8c1e8d9890
Every release member now declares publishConfig.access: public, so the scope no longer mixes levels: the 221 packages/*/* and apps/* manifests join the vendored framework and the native packages. check-workspace-constraints drops the per-sequence expectation and holds every release member to public, which is what stops a member from drifting back. Access is a property of the package, not of a version: the dsh packages already published as restricted become world-readable at their next publication.
credentials/ — credential references
English | 中文
The credential capability family separates reference resolution from its provider:
| Package | Role | ctx key |
|---|---|---|
credentials/ |
Credential-reference seam | ctx.credentials |
credentials-local/ |
Environment and local-file provider | registers ctx.credentials |
Configuration carries references, not secret values. Consumers resolve those references at their operation boundary; the child READMEs own mutation, precedence, and storage semantics.
The subsystem reference — CredentialRef, per-operation resolution, UI-safe CredentialInfo, provider layers — is docs/subsystems/credentials.md.