@ouro.bot/cli 0.1.0-alpha.464 → 0.1.0-alpha.466

package/README.md

@@ -180,6 +180,9 @@ ouro vault unlock --agent <name>
 ouro vault status --agent <name>
 ouro vault config set --agent <name> --key teams.clientSecret
 ouro vault config status --agent <name> --scope all
+ouro vault item set --agent <name> --item <path> --secret-field <field>
+ouro vault item status --agent <name> --item <path>
+ouro vault ops porkbun set --agent <name> --account <account>
 ouro connect --agent <name>
 ouro connect providers --agent <name>
 ouro connect perplexity --agent <name>
@@ -207,6 +210,8 @@ ouro mcp-serve --agent <name>             # start MCP server on stdin/stdout (us
 ouro hook <event> --agent <name>          # fire a lifecycle hook (SessionStart, Stop, PostToolUse)
 ```
 
+The generic secret primitive is a vault item / credential in the owning agent vault: stable item name/path, hidden secret material, optional public fields, notes, timestamps/provenance, and no assumed use. `ouro connect` is for harness-managed workflows; workflow bindings reference ordinary vault items when they need secret material.
+
 ## Setting Up On Another Machine
 
 To clone an existing agent onto a new machine (macOS, Linux, or Windows via WSL2), see **[docs/cross-machine-setup.md](docs/cross-machine-setup.md)**. The short version is bundle plus vault: `npx ouro.bot@latest`, open the home deck, choose clone, enter the bundle's git remote URL, unlock the agent vault, refresh/verify credentials, and start with `ouro up`.

package/changelog.json

@@ -1,6 +1,22 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.466",
+      "changes": [
+        "`ouro vault item set/status/list` is now the generic human-facing path for storing ordinary agent-owned vault items with hidden secret fields, optional public fields, freeform notes, metadata-only status/list output, and no assumed provider semantics.",
+        "`ouro vault ops porkbun` remains as a deprecated compatibility alias over ordinary vault items, while docs and help teach vault item -> managed workflow -> non-secret binding instead of treating Porkbun, DNS, or ops credentials as separate credential species.",
+        "Vault item guardrails now keep harness-managed provider/runtime items on `ouro auth`, `ouro connect`, and `ouro vault config`, and coverage locks no-secret logging, notes-as-orientation, reserved item errors, compatibility behavior, and 100% branch coverage for the new surface."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.465",
+      "changes": [
+        "`ouro vault ops porkbun set` now stores account-scoped Porkbun API credentials in the owning agent vault through hidden prompts, outside the connect bay and runtime/config.",
+        "Porkbun ops credentials are named by their true authority boundary at `ops/registrars/porkbun/accounts/<account>`, so multiple Porkbun accounts can coexist and domain allowlists remain separate.",
+        "Auth/provider docs now clarify that `ouro connect` is only for harness-managed capabilities, while registrar and deployment credentials belong in explicit `ops/...` vault items."
+      ]
+    },
     {
       "version": "0.1.0-alpha.464",
       "changes": [

package/dist/heart/daemon/cli-exec.js

@@ -103,6 +103,7 @@ const provider_ping_1 = require("../provider-ping");
 const agent_discovery_1 = require("./agent-discovery");
 const connect_bay_1 = require("./connect-bay");
 const runtime_capability_check_1 = require("../runtime-capability-check");
+const vault_items_1 = require("./vault-items");
 // ── ensureDaemonRunning ──
 const DEFAULT_DAEMON_STARTUP_TIMEOUT_MS = 60_000;
 const DEFAULT_DAEMON_STARTUP_POLL_INTERVAL_MS = 500;
@@ -325,6 +326,9 @@ function agentResolutionFailureMode(command) {
         case "vault.status":
         case "vault.config.set":
         case "vault.config.status":
+        case "vault.item.set":
+        case "vault.item.status":
+        case "vault.item.list":
         case "connect":
         case "account.ensure":
         case "mail.import-mbox":
@@ -2009,6 +2013,170 @@ async function executeVaultConfigStatus(command, deps) {
     deps.writeStdout(message);
     return message;
 }
+function parseVaultItemPublicFields(fields) {
+    const parsed = {};
+    for (const field of fields ?? []) {
+        const separator = field.indexOf("=");
+        const key = (0, vault_items_1.normalizeVaultItemFieldName)(field.slice(0, separator));
+        parsed[key] = field.slice(separator + 1);
+    }
+    return parsed;
+}
+function uniqueVaultItemSecretFields(command) {
+    const fields = command.template ? (0, vault_items_1.vaultItemTemplateSecretFields)(command.template) : [];
+    for (const field of command.secretFields ?? []) {
+        if (!fields.includes(field))
+            fields.push(field);
+    }
+    return fields;
+}
+function vaultItemCompatibilityNotice(command) {
+    if (command.compatibilityAlias !== vault_items_1.PORKBUN_OPS_COMPATIBILITY_ALIAS)
+        return [];
+    return ["deprecated compatibility alias: use ouro vault item set --template porkbun-api"];
+}
+function freeformVaultItemReservedMessage(itemName) {
+    if (itemName.startsWith("providers/")) {
+        return `Vault item "${itemName}" is reserved for harness-managed workflows. Use ouro auth or ouro connect for provider credentials.`;
+    }
+    if (itemName === "runtime/config" || /^runtime\/machines\/[^/]+\/config$/.test(itemName)) {
+        return `Vault item "${itemName}" is reserved for harness-managed workflows. Use ouro connect or ouro vault config for runtime and sense configuration.`;
+    }
+    return undefined;
+}
+function assertFreeformVaultItemWritable(itemName) {
+    const reservedMessage = freeformVaultItemReservedMessage(itemName);
+    if (reservedMessage)
+        throw new Error(reservedMessage);
+}
+function porkbunAccountForCompatibility(command) {
+    if (command.compatibilityAlias !== vault_items_1.PORKBUN_OPS_COMPATIBILITY_ALIAS)
+        return undefined;
+    return (0, vault_items_1.normalizePorkbunOpsAccount)((0, vault_items_1.porkbunOpsAccountFromItemName)(command.item));
+}
+const PORKBUN_OPS_PROMPT_LABELS = {
+    apiKey: (account) => `Porkbun API key for ${account}: `,
+    secretApiKey: (account) => `Porkbun Secret API key for ${account}: `,
+};
+const PORKBUN_OPS_VALIDATION_LABELS = {
+    apiKey: "Porkbun API key",
+    secretApiKey: "Porkbun Secret API key",
+};
+function vaultItemTemplatePromptLabel(command, field, account) {
+    if (command.compatibilityAlias === vault_items_1.PORKBUN_OPS_COMPATIBILITY_ALIAS) {
+        return PORKBUN_OPS_PROMPT_LABELS[field](account);
+    }
+    return `Secret field ${field} for ${command.item}: `;
+}
+function vaultItemSecretValidationLabel(command, field) {
+    if (command.compatibilityAlias === vault_items_1.PORKBUN_OPS_COMPATIBILITY_ALIAS) {
+        return PORKBUN_OPS_VALIDATION_LABELS[field];
+    }
+    return `Secret field ${field}`;
+}
+async function executeVaultItemSet(command, deps) {
+    if (command.agent === "SerpentGuide") {
+        throw new Error("SerpentGuide has no persistent credential vault. Store vault items in the owning agent vault.");
+    }
+    if (!command.compatibilityAlias)
+        assertFreeformVaultItemWritable(command.item);
+    const account = porkbunAccountForCompatibility(command);
+    const promptSecret = requirePromptSecret(deps, command.compatibilityAlias === vault_items_1.PORKBUN_OPS_COMPATIBILITY_ALIAS ? "Porkbun ops credential entry" : "Vault item secret entry");
+    const secretFieldNames = uniqueVaultItemSecretFields(command);
+    const publicFields = parseVaultItemPublicFields(command.publicFields);
+    if (account && !publicFields.account)
+        publicFields.account = account;
+    const secretFields = {};
+    for (const field of secretFieldNames) {
+        const normalized = (0, vault_items_1.normalizeVaultItemFieldName)(field);
+        const value = await promptSecret(vaultItemTemplatePromptLabel(command, normalized, account));
+        secretFields[normalized] = (0, vault_items_1.requireVaultItemSecret)(value, vaultItemSecretValidationLabel(command, normalized));
+    }
+    const payload = {
+        schemaVersion: 1,
+        updatedAt: providerCliNow(deps).toISOString(),
+        publicFields,
+        secretFields,
+    };
+    const progress = createHumanCommandProgress(deps, command.compatibilityAlias === vault_items_1.PORKBUN_OPS_COMPATIBILITY_ALIAS ? "vault ops porkbun" : "vault item set");
+    try {
+        await runCommandProgressPhase(progress, command.compatibilityAlias === vault_items_1.PORKBUN_OPS_COMPATIBILITY_ALIAS ? "storing ordinary vault item" : "storing vault item", async () => {
+            const store = (0, credential_access_1.getCredentialStore)(command.agent);
+            await store.store(command.item, {
+                ...(account ? { username: account } : {}),
+                password: JSON.stringify(payload),
+                ...(command.note !== undefined
+                    ? { notes: command.note }
+                    : command.compatibilityAlias === vault_items_1.PORKBUN_OPS_COMPATIBILITY_ALIAS
+                        ? { notes: "Ordinary vault item written by a deprecated Porkbun compatibility alias. Notes are for human/agent orientation only; workflow bindings live outside this item." }
+                        : {}),
+            });
+            return command.item;
+        }, () => "secret stored");
+    }
+    finally {
+        progress.end();
+    }
+    const message = [
+        ...vaultItemCompatibilityNotice(command),
+        `stored ordinary vault item for ${command.agent}`,
+        `item: vault:${command.agent}:${command.item}`,
+        ...(account ? [`account: ${account}`] : []),
+        `public fields: ${Object.keys(publicFields).length === 0 ? "none" : Object.keys(publicFields).sort().join(", ")}`,
+        `secret fields: ${Object.keys(secretFields).sort().join(", ")}`,
+        `notes: ${command.note !== undefined || command.compatibilityAlias === vault_items_1.PORKBUN_OPS_COMPATIBILITY_ALIAS ? "present" : "absent"}`,
+        "secret values were not printed",
+    ].join("\n");
+    deps.writeStdout(message);
+    return message;
+}
+async function executeVaultItemStatus(command, deps) {
+    if (command.agent === "SerpentGuide") {
+        const message = "SerpentGuide has no persistent credential vault. Vault items belong in the owning agent vault.";
+        deps.writeStdout(message);
+        return message;
+    }
+    const store = (0, credential_access_1.getCredentialStore)(command.agent);
+    const account = porkbunAccountForCompatibility(command);
+    const meta = await store.get(command.item);
+    const lines = [
+        ...vaultItemCompatibilityNotice(command),
+        `agent: ${command.agent}`,
+        `${command.compatibilityAlias ? "ordinary vault item" : "item"}: vault:${command.agent}:${command.item}`,
+        `status: ${meta ? "present" : "missing"}`,
+    ];
+    if (meta?.username)
+        lines.push(account ? `account: ${meta.username}` : `username: ${meta.username}`);
+    if (meta?.notes)
+        lines.push("notes: present");
+    lines.push("secret values were not printed");
+    const message = lines.join("\n");
+    deps.writeStdout(message);
+    return message;
+}
+async function executeVaultItemList(command, deps) {
+    if (command.agent === "SerpentGuide") {
+        const message = "SerpentGuide has no persistent credential vault. Vault items belong in the owning agent vault.";
+        deps.writeStdout(message);
+        return message;
+    }
+    const store = (0, credential_access_1.getCredentialStore)(command.agent);
+    const prefix = command.prefix;
+    const items = (await store.list())
+        .filter((item) => !prefix || item.domain.startsWith(prefix.endsWith("/") ? prefix : `${prefix}/`))
+        .map((item) => item.domain)
+        .sort();
+    const lines = [
+        ...vaultItemCompatibilityNotice(command),
+        `agent: ${command.agent}`,
+        ...(prefix ? [`prefix: ${prefix}`] : []),
+        `items: ${items.length === 0 ? "none stored" : items.join(", ")}`,
+        "secret values were not printed",
+    ];
+    const message = lines.join("\n");
+    deps.writeStdout(message);
+    return message;
+}
 function requirePromptSecret(deps, purpose) {
     if (deps.promptSecret)
         return deps.promptSecret;
@@ -5354,6 +5522,15 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
     if (command.kind === "vault.config.status") {
         return executeVaultConfigStatus(command, deps);
     }
+    if (command.kind === "vault.item.set") {
+        return executeVaultItemSet(command, deps);
+    }
+    if (command.kind === "vault.item.status") {
+        return executeVaultItemStatus(command, deps);
+    }
+    if (command.kind === "vault.item.list") {
+        return executeVaultItemList(command, deps);
+    }
     // ── auth (local, no daemon socket needed) ──
     if (command.kind === "auth.run") {
         return executeAuthRun(command, deps);

package/dist/heart/daemon/cli-help.js

@@ -212,9 +212,9 @@ exports.COMMAND_REGISTRY = {
     vault: {
         category: "Auth",
         description: "Create, replace, recover, unlock, inspect, and populate the agent credential vault",
-        usage: "ouro vault <create|replace|recover|unlock|status|config> [--agent <name>]",
+        usage: "ouro vault <create|replace|recover|unlock|status|config|item|ops> [--agent <name>]",
         example: "ouro vault status",
-        subcommands: ["create", "replace", "recover", "unlock", "status", "config set", "config status"],
+        subcommands: ["create", "replace", "recover", "unlock", "status", "config set", "config status", "vault item set", "vault item status", "vault item list", "vault ops porkbun set", "vault ops porkbun status"],
     },
     thoughts: {
         category: "Internal",
@@ -366,6 +366,31 @@ const SUBCOMMAND_HELP = {
         usage: "ouro vault config status [--agent <name>] [--scope agent|machine|all]",
         example: "ouro vault config status --scope all",
     },
+    "vault item set": {
+        description: "Store an ordinary vault item / credential with no assumed use. Prompts for hidden secret fields, stores optional public fields and notes, and secret values are not printed.",
+        usage: "ouro vault item set [--agent <name>] --item <path> (--secret-field <name>...|--template <template>) [--public-field <key=value>] [--note <text>]",
+        example: "ouro vault item set --agent slugger --item ops/porkbun/ari@mendelow.me --template porkbun-api",
+    },
+    "vault item status": {
+        description: "Show metadata for an ordinary vault item without printing secret values",
+        usage: "ouro vault item status [--agent <name>] --item <path>",
+        example: "ouro vault item status --agent slugger --item ops/porkbun/ari@mendelow.me",
+    },
+    "vault item list": {
+        description: "List ordinary vault item names and metadata without printing secret values",
+        usage: "ouro vault item list [--agent <name>] [--prefix <path-prefix>]",
+        example: "ouro vault item list --agent slugger --prefix ops/",
+    },
+    "vault ops porkbun set": {
+        description: "deprecated compatibility alias for `ouro vault item set --template porkbun-api`; stores an ordinary vault item, not a special credential kind",
+        usage: "ouro vault ops porkbun set [--agent <name>] --account <account>",
+        example: "ouro vault ops porkbun set --agent slugger --account ari@mendelow.me",
+    },
+    "vault ops porkbun status": {
+        description: "deprecated compatibility alias for checking the ordinary vault item used by the Porkbun API template",
+        usage: "ouro vault ops porkbun status [--agent <name>] [--account <account>]",
+        example: "ouro vault ops porkbun status --agent slugger --account ari@mendelow.me",
+    },
 };
 // ── Levenshtein distance ──
 function levenshteinDistance(a, b) {

package/dist/heart/daemon/cli-parse.js

@@ -16,6 +16,7 @@ exports.parseMcpServeCommand = parseMcpServeCommand;
 exports.parseOuroCommand = parseOuroCommand;
 const types_1 = require("../../mind/friends/types");
 const cli_help_1 = require("./cli-help");
+const vault_items_1 = require("./vault-items");
 // ── Shared helpers ──
 function extractAgentFlag(args) {
     const idx = args.indexOf("--agent");
@@ -95,6 +96,11 @@ function usage() {
         "  ouro vault status [--agent <name>] [--store auto|macos-keychain|windows-dpapi|linux-secret-service|plaintext-file]",
         "  ouro vault config set [--agent <name>] --key <path> [--value <value>] [--scope agent|machine]",
         "  ouro vault config status [--agent <name>] [--scope agent|machine|all]",
+        "  ouro vault item set [--agent <name>] --item <path> --secret-field <name> [--public-field <key=value>] [--note <text>]",
+        "  ouro vault item status [--agent <name>] --item <path>",
+        "  ouro vault item list [--agent <name>] [--prefix <path-prefix>]",
+        "  ouro vault ops porkbun set [--agent <name>] --account <account>",
+        "  ouro vault ops porkbun status [--agent <name>] [--account <account>]",
         "  ouro chat <agent>",
         "  ouro msg --to <agent> [--session <id>] [--task <ref>] <message>",
         "  ouro poke <agent> --task <task-id>",
@@ -458,6 +464,10 @@ function parseVaultCommand(args) {
     const sub = args[0];
     if (sub === "config")
         return parseVaultConfigCommand(args.slice(1));
+    if (sub === "item")
+        return parseVaultItemCommand(args.slice(1));
+    if (sub === "ops")
+        return parseVaultOpsCommand(args.slice(1));
     const { agent, rest } = extractAgentFlag(args.slice(1));
     let email;
     let serverUrl;
@@ -544,6 +554,133 @@ function parseVaultCommand(args) {
     }
     return { kind: "vault.status", ...(agent ? { agent } : {}), ...(store ? { store } : {}) };
 }
+function parseVaultItemCommand(args) {
+    const action = args[0];
+    if (action !== "set" && action !== "status" && action !== "list") {
+        throw new Error("Usage: ouro vault item set|status|list [--agent <name>] --item <path>");
+    }
+    const { agent, rest } = extractAgentFlag(args.slice(1));
+    let item;
+    let prefix;
+    let template;
+    let note;
+    const secretFields = [];
+    const publicFields = [];
+    for (let i = 0; i < rest.length; i += 1) {
+        const token = rest[i];
+        if (token === "--item") {
+            item = (0, vault_items_1.normalizeVaultItemName)(rest[i + 1]);
+            i += 1;
+            continue;
+        }
+        if (token === "--prefix") {
+            const value = rest[i + 1]?.trim() ?? "";
+            if (!value || /[\r\n\t]/.test(value) || value.startsWith("/")) {
+                throw new Error("Vault item prefix must be non-empty, relative, and free of control characters.");
+            }
+            prefix = value;
+            i += 1;
+            continue;
+        }
+        if (token === "--template") {
+            const value = rest[i + 1];
+            if (!(0, vault_items_1.isVaultItemTemplate)(value)) {
+                throw new Error("vault item --template must be porkbun-api");
+            }
+            template = value;
+            i += 1;
+            continue;
+        }
+        if (token === "--secret-field") {
+            secretFields.push((0, vault_items_1.normalizeVaultItemFieldName)(rest[i + 1]));
+            i += 1;
+            continue;
+        }
+        if (token === "--public-field") {
+            const value = rest[i + 1]?.trim() ?? "";
+            const separator = value.indexOf("=");
+            if (separator <= 0 || separator === value.length - 1) {
+                throw new Error("vault item --public-field must be key=value");
+            }
+            (0, vault_items_1.normalizeVaultItemFieldName)(value.slice(0, separator));
+            publicFields.push(value);
+            i += 1;
+            continue;
+        }
+        if (token === "--note") {
+            note = rest[i + 1] ?? "";
+            i += 1;
+            continue;
+        }
+        throw new Error(`Usage: ouro vault item ${action} [--agent <name>] --item <path>`);
+    }
+    if (action === "list") {
+        return { kind: "vault.item.list", ...(agent ? { agent } : {}), ...(prefix ? { prefix } : {}) };
+    }
+    if (!item)
+        throw new Error(`Usage: ouro vault item ${action} [--agent <name>] --item <path>`);
+    if (action === "status") {
+        return { kind: "vault.item.status", ...(agent ? { agent } : {}), item };
+    }
+    if (!template && secretFields.length === 0) {
+        throw new Error("ouro vault item set requires --secret-field or --template");
+    }
+    return {
+        kind: "vault.item.set",
+        ...(agent ? { agent } : {}),
+        item,
+        ...(template ? { template } : {}),
+        ...(secretFields.length > 0 ? { secretFields } : {}),
+        ...(publicFields.length > 0 ? { publicFields } : {}),
+        ...(note !== undefined ? { note } : {}),
+    };
+}
+function parseVaultOpsCommand(args) {
+    const provider = args[0];
+    const action = args[1];
+    if (provider !== "porkbun") {
+        throw new Error("Usage: ouro vault ops porkbun set|status [--agent <name>] [--account <account>]");
+    }
+    if (action !== "set" && action !== "status") {
+        throw new Error("Usage: ouro vault ops porkbun set|status [--agent <name>] [--account <account>]");
+    }
+    const { agent, rest } = extractAgentFlag(args.slice(2));
+    let account;
+    for (let i = 0; i < rest.length; i += 1) {
+        const token = rest[i];
+        if (token === "--account") {
+            account = (0, vault_items_1.normalizePorkbunOpsAccount)(rest[i + 1]);
+            i += 1;
+            continue;
+        }
+        throw new Error(`Usage: ouro vault ops porkbun ${action} [--agent <name>] [--account <account>]`);
+    }
+    if (action === "set") {
+        if (!account)
+            throw new Error("Usage: ouro vault ops porkbun set [--agent <name>] --account <account>");
+        return {
+            kind: "vault.item.set",
+            ...(agent ? { agent } : {}),
+            item: (0, vault_items_1.porkbunOpsCredentialItemName)(account),
+            template: "porkbun-api",
+            compatibilityAlias: vault_items_1.PORKBUN_OPS_COMPATIBILITY_ALIAS,
+        };
+    }
+    if (account) {
+        return {
+            kind: "vault.item.status",
+            ...(agent ? { agent } : {}),
+            item: (0, vault_items_1.porkbunOpsCredentialItemName)(account),
+            compatibilityAlias: vault_items_1.PORKBUN_OPS_COMPATIBILITY_ALIAS,
+        };
+    }
+    return {
+        kind: "vault.item.list",
+        ...(agent ? { agent } : {}),
+        prefix: vault_items_1.PORKBUN_OPS_CREDENTIAL_PREFIX,
+        compatibilityAlias: vault_items_1.PORKBUN_OPS_COMPATIBILITY_ALIAS,
+    };
+}
 function parseVaultConfigCommand(args) {
     const sub = args[0];
     const { agent, rest } = extractAgentFlag(args.slice(1));

package/dist/heart/daemon/vault-items.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PORKBUN_OPS_COMPATIBILITY_ALIAS = exports.PORKBUN_OPS_CREDENTIAL_PREFIX = void 0;
+exports.isVaultItemTemplate = isVaultItemTemplate;
+exports.normalizeVaultItemName = normalizeVaultItemName;
+exports.normalizeVaultItemFieldName = normalizeVaultItemFieldName;
+exports.vaultItemTemplateSecretFields = vaultItemTemplateSecretFields;
+exports.normalizePorkbunOpsAccount = normalizePorkbunOpsAccount;
+exports.porkbunOpsCredentialItemName = porkbunOpsCredentialItemName;
+exports.porkbunOpsAccountFromItemName = porkbunOpsAccountFromItemName;
+exports.requireVaultItemSecret = requireVaultItemSecret;
+exports.PORKBUN_OPS_CREDENTIAL_PREFIX = "ops/registrars/porkbun/accounts";
+exports.PORKBUN_OPS_COMPATIBILITY_ALIAS = "vault ops porkbun";
+const VAULT_ITEM_NAME_FORBIDDEN = /[\r\n\t]/;
+const VAULT_ITEM_FIELD_FORBIDDEN = /[\r\n\t=]/;
+const PORKBUN_OPS_ACCOUNT_FORBIDDEN = /[\/\r\n\t]/;
+function isVaultItemTemplate(value) {
+    return value === "porkbun-api";
+}
+function normalizeVaultItemName(item) {
+    const normalized = item?.trim() ?? "";
+    if (!normalized || VAULT_ITEM_NAME_FORBIDDEN.test(normalized) || normalized.startsWith("/") || normalized.endsWith("/")) {
+        throw new Error("Vault item name/path must be non-empty, relative, and free of control characters.");
+    }
+    return normalized;
+}
+function normalizeVaultItemFieldName(field) {
+    const normalized = field?.trim() ?? "";
+    if (!normalized || VAULT_ITEM_FIELD_FORBIDDEN.test(normalized)) {
+        throw new Error("Vault item field names must be non-empty and free of control characters or '='.");
+    }
+    return normalized;
+}
+function vaultItemTemplateSecretFields(_template) {
+    return ["apiKey", "secretApiKey"];
+}
+function normalizePorkbunOpsAccount(account) {
+    const normalized = account?.trim() ?? "";
+    if (!normalized || PORKBUN_OPS_ACCOUNT_FORBIDDEN.test(normalized)) {
+        throw new Error("Porkbun account must be a non-empty account label without slashes or control characters.");
+    }
+    return normalized;
+}
+function porkbunOpsCredentialItemName(account) {
+    return `${exports.PORKBUN_OPS_CREDENTIAL_PREFIX}/${normalizePorkbunOpsAccount(account)}`;
+}
+function porkbunOpsAccountFromItemName(itemName) {
+    const prefix = `${exports.PORKBUN_OPS_CREDENTIAL_PREFIX}/`;
+    return itemName.startsWith(prefix) ? itemName.slice(prefix.length) : undefined;
+}
+function requireVaultItemSecret(value, label) {
+    const trimmed = value.trim();
+    if (!trimmed)
+        throw new Error(`${label} cannot be blank`);
+    return trimmed;
+}

package/dist/nerves/coverage/file-completeness.js

@@ -59,10 +59,11 @@ const DISPATCH_EXEMPT_PATTERNS = [
     "repertoire/tools-config",
     "repertoire/tools-base",
     // CLI sub-modules: cli-exec.ts is the router with emitNervesEvent calls;
-    // cli-parse, cli-render, and cli-help are pure functions/data with no side effects.
+    // cli-parse, cli-render, cli-help, and their small helpers are pure functions/data with no side effects.
     "daemon/cli-parse",
     "daemon/cli-render",
     "daemon/cli-help",
+    "daemon/vault-items",
     // Shared utility modules: pure helpers consumed by modules that own observability.
     "arc/json-store",
     "repertoire/api-client",

package/dist/repertoire/tools-credential.js

@@ -72,6 +72,11 @@ function optionalTrimmedText(value, fieldName) {
     const trimmed = value.trim();
     return trimmed.length > 0 ? trimmed : undefined;
 }
+function resolveVaultItemArg(args, legacyFieldName = "domain") {
+    if (args.item !== undefined)
+        return requireTrimmedText(args.item, "item");
+    return requireTrimmedText(args[legacyFieldName], legacyFieldName);
+}
 function parsePasswordLength(value) {
     if (value === undefined || value === null || value === "")
         return DEFAULT_PASSWORD_LENGTH;
@@ -127,13 +132,17 @@ exports.credentialToolDefinitions = [
             type: "function",
             function: {
                 name: "credential_get",
-                description: "Get credential metadata for a domain. Returns username, notes, and creation date. Never returns passwords — the credential gateway handles secret injection internally.",
+                description: "Get credential metadata for a vault item name/path. Returns username, notes, and creation date. Never returns passwords — the credential gateway handles secret injection internally.",
                 parameters: {
                     type: "object",
                     properties: {
+                        item: {
+                            type: "string",
+                            description: "Vault item name/path to look up (e.g. 'airbnb.com' or 'ops/porkbun/account')",
+                        },
                         domain: {
                             type: "string",
-                            description: "Domain to look up (e.g. 'airbnb.com', 'api.openweathermap.org')",
+                            description: "compatibility alias for item when the vault item name is a service domain",
                         },
                     },
                     required: ["domain"],
@@ -141,17 +150,18 @@ exports.credentialToolDefinitions = [
             },
         },
         handler: async (args) => {
+            const itemName = resolveVaultItemArg(args);
             (0, runtime_1.emitNervesEvent)({
                 component: "repertoire",
                 event: "repertoire.credential_tool_call",
                 message: "credential_get invoked",
-                meta: { tool: "credential_get", domain: args.domain },
+                meta: { tool: "credential_get", domain: itemName, item: itemName },
             });
             try {
                 const store = (0, credential_access_1.getCredentialStore)();
-                const meta = await store.get(args.domain);
+                const meta = await store.get(itemName);
                 if (!meta) {
-                    return `No credential found for "${args.domain}".`;
+                    return `No credential found for "${itemName}".`;
                 }
                 return JSON.stringify(meta, null, 2);
             }
@@ -220,13 +230,17 @@ exports.credentialToolDefinitions = [
             type: "function",
             function: {
                 name: "credential_store",
-                description: "Store credentials the agent acquired or just used successfully during signup. Prefer credential_generate_password for new passwords, then call this tool once the site accepts the exact password. Stored passwords are never returned later — only metadata is visible.",
+                description: "Store credentials in a vault item name/path after the agent acquired or just used them successfully. Prefer credential_generate_password for new passwords, then call this tool once the site accepts the exact password. Stored passwords are never returned later — only metadata is visible.",
                 parameters: {
                     type: "object",
                     properties: {
+                        item: {
+                            type: "string",
+                            description: "Vault item name/path to store under; domains are examples, not the schema",
+                        },
                         domain: {
                             type: "string",
-                            description: "Domain these credentials are for (e.g. 'airbnb.com')",
+                            description: "compatibility alias for item when the vault item name is a service domain",
                         },
                         username: {
                             type: "string",
@@ -238,7 +252,7 @@ exports.credentialToolDefinitions = [
                         },
                         notes: {
                             type: "string",
-                            description: "Optional notes about this credential",
+                            description: "Optional human/agent orientation notes about this credential; not parsed by code",
                         },
                     },
                     required: ["domain", "username", "password"],
@@ -250,14 +264,15 @@ exports.credentialToolDefinitions = [
             let username = "";
             let password = "";
             let notes;
+            const itemNameForEvent = typeof args.item === "string" && args.item.trim() ? args.item.trim() : args.domain;
             (0, runtime_1.emitNervesEvent)({
                 component: "repertoire",
                 event: "repertoire.credential_tool_call",
                 message: "credential_store invoked",
-                meta: { tool: "credential_store", domain: args.domain },
+                meta: { tool: "credential_store", domain: itemNameForEvent, item: itemNameForEvent },
             });
             try {
-                domain = requireTrimmedText(args.domain, "domain");
+                domain = resolveVaultItemArg(args);
                 username = requireTrimmedText(args.username, "username");
                 password = requireNonBlankSecret(args.password, "password");
                 notes = optionalTrimmedText(args.notes, "notes");
@@ -281,13 +296,13 @@ exports.credentialToolDefinitions = [
             type: "function",
             function: {
                 name: "credential_list",
-                description: "List stored credential domains. Returns metadata only (domain, username, notes, creation date). Never returns passwords.",
+                description: "List stored vault items. Returns metadata only (item/domain name, username, notes, creation date). Never returns passwords.",
                 parameters: {
                     type: "object",
                     properties: {
                         search: {
                             type: "string",
-                            description: "Optional search filter to match against domain names",
+                            description: "Optional search filter to match against vault item names/paths",
                         },
                     },
                 },
@@ -323,13 +338,17 @@ exports.credentialToolDefinitions = [
             type: "function",
             function: {
                 name: "credential_delete",
-                description: "Delete stored credentials for a domain.",
+                description: "Delete stored credentials for a vault item name/path.",
                 parameters: {
                     type: "object",
                     properties: {
+                        item: {
+                            type: "string",
+                            description: "Vault item name/path whose credentials should be deleted",
+                        },
                         domain: {
                             type: "string",
-                            description: "Domain whose credentials should be deleted",
+                            description: "compatibility alias for item when the vault item name is a service domain",
                         },
                     },
                     required: ["domain"],
@@ -344,12 +363,13 @@ exports.credentialToolDefinitions = [
                 meta: { tool: "credential_delete", domain: args.domain },
             });
             try {
+                const itemName = resolveVaultItemArg(args);
                 const store = (0, credential_access_1.getCredentialStore)();
-                const deleted = await store.delete(args.domain);
+                const deleted = await store.delete(itemName);
                 if (deleted) {
-                    return `Credentials for "${args.domain}" deleted.`;
+                    return `Credentials for "${itemName}" deleted.`;
                 }
-                return `No credential found for "${args.domain}".`;
+                return `No credential found for "${itemName}".`;
             }
             catch (err) {
                 /* v8 ignore next -- defensive: store.delete wraps errors @preserve */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.464",
+  "version": "0.1.0-alpha.466",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",