Module credentials 

Credential-shape detection for memory content.

Phase 3 secrets hygiene: wm ingest refuses credential-shaped filenames (.env, keys, certs); this module extends the same discipline to content. A store that silently swallows an API key becomes a liability the moment it is backed up, mesh-synced, or fed into a model context — so writes that look credential-bearing are flagged at the tool layer (warn + advise a keyring, not refuse: false-positive-proof refusal would train agents to hide secrets worse).

High-precision heuristics only — the goal is to warn on real credentials without crying wolf on ordinary prose.

Constants

ADVICE

Kinds of credential shapes the detector recognizes.

Functions

credential_shaped_content

Detect credential-shaped content. Returns the matched kinds (e.g. ["private_key_pem", "github_token"]); empty means clean.