melchizedek-agents 1.3.1 → 1.5.0

package/db/hardening.sql

@@ -30,6 +30,27 @@
 -- The A2A server checks at boot whether this file has been applied and
 -- prints a prominent warning if not (see lib/persistence/supabaseProvider.ts).
 
+-- ── The API roles ────────────────────────────────────────────────────────
+-- anon and authenticated are Supabase's PostgREST roles. Plain Postgres and
+-- embedded Postgres (PGlite) have no REST API and normally no such roles;
+-- there, the PUBLIC revokes and RLS below are the whole lockdown, and the
+-- revokes by role name are skipped rather than failing. These two helpers
+-- live in pg_temp: they exist for this session only and leave nothing behind.
+CREATE OR REPLACE FUNCTION pg_temp.melchizedek_api_roles() RETURNS text
+LANGUAGE sql AS $$
+  SELECT string_agg(quote_ident(rolname), ', ' ORDER BY rolname)
+  FROM pg_roles WHERE rolname IN ('anon', 'authenticated');
+$$;
+
+CREATE OR REPLACE FUNCTION pg_temp.melchizedek_revoke_api(target text) RETURNS void
+LANGUAGE plpgsql AS $$
+DECLARE roles text := pg_temp.melchizedek_api_roles();
+BEGIN
+  IF roles IS NOT NULL THEN
+    EXECUTE format('REVOKE ALL ON %s FROM %s', target, roles);
+  END IF;
+END $$;
+
 -- ── Tier 1: lock the public API paths ────────────────────────────────────
 
 -- Enable RLS. With RLS on and NO policies defined, anon/authenticated get
@@ -40,8 +61,11 @@ ALTER TABLE adk_sessions     ENABLE ROW LEVEL SECURITY;
 -- Belt and suspenders: also revoke the default table privileges from the
 -- API roles, so even a future accidentally-created permissive policy
 -- cannot re-expose the tables.
-REVOKE ALL ON adk_memory_facts FROM anon, authenticated;
-REVOKE ALL ON adk_sessions     FROM anon, authenticated;
+DO $$
+BEGIN
+  PERFORM pg_temp.melchizedek_revoke_api('adk_memory_facts');
+  PERFORM pg_temp.melchizedek_revoke_api('adk_sessions');
+END $$;
 
 -- Optional observability ledger (db/telemetry.sql). Guarded: the tables only
 -- exist when the operator opted into TELEMETRY_SUPABASE. adk_turns holds
@@ -54,14 +78,14 @@ BEGIN
                             'adk_session_events', 'adk_a2a_tasks', 'melchizedek_usage', 'melchizedek_audit'] LOOP
     IF to_regclass('public.' || t) IS NOT NULL THEN
       EXECUTE format('ALTER TABLE %I ENABLE ROW LEVEL SECURITY', t);
-      EXECUTE format('REVOKE ALL ON %I FROM anon, authenticated', t);
+      PERFORM pg_temp.melchizedek_revoke_api(format('%I', t));
     END IF;
   END LOOP;
   -- The production view and the retention function read/delete those
   -- tables on behalf of the caller; neither belongs on the public API.
   FOREACH t IN ARRAY ARRAY['adk_turns_production', 'adk_kpi_daily', 'adk_kpi_routes_daily', 'adk_kpi_judges_daily', 'adk_kpi_hourly'] LOOP
     IF to_regclass('public.' || t) IS NOT NULL THEN
-      EXECUTE format('REVOKE ALL ON %I FROM anon, authenticated', t);
+      PERFORM pg_temp.melchizedek_revoke_api(format('%I', t));
     END IF;
   END LOOP;
   -- Function privileges for these are handled in the FUNCTIONS block below.
@@ -73,7 +97,7 @@ DO $$
 BEGIN
   IF to_regclass('public.melchizedek_schema_version') IS NOT NULL THEN
     EXECUTE 'ALTER TABLE melchizedek_schema_version ENABLE ROW LEVEL SECURITY';
-    EXECUTE 'REVOKE ALL ON melchizedek_schema_version FROM anon, authenticated';
+    PERFORM pg_temp.melchizedek_revoke_api('melchizedek_schema_version');
   END IF;
 END $$;
 
@@ -84,29 +108,29 @@ DO $$
 BEGIN
   IF to_regclass('public.adk_agent_registry') IS NOT NULL THEN
     EXECUTE 'ALTER TABLE adk_agent_registry ENABLE ROW LEVEL SECURITY';
-    EXECUTE 'REVOKE ALL ON adk_agent_registry FROM anon, authenticated';
+    PERFORM pg_temp.melchizedek_revoke_api('adk_agent_registry');
   END IF;
   -- The task tools' lists and job queue (migration 0009).
   IF to_regclass('public.melchizedek_tasks') IS NOT NULL THEN
     EXECUTE 'ALTER TABLE melchizedek_tasks ENABLE ROW LEVEL SECURITY';
     EXECUTE 'ALTER TABLE melchizedek_task_owners ENABLE ROW LEVEL SECURITY';
-    EXECUTE 'REVOKE ALL ON melchizedek_tasks, melchizedek_task_owners FROM anon, authenticated';
+    PERFORM pg_temp.melchizedek_revoke_api('melchizedek_tasks, melchizedek_task_owners');
   END IF;
   -- The memory processed marker (migration 0007): identifiers only.
   IF to_regclass('public.melchizedek_memory_ingest') IS NOT NULL THEN
     EXECUTE 'ALTER TABLE melchizedek_memory_ingest ENABLE ROW LEVEL SECURITY';
-    EXECUTE 'REVOKE ALL ON melchizedek_memory_ingest FROM anon, authenticated';
+    PERFORM pg_temp.melchizedek_revoke_api('melchizedek_memory_ingest');
   END IF;
   -- Third-party tokens held for tools (migration 0013): ciphertext only,
   -- still nothing an API role should read.
   IF to_regclass('public.melchizedek_tool_credentials') IS NOT NULL THEN
     EXECUTE 'ALTER TABLE melchizedek_tool_credentials ENABLE ROW LEVEL SECURITY';
-    EXECUTE 'REVOKE ALL ON melchizedek_tool_credentials FROM anon, authenticated';
+    PERFORM pg_temp.melchizedek_revoke_api('melchizedek_tool_credentials');
   END IF;
   -- Its history (migration 0005): every definition an id has held.
   IF to_regclass('public.adk_agent_registry_versions') IS NOT NULL THEN
     EXECUTE 'ALTER TABLE adk_agent_registry_versions ENABLE ROW LEVEL SECURITY';
-    EXECUTE 'REVOKE ALL ON adk_agent_registry_versions FROM anon, authenticated';
+    PERFORM pg_temp.melchizedek_revoke_api('adk_agent_registry_versions');
   END IF;
 END $$;
 
@@ -141,7 +165,8 @@ BEGIN
                         'melchizedek_memory_dimensions', 'melchizedek_prune_memory_ingest',
                         'melchizedek_prune_memory', 'melchizedek_prune_audit')
   LOOP
-    EXECUTE format('REVOKE ALL ON FUNCTION %s FROM PUBLIC, anon, authenticated', fn);
+    EXECUTE format('REVOKE ALL ON FUNCTION %s FROM PUBLIC', fn);
+    PERFORM pg_temp.melchizedek_revoke_api(format('FUNCTION %s', fn));
     IF has_service_role THEN
       EXECUTE format('GRANT EXECUTE ON FUNCTION %s TO service_role', fn);
     END IF;
@@ -170,9 +195,10 @@ AS $$
                       'melchizedek_audit', 'melchizedek_tool_credentials');
 $$;
 
-REVOKE ALL ON FUNCTION melchizedek_rls_status() FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION melchizedek_rls_status() FROM PUBLIC;
 DO $$
 BEGIN
+  PERFORM pg_temp.melchizedek_revoke_api('FUNCTION melchizedek_rls_status()');
   IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'service_role') THEN
     GRANT EXECUTE ON FUNCTION melchizedek_rls_status() TO service_role;
   END IF;

package/dist/lib/a2a/app.js

@@ -68,6 +68,7 @@ import { setOAuthHosts } from '../tools/oauthHosts.js';
 import { setCredentialHosts } from '../tools/credentialHosts.js';
 import { syndicateCredentialHostProblems } from '../tools/credentialUses.js';
 import { syndicateOAuthHostProblems } from '../tools/oauthTools.js';
+import { credentialValue } from '../models/credentialSource.js';
 const SURFACE_HEADERS = [
     ['x-surface', 'name'],
     ['x-surface-guild', 'guild'],
@@ -335,7 +336,7 @@ export async function createA2AApp(options) {
         // Embeddings and fact extraction use the SERVER's Gemini key: memory is
         // operator infrastructure, like tools.
         const services = await createSupabaseServices({
-            apiKey: process.env.GOOGLE_GENAI_API_KEY || process.env.GEMINI_API_KEY || '',
+            apiKey: credentialValue('GOOGLE_GENAI_API_KEY') || credentialValue('GEMINI_API_KEY') || '',
             withMemory: true,
             extractor: options.memory?.extractor,
             embedder: options.memory?.embedder,

package/dist/lib/chatgpt/state.js

@@ -21,8 +21,9 @@
  * times and the file's path.
  */
 import { existsSync, readFileSync, statSync } from 'node:fs';
-import { homedir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
+import { chatGptSignInFile } from '../paths.js';
+import { credentialEnv } from '../models/credentialSource.js';
 /** Where the credential file lives, when not the default (a path; never a value). */
 export const CHATGPT_SIGNIN_FILE_ENV = 'MELCHIZEDEK_CHATGPT_SIGNIN_FILE';
 /** `off` ignores a stored sign-in (a served process on a machine that also signed in). */
@@ -31,8 +32,7 @@ export const CHATGPT_SIGNIN_ENV = 'MELCHIZEDEK_CHATGPT_SIGNIN';
 export const PLAN_SCOPE = 'chatgpt.tokens.use.direct';
 /** The credential file: MELCHIZEDEK_CHATGPT_SIGNIN_FILE, else ~/.melchizedek/chatgpt-signin.json. */
 export function signInFile(env = process.env) {
-    const set = env[CHATGPT_SIGNIN_FILE_ENV]?.trim();
-    return set ? resolve(set) : join(homedir(), '.melchizedek', 'chatgpt-signin.json');
+    return chatGptSignInFile(env);
 }
 /** The git work tree a path sits inside, if any (an ancestor holding `.git`). */
 export function insideGitWorkTree(file) {
@@ -100,7 +100,7 @@ export function chatGptSignInStatus(env = process.env) {
  * OPENAI_PLATFORM other than direct, no OPENAI_BASE_URL proxy, which must
  * never receive the token).
  */
-export function chatGptSignInRoutesOpenAi(env = process.env) {
+export function chatGptSignInRoutesOpenAi(env = credentialEnv()) {
     if (env.OPENAI_API_KEY?.trim())
         return false;
     const platform = env.OPENAI_PLATFORM?.trim().toLowerCase();

package/dist/lib/compile.js

@@ -42,7 +42,7 @@ import { REASONING_OLDER_SPELLING } from './syndicateSchema.js';
 import { reasoningConfig } from './models/reasoning.js';
 import { instructionFor, toEngineAgent } from './agentDialect.js';
 import { resolveTools as resolveNamedTools } from './toolRegistry.js';
-import { createMcpTools } from './tools/mcpToolFactory.js';
+import { createMcpTools, loadStdioMcpTools } from './tools/mcpToolFactory.js';
 import { requireApproval, toolOf } from './tools/tool.js';
 import { examplesInstructionTool } from './tools/examples.js';
 import { capabilitySummary, describeCapabilities } from './models/capabilities.js';
@@ -145,6 +145,17 @@ export function examplesTool(examples) {
     const tool = examplesInstructionTool(examples);
     return tool ? [tool] : [];
 }
+/** A stdio server's tools (ADR 0132), narrowed to the names the entry lists. */
+async function stdioOfferedBy(server, opts) {
+    const label = `${server.name} (stdio: ${server.command})`;
+    opts.log?.(`Loading MCP tools: ${label}`);
+    const offered = await loadStdioMcpTools(server.name, { command: server.command, args: server.args, env: server.env, pass_env: server.pass_env, cwd: server.cwd });
+    const allowed = new Set(server.tools);
+    const missing = server.tools.filter((n) => !offered.some((t) => t.name === n));
+    if (missing.length)
+        opts.log?.(`MCP ${label} does not offer ${missing.map((n) => `'${n}'`).join(', ')}`);
+    return offered.filter((t) => allowed.has(t.name));
+}
 async function resolveAgentTools(agent, opts) {
     const tools = [...resolveNamedTools(agent.tools, opts.onUnknownTool), ...examplesTool(agent.examples)];
     // OpenAPI operations become tools here, so require_approval can name them.
@@ -185,7 +196,9 @@ async function resolveAgentTools(agent, opts) {
     // mcp_servers (ADR 0124): the loader refused a declared name twice; a
     // server that answers with a name already taken is refused here too, so
     // no server's tool can stand in for another's or the agent's own.
-    const servers = await Promise.all((agent.mcp_servers ?? []).map((server) => offeredBy(`${server.name} (${server.url})`, server.url, server.tools, server.auth?.oauth2, server.transport)));
+    const servers = await Promise.all((agent.mcp_servers ?? []).map((server) => server.command !== undefined
+        ? stdioOfferedBy(server, opts)
+        : offeredBy(`${server.name} (${server.url})`, server.url, server.tools, server.auth?.oauth2, server.transport)));
     for (const [i, offered] of servers.entries()) {
         const server = agent.mcp_servers[i];
         for (const mcpTool of offered) {

package/dist/lib/compileNative.js

@@ -215,6 +215,7 @@ export function workflowSubagentOf(workflow) {
             ...(run.memory ? { memory: run.memory } : {}),
             ...(run.log ? { log: run.log } : {}),
             ...(run.credentials ? { credentials: run.credentials } : {}),
+            ...(run.consent ? { consent: run.consent } : {}),
         }),
     };
 }

package/dist/lib/index.d.ts

@@ -57,3 +57,5 @@ export type { MemoryStore } from './memory/store.ts';
 export { validateSyndicateConfig, syndicateJsonSchema, SyndicateValidationError } from './syndicateSchema.ts';
 export { PROVIDERS, providerForModel, providerKeyPresent, providerStatuses, logProviderStatuses, resolveModel, describeCapabilities, capabilitySummary, planTransport, gatewayConfig, gatewayProblem, gatewayUsable, GATEWAYS, } from './models/registry.ts';
 export { loadEnv } from './loadEnv.ts';
+export { setCredentialSource, credentialValue } from './models/credentialSource.ts';
+export type { CredentialSource } from './models/credentialSource.ts';

package/dist/lib/index.js

@@ -48,3 +48,5 @@ export { PROVIDERS, providerForModel, providerKeyPresent, providerStatuses, logP
 // subpath until 0.16.0.
 describeCapabilities, capabilitySummary, planTransport, gatewayConfig, gatewayProblem, gatewayUsable, GATEWAYS, } from './models/registry.js';
 export { loadEnv } from './loadEnv.js';
+// Where credentials are read, by environment variable name (ADR 0133).
+export { setCredentialSource, credentialValue } from './models/credentialSource.js';

package/dist/lib/loadSyndicate.js

@@ -261,6 +261,10 @@ function anchorSpecPaths(config, dir) {
         for (const entry of agent?.openapi ?? [])
             if (!path.isAbsolute(entry.spec))
                 entry.spec = path.resolve(dir, entry.spec);
+        // A stdio server's working directory, like a spec, is the YAML's (ADR 0132).
+        for (const entry of agent?.mcp_servers ?? [])
+            if (entry.cwd && !path.isAbsolute(entry.cwd))
+                entry.cwd = path.resolve(dir, entry.cwd);
     };
     anchor(config.orchestrator);
     for (const sub of config.subagents ?? [])

package/dist/lib/memory/providers.js

@@ -37,6 +37,7 @@ import { providerForModel } from '../models/providerMap.js';
 import { resolveModel } from '../models/registry.js';
 import { startEngineSpan, traceLlmGeneration } from '../observability/tracer.js';
 import { trimTrailingSlashes } from '../models/urls.js';
+import { credentialEnv } from '../models/credentialSource.js';
 /**
  * Extraction on any model id. The key passed here reaches only a model of
  * the matching provider (resolveModel's BYOK rule); other providers read
@@ -194,7 +195,7 @@ export const DEFAULT_EMBEDDING_MODELS = {
  * already passes for memory; it is used only when the configured extraction
  * model or embedder is Gemini.
  */
-export function memoryProvidersFromEnv(env = process.env, geminiKey) {
+export function memoryProvidersFromEnv(env = credentialEnv(), geminiKey) {
     const extractionModel = env.MEMORY_EXTRACTION_MODEL?.trim() || MEMORY_EXTRACTION_MODEL;
     const extractor = modelExtractor({
         model: extractionModel,

package/dist/lib/models/claudeAdapter.js

@@ -47,6 +47,7 @@ import { currentTurnStart, providerStateOf, withProviderState } from './provider
 import { errorDecision, errorText } from './errorResponse.js';
 import { adaptiveThinkingFor, claudeGeneration, claudeReasoningOf, claudeUrlImagesOn, THINKING_BINDING_BETA } from './claudeModels.js';
 import { isAboveHigh } from './reasoning.js';
+import { credentialValue } from './credentialSource.js';
 /** The provider id this adapter reports and writes its state under (lib/models/providerMap.ts). */
 export const ANTHROPIC_PROVIDER = 'anthropic';
 /** The providerState kind this adapter writes: the signed blocks that preceded a part. */
@@ -217,7 +218,7 @@ export class ClaudeAdapter {
             yield setupFailure('ENDPOINT_MISCONFIGURED', messageOf(err));
             return;
         }
-        const spec = claudeClientSpec(endpoint, this.#apiKey || endpoint.apiKey || process.env.ANTHROPIC_API_KEY);
+        const spec = claudeClientSpec(endpoint, this.#apiKey || endpoint.apiKey || credentialValue('ANTHROPIC_API_KEY'));
         if ('error' in spec) {
             yield setupFailure(endpoint.platform === 'direct' ? 'MISSING_API_KEY' : 'ENDPOINT_MISCONFIGURED', spec.error);
             return;

package/dist/lib/models/credentialSource.d.ts

@@ -0,0 +1,28 @@
+/**
+ * lib/models/credentialSource.ts — where the engine reads a credential by
+ * its environment variable name (ADR 0133).
+ *
+ * By default every provider key, gateway key and embedding key is read from
+ * `process.env`. An embedding application that holds keys elsewhere (an OS
+ * keychain, a secret manager) sets a source once:
+ *
+ *   setCredentialSource((name) => keychain.get(name));
+ *
+ * and every read below asks the source first, by the same names the
+ * environment uses (ANTHROPIC_API_KEY, MODEL_GATEWAY_API_KEY, …), at the
+ * moment of use: nothing is cached, so a key the user removes stops working
+ * on the next call. A source that returns undefined for a name falls back to
+ * the environment. A dependency-free leaf, so providerMap.ts stays one.
+ */
+/** Returns the credential held under an environment variable name, or undefined. Must not throw. */
+export type CredentialSource = (name: string) => string | undefined;
+/** Sets (or, with undefined, clears) the process's credential source. */
+export declare function setCredentialSource(next: CredentialSource | undefined): void;
+/** The credential named `name`: the source's, else `env`'s. A source that throws counts as holding nothing. */
+export declare function credentialValue(name: string, env?: NodeJS.ProcessEnv): string | undefined;
+/**
+ * `env` as the engine's env-reading helpers see it: a read by name asks the
+ * source first. For functions that take an `env` parameter; enumeration and
+ * spreading see only `env`'s own variables.
+ */
+export declare function credentialEnv(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;

package/dist/lib/models/credentialSource.js

@@ -0,0 +1,49 @@
+/**
+ * lib/models/credentialSource.ts — where the engine reads a credential by
+ * its environment variable name (ADR 0133).
+ *
+ * By default every provider key, gateway key and embedding key is read from
+ * `process.env`. An embedding application that holds keys elsewhere (an OS
+ * keychain, a secret manager) sets a source once:
+ *
+ *   setCredentialSource((name) => keychain.get(name));
+ *
+ * and every read below asks the source first, by the same names the
+ * environment uses (ANTHROPIC_API_KEY, MODEL_GATEWAY_API_KEY, …), at the
+ * moment of use: nothing is cached, so a key the user removes stops working
+ * on the next call. A source that returns undefined for a name falls back to
+ * the environment. A dependency-free leaf, so providerMap.ts stays one.
+ */
+let source;
+/** Sets (or, with undefined, clears) the process's credential source. */
+export function setCredentialSource(next) {
+    source = next;
+}
+/** The credential named `name`: the source's, else `env`'s. A source that throws counts as holding nothing. */
+export function credentialValue(name, env = process.env) {
+    if (source) {
+        try {
+            const held = source(name);
+            if (held !== undefined && held !== '')
+                return held;
+        }
+        catch {
+            /* a broken source must not take the engine down; the environment still answers */
+        }
+    }
+    return env[name];
+}
+/**
+ * `env` as the engine's env-reading helpers see it: a read by name asks the
+ * source first. For functions that take an `env` parameter; enumeration and
+ * spreading see only `env`'s own variables.
+ */
+export function credentialEnv(env = process.env) {
+    if (!source)
+        return env;
+    return new Proxy(env, {
+        get(target, key, receiver) {
+            return typeof key === 'string' ? credentialValue(key, target) : Reflect.get(target, key, receiver);
+        },
+    });
+}

package/dist/lib/models/endpoints.js

@@ -31,6 +31,7 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 };
 import { PROVIDERS, providerKeyPresent } from './providerMap.js';
 import { trimTrailingSlashes } from './urls.js';
+import { credentialEnv } from './credentialSource.js';
 export const PLATFORMS_FOR = {
     gemini: ['direct', 'vertex'],
     anthropic: ['direct', 'bedrock', 'vertex'],
@@ -81,7 +82,7 @@ export function platformFromEnv(provider, env = process.env) {
     return raw;
 }
 /** A provider's endpoint as the environment configures it. */
-export function endpointFromEnv(provider, env = process.env) {
+export function endpointFromEnv(provider, env = credentialEnv()) {
     const platform = platformFromEnv(provider, env);
     const mapEnv = MODEL_MAP_ENV[provider];
     const models = mapEnv ? parseModelMap(env[mapEnv], mapEnv) : undefined;

package/dist/lib/models/gateway.js

@@ -41,6 +41,7 @@ import { chatGptSignInRoutesOpenAi } from '../chatgpt/state.js';
 import { providerReady } from './endpoints.js';
 import { PROVIDERS, providerForModel } from './providerMap.js';
 import { trimTrailingSlashes } from './urls.js';
+import { credentialValue } from './credentialSource.js';
 export const GATEWAY_ENV = 'MODEL_GATEWAY';
 export const GATEWAY_KEY_ENV = 'MODEL_GATEWAY_API_KEY';
 export const GATEWAY_BASE_URL_ENV = 'MODEL_GATEWAY_BASE_URL';
@@ -78,7 +79,7 @@ export function gatewayConfig() {
     return {
         gateway,
         baseUrl: trimTrailingSlashes(override || gateway.baseUrl),
-        keyPresent: !!process.env[GATEWAY_KEY_ENV],
+        keyPresent: !!credentialValue(GATEWAY_KEY_ENV),
     };
 }
 /** A human-readable misconfiguration, or undefined when the gateway is

package/dist/lib/models/gatewayAdapter.js

@@ -31,6 +31,7 @@
 import { ChatCompletionsAdapter } from './chatCompletionsAdapter.js';
 import { GATEWAY_ENV, GATEWAY_KEY_ENV, GATEWAY_MODEL_MAP_ENV, gatewayConfig, gatewayWireModel } from './gateway.js';
 import { providerForModel } from './providerMap.js';
+import { credentialValue } from './credentialSource.js';
 export class GatewayAdapter extends ChatCompletionsAdapter {
     /** Attribution stays with the upstream provider named by the YAML id. */
     provider;
@@ -47,7 +48,7 @@ export class GatewayAdapter extends ChatCompletionsAdapter {
         return `${this.#cfg?.baseUrl ?? ''}/chat/completions`;
     }
     headers() {
-        return { Authorization: `Bearer ${process.env[GATEWAY_KEY_ENV] ?? ''}` };
+        return { Authorization: `Bearer ${credentialValue(GATEWAY_KEY_ENV) ?? ''}` };
     }
     wireModelName(model) {
         return this.#cfg ? gatewayWireModel(model, this.#cfg.gateway) : model;

package/dist/lib/models/geminiAdapter.js

@@ -52,6 +52,7 @@ import { currentTurnStart, providerStateOf } from './providerState.js';
 import { classifyError, errorStatus, retryUntilFirstYield } from './retry.js';
 import { isAboveHigh, reasoningConfig } from './reasoning.js';
 import { setLlmSpanAttribute } from '../observability/tracer.js';
+import { credentialValue } from './credentialSource.js';
 /**
  * The provider id this adapter reports and writes its state under, and the
  * providerState kind for a Gemini thought signature (ADR 0046). Defined once
@@ -846,7 +847,7 @@ function nonEmpty(value) {
 }
 /** The Gemini API key from the environment, in ADK's order. */
 function envApiKey() {
-    return nonEmpty(process.env.GOOGLE_GENAI_API_KEY) ?? nonEmpty(process.env.GOOGLE_API_KEY) ?? nonEmpty(process.env.GEMINI_API_KEY);
+    return nonEmpty(credentialValue('GOOGLE_GENAI_API_KEY')) ?? nonEmpty(credentialValue('GOOGLE_API_KEY')) ?? nonEmpty(credentialValue('GEMINI_API_KEY'));
 }
 function messageOf(err) {
     return err instanceof Error ? err.message : String(err);

package/dist/lib/models/gptAdapter.js

@@ -48,6 +48,7 @@ import { currentTurnStart, providerStateOf } from './providerState.js';
 import { effortWord } from './reasoning.js';
 import { toContractJsonSchema } from './schemaNormalize.js';
 import { setLlmSpanAttribute } from '../observability/tracer.js';
+import { credentialValue } from './credentialSource.js';
 /** The providerState kind the Responses adapters write: the reasoning output items that preceded a part (ADR 0046, ADR 0050). */
 export const REASONING_STATE_KIND = 'reasoning_items';
 /** The `include` value that returns reasoning items with their encrypted content. */
@@ -410,7 +411,7 @@ export class GptAdapter {
         return undefined;
     }
     apiKeyFromEnv() {
-        return process.env.OPENAI_API_KEY;
+        return credentialValue('OPENAI_API_KEY');
     }
     missingKeyMessage() {
         return 'OPENAI_API_KEY is not set in environment.';

package/dist/lib/models/grokAdapter.js

@@ -29,6 +29,7 @@ import { GptAdapter } from './gptAdapter.js';
 import { effortWord } from './reasoning.js';
 import { collectionIdsFromEnv, collectionsMaxResultsFromEnv, xaiWebSearchParamsFromEnv, xSearchParamsFromEnv, } from '../tools/xaiSearchParams.js';
 import { setLlmSpanAttribute } from '../observability/tracer.js';
+import { credentialValue } from './credentialSource.js';
 export const XAI_BASE_URL = 'https://api.x.ai/v1';
 /**
  * The ids that take a reasoning effort and return encrypted reasoning:
@@ -60,7 +61,7 @@ export class GrokAdapter extends GptAdapter {
         return XAI_BASE_URL;
     }
     apiKeyFromEnv() {
-        return process.env.XAI_API_KEY;
+        return credentialValue('XAI_API_KEY');
     }
     missingKeyMessage() {
         return 'XAI_API_KEY is not set in environment.';

package/dist/lib/models/kimiAdapter.js

@@ -120,6 +120,7 @@
 import { DEFAULT_KIMI_REASONING_EFFORT } from '../config.js';
 import { ChatCompletionsAdapter, reasonsNotAtAll } from './chatCompletionsAdapter.js';
 import { trimTrailingSlashes } from './urls.js';
+import { credentialValue } from './credentialSource.js';
 export const MOONSHOT_BASE_URL = 'https://api.moonshot.ai/v1';
 /** The flagship takes `reasoning_effort`; the K2 generation takes a `thinking` switch. */
 export function isKimiK3(model) {
@@ -153,7 +154,7 @@ export class KimiAdapter extends ChatCompletionsAdapter {
         return `${this.#baseUrl}/chat/completions`;
     }
     #key() {
-        return this.#apiKey ?? process.env.MOONSHOT_API_KEY;
+        return this.#apiKey ?? credentialValue('MOONSHOT_API_KEY');
     }
     headers() {
         return { Authorization: `Bearer ${this.#key() ?? ''}` };

package/dist/lib/models/providerMap.js

@@ -13,6 +13,7 @@
  *   grok-*     → xai           ollama/<model>    → ollama (local, keyless)
  *   kimi-*     → moonshot      everything else   → gemini (the default)
  */
+import { credentialValue } from './credentialSource.js';
 export const PROVIDERS = {
     gemini: { keyEnv: 'GOOGLE_GENAI_API_KEY', label: 'Google Gemini' },
     anthropic: { keyEnv: 'ANTHROPIC_API_KEY', label: 'Anthropic Claude' },
@@ -43,9 +44,9 @@ export function providerKeyPresent(provider) {
         return true;
     // Gemini historically accepts either env name.
     if (provider === 'gemini') {
-        return realValue(process.env.GOOGLE_GENAI_API_KEY) || realValue(process.env.GEMINI_API_KEY);
+        return realValue(credentialValue('GOOGLE_GENAI_API_KEY')) || realValue(credentialValue('GEMINI_API_KEY'));
     }
-    return realValue(process.env[keyEnv]);
+    return realValue(credentialValue(keyEnv));
 }
 /** Set, and not a `.env.example` placeholder (`your_..._here`, `<...>`).
  *  Inlined rather than imported: this module stays a dependency-free leaf. */

package/dist/lib/observability/embeddings.js

@@ -10,6 +10,7 @@
  */
 import { EMBEDDING_DIMENSIONS, EMBEDDING_MODEL } from '../config.js';
 import { memoryProvidersFromEnv } from '../memory/providers.js';
+import { credentialValue } from '../models/credentialSource.js';
 const MAX_CHARS = 8_000;
 /**
  * Embeds each text with the SAME embedder long-term memory uses, so the two
@@ -20,7 +21,7 @@ const MAX_CHARS = 8_000;
 export async function embedTexts(texts, options = {}) {
     let embedder = options.embedder;
     if (!embedder) {
-        const apiKey = options.apiKey ?? process.env.GOOGLE_GENAI_API_KEY ?? process.env.GEMINI_API_KEY;
+        const apiKey = options.apiKey ?? credentialValue('GOOGLE_GENAI_API_KEY') ?? credentialValue('GEMINI_API_KEY');
         const provider = (process.env.MEMORY_EMBEDDING_PROVIDER?.trim() || 'gemini').toLowerCase();
         if (provider === 'gemini' && !apiKey)
             throw new Error('GOOGLE_GENAI_API_KEY is required for Gemini embeddings');

package/dist/lib/observability/lineage.js

@@ -26,6 +26,7 @@ import { createHash } from 'node:crypto';
 import { execSync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { enginePackageRoot } from '../paths.js';
 /** Schema version stamped on every ledger row (adk_turns / adk_payloads). */
 export const TELEMETRY_SCHEMA_VERSION = 2;
 // ── Span lineage: the names spans are given ──────────────────────────────────
@@ -105,8 +106,10 @@ export function engineVersion() {
         return cachedEngineVersion;
     let pkgVersion = '0.0.0';
     try {
-        const pkgPath = join(process.cwd(), 'package.json');
-        if (existsSync(pkgPath)) {
+        // The engine's own package.json, not the embedding application's.
+        const root = enginePackageRoot();
+        const pkgPath = root ? join(root, 'package.json') : '';
+        if (pkgPath && existsSync(pkgPath)) {
             pkgVersion = String(JSON.parse(readFileSync(pkgPath, 'utf-8')).version ?? pkgVersion);
         }
     }
@@ -116,7 +119,12 @@ export function engineVersion() {
     let commit = process.env.SOURCE_VERSION ?? process.env.HEROKU_SLUG_COMMIT ?? process.env.GIT_COMMIT ?? '';
     if (!commit) {
         try {
-            commit = execSync('git rev-parse --short HEAD', { stdio: ['ignore', 'pipe', 'ignore'] })
+            // Only from the engine's own checkout: an installed package inside an
+            // application's repository would otherwise report the application's commit.
+            const root = enginePackageRoot();
+            if (!root || !existsSync(join(root, '.git')))
+                throw new Error('not a checkout');
+            commit = execSync('git rev-parse --short HEAD', { cwd: root, stdio: ['ignore', 'pipe', 'ignore'] })
                 .toString()
                 .trim();
         }

package/dist/lib/observability/supabaseSpanExporter.d.ts

@@ -174,7 +174,8 @@ export interface ExportStats {
     deadLettered: number;
     payloadsDropped: number;
 }
-interface SupabaseLikeClient {
+/** Where the exporter writes: supabase-js, or `postgresLedgerClient` on a pg pool. */
+export interface LedgerClient {
     from(table: string): {
         insert(rows: unknown[]): PromiseLike<{
             error: {
@@ -183,6 +184,23 @@ interface SupabaseLikeClient {
         }>;
     };
 }
+type SupabaseLikeClient = LedgerClient;
+/** The tables the exporter writes; nothing else is ever named in its SQL. */
+export declare const LEDGER_TABLES: readonly ['adk_telemetry', 'adk_turns', 'adk_payloads'];
+/** The subset of a pg Pool the ledger client needs. */
+export interface LedgerPool {
+    query(text: string, values?: unknown[]): Promise<unknown>;
+}
+/**
+ * The ledger over a direct Postgres connection (ADR 0131): the same rows the
+ * Supabase sink writes, through one parameterised statement per batch. The
+ * rows go in as one JSON array and `jsonb_populate_recordset` gives each
+ * value its column's type, so JSON, arrays and timestamps need no mapping
+ * here. Only the columns the rows carry are named, so the rest keep their
+ * defaults. The table must be one of LEDGER_TABLES and every column name
+ * comes from the row builders above, never from span content.
+ */
+export declare function postgresLedgerClient(pool: LedgerPool): LedgerClient;
 export interface ExporterOptions {
     /** Injected client (tests); default: lazily created supabase-js client. */
     client?: SupabaseLikeClient;