Merge branch 'dev' into feature/heartbeat

# Conflicts:
#	packages/host-bin/package.json
#	packages/host-bin/src/main.ts
#	packages/session-orchestrator/src/orchestrator.ts
#	packages/system-prompt/src/service.test.ts
#	packages/system-prompt/src/service.ts
#	packages/system-prompt/src/types.ts
#	packages/transport-contract/package.json
#	packages/transport-http/package.json
#	packages/transport-http/src/app.test.ts
#	packages/transport-http/src/app.ts
#	packages/transport-http/src/extension.ts
#	packages/transport-http/tsconfig.json
#	tsconfig.json

1 files changed, 14 insertions, 14 deletions

diff --git a/packages/kernel/src/contracts/auth.ts b/packages/kernel/src/contracts/auth.ts
index 6058156..85963ba 100644
--- a/packages/kernel/src/contracts/auth.ts
+++ b/packages/kernel/src/contracts/auth.ts
@@ -11,9 +11,9 @@
  * This is the common case for OpenAI-compatible and most provider extensions.
  */
 export interface ApiKeyCredentials {
-	readonly type: "api-key";
-	readonly apiKey: string;
-	readonly baseURL?: string;
+  readonly type: "api-key";
+  readonly apiKey: string;
+  readonly baseURL?: string;
 }
 
 /**
@@ -22,9 +22,9 @@ export interface ApiKeyCredentials {
  * receives a currently-valid token.
  */
 export interface BearerTokenCredentials {
-	readonly type: "bearer-token";
-	readonly token: string;
-	readonly baseURL?: string;
+  readonly type: "bearer-token";
+  readonly token: string;
+  readonly baseURL?: string;
 }
 
 /** Union of credential shapes the kernel recognizes. */
@@ -36,13 +36,13 @@ export type Credentials = ApiKeyCredentials | BearerTokenCredentials;
  * directly (the concrete vault is a core extension).
  */
 export interface AuthContract {
-	/** Unique identifier for this auth provider (e.g. "apikey", "claude-oauth"). */
-	readonly id: string;
+  /** Unique identifier for this auth provider (e.g. "apikey", "claude-oauth"). */
+  readonly id: string;
 
-	/**
-	 * Resolve currently-valid credentials. May involve reading from the
-	 * secret vault (injected via Host API) or performing a token refresh.
-	 * Returns `null` if credentials are unavailable (e.g. not yet configured).
-	 */
-	readonly resolve: () => Promise<Credentials | null>;
+  /**
+   * Resolve currently-valid credentials. May involve reading from the
+   * secret vault (injected via Host API) or performing a token refresh.
+   * Returns `null` if credentials are unavailable (e.g. not yet configured).
+   */
+  readonly resolve: () => Promise<Credentials | null>;
 }