@praxis-ai/praxis 0.1.0 → 0.1.2

package/dist/runtimeImplementation/runtime.authPlane/index.d.ts

@@ -0,0 +1,19 @@
+import { createRuntimeAuthModelEntry, createRuntimeAuthProviderProfile, bindRuntimeAuthRole, createRuntimeAuthRegistry, type RuntimeAuthCredentialRef } from "./providerAuthRegistry.js";
+import { createInMemoryRuntimeAuthSecretVault, createRuntimeAuthSecretRecord, decryptRuntimeAuthSecretRecord, toRuntimeAuthSecretPublicView } from "./secretVault.js";
+import { createRuntimeAuthResolver } from "./runtimeAuthResolver.js";
+export * from "./providerAuthRegistry.js";
+export * from "./secretVault.js";
+export * from "./runtimeAuthResolver.js";
+export declare function runtimeAuthCredentialRef(input: RuntimeAuthCredentialRef): RuntimeAuthCredentialRef;
+export declare const runtimeAuth: Readonly<{
+    credentialRef: typeof runtimeAuthCredentialRef;
+    profile: typeof createRuntimeAuthProviderProfile;
+    modelEntry: typeof createRuntimeAuthModelEntry;
+    role: typeof bindRuntimeAuthRole;
+    registry: typeof createRuntimeAuthRegistry;
+    createSecret: typeof createRuntimeAuthSecretRecord;
+    decryptSecret: typeof decryptRuntimeAuthSecretRecord;
+    vault: typeof createInMemoryRuntimeAuthSecretVault;
+    publicSecretView: typeof toRuntimeAuthSecretPublicView;
+    resolver: typeof createRuntimeAuthResolver;
+}>;

package/dist/runtimeImplementation/runtime.authPlane/index.js

@@ -0,0 +1,31 @@
+/*
+ * 文件定位：Runtime / authPlane 公开聚合入口。
+ * 核心目的：给 agentCore 的 praxis.auth 暴露单一、声明式的 auth/API 管理构件。
+ */
+import { createRuntimeAuthModelEntry, createRuntimeAuthProviderProfile, bindRuntimeAuthRole, createRuntimeAuthRegistry, } from "./providerAuthRegistry.js";
+import { createInMemoryRuntimeAuthSecretVault, createRuntimeAuthSecretRecord, decryptRuntimeAuthSecretRecord, toRuntimeAuthSecretPublicView, } from "./secretVault.js";
+import { createRuntimeAuthResolver, } from "./runtimeAuthResolver.js";
+export * from "./providerAuthRegistry.js";
+export * from "./secretVault.js";
+export * from "./runtimeAuthResolver.js";
+export function runtimeAuthCredentialRef(input) {
+    return {
+        ...input,
+        credentialRefId: input.credentialRefId.trim(),
+        secretId: input.secretId.trim(),
+        provider: input.provider.trim(),
+        publicSafe: true,
+    };
+}
+export const runtimeAuth = Object.freeze({
+    credentialRef: runtimeAuthCredentialRef,
+    profile: createRuntimeAuthProviderProfile,
+    modelEntry: createRuntimeAuthModelEntry,
+    role: bindRuntimeAuthRole,
+    registry: createRuntimeAuthRegistry,
+    createSecret: createRuntimeAuthSecretRecord,
+    decryptSecret: decryptRuntimeAuthSecretRecord,
+    vault: createInMemoryRuntimeAuthSecretVault,
+    publicSecretView: toRuntimeAuthSecretPublicView,
+    resolver: createRuntimeAuthResolver,
+});

package/dist/runtimeImplementation/runtime.authPlane/providerAuthRegistry.d.ts

@@ -0,0 +1,124 @@
+import type { CredentialType } from "../../modelAdapter/authProfileLayer/credentialRef.js";
+import type { ProviderReasoningConfig } from "../../modelAdapter/providerAccessLayer/providerCarrier.js";
+import type { RuntimeAuthProviderKind, RuntimeAuthSecretKind } from "./secretVault.js";
+export type RuntimeAuthEndpointShape = "responses" | "chat_completions" | "messages" | "gemini_generate_content" | "custom" | (string & {});
+export type RuntimeAuthRole = "primary" | "fallback" | "media" | "embedding" | "realtime" | "batch" | (string & {});
+export type RuntimeAuthCredentialRef = {
+    credentialRefId: string;
+    secretId: string;
+    provider: RuntimeAuthProviderKind;
+    credentialType: CredentialType;
+    secretKind: RuntimeAuthSecretKind;
+    publicSafe: true;
+};
+export type RuntimeAuthProviderProfile = {
+    profileId: string;
+    name: string;
+    provider: RuntimeAuthProviderKind;
+    providerLabel: string;
+    endpointShape: RuntimeAuthEndpointShape;
+    baseURL?: string;
+    credentialRef: RuntimeAuthCredentialRef;
+    authMode: "api_key" | "oauth" | "subscription_contract" | "custom";
+    metadata?: Readonly<Record<string, unknown>>;
+    createdAt: string;
+    updatedAt: string;
+    publicSafe: true;
+};
+export type RuntimeAuthModelEntry = {
+    modelEntryId: string;
+    providerProfileRef: string;
+    model: string;
+    reasoning?: ProviderReasoningConfig;
+    contextWindowTokens?: number;
+    maxOutputTokens?: number;
+    capabilityTags?: readonly string[];
+    metadata?: Readonly<Record<string, unknown>>;
+    testStatus: {
+        state: "unknown" | "passed" | "failed";
+        checkedAt?: string;
+        statusCode?: number;
+        publicSafeMessage?: string;
+    };
+    publicSafe: true;
+};
+export type RuntimeAuthRoleBinding = {
+    role: RuntimeAuthRole;
+    providerProfileRef: string;
+    modelEntryRef?: string;
+    enabled: boolean;
+    priority: number;
+    metadata?: Readonly<Record<string, unknown>>;
+    publicSafe: true;
+};
+export type RuntimeAuthRegistrySnapshot = {
+    profiles: readonly RuntimeAuthProviderProfile[];
+    modelEntries: readonly RuntimeAuthModelEntry[];
+    roleBindings: readonly RuntimeAuthRoleBinding[];
+    publicSafe: true;
+};
+export type RuntimeAuthRegistryErrorCode = "MISSING_PROFILE_ID" | "MISSING_PROVIDER" | "MISSING_CREDENTIAL_REF" | "CREDENTIAL_PROVIDER_MISMATCH" | "MISSING_MODEL_ENTRY_ID" | "MISSING_MODEL" | "MISSING_ROLE" | "MISSING_PROFILE_REF" | "PROFILE_NOT_FOUND" | "MODEL_ENTRY_NOT_FOUND" | "MODEL_ENTRY_PROFILE_MISMATCH" | "ROLE_BINDING_NOT_FOUND";
+export type RuntimeAuthRegistryError = {
+    code: RuntimeAuthRegistryErrorCode;
+    message: string;
+    boundary: "input" | "registry";
+    publicSafe: true;
+};
+export type RuntimeAuthRegistryResult<T> = {
+    ok: true;
+    value: T;
+    events: readonly string[];
+} | {
+    ok: false;
+    error: RuntimeAuthRegistryError;
+    events: readonly string[];
+};
+export type RuntimeAuthRegistry = {
+    putProviderProfile(profile: RuntimeAuthProviderProfile): RuntimeAuthProviderProfile;
+    putModelEntry(entry: RuntimeAuthModelEntry): RuntimeAuthModelEntry;
+    putRoleBinding(binding: RuntimeAuthRoleBinding): RuntimeAuthRoleBinding;
+    getProviderProfile(profileRef: string): RuntimeAuthProviderProfile | undefined;
+    getModelEntry(modelEntryRef: string): RuntimeAuthModelEntry | undefined;
+    selectRole(role: RuntimeAuthRole): RuntimeAuthRegistryResult<{
+        profile: RuntimeAuthProviderProfile;
+        modelEntry?: RuntimeAuthModelEntry;
+        binding: RuntimeAuthRoleBinding;
+    }>;
+    snapshot(): RuntimeAuthRegistrySnapshot;
+};
+export declare function createRuntimeAuthProviderProfile(input: {
+    profileId?: string;
+    name?: string;
+    provider?: RuntimeAuthProviderKind;
+    providerLabel?: string;
+    endpointShape?: RuntimeAuthEndpointShape;
+    baseURL?: string;
+    credentialRef?: RuntimeAuthCredentialRef;
+    authMode?: RuntimeAuthProviderProfile["authMode"];
+    metadata?: Readonly<Record<string, unknown>>;
+    now?: string;
+}): RuntimeAuthRegistryResult<RuntimeAuthProviderProfile>;
+export declare function createRuntimeAuthModelEntry(input: {
+    modelEntryId?: string;
+    providerProfileRef?: string;
+    model?: string;
+    reasoning?: ProviderReasoningConfig;
+    contextWindowTokens?: number;
+    maxOutputTokens?: number;
+    capabilityTags?: readonly string[];
+    metadata?: Readonly<Record<string, unknown>>;
+    testStatus?: RuntimeAuthModelEntry["testStatus"];
+}): RuntimeAuthRegistryResult<RuntimeAuthModelEntry>;
+export declare function bindRuntimeAuthRole(input: {
+    role?: RuntimeAuthRole;
+    providerProfileRef?: string;
+    modelEntryRef?: string;
+    enabled?: boolean;
+    priority?: number;
+    metadata?: Readonly<Record<string, unknown>>;
+}): RuntimeAuthRegistryResult<RuntimeAuthRoleBinding>;
+export declare function createRuntimeAuthRegistry(input?: {
+    profiles?: readonly RuntimeAuthProviderProfile[];
+    modelEntries?: readonly RuntimeAuthModelEntry[];
+    roleBindings?: readonly RuntimeAuthRoleBinding[];
+}): RuntimeAuthRegistry;

package/dist/runtimeImplementation/runtime.authPlane/providerAuthRegistry.js

@@ -0,0 +1,213 @@
+/*
+ * 文件定位：Runtime / authPlane / provider auth registry。
+ * 核心目的：把 providerProfile、modelEntry、roleBinding 和 credentialRef 串成单一事实源。
+ * 边界：只做声明与解析，不读取 secret、不执行 provider 调用。
+ */
+function nowIso(input) {
+    return input?.trim() || new Date().toISOString();
+}
+function hasText(value) {
+    return typeof value === "string" && value.trim().length > 0;
+}
+function providerProtocol(provider) {
+    const value = provider?.trim().toLowerCase();
+    if (value === "openai" || value === "openai-compatible")
+        return "openai";
+    if (value === "anthropic" || value === "anthropic-compatible")
+        return "anthropic";
+    if (value === "gemini" || value === "deepmind" || value === "google")
+        return "gemini";
+    if (value === "custom")
+        return "custom";
+    return undefined;
+}
+function endpointProtocol(endpointShape) {
+    const value = endpointShape?.trim().toLowerCase();
+    if (value === "responses" || value === "chat_completions")
+        return "openai";
+    if (value === "messages")
+        return "anthropic";
+    if (value === "gemini_generate_content")
+        return "gemini";
+    if (value === "custom")
+        return "custom";
+    return undefined;
+}
+function credentialProtocol(credentialType) {
+    if (credentialType === "openai_api_key" || credentialType === "chatgpt_codex_oauth")
+        return "openai";
+    if (credentialType === "anthropic_api_key")
+        return "anthropic";
+    if (credentialType === "gemini_api_key")
+        return "gemini";
+    return "custom";
+}
+function credentialRefMatchesProvider(provider, endpointShape, credentialRef) {
+    const profileProviderName = provider.trim().toLowerCase();
+    const refProviderName = credentialRef.provider.trim().toLowerCase();
+    const profileProtocol = providerProtocol(provider) ?? endpointProtocol(endpointShape);
+    const refProviderProtocol = providerProtocol(credentialRef.provider);
+    const refCredentialProtocol = credentialProtocol(credentialRef.credentialType);
+    return profileProtocol !== undefined &&
+        profileProtocol === refCredentialProtocol &&
+        (refProviderProtocol === undefined ? refProviderName === profileProviderName : refProviderProtocol === profileProtocol);
+}
+function failure(code, message, boundary) {
+    return {
+        ok: false,
+        error: { code, message, boundary, publicSafe: true },
+        events: ["runtime.auth.registry.rejected"],
+    };
+}
+export function createRuntimeAuthProviderProfile(input) {
+    if (!hasText(input.profileId)) {
+        return failure("MISSING_PROFILE_ID", "runtime auth provider profile requires a stable profileId", "input");
+    }
+    if (!hasText(input.provider)) {
+        return failure("MISSING_PROVIDER", "runtime auth provider profile requires a provider", "input");
+    }
+    if (input.credentialRef === undefined) {
+        return failure("MISSING_CREDENTIAL_REF", "runtime auth provider profile requires a credentialRef", "input");
+    }
+    const endpointShape = input.endpointShape ?? "responses";
+    if (!credentialRefMatchesProvider(input.provider, endpointShape, input.credentialRef)) {
+        return failure("CREDENTIAL_PROVIDER_MISMATCH", "runtime auth provider profile credentialRef must match the profile provider protocol", "input");
+    }
+    const stamp = nowIso(input.now);
+    const profileId = input.profileId.trim();
+    return {
+        ok: true,
+        value: {
+            profileId,
+            name: input.name?.trim() || profileId,
+            provider: input.provider.trim(),
+            providerLabel: input.providerLabel?.trim() || input.provider.trim(),
+            endpointShape,
+            baseURL: input.baseURL?.trim() || undefined,
+            credentialRef: input.credentialRef,
+            authMode: input.authMode ?? "api_key",
+            metadata: input.metadata,
+            createdAt: stamp,
+            updatedAt: stamp,
+            publicSafe: true,
+        },
+        events: ["runtime.auth.profile.created"],
+    };
+}
+export function createRuntimeAuthModelEntry(input) {
+    if (!hasText(input.modelEntryId)) {
+        return failure("MISSING_MODEL_ENTRY_ID", "runtime auth model entry requires a stable modelEntryId", "input");
+    }
+    if (!hasText(input.providerProfileRef)) {
+        return failure("MISSING_PROFILE_REF", "runtime auth model entry requires a providerProfileRef", "input");
+    }
+    if (!hasText(input.model)) {
+        return failure("MISSING_MODEL", "runtime auth model entry requires a model name", "input");
+    }
+    return {
+        ok: true,
+        value: {
+            modelEntryId: input.modelEntryId.trim(),
+            providerProfileRef: input.providerProfileRef.trim(),
+            model: input.model.trim(),
+            reasoning: input.reasoning,
+            contextWindowTokens: input.contextWindowTokens,
+            maxOutputTokens: input.maxOutputTokens,
+            capabilityTags: input.capabilityTags ?? [],
+            metadata: input.metadata,
+            testStatus: input.testStatus ?? { state: "unknown" },
+            publicSafe: true,
+        },
+        events: ["runtime.auth.modelEntry.created"],
+    };
+}
+export function bindRuntimeAuthRole(input) {
+    if (!hasText(input.role)) {
+        return failure("MISSING_ROLE", "runtime auth role binding requires a role", "input");
+    }
+    if (!hasText(input.providerProfileRef)) {
+        return failure("MISSING_PROFILE_REF", "runtime auth role binding requires a providerProfileRef", "input");
+    }
+    return {
+        ok: true,
+        value: {
+            role: input.role.trim(),
+            providerProfileRef: input.providerProfileRef.trim(),
+            modelEntryRef: input.modelEntryRef?.trim() || undefined,
+            enabled: input.enabled ?? true,
+            priority: input.priority ?? 0,
+            metadata: input.metadata,
+            publicSafe: true,
+        },
+        events: ["runtime.auth.roleBinding.created"],
+    };
+}
+export function createRuntimeAuthRegistry(input = {}) {
+    const profiles = new Map();
+    const modelEntries = new Map();
+    const roleBindings = [];
+    const registry = {
+        putProviderProfile(profile) {
+            profiles.set(profile.profileId, profile);
+            return profile;
+        },
+        putModelEntry(entry) {
+            modelEntries.set(entry.modelEntryId, entry);
+            return entry;
+        },
+        putRoleBinding(binding) {
+            const existing = roleBindings.findIndex((item) => item.role === binding.role && item.priority === binding.priority);
+            if (existing >= 0) {
+                roleBindings.splice(existing, 1, binding);
+            }
+            else {
+                roleBindings.push(binding);
+            }
+            roleBindings.sort((left, right) => right.priority - left.priority);
+            return binding;
+        },
+        getProviderProfile(profileRef) {
+            return profiles.get(profileRef.trim());
+        },
+        getModelEntry(modelEntryRef) {
+            return modelEntries.get(modelEntryRef.trim());
+        },
+        selectRole(role) {
+            const binding = roleBindings.find((item) => item.enabled && item.role === role);
+            if (binding === undefined) {
+                return failure("ROLE_BINDING_NOT_FOUND", "runtime auth registry did not find an enabled role binding", "registry");
+            }
+            const profile = profiles.get(binding.providerProfileRef);
+            if (profile === undefined) {
+                return failure("PROFILE_NOT_FOUND", "runtime auth role binding points to a missing provider profile", "registry");
+            }
+            const modelEntry = binding.modelEntryRef === undefined ? undefined : modelEntries.get(binding.modelEntryRef);
+            if (binding.modelEntryRef !== undefined && modelEntry === undefined) {
+                return failure("MODEL_ENTRY_NOT_FOUND", "runtime auth role binding points to a missing model entry", "registry");
+            }
+            if (modelEntry !== undefined && modelEntry.providerProfileRef !== profile.profileId) {
+                return failure("MODEL_ENTRY_PROFILE_MISMATCH", "runtime auth role binding points to a model entry owned by another provider profile", "registry");
+            }
+            return {
+                ok: true,
+                value: { profile, modelEntry, binding },
+                events: ["runtime.auth.profile.selected"],
+            };
+        },
+        snapshot() {
+            return {
+                profiles: [...profiles.values()],
+                modelEntries: [...modelEntries.values()],
+                roleBindings: [...roleBindings],
+                publicSafe: true,
+            };
+        },
+    };
+    for (const profile of input.profiles ?? [])
+        registry.putProviderProfile(profile);
+    for (const entry of input.modelEntries ?? [])
+        registry.putModelEntry(entry);
+    for (const binding of input.roleBindings ?? [])
+        registry.putRoleBinding(binding);
+    return registry;
+}

package/dist/runtimeImplementation/runtime.authPlane/runtimeAuthResolver.d.ts

@@ -0,0 +1,50 @@
+import { type CredentialRef } from "../../modelAdapter/authProfileLayer/credentialRef.js";
+import type { AuthEnvelope, ResolvedAuthEnvelope } from "../../modelAdapter/authProfileLayer/authEnvelope.js";
+import type { RuntimeAuthModelEntry, RuntimeAuthProviderProfile, RuntimeAuthRegistry, RuntimeAuthRole } from "./providerAuthRegistry.js";
+import { type RuntimeAuthSecretVault, type RuntimeAuthVaultKeyProvider, type RuntimeAuthAuditEvent } from "./secretVault.js";
+export type RuntimeAuthResolverErrorCode = "AUTH_REQUIRED" | "PROFILE_NOT_FOUND" | "MODEL_ENTRY_NOT_FOUND" | "MODEL_ENTRY_PROFILE_MISMATCH" | "CREDENTIAL_REF_NOT_FOUND" | "AMBIGUOUS_CREDENTIAL_REF" | "SECRET_NOT_FOUND" | "SECRET_UNAVAILABLE" | "SECRET_DECRYPT_FAILED" | "ROLE_BINDING_NOT_FOUND" | "INVALID_CREDENTIAL_REF" | "UNSUPPORTED_CREDENTIAL";
+export type RuntimeAuthResolverError = {
+    code: RuntimeAuthResolverErrorCode;
+    message: string;
+    boundary: "auth" | "registry" | "vault" | "credential";
+    publicSafe: true;
+};
+export type RuntimeAuthResolverSelection = {
+    role: RuntimeAuthRole;
+} | {
+    providerProfileRef: string;
+    modelEntryRef?: string;
+} | {
+    credentialRefId: string;
+    modelEntryRef?: string;
+};
+export type RuntimeAuthResolverRequest = RuntimeAuthResolverSelection & {
+    extraHeaders?: Readonly<Record<string, string>>;
+};
+export type RuntimeAuthResolverResolved = {
+    providerProfile: RuntimeAuthProviderProfile;
+    modelEntry?: RuntimeAuthModelEntry;
+    credentialRef: CredentialRef;
+    auth: AuthEnvelope;
+    resolved: ResolvedAuthEnvelope;
+    publicSafe: true;
+};
+export type RuntimeAuthResolverResult = {
+    ok: true;
+    value: RuntimeAuthResolverResolved;
+    events: readonly (string | RuntimeAuthAuditEvent)[];
+} | {
+    ok: false;
+    error: RuntimeAuthResolverError;
+    events: readonly (string | RuntimeAuthAuditEvent)[];
+};
+export type RuntimeAuthResolver = {
+    resolve(request: RuntimeAuthResolverRequest): Promise<RuntimeAuthResolverResult>;
+};
+export type RuntimeAuthResolverOptions = {
+    registry: RuntimeAuthRegistry;
+    vault: RuntimeAuthSecretVault;
+    keyProvider: RuntimeAuthVaultKeyProvider;
+    now?: () => string | Date;
+};
+export declare function createRuntimeAuthResolver(options: RuntimeAuthResolverOptions): RuntimeAuthResolver;

package/dist/runtimeImplementation/runtime.authPlane/runtimeAuthResolver.js

@@ -0,0 +1,218 @@
+/*
+ * 文件定位：Runtime / authPlane / auth resolver。
+ * 核心目的：按 providerProfileRef/modelEntryRef/credentialRef 从 vault 解密并生成 AuthEnvelope。
+ * 边界：不自动寻找密钥；没有 vault 或 keyProvider 时直接 AUTH_REQUIRED。
+ */
+import { createCredentialRef, } from "../../modelAdapter/authProfileLayer/credentialRef.js";
+import { resolveAuthEnvelope, } from "../../modelAdapter/authProfileLayer/authResolver.js";
+import { decryptRuntimeAuthSecretRecord, } from "./secretVault.js";
+function failure(code, message, boundary, events = ["runtime.auth.resolver.rejected"]) {
+    return {
+        ok: false,
+        error: { code, message, boundary, publicSafe: true },
+        events,
+    };
+}
+function materialForSecret(secret) {
+    if (secret.accessToken !== undefined) {
+        return {
+            injectedMaterial: {
+                headers: {
+                    authorization: `Bearer ${secret.accessToken}`,
+                    ...(secret.accountId !== undefined ? { "ChatGPT-Account-ID": secret.accountId } : {}),
+                },
+            },
+        };
+    }
+    if (secret.custom !== undefined && Object.keys(secret.custom).length > 0) {
+        return { injectedMaterial: { headers: secret.custom } };
+    }
+    return { injectedSecret: secret.apiKey ?? Object.values(secret.custom ?? {})[0] };
+}
+function resolverFailureFromAuth(result) {
+    if (result.ok) {
+        throw new Error("expected failed auth resolver result");
+    }
+    return failure(result.error.code === "UNSUPPORTED_CREDENTIAL_TYPE" ? "UNSUPPORTED_CREDENTIAL" : "AUTH_REQUIRED", result.error.message, "credential", result.events);
+}
+function resolverErrorCodeFromRegistry(code) {
+    if (code === "PROFILE_NOT_FOUND" ||
+        code === "MODEL_ENTRY_NOT_FOUND" ||
+        code === "MODEL_ENTRY_PROFILE_MISMATCH" ||
+        code === "ROLE_BINDING_NOT_FOUND") {
+        return code;
+    }
+    return "PROFILE_NOT_FOUND";
+}
+function hasText(value) {
+    return typeof value === "string" && value.trim().length > 0;
+}
+function timeMs(value) {
+    if (value === undefined)
+        return undefined;
+    const timestamp = value instanceof Date ? value.getTime() : Date.parse(value);
+    return Number.isFinite(timestamp) ? timestamp : undefined;
+}
+function secretUnavailableReason(secret, now) {
+    if (secret.meta.status === "revoked")
+        return "runtime auth secret has been revoked";
+    if (secret.meta.status === "expired")
+        return "runtime auth secret has expired";
+    const expiresAt = timeMs(secret.meta.expiresAt);
+    const current = timeMs(now);
+    if (expiresAt !== undefined && current !== undefined && expiresAt <= current) {
+        return "runtime auth secret expiresAt is in the past";
+    }
+    return undefined;
+}
+async function selectProfile(registry, request) {
+    if ("role" in request) {
+        const selected = registry.selectRole(request.role);
+        if (!selected.ok) {
+            return {
+                ok: false,
+                result: failure(resolverErrorCodeFromRegistry(selected.error.code), selected.error.message, "registry", selected.events),
+            };
+        }
+        return {
+            ok: true,
+            profile: selected.value.profile,
+            modelEntry: selected.value.modelEntry,
+            events: selected.events,
+        };
+    }
+    if ("credentialRefId" in request) {
+        const credentialRefId = request.credentialRefId.trim();
+        if (!hasText(credentialRefId)) {
+            return {
+                ok: false,
+                result: failure("CREDENTIAL_REF_NOT_FOUND", "runtime auth credential ref id was not found", "registry"),
+            };
+        }
+        const modelEntry = request.modelEntryRef === undefined ? undefined : registry.getModelEntry(request.modelEntryRef);
+        if (request.modelEntryRef !== undefined && modelEntry === undefined) {
+            return {
+                ok: false,
+                result: failure("MODEL_ENTRY_NOT_FOUND", "runtime auth model entry was not found", "registry"),
+            };
+        }
+        const candidates = registry.snapshot().profiles.filter((profile) => profile.credentialRef.credentialRefId === credentialRefId);
+        if (candidates.length === 0) {
+            return {
+                ok: false,
+                result: failure("CREDENTIAL_REF_NOT_FOUND", "runtime auth credential ref was not found", "registry"),
+            };
+        }
+        const profile = modelEntry === undefined
+            ? candidates.length === 1 ? candidates[0] : undefined
+            : candidates.find((candidate) => candidate.profileId === modelEntry.providerProfileRef);
+        if (profile === undefined) {
+            return {
+                ok: false,
+                result: failure(modelEntry === undefined ? "AMBIGUOUS_CREDENTIAL_REF" : "MODEL_ENTRY_PROFILE_MISMATCH", modelEntry === undefined
+                    ? "runtime auth credential ref maps to multiple provider profiles"
+                    : "runtime auth model entry belongs to a different provider profile", "registry"),
+            };
+        }
+        return { ok: true, profile, modelEntry, events: ["runtime.auth.profile.selected"] };
+    }
+    const profile = registry.getProviderProfile(request.providerProfileRef);
+    if (profile === undefined) {
+        return {
+            ok: false,
+            result: failure("PROFILE_NOT_FOUND", "runtime auth provider profile was not found", "registry"),
+        };
+    }
+    const modelEntry = request.modelEntryRef === undefined ? undefined : registry.getModelEntry(request.modelEntryRef);
+    if (request.modelEntryRef !== undefined && modelEntry === undefined) {
+        return {
+            ok: false,
+            result: failure("MODEL_ENTRY_NOT_FOUND", "runtime auth model entry was not found", "registry"),
+        };
+    }
+    if (modelEntry !== undefined && modelEntry.providerProfileRef !== profile.profileId) {
+        return {
+            ok: false,
+            result: failure("MODEL_ENTRY_PROFILE_MISMATCH", "runtime auth model entry belongs to a different provider profile", "registry"),
+        };
+    }
+    return { ok: true, profile, modelEntry, events: ["runtime.auth.profile.selected"] };
+}
+function credentialRefFor(profile) {
+    const ref = createCredentialRef({
+        id: profile.credentialRef.credentialRefId,
+        provider: profile.credentialRef.provider,
+        credentialType: profile.credentialRef.credentialType,
+        source: {
+            kind: "profile-store",
+            label: profile.credentialRef.secretId,
+        },
+    });
+    if (!ref.ok) {
+        return failure("INVALID_CREDENTIAL_REF", ref.error.message, "credential", ref.events);
+    }
+    return ref.credentialRef;
+}
+export function createRuntimeAuthResolver(options) {
+    return {
+        async resolve(request) {
+            const selected = await selectProfile(options.registry, request);
+            if (!selected.ok)
+                return selected.result;
+            const credentialRef = credentialRefFor(selected.profile);
+            if ("ok" in credentialRef)
+                return credentialRef;
+            const secret = options.vault.get(selected.profile.credentialRef.secretId);
+            if (secret === undefined) {
+                return failure("SECRET_NOT_FOUND", "runtime auth secret was not found in the injected vault", "vault", [
+                    ...selected.events,
+                    "runtime.auth.resolver.secretNotFound",
+                ]);
+            }
+            const unavailableReason = secretUnavailableReason(secret, options.now?.() ?? new Date());
+            if (unavailableReason !== undefined) {
+                return failure("SECRET_UNAVAILABLE", unavailableReason, "vault", [
+                    ...selected.events,
+                    "runtime.auth.resolver.secretUnavailable",
+                ]);
+            }
+            const decrypted = await decryptRuntimeAuthSecretRecord({
+                record: secret,
+                keyProvider: options.keyProvider,
+            });
+            if (!decrypted.ok) {
+                return failure("SECRET_DECRYPT_FAILED", decrypted.error.message, "vault", [
+                    ...selected.events,
+                    ...decrypted.events,
+                ]);
+            }
+            const material = materialForSecret(decrypted.value);
+            const auth = resolveAuthEnvelope({
+                credentialRef,
+                injectedSecret: material.injectedSecret,
+                injectedMaterial: material.injectedMaterial,
+                extraHeaders: request.extraHeaders,
+            });
+            if (!auth.ok) {
+                return resolverFailureFromAuth(auth);
+            }
+            return {
+                ok: true,
+                value: {
+                    providerProfile: selected.profile,
+                    modelEntry: selected.modelEntry,
+                    credentialRef,
+                    auth: auth.resolved.envelope,
+                    resolved: auth.resolved,
+                    publicSafe: true,
+                },
+                events: [
+                    ...selected.events,
+                    ...decrypted.events,
+                    ...auth.events,
+                    "runtime.auth.resolver.resolved",
+                ],
+            };
+        },
+    };
+}