@vellumai/credential-executor 0.10.7 → 0.10.8-dev.202607102228.5945895

package/src/__tests__/managed-integration.test.ts

@@ -21,14 +21,17 @@ import { afterEach, describe, expect, test } from "bun:test";
 import { mkdirSync, mkdtempSync, rmSync, unlinkSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { createConnection, createServer as createNetServer, type Socket } from "node:net";
+import {
+  createConnection,
+  createServer as createNetServer,
+  type Socket,
+} from "node:net";
 import { Readable, Writable } from "node:stream";
 
 import {
   CES_PROTOCOL_VERSION,
   CesRpcMethod,
   type HandshakeAck,
-  type ListGrantsResponse,
   type GetCredentialResponse,
   type SetCredentialResponse,
   type DeleteCredentialResponse,
@@ -36,13 +39,11 @@ import {
   type RpcEnvelope,
 } from "@vellumai/service-contracts/credential-rpc";
 
-import { PersistentGrantStore } from "../grants/persistent-store.js";
-import { AuditStore } from "../audit/store.js";
 import {
-  createListGrantsHandler,
-  createListAuditRecordsHandler,
-} from "../grants/rpc-handlers.js";
-import { CesRpcServer, type RpcHandlerRegistry, type ServeEndReason } from "../server.js";
+  CesRpcServer,
+  type RpcHandlerRegistry,
+  type ServeEndReason,
+} from "../server.js";
 import { createLocalSecureKeyBackend } from "../materializers/local-secure-key-backend.js";
 
 // ---------------------------------------------------------------------------
@@ -83,40 +84,11 @@ function restoreEnv(saved: SavedEnv): void {
 // Helpers
 // ---------------------------------------------------------------------------
 
-/**
- * Build a minimal RPC handler registry with `list_grants` and
- * `list_audit_records` backed by real stores in a temp directory.
- */
-function buildMinimalHandlers(dataDir: string): RpcHandlerRegistry {
-  const grantsDir = join(dataDir, "grants");
-  const auditDir = join(dataDir, "audit");
-  mkdirSync(grantsDir, { recursive: true });
-  mkdirSync(auditDir, { recursive: true });
-
-  const persistentGrantStore = new PersistentGrantStore(grantsDir);
-  persistentGrantStore.init();
-
-  const auditStore = new AuditStore(auditDir);
-  auditStore.init();
-
-  const handlers: RpcHandlerRegistry = {};
-
-  handlers[CesRpcMethod.ListGrants] = createListGrantsHandler({
-    persistentGrantStore,
-  }) as typeof handlers[string];
-
-  handlers[CesRpcMethod.ListAuditRecords] = createListAuditRecordsHandler({
-    auditStore,
-  }) as typeof handlers[string];
-
-  return handlers;
-}
-
 /**
  * Build an RPC handler registry with credential CRUD handlers backed by
  * a real SecureKeyBackend using a temp directory for credential storage.
  *
- * Mirrors the handler registration in managed-main.ts.
+ * Mirrors the handler registration in main.ts.
  */
 function buildCredentialHandlers(vellumRoot: string): RpcHandlerRegistry {
   const secureKeyBackend = createLocalSecureKeyBackend(vellumRoot);
@@ -125,22 +97,27 @@ function buildCredentialHandlers(vellumRoot: string): RpcHandlerRegistry {
   handlers[CesRpcMethod.GetCredential] = (async (req: { account: string }) => {
     const value = await secureKeyBackend.get(req.account);
     return { found: value !== undefined, value };
-  }) as typeof handlers[string];
+  }) as (typeof handlers)[string];
 
-  handlers[CesRpcMethod.SetCredential] = (async (req: { account: string; value: string }) => {
+  handlers[CesRpcMethod.SetCredential] = (async (req: {
+    account: string;
+    value: string;
+  }) => {
     const ok = await secureKeyBackend.set(req.account, req.value);
     return { ok };
-  }) as typeof handlers[string];
+  }) as (typeof handlers)[string];
 
-  handlers[CesRpcMethod.DeleteCredential] = (async (req: { account: string }) => {
+  handlers[CesRpcMethod.DeleteCredential] = (async (req: {
+    account: string;
+  }) => {
     const result = await secureKeyBackend.delete(req.account);
     return { result };
-  }) as typeof handlers[string];
+  }) as (typeof handlers)[string];
 
   handlers[CesRpcMethod.ListCredentials] = (async () => {
     const accounts = await secureKeyBackend.list();
     return { accounts };
-  }) as typeof handlers[string];
+  }) as (typeof handlers)[string];
 
   return handlers;
 }
@@ -149,10 +126,13 @@ function buildCredentialHandlers(vellumRoot: string): RpcHandlerRegistry {
  * Accept a single connection on a Unix socket and return
  * readable/writable streams plus cleanup helpers.
  *
- * Replicates the same accept-one-connection pattern from managed-main.ts
+ * Replicates the same accept-one-connection pattern from main.ts
  * but in a test-friendly form.
  */
-function acceptOneConnection(socketPath: string, signal: AbortSignal): Promise<{
+function acceptOneConnection(
+  socketPath: string,
+  signal: AbortSignal,
+): Promise<{
   readable: Readable;
   writable: Writable;
   socket: Socket;
@@ -162,7 +142,11 @@ function acceptOneConnection(socketPath: string, signal: AbortSignal): Promise<{
 
     const cleanup = () => {
       netServer.close();
-      try { unlinkSync(socketPath); } catch { /* ok */ }
+      try {
+        unlinkSync(socketPath);
+      } catch {
+        /* ok */
+      }
     };
 
     if (signal.aborted) {
@@ -170,10 +154,14 @@ function acceptOneConnection(socketPath: string, signal: AbortSignal): Promise<{
       return;
     }
 
-    signal.addEventListener("abort", () => {
-      cleanup();
-      reject(new Error("Aborted while waiting for connection"));
-    }, { once: true });
+    signal.addEventListener(
+      "abort",
+      () => {
+        cleanup();
+        reject(new Error("Aborted while waiting for connection"));
+      },
+      { once: true },
+    );
 
     netServer.on("error", (err: Error) => {
       cleanup();
@@ -186,11 +174,19 @@ function acceptOneConnection(socketPath: string, signal: AbortSignal): Promise<{
 
     netServer.on("connection", (sock: Socket) => {
       netServer.close();
-      try { unlinkSync(socketPath); } catch { /* ok */ }
+      try {
+        unlinkSync(socketPath);
+      } catch {
+        /* ok */
+      }
 
       const readable = new Readable({ read() {} });
       const writable = new Writable({
-        write(chunk: Buffer, _encoding: string, callback: (err?: Error | null) => void) {
+        write(
+          chunk: Buffer,
+          _encoding: string,
+          callback: (err?: Error | null) => void,
+        ) {
           if (sock.writable) {
             sock.write(chunk, callback);
           } else {
@@ -256,7 +252,11 @@ function connectToSocket(
  * Read newline-delimited JSON messages from a socket, collecting them
  * until the expected count is reached or a timeout fires.
  */
-function readMessages(sock: Socket, expectedCount: number, timeoutMs = 3000): Promise<unknown[]> {
+function readMessages(
+  sock: Socket,
+  expectedCount: number,
+  timeoutMs = 3000,
+): Promise<unknown[]> {
   return new Promise((resolve, reject) => {
     const messages: unknown[] = [];
     let buffer = "";
@@ -329,7 +329,9 @@ afterEach(async () => {
   if (tmpDir) {
     try {
       rmSync(tmpDir, { recursive: true, force: true });
-    } catch { /* ok */ }
+    } catch {
+      /* ok */
+    }
   }
 });
 
@@ -367,7 +369,7 @@ describe("managed CES integration (real Unix socket)", () => {
 
     // -- Start health server ---------------------------------------------------
     // NOTE: This uses a local Bun.serve mock rather than the production
-    // `startHealthServer()` from managed-main.ts. The production function is
+    // `startHealthServer()` from main.ts. The production function is
     // not exported and depends on module-level mutable state (the
     // `rpcConnected` flag) that cannot be controlled from tests.
     //
@@ -377,7 +379,7 @@ describe("managed CES integration (real Unix socket)", () => {
     //   - End-to-end socket + RPC + health plumbing in one integration flow.
     //
     // What this does NOT cover:
-    //   - The actual `startHealthServer()` implementation in managed-main.ts,
+    //   - The actual `startHealthServer()` implementation in main.ts,
     //     including the `rpcConnected` field in the /readyz response. If the
     //     production health handler drifts (changes routes, status codes, or
     //     response shape), this test will not catch it. To close that gap,
@@ -388,10 +390,9 @@ describe("managed CES integration (real Unix socket)", () => {
       fetch(req) {
         const url = new URL(req.url);
         if (url.pathname === "/healthz") {
-          return new Response(
-            JSON.stringify({ status: "ok" }),
-            { headers: { "Content-Type": "application/json" } },
-          );
+          return new Response(JSON.stringify({ status: "ok" }), {
+            headers: { "Content-Type": "application/json" },
+          });
         }
         if (url.pathname === "/readyz") {
           return new Response(
@@ -404,7 +405,10 @@ describe("managed CES integration (real Unix socket)", () => {
     });
 
     // -- Start accept-one-connection on the Unix socket ------------------------
-    const connectionPromise = acceptOneConnection(socketPath, controller.signal);
+    const connectionPromise = acceptOneConnection(
+      socketPath,
+      controller.signal,
+    );
 
     // -- Client connects -------------------------------------------------------
     clientSocket = await connectToSocket(socketPath);
@@ -413,7 +417,7 @@ describe("managed CES integration (real Unix socket)", () => {
     const conn = await connectionPromise;
 
     let observedSessionId = "";
-    const handlers = buildMinimalHandlers(dataDir);
+    const handlers = buildCredentialHandlers(dataDir);
 
     serverRpcServer = new CesRpcServer({
       input: conn.readable,
@@ -454,13 +458,13 @@ describe("managed CES integration (real Unix socket)", () => {
     expect(observedSessionId).toBe(handshakeSessionId);
     expect(serverRpcServer.currentSessionId).toBe(handshakeSessionId);
 
-    // -- Step 2: RPC dispatch (list_grants) ------------------------------------
+    // -- Step 2: RPC dispatch (list_credentials) -------------------------------
     const rpcId = "rpc-1";
     sendMessage(clientSocket, {
       type: "rpc",
       id: rpcId,
       kind: "request",
-      method: CesRpcMethod.ListGrants,
+      method: CesRpcMethod.ListCredentials,
       payload: {},
       timestamp: new Date().toISOString(),
     });
@@ -472,34 +476,33 @@ describe("managed CES integration (real Unix socket)", () => {
     expect(rpcResp.type).toBe("rpc");
     expect(rpcResp.id).toBe(rpcId);
     expect(rpcResp.kind).toBe("response");
-    expect(rpcResp.method).toBe(CesRpcMethod.ListGrants);
+    expect(rpcResp.method).toBe(CesRpcMethod.ListCredentials);
 
-    const grantsPayload = rpcResp.payload as ListGrantsResponse;
-    expect(grantsPayload.grants).toEqual([]);
+    const listPayload = rpcResp.payload as { accounts: string[] };
+    expect(listPayload.accounts).toEqual([]);
 
-    // -- Step 3: RPC dispatch (list_audit_records) -----------------------------
-    const auditRpcId = "rpc-2";
+    // -- Step 3: RPC dispatch (get_credential, not found) ----------------------
+    const getRpcId = "rpc-2";
     sendMessage(clientSocket, {
       type: "rpc",
-      id: auditRpcId,
+      id: getRpcId,
       kind: "request",
-      method: CesRpcMethod.ListAuditRecords,
-      payload: {},
+      method: CesRpcMethod.GetCredential,
+      payload: { account: "does-not-exist" },
       timestamp: new Date().toISOString(),
     });
 
-    const auditMessages = await readMessages(clientSocket, 1);
-    expect(auditMessages.length).toBe(1);
+    const getMessages = await readMessages(clientSocket, 1);
+    expect(getMessages.length).toBe(1);
 
-    const auditResp = auditMessages[0] as RpcEnvelope & { type: "rpc" };
-    expect(auditResp.type).toBe("rpc");
-    expect(auditResp.id).toBe(auditRpcId);
-    expect(auditResp.kind).toBe("response");
-    expect(auditResp.method).toBe(CesRpcMethod.ListAuditRecords);
+    const getResp = getMessages[0] as RpcEnvelope & { type: "rpc" };
+    expect(getResp.type).toBe("rpc");
+    expect(getResp.id).toBe(getRpcId);
+    expect(getResp.kind).toBe("response");
+    expect(getResp.method).toBe(CesRpcMethod.GetCredential);
 
-    const auditPayload = auditResp.payload as { records: unknown[]; nextCursor: string | null };
-    expect(auditPayload.records).toEqual([]);
-    expect(auditPayload.nextCursor).toBeNull();
+    const getPayload = getResp.payload as { found: boolean };
+    expect(getPayload.found).toBe(false);
 
     // -- Step 4: Health endpoint -----------------------------------------------
     const healthzResp = await fetch(`http://localhost:${healthPort}/healthz`);
@@ -529,7 +532,10 @@ describe("managed CES integration (real Unix socket)", () => {
     const unknownResp = unknownMessages[0] as RpcEnvelope & { type: "rpc" };
     expect(unknownResp.id).toBe(unknownRpcId);
     expect(unknownResp.kind).toBe("response");
-    const unknownPayload = unknownResp.payload as { success: boolean; error: { code: string } };
+    const unknownPayload = unknownResp.payload as {
+      success: boolean;
+      error: { code: string };
+    };
     expect(unknownPayload.error.code).toBe("METHOD_NOT_FOUND");
 
     // -- Cleanup ---------------------------------------------------------------
@@ -552,7 +558,10 @@ describe("managed CES integration (real Unix socket)", () => {
 
     controller = new AbortController();
 
-    const connectionPromise = acceptOneConnection(socketPath, controller.signal);
+    const connectionPromise = acceptOneConnection(
+      socketPath,
+      controller.signal,
+    );
     clientSocket = await connectToSocket(socketPath);
     const conn = await connectionPromise;
 
@@ -601,11 +610,14 @@ describe("managed CES integration (real Unix socket)", () => {
 
     controller = new AbortController();
 
-    const connectionPromise = acceptOneConnection(socketPath, controller.signal);
+    const connectionPromise = acceptOneConnection(
+      socketPath,
+      controller.signal,
+    );
     clientSocket = await connectToSocket(socketPath);
     const conn = await connectionPromise;
 
-    const handlers = buildMinimalHandlers(dataDir);
+    const handlers = buildCredentialHandlers(dataDir);
     serverRpcServer = new CesRpcServer({
       input: conn.readable,
       output: conn.writable,
@@ -621,7 +633,7 @@ describe("managed CES integration (real Unix socket)", () => {
       type: "rpc",
       id: "pre-hs-1",
       kind: "request",
-      method: CesRpcMethod.ListGrants,
+      method: CesRpcMethod.ListCredentials,
       payload: {},
       timestamp: new Date().toISOString(),
     });
@@ -632,7 +644,10 @@ describe("managed CES integration (real Unix socket)", () => {
     const resp = messages[0] as RpcEnvelope & { type: "rpc" };
     expect(resp.id).toBe("pre-hs-1");
     expect(resp.kind).toBe("response");
-    const payload = resp.payload as { success: boolean; error: { code: string } };
+    const payload = resp.payload as {
+      success: boolean;
+      error: { code: string };
+    };
     expect(payload.error.code).toBe("HANDSHAKE_REQUIRED");
 
     clientSocket.end();
@@ -649,7 +664,10 @@ describe("managed CES integration (real Unix socket)", () => {
 
     controller = new AbortController();
 
-    const connectionPromise = acceptOneConnection(socketPath, controller.signal);
+    const connectionPromise = acceptOneConnection(
+      socketPath,
+      controller.signal,
+    );
 
     // First connection succeeds
     clientSocket = await connectToSocket(socketPath);
@@ -700,7 +718,10 @@ describe("credential CRUD RPC", () => {
 
     controller = new AbortController();
 
-    const connectionPromise = acceptOneConnection(socketPath, controller.signal);
+    const connectionPromise = acceptOneConnection(
+      socketPath,
+      controller.signal,
+    );
     clientSocket = await connectToSocket(socketPath);
     const conn = await connectionPromise;
 

package/src/__tests__/managed-reconnect.test.ts

@@ -1,7 +1,7 @@
 /**
  * Managed CES reconnection test (real entrypoint subprocess).
  *
- * Spawns the actual `managed-main.ts` entrypoint and verifies that the CES
+ * Spawns the actual `main.ts` entrypoint and verifies that the CES
  * sidecar survives the assistant disconnecting and accepts a reconnection,
  * rather than shutting down when the RPC stream ends.
  *
@@ -179,7 +179,7 @@ describe("managed CES reconnection (real entrypoint)", () => {
     mkdirSync(join(assistantDataMount, ".vellum"), { recursive: true });
 
     const healthPort = await pickFreePort();
-    const managedMain = resolve(__dirname, "..", "managed-main.ts");
+    const managedMain = resolve(__dirname, "..", "main.ts");
 
     proc = Bun.spawn({
       cmd: [process.execPath, managedMain],

package/src/__tests__/transport.test.ts

@@ -125,39 +125,28 @@ function createTestServer(handlers: RpcHandlerRegistry = {}) {
 // ---------------------------------------------------------------------------
 
 describe("managed entrypoint transport isolation", () => {
-  test("managed-main.ts does not call Bun.serve for RPC (only health)", () => {
+  test("main.ts uses Bun.serve only for health probes (managed mode)", () => {
     const src = readFileSync(
-      resolve(__dirname, "..", "managed-main.ts"),
+      resolve(__dirname, "..", "main.ts"),
       "utf-8",
     );
-    // Bun.serve calls in managed-main should only be in startHealthServer
+    // Bun.serve is used for the health server in managed mode
     const bunServeMatches = src.match(/Bun\.serve\(/g);
     expect(bunServeMatches).not.toBeNull();
     // There should be exactly 1 Bun.serve call — for health probes only
     expect(bunServeMatches!.length).toBe(1);
   });
 
-  test("managed-main.ts uses createNetServer for Unix socket, not Bun.serve", () => {
+  test("main.ts uses createNetServer for Unix socket transport", () => {
     const src = readFileSync(
-      resolve(__dirname, "..", "managed-main.ts"),
+      resolve(__dirname, "..", "main.ts"),
       "utf-8",
     );
-    // Uses node:net createServer for the bootstrap socket
+    // Uses node:net createServer for the socket transport (both modes)
     expect(src).toMatch(/createNetServer/);
     // The net server never listens on a TCP port (only a socket path)
     expect(src).not.toMatch(/netServer\.listen\(\d+/);
   });
-
-  test("managed-main.ts unlinks socket after accepting one connection", () => {
-    const src = readFileSync(
-      resolve(__dirname, "..", "managed-main.ts"),
-      "utf-8",
-    );
-    // Should unlink the socket path after connection
-    expect(src).toMatch(/unlinkSync\(socketPath\)/);
-    // Should close the net server after one connection
-    expect(src).toMatch(/netServer\.close\(\)/);
-  });
 });
 
 // ---------------------------------------------------------------------------
@@ -165,9 +154,9 @@ describe("managed entrypoint transport isolation", () => {
 // ---------------------------------------------------------------------------
 
 describe("health probes", () => {
-  test("managed-main.ts serves /healthz and /readyz on a separate port", () => {
+  test("main.ts serves /healthz and /readyz in managed mode", () => {
     const src = readFileSync(
-      resolve(__dirname, "..", "managed-main.ts"),
+      resolve(__dirname, "..", "main.ts"),
       "utf-8",
     );
     expect(src).toMatch(/\/healthz/);
@@ -203,18 +192,25 @@ describe("health probes", () => {
 });
 
 // ---------------------------------------------------------------------------
-// 3. Local stdio transport not inherited by subprocesses
+// 3. Local socket transport not inherited by subprocesses
 // ---------------------------------------------------------------------------
 
 describe("local entrypoint transport isolation", () => {
-  test("main.ts serves over stdio or a Unix socket, never a TCP listener", () => {
+  test("main.ts serves over a Unix socket, never stdio or a TCP listener", () => {
     const src = readFileSync(resolve(__dirname, "..", "main.ts"), "utf-8");
-    // Serves the stdio-child transport (default mode).
-    expect(src).toMatch(/process\.stdin/);
-    expect(src).toMatch(/process\.stdout/);
-    // Standalone mode (CES_STANDALONE=1) listens on a Unix socket path only —
-    // never a numeric TCP port — and never opens an HTTP server.
-    expect(src).not.toMatch(/Bun\.serve\(/);
+    // Socket transport only — no stdio-child transport.
+    expect(src).not.toMatch(/process\.stdin/);
+    expect(src).not.toMatch(/process\.stdout/);
+    // Bun.serve is only used inside the managed-mode health server block
+    // (startHealthServer), never for RPC transport. The RPC transport uses
+    // node:net createServer listening on a Unix socket path.
+    const bunServeMatches = src.match(/Bun\.serve\(/g);
+    expect(bunServeMatches).not.toBeNull();
+    expect(bunServeMatches!.length).toBe(1);
+    // The Bun.serve call must be inside the startHealthServer function, which
+    // is only invoked in managed mode.
+    expect(src).toMatch(/function startHealthServer/);
+    // Never listens on a numeric TCP port for RPC transport.
     expect(src).not.toMatch(/\.listen\(\d+/);
   });
 

package/src/cli.ts

@@ -25,7 +25,7 @@ import { homedir } from "node:os";
 import { createLocalSecureKeyBackend } from "./materializers/local-secure-key-backend.js";
 
 // ---------------------------------------------------------------------------
-// Path resolution (mirrors managed-main.ts)
+// Path resolution (mirrors the managed-mode path in main.ts)
 // ---------------------------------------------------------------------------
 
 function resolveVellumRoot(): string {

package/src/index.ts

@@ -2,108 +2,28 @@
 /**
  * @vellumai/credential-executor
  *
- * Credential Execution Service (CES) — an isolated runtime that executes
- * credential-bearing tool operations on behalf of untrusted agents. The CES
- * receives RPC requests from the assistant daemon, materialises credentials
- * from the local credential store, executes the requested operation through
- * the egress proxy, and returns sanitised results.
+ * Credential Execution Service (CES) — an isolated runtime that stores and
+ * serves credentials on behalf of the assistant daemon over RPC. The CES owns
+ * the credential store and exposes credential CRUD operations (get, set,
+ * delete, list, bulk-set) plus the managed-credential update handshake.
  *
- * This module re-exports the public API surface. For entrypoints see:
- * - `main.ts` — local mode (stdio transport, child process)
- * - `managed-main.ts` — managed mode (Unix socket transport, sidecar)
+ * This module re-exports the public API surface. For the entrypoint see
+ * `main.ts` — unified for both local (bare-metal sibling) and managed
+ * (Kubernetes sidecar) modes, selected by `getCesMode()`.
  */
 
-export {
-  CesRpcServer,
-  createCesServer,
-  createRunAuthenticatedCommandHandler,
-  registerCommandExecutionHandler,
-  createMakeAuthenticatedRequestHandler,
-  createManageSecureCommandToolHandler,
-  registerManageSecureCommandToolHandler,
-  buildHandlersWithHttp,
-} from "./server.js";
+export { CesRpcServer, createCesServer } from "./server.js";
 export type {
   CesServerOptions,
-  ManageSecureCommandToolHandlerDeps,
   RpcHandlerRegistry,
   RpcMethodHandler,
-  RunAuthenticatedCommandHandlerOptions,
   SessionContext,
 } from "./server.js";
 
 export {
   getCesDataRoot,
-  getCesGrantsDir,
-  getCesAuditDir,
-  getCesToolStoreDir,
   getCesMode,
   getBootstrapSocketPath,
   getHealthPort,
 } from "./paths.js";
 export type { CesMode } from "./paths.js";
-
-export { PersistentGrantStore, TemporaryGrantStore } from "./grants/index.js";
-export type {
-  PersistentGrant,
-  TemporaryGrant,
-  TemporaryGrantKind,
-} from "./grants/index.js";
-
-export { computeDigest, verifyDigest } from "./toolstore/integrity.js";
-export type { DigestVerificationResult } from "./toolstore/integrity.js";
-
-export {
-  isValidSha256Hex,
-  validateSourceUrl,
-  isWorkspaceOriginPath,
-} from "./toolstore/manifest.js";
-export type {
-  BundleOrigin,
-  ToolstoreManifest,
-} from "./toolstore/manifest.js";
-
-export {
-  publishBundle,
-  readPublishedManifest,
-  isBundlePublished,
-  getBundleDir,
-  getBundleManifestPath,
-  getBundleContentPath,
-} from "./toolstore/publish.js";
-export type {
-  PublishRequest,
-  PublishResult,
-} from "./toolstore/publish.js";
-
-export { resolveLocalSubject } from "./subjects/local.js";
-export type {
-  ResolvedStaticSubject,
-  ResolvedOAuthSubject,
-  ResolvedLocalSubject,
-  SubjectResolutionResult,
-  OAuthConnectionLookup,
-  LocalSubjectResolverDeps,
-} from "./subjects/local.js";
-
-export { LocalMaterialiser } from "./materializers/local.js";
-export type {
-  MaterialisedCredential,
-  MaterialisationResult,
-  TokenRefreshFn,
-  LocalMaterialiserDeps,
-} from "./materializers/local.js";
-
-export { executeAuthenticatedCommand } from "./commands/executor.js";
-export type {
-  ExecuteCommandRequest,
-  ExecuteCommandResult,
-  CommandExecutorDeps,
-  MaterializeCredentialFn,
-  MaterializeCredentialResult,
-} from "./commands/executor.js";
-
-export { executeAuthenticatedHttpRequest } from "./http/executor.js";
-export type { HttpExecutorDeps } from "./http/executor.js";
-
-export { MANAGED_LOCAL_STATIC_REJECTION_ERROR } from "./managed-errors.js";