@vellumai/plugin-api 0.10.9-dev.202607161044.1a55a2d → 0.10.9-dev.202607161241.f69e16e

package/index.d.ts

@@ -2390,6 +2390,34 @@ declare interface CopyBlockSurfaceData {
     language?: string;
 }
 
+/**
+ * Plugin-facing credential resolution.
+ *
+ * {@link resolveCredential} returns a stored credential's plaintext value — the
+ * same value `assistant credentials reveal` prints — resolving a reference that
+ * is either a credential UUID or a `"service/field"` string, exactly as the
+ * reveal path does (see {@link ../tools/credentials/resolve.resolveCredentialRef}
+ * and the `credentials/reveal` route).
+ *
+ * ## Plugin scoping
+ *
+ * When a plugin is in context — its hook or tool is executing, tracked by
+ * {@link ../plugins/plugin-execution-context.getCurrentPluginName} — resolution
+ * is restricted: the plugin may only resolve credentials whose `field` equals
+ * the plugin's own manifest name. A plugin named `acme` can therefore read
+ * `openai/acme` or `stripe/acme` but not `openai/api_key`. Outside any plugin
+ * context (host-internal callers, CLI, tests) the resolver is unscoped and
+ * behaves like a direct reveal.
+ */
+/**
+ * Raised when a credential cannot be resolved: the reference does not match a
+ * stored credential, the store is unreachable, or the calling plugin is not
+ * permitted to resolve the requested credential.
+ */
+export declare class CredentialResolutionError extends Error {
+    constructor(message: string);
+}
+
 declare interface CustomSlimSkill extends SlimSkillBase {
     origin: "custom";
 }
@@ -4764,6 +4792,16 @@ declare const RelationshipStateUpdatedEventSchema: z.ZodObject<{
     updatedAt: z.ZodString;
 }, z.core.$strip>;
 
+/**
+ * Resolve a credential reference to its plaintext value.
+ *
+ * @param ref A credential UUID or a `"service/field"` string.
+ * @returns The plaintext credential value.
+ * @throws {CredentialResolutionError} when the reference does not resolve, the
+ *   store is unreachable, or a plugin in context is not scoped to the credential.
+ */
+export declare function resolveCredential(ref: string): Promise<string>;
+
 /**
  * Plugin-facing read API over the skill surface: the locally installed
  * catalog with resolved enablement states, and the remote skill catalog —

package/index.js

@@ -1,6 +1,7 @@
 // Generated by scripts/build-plugin-api.ts — do not edit by hand.
 const api = globalThis[Symbol.for("vellum.plugin-api")] ?? {};
 export const CLI_COMMAND_HELP = api.CLI_COMMAND_HELP;
+export const CredentialResolutionError = api.CredentialResolutionError;
 export const HOOKS = api.HOOKS;
 export const INTERNAL_NUDGE_OUTPUT_SUPPRESSION = api.INTERNAL_NUDGE_OUTPUT_SUPPRESSION;
 export const RiskLevel = api.RiskLevel;
@@ -25,6 +26,7 @@ export const listCatalogSkills = api.listCatalogSkills;
 export const listConversations = api.listConversations;
 export const listInstalledSkills = api.listInstalledSkills;
 export const parseMessageMetadata = api.parseMessageMetadata;
+export const resolveCredential = api.resolveCredential;
 export const resolveMediaSourceData = api.resolveMediaSourceData;
 export const resolveUserName = api.resolveUserName;
 export const runConversationTurn = api.runConversationTurn;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/plugin-api",
-  "version": "0.10.9-dev.202607161044.1a55a2d",
+  "version": "0.10.9-dev.202607161241.f69e16e",
   "description": "Public TypeScript authoring contract for Vellum assistant plugins.",
   "license": "MIT",
   "type": "module",