credentials/

English | 中文

The credential capability family separates reference resolution from its provider, and separates both from obtaining a credential that has to be asked for:

Package	Role	ctx key
credentials/	Credential-reference and credential-record seam	ctx.credentials
credentials-local/	Environment and local-file provider	registers ctx.credentials
authorization/	Plugin-owned flows that obtain a credential by asking a human	ctx.authorization

Configuration carries references, not secret values. Consumers resolve those references at their operation boundary; the child READMEs own mutation, precedence, and storage semantics. An authorization flow writes a credential record and is keyed by it, so the two seams meet at the record and nowhere else.

The subsystem reference — CredentialRef, per-operation resolution, UI-safe CredentialInfo, provider layers — is docs/subsystems/credentials.md.