Provider package format

Reference for CredentialProvider manifests, archives, Git sources, immutable builds, and private catalog publication.

referenceFor provider authors, release engineersOwner Constal platform teamVerified 2026-08-20

CredentialProvider packages use the managed executable deployment pipeline and publish immutable code packages into the provider catalog. Uploading code does not install a provider instance.

Required files

File	Purpose
`constal.credential-provider.json`	Package identity, version, namespace, entrypoint, expected revision
`package.json`	Exact runtime dependency contract
`schema.json`	Provider-installation configuration schema
TypeScript entrypoint	Default export from `credentialProvider(...)`
Source modules	Provider protocol implementation

The archive root must contain the manifest directly. Do not wrap it in an extra directory. Do not include node_modules, development dependencies, lifecycle scripts, symlinks, or unrelated executables.

Manifest

constal.credential-provider.json

{
  "schemaVersion": 2,
  "kind": "credential-provider",
  "id": "example-token",
  "namespace": "providers",
  "version": "1.0.0",
  "entry": "index.ts",
  "expectedCurrentDeploymentRevision": null
}

Archive upload

The Console accepts ZIP and tar.gz archives up to the platform deployment limit. The isolated builder extracts safely, installs exact dependencies, type-checks the SDK contract, bundles the Driver, computes integrity evidence, uploads an immutable Worker version, and probes its identity and operation catalog.

Git source

Provide a public HTTPS GitHub, GitLab, or Bitbucket repository and a full commit SHA. Branches and tags are not immutable inputs. The deployer resolves a provider-specific archive URL and subjects the snapshot to the same extraction and build pipeline as a local archive.

Catalog publication

A successful custom build publishes a private catalog entry visible only to the publisher tenant. Installation later binds namespace configuration, bootstrap Credentials, Policies, and a provider instance name. Community publication is not exposed through the tenant Console.

Integrity

The catalog entry pins package hash, Driver hash, deployment revision, Worker version, configuration schema, lifecycle metadata, egress, rotation, and authorization origins. Re-uploading different code under the same apparent identity cannot mutate an existing immutable package.