@ouro.bot/cli 0.1.0-alpha.99 → 0.1.0-alpha.991

package/dist/heart/runtime-credentials.js

@@ -0,0 +1,608 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MACHINE_RUNTIME_CONFIG_ITEM_PREFIX = exports.RUNTIME_CONFIG_ITEM_NAME = void 0;
+exports.machineRuntimeConfigItemName = machineRuntimeConfigItemName;
+exports.readRuntimeCredentialConfig = readRuntimeCredentialConfig;
+exports.readMachineRuntimeCredentialConfig = readMachineRuntimeCredentialConfig;
+exports.cacheRuntimeCredentialConfig = cacheRuntimeCredentialConfig;
+exports.cacheMachineRuntimeCredentialConfig = cacheMachineRuntimeCredentialConfig;
+exports.isRuntimeCredentialBootstrapMessage = isRuntimeCredentialBootstrapMessage;
+exports.applyRuntimeCredentialBootstrapMessage = applyRuntimeCredentialBootstrapMessage;
+exports.persistRuntimeCredentialBootstrapMessage = persistRuntimeCredentialBootstrapMessage;
+exports.waitForRuntimeCredentialBootstrap = waitForRuntimeCredentialBootstrap;
+exports.refreshRuntimeCredentialConfig = refreshRuntimeCredentialConfig;
+exports.refreshMachineRuntimeCredentialConfig = refreshMachineRuntimeCredentialConfig;
+exports.mergeRuntimeCredentialConfig = mergeRuntimeCredentialConfig;
+exports.upsertRuntimeCredentialConfig = upsertRuntimeCredentialConfig;
+exports.upsertMachineRuntimeCredentialConfig = upsertMachineRuntimeCredentialConfig;
+exports.mergeMachineRuntimeCredentialConfig = mergeMachineRuntimeCredentialConfig;
+exports.resetRuntimeCredentialConfigCache = resetRuntimeCredentialConfigCache;
+const crypto = __importStar(require("node:crypto"));
+const runtime_1 = require("../nerves/runtime");
+const credential_access_1 = require("../repertoire/credential-access");
+const identity_1 = require("./identity");
+const provider_credentials_1 = require("./provider-credentials");
+exports.RUNTIME_CONFIG_ITEM_NAME = "runtime/config";
+exports.MACHINE_RUNTIME_CONFIG_ITEM_PREFIX = "runtime/machines";
+let cachedRuntimeConfigs = new Map();
+let cachedMachineRuntimeConfigs = new Map();
+function isRecord(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function isCredentialValue(value) {
+    return typeof value === "string" || typeof value === "number";
+}
+function isCredentialRecord(value) {
+    if (!isRecord(value))
+        return false;
+    return Object.values(value).every(isCredentialValue);
+}
+function isPresentCredentialValue(value) {
+    if (typeof value === "string")
+        return value.trim().length > 0;
+    return typeof value === "number" && Number.isFinite(value) && value !== 0;
+}
+function hasExactKeys(value, keys) {
+    return Object.keys(value).sort().join(",") === [...keys].sort().join(",");
+}
+function isCanonicalTimestamp(value) {
+    if (typeof value !== "string")
+        return false;
+    try {
+        return new Date(value).toISOString() === value;
+    }
+    catch {
+        return false;
+    }
+}
+function isProviderCredentialRecord(value) {
+    if (!isRecord(value))
+        return false;
+    if (!hasExactKeys(value, ["provider", "revision", "updatedAt", "credentials", "config", "provenance"]))
+        return false;
+    if (typeof value.provider !== "string" || !Object.prototype.hasOwnProperty.call(identity_1.PROVIDER_CREDENTIALS, value.provider))
+        return false;
+    if (typeof value.revision !== "string" || !/^vault_[0-9a-f]{16}$/u.test(value.revision))
+        return false;
+    if (!isCanonicalTimestamp(value.updatedAt))
+        return false;
+    const credentials = value.credentials;
+    const config = value.config;
+    if (!isCredentialRecord(credentials))
+        return false;
+    if (!isCredentialRecord(config))
+        return false;
+    const provider = value.provider;
+    const canonicalCredentials = (0, provider_credentials_1.splitProviderCredentialFields)(provider, credentials).credentials;
+    const canonicalConfig = (0, provider_credentials_1.splitProviderCredentialFields)(provider, config).config;
+    const requirements = identity_1.PROVIDER_CREDENTIALS[provider];
+    if (![requirements.required, ...(requirements.alternativeRequired ?? [])].some((fields) => fields.every((field) => (isPresentCredentialValue(canonicalCredentials[field]) || isPresentCredentialValue(canonicalConfig[field])))))
+        return false;
+    const provenance = value.provenance;
+    if (!isRecord(provenance))
+        return false;
+    if (!hasExactKeys(provenance, ["source", "updatedAt"]))
+        return false;
+    if (provenance.source !== "auth-flow" && provenance.source !== "manual")
+        return false;
+    if (!isCanonicalTimestamp(provenance.updatedAt) || provenance.updatedAt !== value.updatedAt)
+        return false;
+    return true;
+}
+function stableJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(stableJson).join(",")}]`;
+    if (isRecord(value)) {
+        return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stableJson(value[key])}`).join(",")}}`;
+    }
+    return JSON.stringify(value);
+}
+function reconcileBootstrapFields(base, bootstrap, prefix) {
+    const conflicts = [];
+    const merge = (current, incoming, pathPrefix) => {
+        const next = { ...current };
+        for (const [key, incomingValue] of Object.entries(incoming)) {
+            const fieldPath = `${pathPrefix}.${key}`;
+            if (!Object.prototype.hasOwnProperty.call(current, key)) {
+                next[key] = incomingValue;
+                continue;
+            }
+            const currentValue = current[key];
+            if (isRecord(currentValue) && isRecord(incomingValue)) {
+                next[key] = merge(currentValue, incomingValue, fieldPath);
+            }
+            else if (stableJson(currentValue) !== stableJson(incomingValue)) {
+                conflicts.push(fieldPath);
+            }
+        }
+        return next;
+    };
+    const merged = merge(base, bootstrap, prefix);
+    if (conflicts.length > 0) {
+        throw new Error(`container credential bootstrap conflicts with existing fields: ${conflicts.sort().join(", ")}`);
+    }
+    return merged;
+}
+function assertBootstrapReadback(actual, expected, prefix) {
+    const failures = [];
+    const inspect = (current, intended, pathPrefix) => {
+        for (const [key, intendedValue] of Object.entries(intended)) {
+            const fieldPath = `${pathPrefix}.${key}`;
+            if (!Object.prototype.hasOwnProperty.call(current, key)) {
+                failures.push(fieldPath);
+                continue;
+            }
+            const currentValue = current[key];
+            if (isRecord(currentValue) && isRecord(intendedValue)) {
+                inspect(currentValue, intendedValue, fieldPath);
+            }
+            else if (stableJson(currentValue) !== stableJson(intendedValue)) {
+                failures.push(fieldPath);
+            }
+        }
+    };
+    inspect(actual, expected, prefix);
+    if (failures.length > 0) {
+        throw new Error(`container credential bootstrap readback did not contain intended fields: ${failures.sort().join(", ")}`);
+    }
+}
+function runtimeConfigVaultPath(agentName, itemName = exports.RUNTIME_CONFIG_ITEM_NAME) {
+    return `vault:${agentName}:${itemName}`;
+}
+function machineRuntimeConfigItemName(machineId) {
+    const normalized = machineId.trim();
+    if (!normalized)
+        throw new Error("machineId must be non-empty");
+    return `${exports.MACHINE_RUNTIME_CONFIG_ITEM_PREFIX}/${normalized}/config`;
+}
+function runtimeConfigRevision(payload) {
+    return `runtime_${crypto
+        .createHash("sha256")
+        .update(stableJson(payload))
+        .digest("hex")
+        .slice(0, 16)}`;
+}
+function validateRuntimeCredentialPayload(value) {
+    if (!isRecord(value))
+        throw new Error("runtime credential payload must be an object");
+    if (value.schemaVersion !== 1)
+        throw new Error("runtime credential payload schemaVersion must be 1");
+    if (value.kind !== "runtime-config")
+        throw new Error("runtime credential payload kind must be runtime-config");
+    if (typeof value.updatedAt !== "string" || value.updatedAt.trim().length === 0) {
+        throw new Error("runtime credential payload updatedAt must be non-empty");
+    }
+    if (!isRecord(value.config))
+        throw new Error("runtime credential payload config must be an object");
+    return value;
+}
+function resultFromPayload(agentName, payload) {
+    return {
+        ok: true,
+        itemPath: runtimeConfigVaultPath(agentName),
+        config: { ...payload.config },
+        revision: runtimeConfigRevision(payload),
+        updatedAt: payload.updatedAt,
+    };
+}
+function resultFromPayloadForItem(agentName, itemName, payload) {
+    return {
+        ok: true,
+        itemPath: runtimeConfigVaultPath(agentName, itemName),
+        config: { ...payload.config },
+        revision: runtimeConfigRevision(payload),
+        updatedAt: payload.updatedAt,
+    };
+}
+function missingRuntimeConfig(agentName, itemName = exports.RUNTIME_CONFIG_ITEM_NAME) {
+    return {
+        ok: false,
+        reason: "missing",
+        itemPath: runtimeConfigVaultPath(agentName, itemName),
+        error: `no runtime credentials stored at ${runtimeConfigVaultPath(agentName, itemName)}`,
+    };
+}
+function cacheResult(agentName, result) {
+    cachedRuntimeConfigs.set(agentName, result);
+    return result;
+}
+function cacheMachineResult(agentName, result) {
+    cachedMachineRuntimeConfigs.set(agentName, result);
+    return result;
+}
+function missingMachineRuntimeConfig(agentName) {
+    return {
+        ok: false,
+        reason: "missing",
+        itemPath: `vault:${agentName}:${exports.MACHINE_RUNTIME_CONFIG_ITEM_PREFIX}/<this-machine>/config`,
+        error: `no machine runtime credentials loaded for ${agentName}`,
+    };
+}
+function readRuntimeCredentialConfig(agentName = (0, identity_1.getAgentName)()) {
+    return cachedRuntimeConfigs.get(agentName) ?? missingRuntimeConfig(agentName);
+}
+function readMachineRuntimeCredentialConfig(agentName = (0, identity_1.getAgentName)()) {
+    return cachedMachineRuntimeConfigs.get(agentName) ?? missingMachineRuntimeConfig(agentName);
+}
+function cacheRuntimeCredentialConfig(agentName, config, now = new Date()) {
+    const payload = {
+        schemaVersion: 1,
+        kind: "runtime-config",
+        updatedAt: now.toISOString(),
+        config: { ...config },
+    };
+    return cacheResult(agentName, resultFromPayload(agentName, payload));
+}
+function cacheMachineRuntimeCredentialConfig(agentName, config, now = new Date(), machineId = "<this-machine>") {
+    const payload = {
+        schemaVersion: 1,
+        kind: "runtime-config",
+        updatedAt: now.toISOString(),
+        config: { ...config },
+    };
+    return cacheMachineResult(agentName, resultFromPayloadForItem(agentName, machineRuntimeConfigItemName(machineId), payload));
+}
+function isRuntimeCredentialBootstrapMessage(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const record = value;
+    if (!Object.keys(record).every((key) => [
+        "type",
+        "agentName",
+        "runtimeConfig",
+        "machineRuntimeConfig",
+        "machineId",
+        "providerCredentialRecords",
+    ].includes(key)))
+        return false;
+    if (record.type !== "ouro.runtimeCredentialBootstrap")
+        return false;
+    if (typeof record.agentName !== "string" || record.agentName.trim().length === 0)
+        return false;
+    if (record.runtimeConfig !== undefined
+        && (!isRecord(record.runtimeConfig) || Object.keys(record.runtimeConfig).length === 0))
+        return false;
+    if (record.machineRuntimeConfig !== undefined
+        && (!isRecord(record.machineRuntimeConfig) || Object.keys(record.machineRuntimeConfig).length === 0))
+        return false;
+    if (record.machineId !== undefined && (typeof record.machineId !== "string" || record.machineId.trim().length === 0))
+        return false;
+    if (record.providerCredentialRecords !== undefined
+        && (!Array.isArray(record.providerCredentialRecords)
+            || record.providerCredentialRecords.length === 0
+            || !record.providerCredentialRecords.every(isProviderCredentialRecord)))
+        return false;
+    if (Array.isArray(record.providerCredentialRecords)) {
+        const providers = record.providerCredentialRecords.map((providerRecord) => providerRecord.provider);
+        if (new Set(providers).size !== providers.length)
+            return false;
+    }
+    if (record.runtimeConfig === undefined
+        && record.machineRuntimeConfig === undefined
+        && (!Array.isArray(record.providerCredentialRecords) || record.providerCredentialRecords.length === 0))
+        return false;
+    return true;
+}
+function applyRuntimeCredentialBootstrapMessage(message) {
+    if (!isRuntimeCredentialBootstrapMessage(message))
+        return false;
+    const agentName = message.agentName.trim();
+    const now = new Date();
+    if (message.runtimeConfig) {
+        cacheRuntimeCredentialConfig(agentName, message.runtimeConfig, now);
+    }
+    if (message.machineRuntimeConfig) {
+        cacheMachineRuntimeCredentialConfig(agentName, message.machineRuntimeConfig, now, message.machineId ?? "<this-machine>");
+    }
+    if (message.providerCredentialRecords && message.providerCredentialRecords.length > 0) {
+        (0, provider_credentials_1.cacheProviderCredentialRecords)(agentName, message.providerCredentialRecords, now);
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "config/identity",
+        event: "config.runtime_credentials_bootstrapped",
+        message: "loaded runtime credentials from daemon bootstrap",
+        meta: {
+            agentName,
+            runtimeConfig: !!message.runtimeConfig,
+            machineRuntimeConfig: !!message.machineRuntimeConfig,
+            providerCredentialRecords: message.providerCredentialRecords?.length ?? 0,
+        },
+    });
+    return true;
+}
+async function persistRuntimeCredentialBootstrapMessage(message, options) {
+    if (!isRuntimeCredentialBootstrapMessage(message))
+        return false;
+    const agentName = message.agentName.trim();
+    const now = options.now ?? new Date();
+    if (message.machineId !== undefined && message.machineId.trim() !== options.machineId.trim()) {
+        throw new Error("container credential bootstrap machineId does not match this machine");
+    }
+    let runtimePlan = null;
+    let machinePlan = null;
+    let expectedRuntime = null;
+    let expectedMachine = null;
+    const providerPlans = [];
+    const expectedProviders = new Map();
+    if (message.runtimeConfig) {
+        const current = await refreshRuntimeCredentialConfig(agentName);
+        if (!current.ok && current.reason !== "missing") {
+            throw new Error(`cannot reconcile runtimeConfig at ${current.itemPath}: ${current.error}`);
+        }
+        const base = current.ok ? current.config : {};
+        const merged = reconcileBootstrapFields(base, message.runtimeConfig, "runtimeConfig");
+        expectedRuntime = merged;
+        if (stableJson(merged) !== stableJson(base))
+            runtimePlan = merged;
+    }
+    if (message.machineRuntimeConfig) {
+        const machineId = message.machineId ?? options.machineId;
+        const current = await refreshMachineRuntimeCredentialConfig(agentName, machineId);
+        if (!current.ok && current.reason !== "missing") {
+            throw new Error(`cannot reconcile machineRuntimeConfig at ${current.itemPath}: ${current.error}`);
+        }
+        const base = current.ok ? current.config : {};
+        const merged = reconcileBootstrapFields(base, message.machineRuntimeConfig, "machineRuntimeConfig");
+        expectedMachine = merged;
+        if (stableJson(merged) !== stableJson(base))
+            machinePlan = merged;
+    }
+    for (const record of message.providerCredentialRecords ?? []) {
+        const current = await (0, provider_credentials_1.refreshProviderCredentialPool)(agentName, { providers: [record.provider], skipCache: true });
+        if (!current.ok && current.reason !== "missing") {
+            throw new Error(`cannot reconcile providerCredentialRecords.${record.provider} at ${current.poolPath}: ${current.error}`);
+        }
+        const existing = current.ok ? current.pool.providers[record.provider] : undefined;
+        const credentials = reconcileBootstrapFields(existing?.credentials ?? {}, record.credentials, `providerCredentialRecords.${record.provider}.credentials`);
+        const config = reconcileBootstrapFields(existing?.config ?? {}, record.config, `providerCredentialRecords.${record.provider}.config`);
+        expectedProviders.set(record.provider, { credentials, config });
+        if (!existing || stableJson(credentials) !== stableJson(existing.credentials) || stableJson(config) !== stableJson(existing.config)) {
+            providerPlans.push({
+                provider: record.provider,
+                credentials,
+                config,
+                provenanceSource: existing?.provenance.source ?? record.provenance.source,
+            });
+        }
+    }
+    if (runtimePlan)
+        await upsertRuntimeCredentialConfig(agentName, runtimePlan, now);
+    if (machinePlan) {
+        await upsertMachineRuntimeCredentialConfig(agentName, message.machineId ?? options.machineId, machinePlan, now);
+    }
+    for (const plan of providerPlans) {
+        await (0, provider_credentials_1.upsertProviderCredential)({
+            agentName,
+            provider: plan.provider,
+            credentials: plan.credentials,
+            config: plan.config,
+            provenance: { source: plan.provenanceSource },
+            now,
+        });
+    }
+    if (message.runtimeConfig) {
+        const refreshed = await refreshRuntimeCredentialConfig(agentName);
+        if (!refreshed.ok)
+            throw new Error(`cannot read back runtimeConfig at ${refreshed.itemPath}: ${refreshed.error}`);
+        assertBootstrapReadback(refreshed.config, expectedRuntime, "runtimeConfig");
+    }
+    if (message.machineRuntimeConfig) {
+        const refreshed = await refreshMachineRuntimeCredentialConfig(agentName, message.machineId ?? options.machineId);
+        if (!refreshed.ok)
+            throw new Error(`cannot read back machineRuntimeConfig at ${refreshed.itemPath}: ${refreshed.error}`);
+        assertBootstrapReadback(refreshed.config, expectedMachine, "machineRuntimeConfig");
+    }
+    if ((message.providerCredentialRecords?.length ?? 0) > 0) {
+        const refreshed = await (0, provider_credentials_1.refreshProviderCredentialPool)(agentName);
+        if (!refreshed.ok)
+            throw new Error(`cannot read back providerCredentialRecords at ${refreshed.poolPath}: ${refreshed.error}`);
+        for (const [provider, expected] of expectedProviders) {
+            const record = refreshed.pool.providers[provider];
+            if (!record) {
+                throw new Error(`container credential bootstrap readback did not contain intended fields: providerCredentialRecords.${provider}`);
+            }
+            assertBootstrapReadback(record.credentials, expected.credentials, `providerCredentialRecords.${provider}.credentials`);
+            assertBootstrapReadback(record.config, expected.config, `providerCredentialRecords.${provider}.config`);
+        }
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "config/identity",
+        event: "config.runtime_credentials_bootstrap_persisted",
+        message: "persisted container credential bootstrap in the agent vault",
+        meta: {
+            agentName,
+            runtimeConfig: !!message.runtimeConfig,
+            machineRuntimeConfig: !!message.machineRuntimeConfig,
+            providerCredentialRecords: message.providerCredentialRecords?.length ?? 0,
+        },
+    });
+    return true;
+}
+function waitForRuntimeCredentialBootstrap(agentName, options = {}) {
+    const timeoutMs = options.timeoutMs ?? 1_500;
+    return new Promise((resolve) => {
+        let settled = false;
+        let timer = null;
+        const finish = (value) => {
+            /* v8 ignore next -- defensive: listener cleanup and timer cleanup prevent double settlement @preserve */
+            if (settled)
+                return;
+            settled = true;
+            /* v8 ignore next -- defensive: timer is assigned immediately after listener registration @preserve */
+            if (timer)
+                clearTimeout(timer);
+            process.off?.("message", onMessage);
+            resolve(value);
+        };
+        const onMessage = (message) => {
+            if (!isRuntimeCredentialBootstrapMessage(message))
+                return;
+            if (message.agentName.trim() !== agentName.trim())
+                return;
+            finish(applyRuntimeCredentialBootstrapMessage(message));
+        };
+        process.on?.("message", onMessage);
+        timer = setTimeout(() => finish(false), timeoutMs);
+    });
+}
+async function refreshRuntimeCredentialConfigItem(agentName, itemName, cache, options = {}) {
+    try {
+        const store = (0, credential_access_1.getCredentialStore)(agentName);
+        const raw = await store.getRawSecret(itemName, "password");
+        const payload = validateRuntimeCredentialPayload(JSON.parse(raw));
+        const result = resultFromPayloadForItem(agentName, itemName, payload);
+        (0, runtime_1.emitNervesEvent)({
+            component: "config/identity",
+            event: "config.runtime_credentials_loaded",
+            message: "loaded runtime credentials from vault",
+            meta: { agentName, itemPath: result.itemPath, revision: result.revision },
+        });
+        return cache(agentName, result);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        const existing = cache === cacheMachineResult
+            ? cachedMachineRuntimeConfigs.get(agentName)
+            : cachedRuntimeConfigs.get(agentName);
+        const reason = message.includes(`no credential found for domain "${itemName}"`)
+            ? "missing"
+            : message.includes("runtime credential payload")
+                ? "invalid"
+                : "unavailable";
+        const result = {
+            ok: false,
+            reason,
+            itemPath: runtimeConfigVaultPath(agentName, itemName),
+            error: reason === "missing" ? `no runtime credentials stored at ${runtimeConfigVaultPath(agentName, itemName)}` : message,
+        };
+        (0, runtime_1.emitNervesEvent)({
+            level: reason === "missing" ? "warn" : "error",
+            component: "config/identity",
+            event: "config.runtime_credentials_unavailable",
+            message: "runtime credentials unavailable",
+            meta: { agentName, reason, itemPath: result.itemPath },
+        });
+        if (options.preserveCachedOnFailure && existing?.ok)
+            return existing;
+        return cache(agentName, result);
+    }
+}
+async function refreshRuntimeCredentialConfig(agentName, options = {}) {
+    return refreshRuntimeCredentialConfigItem(agentName, exports.RUNTIME_CONFIG_ITEM_NAME, cacheResult, options);
+}
+async function refreshMachineRuntimeCredentialConfig(agentName, machineId, options = {}) {
+    return refreshRuntimeCredentialConfigItem(agentName, machineRuntimeConfigItemName(machineId), cacheMachineResult, options);
+}
+function mergeRuntimeCredentialConfigObjects(base, patch) {
+    const next = { ...base };
+    for (const key of Object.keys(patch)) {
+        const baseValue = next[key];
+        const patchValue = patch[key];
+        next[key] = isRecord(baseValue) && isRecord(patchValue)
+            ? mergeRuntimeCredentialConfigObjects(baseValue, patchValue)
+            : patchValue;
+    }
+    return next;
+}
+async function mergeRuntimeCredentialConfig(agentName, patch, now = new Date()) {
+    const current = await refreshRuntimeCredentialConfig(agentName);
+    if (!current.ok && current.reason !== "missing") {
+        throw new Error(`cannot merge runtime config at ${current.itemPath}: ${current.error}`);
+    }
+    const base = current.ok ? current.config : {};
+    return upsertRuntimeCredentialConfig(agentName, mergeRuntimeCredentialConfigObjects(base, patch), now);
+}
+async function upsertRuntimeCredentialConfig(agentName, config, now = new Date()) {
+    const payload = {
+        schemaVersion: 1,
+        kind: "runtime-config",
+        updatedAt: now.toISOString(),
+        config: { ...config },
+    };
+    const store = (0, credential_access_1.getCredentialStore)(agentName);
+    await store.store(exports.RUNTIME_CONFIG_ITEM_NAME, {
+        username: "runtime/config",
+        password: JSON.stringify(payload),
+        notes: "Ouro runtime credentials for senses and integrations. Provider credentials live in providers/* items.",
+    });
+    const result = resultFromPayload(agentName, payload);
+    (0, runtime_1.emitNervesEvent)({
+        component: "config/identity",
+        event: "config.runtime_credentials_upserted",
+        message: "upserted runtime credential config in vault",
+        meta: { agentName, itemPath: result.itemPath, revision: result.revision },
+    });
+    cacheResult(agentName, result);
+    return result;
+}
+async function upsertMachineRuntimeCredentialConfig(agentName, machineId, config, now = new Date()) {
+    const payload = {
+        schemaVersion: 1,
+        kind: "runtime-config",
+        updatedAt: now.toISOString(),
+        config: { ...config },
+    };
+    const itemName = machineRuntimeConfigItemName(machineId);
+    const store = (0, credential_access_1.getCredentialStore)(agentName);
+    await store.store(itemName, {
+        username: itemName,
+        password: JSON.stringify(payload),
+        notes: "Ouro machine-local runtime credentials for senses attached to one machine. Portable runtime credentials live in runtime/config.",
+    });
+    const result = resultFromPayloadForItem(agentName, itemName, payload);
+    (0, runtime_1.emitNervesEvent)({
+        component: "config/identity",
+        event: "config.runtime_credentials_upserted",
+        message: "upserted machine runtime credential config in vault",
+        meta: { agentName, itemPath: result.itemPath, revision: result.revision },
+    });
+    cacheMachineResult(agentName, result);
+    return result;
+}
+// Partial machine-runtime writers must use this helper, not raw upsert: one
+// machine item carries multiple local attachments such as A2A, BlueBubbles, and Voice.
+async function mergeMachineRuntimeCredentialConfig(agentName, machineId, patch, now = new Date()) {
+    const current = await refreshMachineRuntimeCredentialConfig(agentName, machineId);
+    if (!current.ok && current.reason !== "missing") {
+        throw new Error(`cannot merge machine runtime config at ${current.itemPath}: ${current.error}`);
+    }
+    const base = current.ok ? current.config : {};
+    return upsertMachineRuntimeCredentialConfig(agentName, machineId, mergeRuntimeCredentialConfigObjects(base, patch), now);
+}
+function resetRuntimeCredentialConfigCache() {
+    cachedRuntimeConfigs = new Map();
+    cachedMachineRuntimeConfigs = new Map();
+}