refactor(credentials)!: split credential-providers into corbits-credential-header and corbits-credential-mcp (CL-8339)

VENDORED.md

@@ -27,7 +27,7 @@ Pinned to [faremeter/interchange](https://github.com/faremeter/interchange)
 
 | Vendored path                 | What it is                                                              | Owner  | Kill date  |
 | ------------------------------ | ------------------------------------------------------------------------ | ------ | ---------- |
-| `apps/sidecar`                 | Byte-identical copy of upstream's sidecar app; apps are never npm-published | sawyer | 2026-11-03 |
+| `apps/sidecar`                 | Copy of upstream's sidecar app; apps are never npm-published. One local delta: `workflow-substrate-factory.ts` registers `@corbits/credential-header`'s and `@corbits/credential-mcp`'s providers alongside `builtinCredentialProviders()` | sawyer | 2026-11-03 |
 | `vendor/intx/agent`            | `@intx/agent` at a newer commit than npm has published                    | sawyer | 2026-11-03 |
 | `vendor/intx/db`                | `@intx/db`, with one local serving-time credential-refresh delta          | sawyer | 2026-11-03 |
 | `vendor/intx/harness`           | `@intx/harness` at a newer commit than npm has published                  | sawyer | 2026-11-03 |

apps/hub/package.json

@@ -18,7 +18,6 @@
     "@corbits/artifact-ui": "workspace:*",
     "@corbits/artifacts": "github:corbitsdev/corbits-artifacts#5309a15d4aa504f132c54b4da08bb672b4903873",
     "@corbits/codex-provider": "github:corbitsdev/corbits-codex-provider#a1f475f341261c05fa8dade0c82f1246c175b5b3",
-    "@corbits/credential-providers": "workspace:*",
     "@corbits/cron": "workspace:*",
     "@corbits/error-sink": "workspace:*",
     "@corbits/hub-api-client": "workspace:*",

apps/sidecar/package.json

@@ -15,6 +15,8 @@
     "test": "bun test"
   },
   "dependencies": {
+    "@corbits/credential-header": "github:corbitsdev/corbits-credential-header#eee7b7eb79755fd1ddc3eb2b9a57c4e50982e293",
+    "@corbits/credential-mcp": "github:corbitsdev/corbits-credential-mcp#fb9ec3a6754348cd33c388c70c0830b8844c83de",
     "@intx/agent": "workspace:*",
     "@intx/authz": "0.3.0",
     "@intx/crypto": "0.3.0",

apps/sidecar/src/workflow-substrate-factory.ts

@@ -53,6 +53,11 @@
   type ConnectorReplyDrain,
   type CredentialProviderRegistry,
 } from "@intx/harness";
+import {
+  rawAuthorizationCredentialProvider,
+  xApiKeyCredentialProvider,
+} from "@corbits/credential-header";
+import { createMcpStreamableHttpCredentialProvider } from "@corbits/credential-mcp";
 import { createSSHSignature } from "@intx/crypto";
 import {
   createAgentRepoStore,
@@ -262,9 +267,9 @@
     parsed = JSON.parse(raw);
   } catch (cause) {
     const reason = cause instanceof Error ? cause.message : String(cause);
     throw new Error(
       `sidecar workflow-child substrate config: STEP_INFERENCE_SOURCES is not valid JSON: ${reason}`,
     );
   }
   const validated = StepInferenceSourceTable(parsed);
   if (validated instanceof type.errors) {
@@ -297,9 +302,9 @@
     parsed = JSON.parse(raw);
   } catch (cause) {
     const reason = cause instanceof Error ? cause.message : String(cause);
     throw new Error(
       `sidecar workflow-child substrate config: WORKFLOW_BODY_SOURCES is not valid JSON: ${reason}`,
     );
   }
   const validated = BodyInferenceSources(parsed);
   if (validated instanceof type.errors) {
@@ -2226,9 +2231,20 @@
 
     // The credential provider registry that shapes a delivered credential into
     // a mediated handle. Built once here from the sidecar-static built-ins (the
-    // origin-pinned http provider) and shared by every per-step build; the
-    // per-run material and grants ride in separately at each invoke.
-    const credentialProviders = createCredentialProviderRegistry(builtinCredentialProviders());
+    // origin-pinned http provider) plus the header-shaped presets
+    // (`@corbits/credential-header`, for a provider row whose API expects
+    // the raw secret in `authorization` or an `x-api-key` header instead of
+    // a Bearer-prefixed `authorization`) and the MCP streamable-HTTP
+    // provider (`@corbits/credential-mcp`, for a tenant-connected MCP
+    // server, including its keyless-connection sentinel) — shared by every
+    // per-step build; the per-run material and grants ride in separately at
+    // each invoke.
+    const credentialProviders = createCredentialProviderRegistry([
+      ...builtinCredentialProviders(),
+      xApiKeyCredentialProvider(),
+      rawAuthorizationCredentialProvider(),
+      createMcpStreamableHttpCredentialProvider(),
+    ]);
 
     // Spawned-child step build env (INTR-310). Every spawned child's steps --
     // a childWorkflow child's and an onTrigger section body's alike -- run real,