@nomix-ai/nomix-harness 0.2.4 → 0.2.6

package/dist/kernel/cosmokit/lib/types/string.d.ts

@@ -0,0 +1,89 @@
+/** Uppercase the first character of a string. */
+export declare function capitalize(source: string): string;
+/** Lowercase the first character of a string. */
+export declare function uncapitalize(source: string): string;
+/** Convert dash or underscore delimited text to camelCase. */
+export declare function camelCase(source: string): string;
+/** Convert text to dash-delimited parameter case. */
+export declare function paramCase(source: string): string;
+/** Convert text to underscore-delimited snake case. */
+export declare function snakeCase(source: string): string;
+/** Runtime alias for `camelCase`. */
+export declare const camelize: typeof camelCase;
+/** Runtime alias for `paramCase`. */
+export declare const hyphenate: typeof paramCase;
+declare namespace Letter {
+    interface LowerToUpper {
+        a: 'A';
+        b: 'B';
+        c: 'C';
+        d: 'D';
+        e: 'E';
+        f: 'F';
+        g: 'G';
+        h: 'H';
+        i: 'I';
+        j: 'J';
+        k: 'K';
+        l: 'L';
+        m: 'M';
+        n: 'N';
+        o: 'O';
+        p: 'P';
+        q: 'Q';
+        r: 'R';
+        s: 'S';
+        t: 'T';
+        u: 'U';
+        v: 'V';
+        w: 'W';
+        x: 'X';
+        y: 'Y';
+        z: 'Z';
+    }
+    interface UpperToLower {
+        A: 'a';
+        B: 'b';
+        C: 'c';
+        D: 'd';
+        E: 'e';
+        F: 'f';
+        G: 'g';
+        H: 'h';
+        I: 'i';
+        J: 'j';
+        K: 'k';
+        L: 'l';
+        M: 'm';
+        N: 'n';
+        O: 'o';
+        P: 'p';
+        Q: 'q';
+        R: 'r';
+        S: 's';
+        T: 't';
+        U: 'u';
+        V: 'v';
+        W: 'w';
+        X: 'x';
+        Y: 'y';
+        Z: 'z';
+    }
+    export type Upper = keyof UpperToLower;
+    export type Lower = keyof LowerToUpper;
+    export type ToUpper<S extends string> = S extends Lower ? LowerToUpper[S] : S;
+    export type ToLower<S extends string, P extends string = ''> = S extends Upper ? `${P}${UpperToLower[S]}` : S;
+    export {};
+}
+/** Type-level conversion from dash-delimited text to camelCase. */
+export type camelize<S extends string> = S extends `${infer L}-${infer M}${infer R}` ? `${L}${Letter.ToUpper<M>}${camelize<R>}` : S;
+/** Type-level conversion from camelCase text to dash-delimited text. */
+export type hyphenate<S extends string> = S extends `${infer L}${infer R}` ? `${Letter.ToLower<L, '-'>}${hyphenate<R>}` : S;
+/** Format a property key as a JavaScript member access suffix. */
+export declare function formatProperty(key: keyof any): string;
+/** Remove one trailing slash from a path string. */
+export declare function trimSlash(source: string): string;
+/** Ensure a path starts with `/` and has no trailing slash. */
+export declare function sanitize(source: string): string;
+export {};
+//# sourceMappingURL=string.d.ts.map

package/dist/kernel/cosmokit/lib/types/string.js

@@ -0,0 +1,79 @@
+/** Uppercase the first character of a string. */
+export function capitalize(source) {
+    return source.charAt(0).toUpperCase() + source.slice(1);
+}
+/** Lowercase the first character of a string. */
+export function uncapitalize(source) {
+    return source.charAt(0).toLowerCase() + source.slice(1);
+}
+/** Convert dash or underscore delimited text to camelCase. */
+export function camelCase(source) {
+    return source.replace(/[_-][a-z]/g, str => str.slice(1).toUpperCase());
+}
+function tokenize(source, delimiters, delimiter) {
+    const output = [];
+    let state = 0 /* State.DELIM */;
+    for (let i = 0; i < source.length; i++) {
+        const code = source.charCodeAt(i);
+        if (code >= 65 && code <= 90) {
+            if (state === 1 /* State.UPPER */) {
+                const next = source.charCodeAt(i + 1);
+                if (next >= 97 && next <= 122) {
+                    output.push(delimiter);
+                }
+                output.push(code + 32);
+            }
+            else {
+                if (state !== 0 /* State.DELIM */) {
+                    output.push(delimiter);
+                }
+                output.push(code + 32);
+            }
+            state = 1 /* State.UPPER */;
+        }
+        else if (code >= 97 && code <= 122) {
+            output.push(code);
+            state = 2 /* State.LOWER */;
+        }
+        else if (delimiters.includes(code)) {
+            if (state !== 0 /* State.DELIM */) {
+                output.push(delimiter);
+            }
+            state = 0 /* State.DELIM */;
+        }
+        else {
+            output.push(code);
+        }
+    }
+    return String.fromCharCode(...output);
+}
+/** Convert text to dash-delimited parameter case. */
+export function paramCase(source) {
+    return tokenize(source, [45, 95], 45);
+}
+/** Convert text to underscore-delimited snake case. */
+export function snakeCase(source) {
+    return tokenize(source, [45, 95], 95);
+}
+/** Runtime alias for `camelCase`. */
+export const camelize = camelCase;
+/** Runtime alias for `paramCase`. */
+export const hyphenate = paramCase;
+/* eslint-enable @typescript-eslint/naming-convention */
+/** Format a property key as a JavaScript member access suffix. */
+export function formatProperty(key) {
+    if (typeof key !== 'string')
+        return `[${key.toString()}]`;
+    return /^[a-z_$][\w$]*$/i.test(key) ? `.${key}` : `[${JSON.stringify(key)}]`;
+}
+/** Remove one trailing slash from a path string. */
+export function trimSlash(source) {
+    return source.replace(/\/$/, '');
+}
+/** Ensure a path starts with `/` and has no trailing slash. */
+export function sanitize(source) {
+    if (!source.startsWith('/'))
+        source = '/' + source;
+    return trimSlash(source);
+}
+//# sourceMappingURL=string.js.map

package/dist/kernel/cosmokit/lib/types/time.d.ts

@@ -0,0 +1,19 @@
+/** Time constants plus parsing and formatting helpers. */
+export declare namespace Time {
+    const millisecond = 1;
+    const second = 1000;
+    const minute: number;
+    const hour: number;
+    const day: number;
+    const week: number;
+    function setTimezoneOffset(offset: number): void;
+    function getTimezoneOffset(): number;
+    function getDateNumber(date?: number | Date, offset?: number): number;
+    function fromDateNumber(value: number, offset?: number): Date;
+    function parseTime(source: string): number;
+    function parseDate(date: string): Date;
+    function format(ms: number): string;
+    function toDigits(source: number, length?: number): string;
+    function template(template: string, time?: Date): string;
+}
+//# sourceMappingURL=time.d.ts.map

package/dist/kernel/cosmokit/lib/types/time.js

@@ -0,0 +1,101 @@
+/** Time constants plus parsing and formatting helpers. */
+export var Time;
+(function (Time) {
+    Time.millisecond = 1;
+    Time.second = 1000;
+    Time.minute = Time.second * 60;
+    Time.hour = Time.minute * 60;
+    Time.day = Time.hour * 24;
+    Time.week = Time.day * 7;
+    let timezoneOffset = new Date().getTimezoneOffset();
+    function setTimezoneOffset(offset) {
+        timezoneOffset = offset;
+    }
+    Time.setTimezoneOffset = setTimezoneOffset;
+    function getTimezoneOffset() {
+        return timezoneOffset;
+    }
+    Time.getTimezoneOffset = getTimezoneOffset;
+    function getDateNumber(date = new Date(), offset) {
+        if (typeof date === 'number')
+            date = new Date(date);
+        if (offset === undefined)
+            offset = timezoneOffset;
+        return Math.floor((date.valueOf() / Time.minute - offset) / 1440);
+    }
+    Time.getDateNumber = getDateNumber;
+    function fromDateNumber(value, offset) {
+        const date = new Date(value * Time.day);
+        if (offset === undefined)
+            offset = timezoneOffset;
+        return new Date(+date + offset * Time.minute);
+    }
+    Time.fromDateNumber = fromDateNumber;
+    const numeric = /\d+(?:\.\d+)?/.source;
+    const timeRegExp = new RegExp(`^${[
+        'w(?:eek(?:s)?)?',
+        'd(?:ay(?:s)?)?',
+        'h(?:our(?:s)?)?',
+        'm(?:in(?:ute)?(?:s)?)?',
+        's(?:ec(?:ond)?(?:s)?)?',
+    ].map(unit => `(${numeric}${unit})?`).join('')}$`);
+    function parseTime(source) {
+        const capture = timeRegExp.exec(source);
+        if (!capture)
+            return 0;
+        return (parseFloat(capture[1]) * Time.week || 0)
+            + (parseFloat(capture[2]) * Time.day || 0)
+            + (parseFloat(capture[3]) * Time.hour || 0)
+            + (parseFloat(capture[4]) * Time.minute || 0)
+            + (parseFloat(capture[5]) * Time.second || 0);
+    }
+    Time.parseTime = parseTime;
+    function parseDate(date) {
+        const parsed = parseTime(date);
+        if (parsed) {
+            date = Date.now() + parsed;
+        }
+        else if (/^\d{1,2}(:\d{1,2}){1,2}$/.test(date)) {
+            date = `${new Date().toLocaleDateString()}-${date}`;
+        }
+        else if (/^\d{1,2}-\d{1,2}-\d{1,2}(:\d{1,2}){1,2}$/.test(date)) {
+            date = `${new Date().getFullYear()}-${date}`;
+        }
+        return date ? new Date(date) : new Date();
+    }
+    Time.parseDate = parseDate;
+    function format(ms) {
+        const abs = Math.abs(ms);
+        if (abs >= Time.day - Time.hour / 2) {
+            return Math.round(ms / Time.day) + 'd';
+        }
+        else if (abs >= Time.hour - Time.minute / 2) {
+            return Math.round(ms / Time.hour) + 'h';
+        }
+        else if (abs >= Time.minute - Time.second / 2) {
+            return Math.round(ms / Time.minute) + 'm';
+        }
+        else if (abs >= Time.second) {
+            return Math.round(ms / Time.second) + 's';
+        }
+        return ms + 'ms';
+    }
+    Time.format = format;
+    function toDigits(source, length = 2) {
+        return source.toString().padStart(length, '0');
+    }
+    Time.toDigits = toDigits;
+    function template(template, time = new Date()) {
+        return template
+            .replace('yyyy', time.getFullYear().toString())
+            .replace('yy', time.getFullYear().toString().slice(2))
+            .replace('MM', toDigits(time.getMonth() + 1))
+            .replace('dd', toDigits(time.getDate()))
+            .replace('hh', toDigits(time.getHours()))
+            .replace('mm', toDigits(time.getMinutes()))
+            .replace('ss', toDigits(time.getSeconds()))
+            .replace('SSS', toDigits(time.getMilliseconds(), 3));
+    }
+    Time.template = template;
+})(Time || (Time = {}));
+//# sourceMappingURL=time.js.map

package/dist/kernel/cosmokit/lib/types/types.d.ts

@@ -0,0 +1,34 @@
+type GlobalConstructorNames = keyof {
+    [K in keyof typeof globalThis as typeof globalThis[K] extends abstract new (...args: any) => any ? K : never]: K;
+};
+/** Create a predicate for a global constructor name. */
+export declare function is<K extends GlobalConstructorNames>(type: K): (value: any) => value is InstanceType<typeof globalThis[K]>;
+/** Test whether a value matches a global constructor name. */
+export declare function is<K extends GlobalConstructorNames>(type: K, value: any): value is InstanceType<typeof globalThis[K]>;
+declare function isArrayBufferLike(value: any): value is ArrayBufferLike;
+declare function isArrayBufferSource(value: any): value is Binary.Source;
+/** Binary source detection and base64/hex conversion helpers. */
+export declare namespace Binary {
+    type Source<T extends ArrayBufferLike = ArrayBufferLike> = T | ArrayBufferView<T>;
+    const is: typeof isArrayBufferLike;
+    const isSource: typeof isArrayBufferSource;
+    function fromSource<T extends ArrayBufferLike>(source: Source<T>): T;
+    function toBase64(source: Source): string;
+    function fromBase64(source: string): ArrayBuffer | Uint8Array<ArrayBuffer>;
+    function toHex(source: Source): string;
+    function fromHex(source: string): ArrayBuffer;
+}
+/** Decode a base64 string into binary data. */
+export declare const base64ToArrayBuffer: typeof Binary.fromBase64;
+/** Encode binary data as base64. */
+export declare const arrayBufferToBase64: typeof Binary.toBase64;
+/** Decode a hex string into binary data. */
+export declare const hexToArrayBuffer: typeof Binary.fromHex;
+/** Encode binary data as hex. */
+export declare const arrayBufferToHex: typeof Binary.toHex;
+/** Deep-clone common JavaScript values while preserving prototypes. */
+export declare function clone<T>(source: T): T;
+/** Deeply compare arrays, dates, regexps, buffers, and plain object fields. */
+export declare function deepEqual(a: any, b: any, strict?: boolean): boolean;
+export {};
+//# sourceMappingURL=types.d.ts.map

package/dist/kernel/cosmokit/lib/types/types.js

@@ -0,0 +1,141 @@
+import { isNullable } from "./misc.js";
+/** Test values using `instanceof` with a `toStringTag` fallback. */
+export function is(type, value) {
+    if (arguments.length === 1)
+        return (value) => is(type, value);
+    return type in globalThis && value instanceof globalThis[type]
+        || Object.prototype.toString.call(value).slice(8, -1) === type;
+}
+function isArrayBufferLike(value) {
+    return is('ArrayBuffer', value) || is('SharedArrayBuffer', value);
+}
+function isArrayBufferSource(value) {
+    return isArrayBufferLike(value) || ArrayBuffer.isView(value);
+}
+/** Binary source detection and base64/hex conversion helpers. */
+export var Binary;
+(function (Binary) {
+    Binary.is = isArrayBufferLike;
+    Binary.isSource = isArrayBufferSource;
+    function fromSource(source) {
+        if (ArrayBuffer.isView(source)) {
+            // https://stackoverflow.com/questions/8609289/convert-a-binary-nodejs-buffer-to-javascript-arraybuffer#answer-31394257
+            return source.buffer.slice(source.byteOffset, source.byteOffset + source.byteLength);
+        }
+        else {
+            return source;
+        }
+    }
+    Binary.fromSource = fromSource;
+    function toBase64(source) {
+        source = fromSource(source);
+        if (typeof Buffer !== 'undefined') {
+            return Buffer.from(source).toString('base64');
+        }
+        let binary = '';
+        const bytes = new Uint8Array(source);
+        for (let i = 0; i < bytes.byteLength; i++) {
+            binary += String.fromCharCode(bytes[i]);
+        }
+        return btoa(binary);
+    }
+    Binary.toBase64 = toBase64;
+    function fromBase64(source) {
+        if (typeof Buffer !== 'undefined')
+            return fromSource(Buffer.from(source, 'base64'));
+        return Uint8Array.from(atob(source), c => c.charCodeAt(0));
+    }
+    Binary.fromBase64 = fromBase64;
+    function toHex(source) {
+        source = fromSource(source);
+        if (typeof Buffer !== 'undefined')
+            return Buffer.from(source).toString('hex');
+        return Array.from(new Uint8Array(source), byte => byte.toString(16).padStart(2, '0')).join('');
+    }
+    Binary.toHex = toHex;
+    function fromHex(source) {
+        if (typeof Buffer !== 'undefined')
+            return fromSource(Buffer.from(source, 'hex'));
+        const hex = source.length % 2 === 0 ? source : source.slice(0, source.length - 1);
+        const buffer = [];
+        for (let i = 0; i < hex.length; i += 2) {
+            buffer.push(parseInt(`${hex[i]}${hex[i + 1]}`, 16));
+        }
+        return Uint8Array.from(buffer).buffer;
+    }
+    Binary.fromHex = fromHex;
+})(Binary || (Binary = {}));
+/** Decode a base64 string into binary data. */
+export const base64ToArrayBuffer = Binary.fromBase64;
+/** Encode binary data as base64. */
+export const arrayBufferToBase64 = Binary.toBase64;
+/** Decode a hex string into binary data. */
+export const hexToArrayBuffer = Binary.fromHex;
+/** Encode binary data as hex. */
+export const arrayBufferToHex = Binary.toHex;
+/** Deep-clone common JavaScript values while preserving prototypes and cycles. */
+export function clone(source, refs = new Map()) {
+    if (!source || typeof source !== 'object')
+        return source;
+    if (is('Date', source))
+        return new Date(source.valueOf());
+    if (is('RegExp', source))
+        return new RegExp(source.source, source.flags);
+    if (isArrayBufferLike(source))
+        return source.slice(0);
+    if (ArrayBuffer.isView(source))
+        return source.buffer.slice(source.byteOffset, source.byteOffset + source.byteLength);
+    const cached = refs.get(source);
+    if (cached)
+        return cached;
+    if (Array.isArray(source)) {
+        const result = [];
+        refs.set(source, result);
+        source.forEach((value, index) => {
+            result[index] = Reflect.apply(clone, null, [value, refs]);
+        });
+        return result;
+    }
+    const result = Object.create(Object.getPrototypeOf(source));
+    refs.set(source, result);
+    for (const key of Reflect.ownKeys(source)) {
+        const descriptor = { ...Reflect.getOwnPropertyDescriptor(source, key) };
+        if ('value' in descriptor) {
+            descriptor.value = Reflect.apply(clone, null, [descriptor.value, refs]);
+        }
+        Reflect.defineProperty(result, key, descriptor);
+    }
+    return result;
+}
+/** Deeply compare arrays, dates, regexps, buffers, and plain object fields. */
+export function deepEqual(a, b, strict) {
+    if (a === b)
+        return true;
+    if (!strict && isNullable(a) && isNullable(b))
+        return true;
+    if (typeof a !== typeof b)
+        return false;
+    if (typeof a !== 'object')
+        return false;
+    if (!a || !b)
+        return false;
+    function check(test, then) {
+        return test(a) ? test(b) ? then(a, b) : false : test(b) ? false : undefined;
+    }
+    return check(Array.isArray, (a, b) => a.length === b.length && a.every((item, index) => deepEqual(item, b[index])))
+        ?? check(is('Date'), (a, b) => a.valueOf() === b.valueOf())
+        ?? check(is('RegExp'), (a, b) => a.source === b.source && a.flags === b.flags)
+        ?? check(isArrayBufferLike, (a, b) => {
+            if (a.byteLength !== b.byteLength)
+                return false;
+            const viewA = new Uint8Array(a);
+            const viewB = new Uint8Array(b);
+            for (let i = 0; i < viewA.length; i++) {
+                if (viewA[i] !== viewB[i])
+                    return false;
+            }
+            return true;
+        })
+        ?? Object.keys({ ...a, ...b }).every(key => deepEqual(a[key], b[key], strict));
+}
+//# sourceMappingURL=types.js.map

package/dist/kernel/cosmokit/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@nomix-ai/cosmokit",
+  "description": "A collection of common utilities",
+  "version": "1.8.2",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ditgaldev/nomix-harness.git",
+    "directory": "vendor/cosmokit"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./src/*": "./src/*",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib/index.js",
+    "lib/types/**/*.d.ts",
+    "lib/types/**/*.d.ts.map",
+    "src"
+  ],
+  "author": "Shigma <shigma10826@gmail.com>",
+  "license": "MIT"
+}

package/dist/kernel/credentials/lib/index.js

@@ -1,4 +1,4 @@
-import { Service } from "@nomix-ai/cordis";
+import { Service } from "../../cordis/lib/index.js";
 //#region lib/types/index.js
 /**
 * Service Definition for the credential-reference capability seam (`ctx.credentials`). Settings and composition files carry
@@ -10,27 +10,106 @@ import { Service } from "@nomix-ai/cordis";
 * @module @nomix-ai/nomix-credentials
 */
 const REF_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Both halves of a {@link CredentialKey}; the `/` between them is what keeps it out of {@link REF_PATTERN}. */
+const KEY_SEGMENT_PATTERN = /^[a-z][a-z0-9-]*$/;
 /**
 * Brand a raw string as a {@link CredentialRef}.
 * @param value - candidate reference; a POSIX shell identifier such as `DEEPSEEK_API_KEY`.
 * @returns the branded reference.
 */
 function credentialRef(value) {
-	if (!REF_PATTERN.test(value)) throw new TypeError(`credential ref "${value}" must match ${String(REF_PATTERN)}`);
+	if (!isCredentialRefName(value)) throw new TypeError(`credential ref "${value}" must match ${String(REF_PATTERN)}`);
 	return value;
 }
 /**
-* Abstract credential service. Providers implement the four operations over
-* their source layers; one seam-wide rule binds them all: an empty stored
-* value is absent everywhere — `resolve` skips it, `describe` reports it
-* unconfigured — so a blank never masquerades as a configured secret.
+* Whether a raw string could name a reference at all. Consumers that receive
+* environment-variable names from somewhere else — a provider library's own
+* ambient discovery, a hook payload — ask this before resolving, because a name
+* outside the grammar has no reference to miss and should read as "not set"
+* rather than as a thrown error.
+* @param value - candidate reference.
+* @returns true when {@link credentialRef} would accept it.
+*/
+function isCredentialRefName(value) {
+	return REF_PATTERN.test(value);
+}
+/**
+* Whether a raw string could be a {@link credentialKey} segment at all.
+* Consumers whose addressing units come from somewhere else — a settings dict
+* key, a library's own provider id — ask this before building a key, because a
+* unit outside the grammar can never have stored a record and should read as
+* "nothing stored" rather than as a thrown error.
+* @param value - candidate segment.
+* @returns true when {@link credentialKey} would accept it as either segment.
+*/
+function isCredentialKeySegment(value) {
+	return KEY_SEGMENT_PATTERN.test(value);
+}
+/**
+* Brand a scope and an id as a {@link CredentialKey}.
+* @param scope - the owning plugin's registered name, such as `llm-pi-ai`.
+* @param id - that plugin's own addressing unit, such as a provider route key.
+* @returns the branded key.
+* @throws TypeError when either segment is not a lowercase hyphenated identifier.
+*/
+function credentialKey(scope, id) {
+	for (const segment of [scope, id]) if (!KEY_SEGMENT_PATTERN.test(segment)) throw new TypeError(`credential key segment "${segment}" must match ${String(KEY_SEGMENT_PATTERN)}`);
+	return `${scope}/${id}`;
+}
+/**
+* Brand a stored `<scope>/<id>` string as a {@link CredentialKey}. This is the
+* read half of {@link credentialKey}, for a provider admitting keys off disk.
+* @param value - candidate key in its joined form.
+* @returns the branded key.
+* @throws TypeError when the value is not exactly two valid segments.
+*/
+function parseCredentialKey(value) {
+	const segments = value.split("/");
+	const [scope, id] = segments;
+	if (segments.length !== 2 || scope === void 0 || id === void 0) throw new TypeError(`credential key "${value}" must be "<scope>/<id>"`);
+	return credentialKey(scope, id);
+}
+/**
+* The owning plugin's name for one key. A record whose scope names no
+* currently registered owner is an orphan, which a configuration surface must
+* report as such rather than as a working credential.
+* @param key - the key to read.
+* @returns the scope segment.
+*/
+function credentialKeyScope(key) {
+	return key.slice(0, key.indexOf("/"));
+}
+/**
+* The owning plugin's own addressing unit for one key — the half that plugin
+* chose, such as a provider route.
+* @param key - the key to read.
+* @returns the id segment.
+*/
+function credentialKeyId(key) {
+	return key.slice(key.indexOf("/") + 1);
+}
+/**
+* Abstract credential service over two key spaces that answer two questions.
+*
+* A {@link CredentialRef} answers "what is behind this environment-variable
+* name", layered over the process environment, the provider-managed store, and
+* `.env` files. One seam-wide rule binds that half: an empty stored value is
+* absent everywhere — `resolve` skips it, `describe` reports it unconfigured —
+* so a blank never masquerades as a configured secret.
+*
+* A {@link CredentialKey} answers "what credential does this plugin hold for
+* this id". Nothing can layer here — an authorization grant has no
+* environment to be read from — so presence of the record is the whole fact,
+* and {@link modifyRecord} is the only write path because a correct write
+* depends on the current value (a token refresh is read-decide-replace under
+* one lock).
 */
 var CredentialProvider = class extends Service {
 	constructor(ctx) {
 		super(ctx, "credentials");
 	}
 	/**
-	* Fan `credentials/updated` out with contained listener failures: every
+	* Fan `credentials/reference-updated` out with contained listener failures: every
 	* listener runs, and a sync throw or async rejection is logged without
 	* changing the committed operation's outcome — except `INVARIANT`-coded
 	* failures, which rethrow after every listener ran (the rethrow reaches the
@@ -41,27 +120,39 @@ var CredentialProvider = class extends Service {
 	* @param ref - the reference whose stored value changed.
 	*/
 	notifyUpdated(ref) {
+		this.fanOut("credentials/reference-updated", ref);
+	}
+	/**
+	* Fan `credentials/record-updated` out on exactly the terms
+	* {@link notifyUpdated} documents, for the record half of the seam.
+	* @param key - the record whose stored value changed.
+	*/
+	notifyRecordUpdated(key) {
+		this.fanOut("credentials/record-updated", key);
+	}
+	/** The contained dispatch both notifications run through; see {@link notifyUpdated}. */
+	fanOut(event, subject) {
 		let invariantFailure;
-		const args = ["credentials/updated", ref];
+		const args = [event, subject];
 		for (const listener of this.ctx.events.dispatch("emit", args)) try {
-			const returned = listener(ref);
+			const returned = listener(subject);
 			if (returned != null && typeof returned.then === "function") Promise.resolve(returned).then(void 0, (error) => {
-				this.warnListenerFailure(ref, error);
+				this.warnListenerFailure(event, subject, error);
 			});
 		} catch (error) {
 			if (error?.code === "INVARIANT") {
 				invariantFailure ??= error;
 				continue;
 			}
-			this.warnListenerFailure(ref, error);
+			this.warnListenerFailure(event, subject, error);
 		}
 		if (invariantFailure !== void 0) throw invariantFailure;
 	}
 	/** Contained-listener diagnostic shared by the sync and async failure paths. */
-	warnListenerFailure(ref, error) {
-		this.ctx.logger.warn("credentials: a credentials/updated listener for \"%s\" failed", ref);
+	warnListenerFailure(event, subject, error) {
+		this.ctx.logger.warn("credentials: a %s listener for \"%s\" failed", event, subject);
 		this.ctx.logger.warn(error);
 	}
 };
 //#endregion
-export { CredentialProvider, CredentialProvider as default, credentialRef };
+export { CredentialProvider, CredentialProvider as default, credentialKey, credentialKeyId, credentialKeyScope, credentialRef, isCredentialKeySegment, isCredentialRefName, parseCredentialKey };