imccyu
97eb14a007
Every package under packages/, apps/, and vendor/ drops "private": true and declares publishConfig.access "restricted": the repository now states which packages it publishes instead of deciding it at publish time. Each one also declares its repository and directory, which is how a consumer of a private package reaches its source. The Landlock packages move to restricted with them. They have never been published, so nothing anonymous depends on them today, and the whole @deepseek-ai scope stays private. The workspace constraint that required every package to be private now applies to non-members only, and asserts the publishable trio on each release member.
credentials/ — credential references
English | 中文
The credential capability family separates reference resolution from its provider:
| Package | Role | ctx key |
|---|---|---|
credentials/ |
Credential-reference seam | ctx.credentials |
credentials-local/ |
Environment and local-file provider | registers ctx.credentials |
Configuration carries references, not secret values. Consumers resolve those references at their operation boundary; the child READMEs own mutation, precedence, and storage semantics.
The subsystem reference — CredentialRef, per-operation resolution, UI-safe CredentialInfo, provider layers — is docs/subsystems/credentials.md.