (e.tags.some((tag) => tag.toLowerCase().includes(t)))
+                score += 2;
+            const occurrences = hay.split(t).length - 1;
+            score += Math.min(occurrences, 5);
+        }
+        if (score > 0) {
+            const firstHit = terms.map((t) => content.toLowerCase().indexOf(t)).filter((i) => i >= 0).sort((a, b) => a - b)[0] ?? 0;
+            scored.push({ e, score, preview: content.slice(Math.max(0, firstHit - 20), firstHit + 180).replace(/\n/g, " ") });
+        }
+    }
+    scored.sort((a, b) => b.score - a.score);
+    const results = scored.slice(0, opts.limit ?? 20).map(({ e, preview }) => ({
+        key: e.key, title: e.title, type: e.type, version: e.currentVersion, preview,
+    }));
+    return { results };
+}
+// ── history ───────────────────────────────────────────────────────────────────
+function localVaultHistory(cfg, key) {
+    const idx = readIndex(cfg);
+    const e = idx.entries[key];
+    if (!e)
+        throw notFound(key);
+    return {
+        key: e.key, title: e.title, currentVersion: e.currentVersion,
+        history: [...e.versions].sort((a, b) => b.version - a.version),
+    };
+}
+// ── diff ──────────────────────────────────────────────────────────────────────
+function lineDiff(a, b) {
+    const al = a.split("\n"), bl = b.split("\n");
+    const m = al.length, n = bl.length;
+    // LCS length table (bottom-up) - fine for the artifact sizes a vault holds.
+    const dp = Array.from({ length: m + 1 }, () => new Array(n + 1).fill(0));
+    for (let i = m - 1; i >= 0; i--)
+        for (let j = n - 1; j >= 0; j--)
+            dp[i][j] = al[i] === bl[j] ? dp[i + 1][j + 1] + 1 : Math.max(dp[i + 1][j], dp[i][j + 1]);
+    const out = [];
+    let i = 0, j = 0;
+    while (i < m && j < n) {
+        if (al[i] === bl[j]) {
+            out.push(`  ${al[i]}`);
+            i++;
+            j++;
+        }
+        else if (dp[i + 1][j] >= dp[i][j + 1]) {
+            out.push(`- ${al[i]}`);
+            i++;
+        }
+        else {
+            out.push(`+ ${bl[j]}`);
+            j++;
+        }
+    }
+    while (i < m)
+        out.push(`- ${al[i++]}`);
+    while (j < n)
+        out.push(`+ ${bl[j++]}`);
+    return out.join("\n");
+}
+function localVaultDiff(cfg, key, fromVersion, toVersion) {
+    const idx = readIndex(cfg);
+    const e = idx.entries[key];
+    if (!e)
+        throw notFound(key);
+    const has = (v) => e.versions.some((x) => x.version === v);
+    if (!has(fromVersion) || !has(toVersion)) {
+        throw new Error(`version range v${fromVersion}->v${toVersion} invalid for ${key}`);
+    }
+    const from = readContent(cfg, e.dir, fromVersion);
+    const to = readContent(cfg, e.dir, toVersion);
+    // The LCS diff is O(m*n) in memory - guard against a pathologically large
+    // multi-line entry blowing up the process instead of returning a diff.
+    const la = from.split("\n").length, lb = to.split("\n").length;
+    if (la * lb > 4000000) {
+        return { key, diff: `(v${fromVersion}: ${la} lines · v${toVersion}: ${lb} lines — too large for a line-by-line diff)` };
+    }
+    return { key, diff: lineDiff(from, to) };
+}
+// ── export ────────────────────────────────────────────────────────────────────
+function localVaultExport(cfg, type) {
+    const idx = readIndex(cfg);
+    let rows = Object.values(idx.entries).filter((e) => e.type !== "credential");
+    if (type)
+        rows = rows.filter((e) => e.type === type);
+    const entries = rows.map((e) => ({
+        key: e.key, title: e.title, type: e.type, version: e.currentVersion,
+        content: readContent(cfg, e.dir, e.currentVersion),
+    }));
+    return { exportedAt: now(), totalEntries: entries.length, entries };
+}
+// ── pin / delete / tag ────────────────────────────────────────────────────────
+function localVaultPin(cfg, key, pinned) {
+    const idx = readIndex(cfg);
+    const e = idx.entries[key];
+    if (!e)
+        throw notFound(key);
+    e.pinned = pinned;
+    writeIndex(cfg, idx);
+    return { pinned };
+}
+function localVaultDelete(cfg, key) {
+    const idx = readIndex(cfg);
+    const e = idx.entries[key];
+    if (!e)
+        throw notFound(key);
+    const versionsRemoved = e.versions.length;
+    try {
+        fs.rmSync(path.join(cfg.dir, "data", e.dir), { recursive: true, force: true });
+    }
+    catch { /* best effort */ }
+    delete idx.entries[key];
+    idx.links = idx.links.filter((l) => l.fromKey !== key && l.toKey !== key);
+    writeIndex(cfg, idx);
+    return { versionsRemoved };
+}
+function localVaultTag(cfg, key, tags, replace) {
+    const idx = readIndex(cfg);
+    const e = idx.entries[key];
+    if (!e)
+        throw notFound(key);
+    e.tags = replace ? Array.from(new Set(tags)) : Array.from(new Set([...e.tags, ...tags]));
+    e.updatedAt = now();
+    writeIndex(cfg, idx);
+    return { tags: e.tags };
+}
+// ── link / related ────────────────────────────────────────────────────────────
+function localVaultLink(cfg, fromKey, toKey, relation) {
+    const idx = readIndex(cfg);
+    if (!idx.entries[fromKey])
+        throw notFound(fromKey);
+    if (!idx.entries[toKey])
+        throw notFound(toKey);
+    const existing = idx.links.find((l) => l.fromKey === fromKey && l.toKey === toKey);
+    if (existing) {
+        existing.relation = relation;
+        writeIndex(cfg, idx);
+        return { updated: true };
+    }
+    idx.links.push({ fromKey, toKey, relation });
+    writeIndex(cfg, idx);
+    return { updated: false };
+}
+function localVaultRelated(cfg, key, relation) {
+    const idx = readIndex(cfg);
+    if (!idx.entries[key])
+        throw notFound(key);
+    const related = [];
+    for (const l of idx.links) {
+        if (relation && l.relation !== relation)
+            continue;
+        if (l.fromKey === key) {
+            const t = idx.entries[l.toKey];
+            if (t)
+                related.push({ key: l.toKey, title: t.title, type: t.type, relation: l.relation, direction: "→" });
+        }
+        else if (l.toKey === key) {
+            const f = idx.entries[l.fromKey];
+            if (f)
+                related.push({ key: l.fromKey, title: f.title, type: f.type, relation: l.relation, direction: "←" });
+        }
+    }
+    return { key, related };
+}
+// ── credentials (AES-256-GCM, key at ~/.finch/vault/.credkey, 0600) ─────────
+function credKeyPath(cfg) { return path.join(cfg.dir, ".credkey"); }
+function credStorePath(cfg) { return path.join(cfg.dir, "credentials.json"); }
+function getCredKey(cfg) {
+    ensureDir(cfg);
+    const p = credKeyPath(cfg);
+    try {
+        return Buffer.from(fs.readFileSync(p, "utf8").trim(), "hex");
+    }
+    catch {
+        const key = crypto.randomBytes(32);
+        fs.writeFileSync(p, key.toString("hex"), { mode: 0o600 });
+        return key;
+    }
+}
+function readCredStore(cfg) {
+    try {
+        return JSON.parse(fs.readFileSync(credStorePath(cfg), "utf8"));
+    }
+    catch {
+        return {};
+    }
+}
+function localVaultStoreCredential(cfg, name, value, description) {
+    const key = getCredKey(cfg);
+    const iv = crypto.randomBytes(12);
+    const cipher = crypto.createCipheriv("aes-256-gcm", key, iv);
+    const enc = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
+    const store = readCredStore(cfg);
+    store[name] = { iv: iv.toString("hex"), tag: cipher.getAuthTag().toString("hex"), data: enc.toString("hex"), description, storedAt: new Date(now()).toUTCString() };
+    fs.writeFileSync(credStorePath(cfg), JSON.stringify(store, null, 2), { mode: 0o600 });
+    return { name, key: `credential/${name}` };
+}
+function localVaultGetCredential(cfg, name) {
+    const store = readCredStore(cfg);
+    const rec = store[name];
+    if (!rec)
+        throw notFound(`credential ${name}`);
+    const key = getCredKey(cfg);
+    const decipher = crypto.createDecipheriv("aes-256-gcm", key, Buffer.from(rec.iv, "hex"));
+    decipher.setAuthTag(Buffer.from(rec.tag, "hex"));
+    const dec = Buffer.concat([decipher.update(Buffer.from(rec.data, "hex")), decipher.final()]).toString("utf8");
+    return { name, value: dec, description: rec.description, storedAt: rec.storedAt };
+}