Module identities 

Identity subsystem — accounts, bundles, and the junctions that tie them to agents.

Layered model:

• IdentityAccount (db_identity_accounts): a single credential pointer (provider + kind + secret_ref).
• Identity (db_identity_bundles): a named bundle that contains zero or more accounts via the db_identity_bindings junction. The launch UI picks an Identity bundle, not raw accounts.
• AgentIdentityLink (db_agent_identity_links): legacy junction binding an agent to an account directly. Kept for the identity migration path.

Extracted from store.rs in Phase R.2 of the storage modularization plan (docs/specs/SPEC_STORE_MODULARIZATION_2026_05_27.md). The method surface is unchanged — Store::identity_*, bundle_identity_*, and agent_identity_* still live on Store via this impl block; existing imports of the structs from storage::store::* keep working thanks to re-exports.

Structs

AgentIdentityLink

Junction row: which identity an agent uses for a given provider.

Identity

A named credential bundle. Contains zero or more accounts via the db_identity_bindings junction. is_blank tags the seeded singleton row that the launch UI uses as the default option.

IdentityAccount

An identity account (reusable credential, linked to agents via the db_agent_identity_links junction). Replaces the browser localStorage identity store.

IdentityBinding

Junction row binding an account to an identity for a given provider.

Enums

SecretRef

Provider-specific credential reference. Stored as JSON in db_identity_accounts.secret_ref. backend is the discriminator. The actual secret value is NEVER stored in the DB — only how to look it up at launch time (env var, secrets-manager path, etc.). PlaintextDev exists for local dev convenience and must never be the default path in production builds.

Functions

default_context_json 🔒

default_identity_status 🔒