@cat-factory/contracts 0.214.0 → 0.215.0

package/dist/binary-generators.d.ts

@@ -10,12 +10,31 @@ import * as v from 'valibot';
  */
 export declare const binaryGeneratorCredentialSchema: v.ObjectSchema<{
     /**
-     * The credential's key. It is both what the secret resolver is asked for and the ENVIRONMENT
-     * VARIABLE the agent reads it from, so it must be a valid POSIX variable name — a generator
-     * declaring `x-rd-token` would resolve fine and then be dropped by the harness's env
+     * The credential's LOOKUP key: what the secret resolver is asked for, and what a workspace
+     * stores its own value under. Also the ENVIRONMENT VARIABLE the agent reads it from unless
+     * {@link envName} says otherwise, so it must be a valid POSIX variable name either way: a
+     * generator declaring `x-rd-token` would resolve fine and then be dropped by the harness's env
      * validation, which is a silent "the integration just 401s" at run time.
+     *
+     * It may NOT name a variable the platform's own configuration owns
+     * ({@link isReservedPlatformEnvKey}). The resolver reads the key off the deployment's
+     * environment and the value is injected into an agent process, so an integration declaring
+     * `ENCRYPTION_KEY` would hand a prompt-injectable agent the deployment's master sealing key.
+     * Refused here so a deployment learns at boot, and again at dispatch, since a mothership-mode
+     * node boot-validates none of the definitions it resolves.
      */
-    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 128, undefined>, v.RegexAction<string, "must be a valid environment variable name">]>;
+    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 128, undefined>, v.RegexAction<string, "must be a valid environment variable name">, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>]>;
+    /**
+     * The environment variable the value is injected as, when that differs from {@link key}. This
+     * is the name the agent is told to read, and it is what a vendor SDK that auto-reads its own
+     * documented variable needs.
+     *
+     * Held to the toolchain rule rather than the reserved-platform one, because it reads nothing:
+     * the floor above is about what may be READ off the deployment's environment, and an injection
+     * name only decides what a variable is called inside this job's agent process. That is what lets
+     * an integration keep a vendor's documented name even when a platform prefix family covers it.
+     */
+    readonly envName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 128, undefined>, v.RegexAction<string, "must be a valid environment variable name">, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>]>, undefined>;
     /**
      * How the integration expects the credential to be presented (`X-RD-Token: <value>`,
      * `Authorization: Bearer <value>`). Folded into the brief verbatim: the agent writes the
@@ -75,12 +94,31 @@ export declare const binaryGeneratorDefinitionSchema: v.ObjectSchema<{
     readonly guidance: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 20000, undefined>]>, undefined>;
     readonly credential: v.OptionalSchema<v.ObjectSchema<{
         /**
-         * The credential's key. It is both what the secret resolver is asked for and the ENVIRONMENT
-         * VARIABLE the agent reads it from, so it must be a valid POSIX variable name — a generator
-         * declaring `x-rd-token` would resolve fine and then be dropped by the harness's env
+         * The credential's LOOKUP key: what the secret resolver is asked for, and what a workspace
+         * stores its own value under. Also the ENVIRONMENT VARIABLE the agent reads it from unless
+         * {@link envName} says otherwise, so it must be a valid POSIX variable name either way: a
+         * generator declaring `x-rd-token` would resolve fine and then be dropped by the harness's env
          * validation, which is a silent "the integration just 401s" at run time.
+         *
+         * It may NOT name a variable the platform's own configuration owns
+         * ({@link isReservedPlatformEnvKey}). The resolver reads the key off the deployment's
+         * environment and the value is injected into an agent process, so an integration declaring
+         * `ENCRYPTION_KEY` would hand a prompt-injectable agent the deployment's master sealing key.
+         * Refused here so a deployment learns at boot, and again at dispatch, since a mothership-mode
+         * node boot-validates none of the definitions it resolves.
+         */
+        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 128, undefined>, v.RegexAction<string, "must be a valid environment variable name">, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>]>;
+        /**
+         * The environment variable the value is injected as, when that differs from {@link key}. This
+         * is the name the agent is told to read, and it is what a vendor SDK that auto-reads its own
+         * documented variable needs.
+         *
+         * Held to the toolchain rule rather than the reserved-platform one, because it reads nothing:
+         * the floor above is about what may be READ off the deployment's environment, and an injection
+         * name only decides what a variable is called inside this job's agent process. That is what lets
+         * an integration keep a vendor's documented name even when a platform prefix family covers it.
          */
-        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 128, undefined>, v.RegexAction<string, "must be a valid environment variable name">]>;
+        readonly envName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 128, undefined>, v.RegexAction<string, "must be a valid environment variable name">, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>]>, undefined>;
         /**
          * How the integration expects the credential to be presented (`X-RD-Token: <value>`,
          * `Authorization: Bearer <value>`). Folded into the brief verbatim: the agent writes the

package/dist/binary-generators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"binary-generators.d.ts","sourceRoot":"","sources":["../src/binary-generators.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAgC5B;;;;;;;;GAQG;AACH,eAAO,MAAM,+BAA+B;IAC1C;;;;;OAKG;;IAQH;;;;OAIG;;IAEH;;;;;OAKG;;aAEH,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,+BAA+B,CAAC,CAAA;AAE7F;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B;IAC1C,iFAAiF;;;IAGjF,2DAA2D;;IAE3D;;;OAGG;;IAEH;;;OAGG;;IAEH;;;;OAIG;;IAEH;;;;OAIG;;IAEH;;;;OAIG;;;QArEH;;;;;WAKG;;QAQH;;;;WAIG;;QAEH;;;;;WAKG;;;IAgDH;;;;OAIG;;;;;;;aAEH,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,+BAA+B,CAAC,CAAA;AAE7F;;;;;;;;GAQG;AACH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,+BAA+B;;;;IAI1C,0FAA0F;;IAE1F,gGAAgG;;aAEhG,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,+BAA+B,CAAC,CAAA;AAE7F,wBAAgB,+BAA+B,CAAC,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE,CAO7E"}
+{"version":3,"file":"binary-generators.d.ts","sourceRoot":"","sources":["../src/binary-generators.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAsC5B;;;;;;;;GAQG;AACH,eAAO,MAAM,+BAA+B;IAC1C;;;;;;;;;;;;;OAaG;;IAYH;;;;;;;;;OASG;;IAcH;;;;OAIG;;IAEH;;;;;OAKG;;aAEH,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,+BAA+B,CAAC,CAAA;AAE7F;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B;IAC1C,iFAAiF;;;IAGjF,2DAA2D;;IAE3D;;;OAGG;;IAEH;;;OAGG;;IAEH;;;;OAIG;;IAEH;;;;OAIG;;IAEH;;;;OAIG;;;QAxGH;;;;;;;;;;;;;WAaG;;QAYH;;;;;;;;;WASG;;QAcH;;;;WAIG;;QAEH;;;;;WAKG;;;IAgDH;;;;OAIG;;;;;;;aAEH,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,+BAA+B,CAAC,CAAA;AAE7F;;;;;;;;GAQG;AACH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,+BAA+B;;;;IAI1C,0FAA0F;;IAE1F,gGAAgG;;aAEhG,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,+BAA+B,CAAC,CAAA;AAE7F,wBAAgB,+BAA+B,CAAC,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE,CAO7E"}

package/dist/binary-generators.js

@@ -1,6 +1,7 @@
 import * as v from 'valibot';
 import { binaryModalitySchema, mediaTypeSchema } from './binary-modalities.js';
 import { uploadApiContractSchema } from './foundational-services.js';
+import { isReservedPlatformEnvKey, isToolchainEnvName, reservedEnvKeyMessage, toolchainEnvNameMessage, } from './reserved-env-keys.js';
 // ---------------------------------------------------------------------------
 // Wire vocabulary for GENERATIVE BINARY INTEGRATIONS — the third-party (or in-house) APIs a
 // binary-generating agent kind calls to PRODUCE its deliverable: an image generator, a
@@ -32,12 +33,31 @@ const slug = v.pipe(v.string(), v.trim(), v.minLength(1), v.maxLength(64), v.reg
  */
 export const binaryGeneratorCredentialSchema = v.object({
     /**
-     * The credential's key. It is both what the secret resolver is asked for and the ENVIRONMENT
-     * VARIABLE the agent reads it from, so it must be a valid POSIX variable name — a generator
-     * declaring `x-rd-token` would resolve fine and then be dropped by the harness's env
+     * The credential's LOOKUP key: what the secret resolver is asked for, and what a workspace
+     * stores its own value under. Also the ENVIRONMENT VARIABLE the agent reads it from unless
+     * {@link envName} says otherwise, so it must be a valid POSIX variable name either way: a
+     * generator declaring `x-rd-token` would resolve fine and then be dropped by the harness's env
      * validation, which is a silent "the integration just 401s" at run time.
+     *
+     * It may NOT name a variable the platform's own configuration owns
+     * ({@link isReservedPlatformEnvKey}). The resolver reads the key off the deployment's
+     * environment and the value is injected into an agent process, so an integration declaring
+     * `ENCRYPTION_KEY` would hand a prompt-injectable agent the deployment's master sealing key.
+     * Refused here so a deployment learns at boot, and again at dispatch, since a mothership-mode
+     * node boot-validates none of the definitions it resolves.
      */
-    key: v.pipe(v.string(), v.trim(), v.minLength(1), v.maxLength(128), v.regex(/^[A-Za-z_][A-Za-z0-9_]*$/, 'must be a valid environment variable name')),
+    key: v.pipe(v.string(), v.trim(), v.minLength(1), v.maxLength(128), v.regex(/^[A-Za-z_][A-Za-z0-9_]*$/, 'must be a valid environment variable name'), v.check((key) => !isReservedPlatformEnvKey(key), (issue) => reservedEnvKeyMessage(String(issue.input)))),
+    /**
+     * The environment variable the value is injected as, when that differs from {@link key}. This
+     * is the name the agent is told to read, and it is what a vendor SDK that auto-reads its own
+     * documented variable needs.
+     *
+     * Held to the toolchain rule rather than the reserved-platform one, because it reads nothing:
+     * the floor above is about what may be READ off the deployment's environment, and an injection
+     * name only decides what a variable is called inside this job's agent process. That is what lets
+     * an integration keep a vendor's documented name even when a platform prefix family covers it.
+     */
+    envName: v.optional(v.pipe(v.string(), v.trim(), v.minLength(1), v.maxLength(128), v.regex(/^[A-Za-z_][A-Za-z0-9_]*$/, 'must be a valid environment variable name'), v.check((name) => !isToolchainEnvName(name), (issue) => toolchainEnvNameMessage(String(issue.input))))),
     /**
      * How the integration expects the credential to be presented (`X-RD-Token: <value>`,
      * `Authorization: Bearer <value>`). Folded into the brief verbatim: the agent writes the

package/dist/binary-generators.js.map

@@ -1 +1 @@
-{"version":3,"file":"binary-generators.js","sourceRoot":"","sources":["../src/binary-generators.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAC5B,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAA;AAEpE,8EAA8E;AAC9E,4FAA4F;AAC5F,uFAAuF;AACvF,6CAA6C;AAC7C,EAAE;AACF,+FAA+F;AAC/F,+FAA+F;AAC/F,8FAA8F;AAC9F,8FAA8F;AAC9F,8FAA8F;AAC9F,6FAA6F;AAC7F,+FAA+F;AAC/F,iCAAiC;AACjC,EAAE;AACF,+FAA+F;AAC/F,+FAA+F;AAC/F,uFAAuF;AACvF,2CAA2C;AAC3C,8EAA8E;AAE9E,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CACjB,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,IAAI,EAAE,EACR,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EACd,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,EACf,CAAC,CAAC,KAAK,CAAC,sBAAsB,EAAE,4BAA4B,CAAC,CAC9D,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD;;;;;OAKG;IACH,GAAG,EAAE,CAAC,CAAC,IAAI,CACT,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,IAAI,EAAE,EACR,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EACd,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,EAChB,CAAC,CAAC,KAAK,CAAC,0BAA0B,EAAE,2CAA2C,CAAC,CACjF;IACD;;;;OAIG;IACH,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;CAClC,CAAC,CAAA;AAGF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,iFAAiF;IACjF,EAAE,EAAE,IAAI;IACR,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpE,2DAA2D;IAC3D,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACvE;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9D;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACjE;;;;OAIG;IACH,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAChD;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACrF;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,+BAA+B,CAAC;IACvD;;;;OAIG;IACH,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;CACxD,CAAC,CAAA;AAGF;;;;;;;;GAQG;AACH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,EAAE,EAAE,IAAI;IACR,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,0FAA0F;IAC1F,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;IACzC,gGAAgG;IAChG,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;CACjD,CAAC,CAAA;AAGF,MAAM,UAAU,+BAA+B,CAAC,UAAmB;IACjE,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,+BAA+B,EAAE,UAAU,CAAC,CAAA;IACvE,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,CAAA;IAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACxE,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAA;IAC3D,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"binary-generators.js","sourceRoot":"","sources":["../src/binary-generators.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAC5B,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAA;AACpE,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,wBAAwB,CAAA;AAE/B,8EAA8E;AAC9E,4FAA4F;AAC5F,uFAAuF;AACvF,6CAA6C;AAC7C,EAAE;AACF,+FAA+F;AAC/F,+FAA+F;AAC/F,8FAA8F;AAC9F,8FAA8F;AAC9F,8FAA8F;AAC9F,6FAA6F;AAC7F,+FAA+F;AAC/F,iCAAiC;AACjC,EAAE;AACF,+FAA+F;AAC/F,+FAA+F;AAC/F,uFAAuF;AACvF,2CAA2C;AAC3C,8EAA8E;AAE9E,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CACjB,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,IAAI,EAAE,EACR,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EACd,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,EACf,CAAC,CAAC,KAAK,CAAC,sBAAsB,EAAE,4BAA4B,CAAC,CAC9D,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD;;;;;;;;;;;;;OAaG;IACH,GAAG,EAAE,CAAC,CAAC,IAAI,CACT,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,IAAI,EAAE,EACR,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EACd,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,EAChB,CAAC,CAAC,KAAK,CAAC,0BAA0B,EAAE,2CAA2C,CAAC,EAChF,CAAC,CAAC,KAAK,CACL,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,wBAAwB,CAAC,GAAG,CAAC,EACvC,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CACtD,CACF;IACD;;;;;;;;;OASG;IACH,OAAO,EAAE,CAAC,CAAC,QAAQ,CACjB,CAAC,CAAC,IAAI,CACJ,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,IAAI,EAAE,EACR,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EACd,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,EAChB,CAAC,CAAC,KAAK,CAAC,0BAA0B,EAAE,2CAA2C,CAAC,EAChF,CAAC,CAAC,KAAK,CACL,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EACnC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CACxD,CACF,CACF;IACD;;;;OAIG;IACH,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;CAClC,CAAC,CAAA;AAGF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,iFAAiF;IACjF,EAAE,EAAE,IAAI;IACR,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpE,2DAA2D;IAC3D,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACvE;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9D;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACjE;;;;OAIG;IACH,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAChD;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACrF;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,+BAA+B,CAAC;IACvD;;;;OAIG;IACH,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;CACxD,CAAC,CAAA;AAGF;;;;;;;;GAQG;AACH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,EAAE,EAAE,IAAI;IACR,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,0FAA0F;IAC1F,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;IACzC,gGAAgG;IAChG,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;CACjD,CAAC,CAAA;AAGF,MAAM,UAAU,+BAA+B,CAAC,UAAmB;IACjE,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,+BAA+B,EAAE,UAAU,CAAC,CAAA;IACvE,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,CAAA;IAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACxE,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAA;IAC3D,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/capability-credentials.d.ts

@@ -0,0 +1,159 @@
+import * as v from 'valibot';
+/**
+ * The key a stored credential answers for: the LOOKUP name the capability's definition declares,
+ * which is what a resolver is asked for.
+ *
+ * It is not necessarily the variable the agent reads the value from. A definition that needs a
+ * specific variable name in the process it configures declares `envName` beside its `key`, and
+ * the store never sees that name: it stores what the resolver is ASKED for, and the injection
+ * name is applied afterwards, at dispatch.
+ *
+ * Held to BOTH lists, which protect different things and neither implies the other:
+ *
+ *   - {@link isReservedPlatformEnvKey}, the platform's own configuration. Storing a value under
+ *     `ENCRYPTION_KEY` would not read the deployment's key (this store answers first), but the
+ *     declaration it would satisfy is refused at boot, so accepting it here lets an operator fill
+ *     in a credential that can never be asked for.
+ *   - {@link isToolchainEnvName}, the harness's own process. This one is belt-and-braces at this
+ *     boundary rather than the real guard (the real guard is on `envName` at declaration), because
+ *     a stored key with no `envName` beside it IS the injected name.
+ */
+export declare const capabilityCredentialKeySchema: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 128, undefined>, v.RegexAction<string, "must be a valid environment variable name (letters, digits and underscores, not starting with a digit)">, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>]>;
+/** One stored credential: the key it answers for, and the write-only value sealed at rest. */
+export declare const capabilityCredentialEntrySchema: v.ObjectSchema<{
+    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 128, undefined>, v.RegexAction<string, "must be a valid environment variable name (letters, digits and underscores, not starting with a digit)">, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>]>;
+    readonly value: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 8192, undefined>]>;
+}, undefined>;
+export type CapabilityCredentialEntry = v.InferOutput<typeof capabilityCredentialEntrySchema>;
+/**
+ * The non-secret projection of a stored credential — what the API returns and the UI lists.
+ *
+ * A KEY and nothing else. There is deliberately no operator-authored description field, unlike a
+ * test secret's: what a capability credential is FOR is already stated by the definition that
+ * declares it (`usage`, `guidance`), and a second free-text answer beside it is a copy that can
+ * disagree with the definition and always wins visually. The read that pairs stored keys with
+ * their DECLARATIONS is {@link capabilityCredentialStatusSchema}.
+ */
+export declare const capabilityCredentialRefSchema: v.ObjectSchema<{
+    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 128, undefined>, v.RegexAction<string, "must be a valid environment variable name (letters, digits and underscores, not starting with a digit)">, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>]>;
+    /** When the value was last written, so the UI can show age without revealing the value. */
+    readonly updatedAt: v.NumberSchema<undefined>;
+}, undefined>;
+export type CapabilityCredentialRef = v.InferOutput<typeof capabilityCredentialRefSchema>;
+/**
+ * A credential the deployment's registered capabilities actually DECLARE, joined to whether this
+ * workspace has stored one.
+ *
+ * This is the read that makes the store usable rather than a blank key-value form. The keys a
+ * workspace must fill in are not a workspace fact at all — they are a property of the
+ * deployment's CODE (its `AgentKindRegistry` tool servers, its `BinaryGeneratorRegistry`) — so
+ * without projecting them, an operator has to read the deployment's source to learn what to type,
+ * and a typo produces a stored credential that is never asked for.
+ *
+ * Admin-gated on purpose. The workspace SNAPSHOT's generative-integration projection deliberately
+ * omits credential key names ("a workspace viewer has no business learning which environment
+ * variables the deployment sets"), and that judgement does not change because the value now lives
+ * in a row: this rides the same `secrets.manage` surface as the write.
+ */
+export declare const capabilityCredentialStatusSchema: v.ObjectSchema<{
+    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 128, undefined>, v.RegexAction<string, "must be a valid environment variable name (letters, digits and underscores, not starting with a digit)">, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>]>;
+    /** Which capabilities want it — id + label, so the UI can say who a key is for. */
+    readonly declaredBy: v.ArraySchema<v.ObjectSchema<{
+        readonly subject: v.PicklistSchema<["tool-server", "binary-generator"], undefined>;
+        readonly id: v.StringSchema<undefined>;
+        readonly label: v.StringSchema<undefined>;
+        /** The definition's own note on how the value is presented, when it states one. */
+        readonly usage: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    }, undefined>, undefined>;
+    /** Whether at least one declaring capability treats it as required. */
+    readonly required: v.BooleanSchema<undefined>;
+    /** Whether THIS workspace has stored a value. */
+    readonly stored: v.BooleanSchema<undefined>;
+    /** When the stored value was last written. Absent when nothing is stored. */
+    readonly updatedAt: v.OptionalSchema<v.NumberSchema<undefined>, undefined>;
+}, undefined>;
+export type CapabilityCredentialStatus = v.InferOutput<typeof capabilityCredentialStatusSchema>;
+/** Set/replace a workspace's capability credentials. Values write-only; keys unique. */
+export declare const upsertCapabilityCredentialsSchema: v.SchemaWithPipe<readonly [v.ObjectSchema<{
+    readonly entries: v.ArraySchema<v.ObjectSchema<{
+        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 128, undefined>, v.RegexAction<string, "must be a valid environment variable name (letters, digits and underscores, not starting with a digit)">, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>]>;
+        readonly value: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 8192, undefined>]>;
+    }, undefined>, undefined>;
+}, undefined>, v.CheckAction<{
+    entries: {
+        key: string;
+        value: string;
+    }[];
+}, "capability credential keys must be unique within a workspace">, v.CheckAction<{
+    entries: {
+        key: string;
+        value: string;
+    }[];
+}, "at most 100 capability credentials per workspace">]>;
+export type UpsertCapabilityCredentialsInput = v.InferOutput<typeof upsertCapabilityCredentialsSchema>;
+/**
+ * What the credential surface returns: what this deployment's capabilities DECLARE joined to what
+ * this workspace has STORED, plus any stored key nothing declares.
+ *
+ * The orphan half is not tidiness. A capability is deployment CODE, so a workspace's stored key
+ * stops being declared whenever the deployment retires an integration or renames a variable — and
+ * an orphaned credential is a live secret nobody will ever ask for, sitting sealed in a row. It is
+ * reported as its own list rather than dropped from the view, for the same reason an unknown
+ * generator id is named rather than filtered: the operator is the only one who can decide whether
+ * to delete it or whether the deployment regressed.
+ */
+export declare const capabilityCredentialsViewSchema: v.ObjectSchema<{
+    readonly declared: v.ArraySchema<v.ObjectSchema<{
+        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 128, undefined>, v.RegexAction<string, "must be a valid environment variable name (letters, digits and underscores, not starting with a digit)">, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>]>;
+        /** Which capabilities want it — id + label, so the UI can say who a key is for. */
+        readonly declaredBy: v.ArraySchema<v.ObjectSchema<{
+            readonly subject: v.PicklistSchema<["tool-server", "binary-generator"], undefined>;
+            readonly id: v.StringSchema<undefined>;
+            readonly label: v.StringSchema<undefined>;
+            /** The definition's own note on how the value is presented, when it states one. */
+            readonly usage: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        }, undefined>, undefined>;
+        /** Whether at least one declaring capability treats it as required. */
+        readonly required: v.BooleanSchema<undefined>;
+        /** Whether THIS workspace has stored a value. */
+        readonly stored: v.BooleanSchema<undefined>;
+        /** When the stored value was last written. Absent when nothing is stored. */
+        readonly updatedAt: v.OptionalSchema<v.NumberSchema<undefined>, undefined>;
+    }, undefined>, undefined>;
+    /** Stored keys no registered capability declares. */
+    readonly orphaned: v.ArraySchema<v.ObjectSchema<{
+        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 128, undefined>, v.RegexAction<string, "must be a valid environment variable name (letters, digits and underscores, not starting with a digit)">, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>]>;
+        /** When the value was last written, so the UI can show age without revealing the value. */
+        readonly updatedAt: v.NumberSchema<undefined>;
+    }, undefined>, undefined>;
+    /**
+     * Whether the deployment ALSO has an environment-variable fallback behind this store. False
+     * when a facade wired a store-only resolver.
+     *
+     * Stated because it changes what an EMPTY row means: with the fallback, a key nothing is stored
+     * for may still resolve from the deployment's environment, so the UI must not report it as
+     * missing. "Absent" and "zero" again.
+     */
+    readonly environmentFallback: v.BooleanSchema<undefined>;
+    /**
+     * Whether the DECLARATION half of this view is known to be incomplete — the generative
+     * integrations are read through `BinaryGeneratorSource`, which THROWS rather than answering an
+     * empty set when it cannot reach the mothership, and this surface must not turn that outage
+     * into "no integration needs a credential".
+     *
+     * Its own flag rather than a failed request, because the stored half is still perfectly
+     * readable and an operator locked out of their own credential list during someone else's
+     * outage is a worse answer than a list with a caveat on it.
+     */
+    readonly declarationsIncomplete: v.BooleanSchema<undefined>;
+}, undefined>;
+export type CapabilityCredentialsView = v.InferOutput<typeof capabilityCredentialsViewSchema>;
+/** Validate a decrypted blob at the read boundary, so a drifted row fails clearly and early. */
+export declare const capabilityCredentialEntriesSchema: v.ArraySchema<v.ObjectSchema<{
+    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 128, undefined>, v.RegexAction<string, "must be a valid environment variable name (letters, digits and underscores, not starting with a digit)">, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>]>;
+    readonly value: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 8192, undefined>]>;
+}, undefined>, undefined>;
+export declare function parseCapabilityCredentialEntries(raw: unknown): CapabilityCredentialEntry[];
+/** The non-secret summary persisted beside the sealed values, so a read decrypts nothing. */
+export declare function capabilityCredentialsSummary(entries: CapabilityCredentialEntry[], updatedAt: number): CapabilityCredentialRef[];
+//# sourceMappingURL=capability-credentials.d.ts.map

package/dist/capability-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-credentials.d.ts","sourceRoot":"","sources":["../src/capability-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAiC5B;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,6BAA6B,2ZAiBzC,CAAA;AAED,8FAA8F;AAC9F,eAAO,MAAM,+BAA+B;;;aAG1C,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,+BAA+B,CAAC,CAAA;AAE7F;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B;;IAExC,2FAA2F;;aAE3F,CAAA;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,6BAA6B,CAAC,CAAA;AAEzF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,gCAAgC;;IAE3C,mFAAmF;;;;;QAM/E,mFAAmF;;;IAIvF,uEAAuE;;IAEvE,iDAAiD;;IAEjD,6EAA6E;;aAE7E,CAAA;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,gCAAgC,CAAC,CAAA;AAE/F,wFAAwF;AACxF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;wDAO7C,CAAA;AACD,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,WAAW,CAC1D,OAAO,iCAAiC,CACzC,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,+BAA+B;;;QA3C1C,mFAAmF;;;;;YAM/E,mFAAmF;;;QAIvF,uEAAuE;;QAEvE,iDAAiD;;QAEjD,6EAA6E;;;IA+B7E,qDAAqD;;;QAnErD,2FAA2F;;;IAqE3F;;;;;;;OAOG;;IAEH;;;;;;;;;OASG;;aAEH,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,+BAA+B,CAAC,CAAA;AAE7F,gGAAgG;AAChG,eAAO,MAAM,iCAAiC;;;yBAA2C,CAAA;AACzF,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,OAAO,GAAG,yBAAyB,EAAE,CAE1F;AAED,6FAA6F;AAC7F,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,yBAAyB,EAAE,EACpC,SAAS,EAAE,MAAM,GAChB,uBAAuB,EAAE,CAE3B"}

package/dist/capability-credentials.js

@@ -0,0 +1,145 @@
+import * as v from 'valibot';
+import { isReservedPlatformEnvKey, isToolchainEnvName, reservedEnvKeyMessage, toolchainEnvNameMessage, } from './reserved-env-keys.js';
+// ---------------------------------------------------------------------------
+// PER-WORKSPACE capability credentials (SEALED) — the tenant-scoped home for the secrets a
+// registered capability declares.
+//
+// A tool server (MCP) and a generative binary integration each declare the credential they need
+// BY NAME, and the value is resolved per dispatch through the kernel `ToolSecretResolver`. The
+// shipped default reads that name off the DEPLOYMENT'S OWN ENVIRONMENT, which is the right answer
+// for a single-tenant install and the wrong one for every other shape: one process serves many
+// workspaces, so one variable serves them all — every tenant's runs authenticate as whoever set
+// the variable, a tenant cannot supply its own vendor account, rotating one tenant's key means a
+// redeploy, and the value is visible to every operator with shell access to the host.
+//
+// Every other credential in the platform already went the other way: provider API keys, tracker /
+// document / runner / observability connections, personal subscriptions, private package
+// registries and the sensitive test secrets are all per-tenant rows, sealed at rest, edited in
+// the UI. Capabilities are the subsystem that did not get it. This module is that store's wire
+// vocabulary, and it is modelled on `test-secrets.ts` deliberately — same sealed-blob-plus-
+// non-secret-summary shape, same write-only values, same "the view lists KEYS, never values".
+//
+// The env resolver is NOT removed. It becomes the FALLBACK: a workspace that has stored nothing
+// keeps resolving exactly as before, so a local install and a single-tenant deployment need no
+// migration and no UI visit. What changes is which one wins when both have a value — see
+// `composeToolSecretResolvers` in `@cat-factory/server`.
+// ---------------------------------------------------------------------------
+/**
+ * The key a stored credential answers for: the LOOKUP name the capability's definition declares,
+ * which is what a resolver is asked for.
+ *
+ * It is not necessarily the variable the agent reads the value from. A definition that needs a
+ * specific variable name in the process it configures declares `envName` beside its `key`, and
+ * the store never sees that name: it stores what the resolver is ASKED for, and the injection
+ * name is applied afterwards, at dispatch.
+ *
+ * Held to BOTH lists, which protect different things and neither implies the other:
+ *
+ *   - {@link isReservedPlatformEnvKey}, the platform's own configuration. Storing a value under
+ *     `ENCRYPTION_KEY` would not read the deployment's key (this store answers first), but the
+ *     declaration it would satisfy is refused at boot, so accepting it here lets an operator fill
+ *     in a credential that can never be asked for.
+ *   - {@link isToolchainEnvName}, the harness's own process. This one is belt-and-braces at this
+ *     boundary rather than the real guard (the real guard is on `envName` at declaration), because
+ *     a stored key with no `envName` beside it IS the injected name.
+ */
+export const capabilityCredentialKeySchema = v.pipe(v.string(), v.trim(), v.minLength(1), v.maxLength(128), v.regex(/^[A-Za-z_][A-Za-z0-9_]*$/, 'must be a valid environment variable name (letters, digits and underscores, not starting with a digit)'), v.check((key) => !isReservedPlatformEnvKey(key), (issue) => reservedEnvKeyMessage(String(issue.input))), v.check((key) => !isToolchainEnvName(key), (issue) => toolchainEnvNameMessage(String(issue.input))));
+/** One stored credential: the key it answers for, and the write-only value sealed at rest. */
+export const capabilityCredentialEntrySchema = v.object({
+    key: capabilityCredentialKeySchema,
+    value: v.pipe(v.string(), v.minLength(1), v.maxLength(8192)),
+});
+/**
+ * The non-secret projection of a stored credential — what the API returns and the UI lists.
+ *
+ * A KEY and nothing else. There is deliberately no operator-authored description field, unlike a
+ * test secret's: what a capability credential is FOR is already stated by the definition that
+ * declares it (`usage`, `guidance`), and a second free-text answer beside it is a copy that can
+ * disagree with the definition and always wins visually. The read that pairs stored keys with
+ * their DECLARATIONS is {@link capabilityCredentialStatusSchema}.
+ */
+export const capabilityCredentialRefSchema = v.object({
+    key: capabilityCredentialKeySchema,
+    /** When the value was last written, so the UI can show age without revealing the value. */
+    updatedAt: v.number(),
+});
+/**
+ * A credential the deployment's registered capabilities actually DECLARE, joined to whether this
+ * workspace has stored one.
+ *
+ * This is the read that makes the store usable rather than a blank key-value form. The keys a
+ * workspace must fill in are not a workspace fact at all — they are a property of the
+ * deployment's CODE (its `AgentKindRegistry` tool servers, its `BinaryGeneratorRegistry`) — so
+ * without projecting them, an operator has to read the deployment's source to learn what to type,
+ * and a typo produces a stored credential that is never asked for.
+ *
+ * Admin-gated on purpose. The workspace SNAPSHOT's generative-integration projection deliberately
+ * omits credential key names ("a workspace viewer has no business learning which environment
+ * variables the deployment sets"), and that judgement does not change because the value now lives
+ * in a row: this rides the same `secrets.manage` surface as the write.
+ */
+export const capabilityCredentialStatusSchema = v.object({
+    key: capabilityCredentialKeySchema,
+    /** Which capabilities want it — id + label, so the UI can say who a key is for. */
+    declaredBy: v.array(v.object({
+        subject: v.picklist(['tool-server', 'binary-generator']),
+        id: v.string(),
+        label: v.string(),
+        /** The definition's own note on how the value is presented, when it states one. */
+        usage: v.optional(v.string()),
+    })),
+    /** Whether at least one declaring capability treats it as required. */
+    required: v.boolean(),
+    /** Whether THIS workspace has stored a value. */
+    stored: v.boolean(),
+    /** When the stored value was last written. Absent when nothing is stored. */
+    updatedAt: v.optional(v.number()),
+});
+/** Set/replace a workspace's capability credentials. Values write-only; keys unique. */
+export const upsertCapabilityCredentialsSchema = v.pipe(v.object({ entries: v.array(capabilityCredentialEntrySchema) }), v.check((o) => new Set(o.entries.map((e) => e.key)).size === o.entries.length, 'capability credential keys must be unique within a workspace'), v.check((o) => o.entries.length <= 100, 'at most 100 capability credentials per workspace'));
+/**
+ * What the credential surface returns: what this deployment's capabilities DECLARE joined to what
+ * this workspace has STORED, plus any stored key nothing declares.
+ *
+ * The orphan half is not tidiness. A capability is deployment CODE, so a workspace's stored key
+ * stops being declared whenever the deployment retires an integration or renames a variable — and
+ * an orphaned credential is a live secret nobody will ever ask for, sitting sealed in a row. It is
+ * reported as its own list rather than dropped from the view, for the same reason an unknown
+ * generator id is named rather than filtered: the operator is the only one who can decide whether
+ * to delete it or whether the deployment regressed.
+ */
+export const capabilityCredentialsViewSchema = v.object({
+    declared: v.array(capabilityCredentialStatusSchema),
+    /** Stored keys no registered capability declares. */
+    orphaned: v.array(capabilityCredentialRefSchema),
+    /**
+     * Whether the deployment ALSO has an environment-variable fallback behind this store. False
+     * when a facade wired a store-only resolver.
+     *
+     * Stated because it changes what an EMPTY row means: with the fallback, a key nothing is stored
+     * for may still resolve from the deployment's environment, so the UI must not report it as
+     * missing. "Absent" and "zero" again.
+     */
+    environmentFallback: v.boolean(),
+    /**
+     * Whether the DECLARATION half of this view is known to be incomplete — the generative
+     * integrations are read through `BinaryGeneratorSource`, which THROWS rather than answering an
+     * empty set when it cannot reach the mothership, and this surface must not turn that outage
+     * into "no integration needs a credential".
+     *
+     * Its own flag rather than a failed request, because the stored half is still perfectly
+     * readable and an operator locked out of their own credential list during someone else's
+     * outage is a worse answer than a list with a caveat on it.
+     */
+    declarationsIncomplete: v.boolean(),
+});
+/** Validate a decrypted blob at the read boundary, so a drifted row fails clearly and early. */
+export const capabilityCredentialEntriesSchema = v.array(capabilityCredentialEntrySchema);
+export function parseCapabilityCredentialEntries(raw) {
+    return v.parse(capabilityCredentialEntriesSchema, raw);
+}
+/** The non-secret summary persisted beside the sealed values, so a read decrypts nothing. */
+export function capabilityCredentialsSummary(entries, updatedAt) {
+    return entries.map((entry) => ({ key: entry.key, updatedAt }));
+}
+//# sourceMappingURL=capability-credentials.js.map

package/dist/capability-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-credentials.js","sourceRoot":"","sources":["../src/capability-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAC5B,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,wBAAwB,CAAA;AAE/B,8EAA8E;AAC9E,2FAA2F;AAC3F,kCAAkC;AAClC,EAAE;AACF,gGAAgG;AAChG,+FAA+F;AAC/F,kGAAkG;AAClG,+FAA+F;AAC/F,gGAAgG;AAChG,iGAAiG;AACjG,sFAAsF;AACtF,EAAE;AACF,kGAAkG;AAClG,yFAAyF;AACzF,+FAA+F;AAC/F,+FAA+F;AAC/F,4FAA4F;AAC5F,8FAA8F;AAC9F,EAAE;AACF,gGAAgG;AAChG,+FAA+F;AAC/F,yFAAyF;AACzF,yDAAyD;AACzD,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,IAAI,CACjD,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,IAAI,EAAE,EACR,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EACd,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,EAChB,CAAC,CAAC,KAAK,CACL,0BAA0B,EAC1B,wGAAwG,CACzG,EACD,CAAC,CAAC,KAAK,CACL,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,wBAAwB,CAAC,GAAG,CAAC,EACvC,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CACtD,EACD,CAAC,CAAC,KAAK,CACL,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,EACjC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CACxD,CACF,CAAA;AAED,8FAA8F;AAC9F,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,GAAG,EAAE,6BAA6B;IAClC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;CAC7D,CAAC,CAAA;AAGF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,GAAG,EAAE,6BAA6B;IAClC,2FAA2F;IAC3F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAA;AAGF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,GAAG,EAAE,6BAA6B;IAClC,mFAAmF;IACnF,UAAU,EAAE,CAAC,CAAC,KAAK,CACjB,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;QACxD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,mFAAmF;QACnF,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KAC9B,CAAC,CACH;IACD,uEAAuE;IACvE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,iDAAiD;IACjD,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,6EAA6E;IAC7E,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAClC,CAAC,CAAA;AAGF,wFAAwF;AACxF,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,IAAI,CACrD,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC,EAAE,CAAC,EAC/D,CAAC,CAAC,KAAK,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EACrE,8DAA8D,CAC/D,EACD,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG,EAAE,kDAAkD,CAAC,CAC5F,CAAA;AAKD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,gCAAgC,CAAC;IACnD,qDAAqD;IACrD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC;IAChD;;;;;;;OAOG;IACH,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE;IAChC;;;;;;;;;OASG;IACH,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE;CACpC,CAAC,CAAA;AAGF,gGAAgG;AAChG,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAA;AACzF,MAAM,UAAU,gCAAgC,CAAC,GAAY;IAC3D,OAAO,CAAC,CAAC,KAAK,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAA;AACxD,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,4BAA4B,CAC1C,OAAoC,EACpC,SAAiB;IAEjB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;AAChE,CAAC"}

package/dist/index.d.ts

@@ -19,6 +19,8 @@ export * from './skill-library.js';
 export * from './foundational-services.js';
 export * from './binary-modalities.js';
 export * from './binary-generators.js';
+export * from './reserved-env-keys.js';
+export * from './capability-credentials.js';
 export * from './binary-outputs.js';
 export * from './accounts.js';
 export * from './workspace-members.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,0BAA0B,CAAA;AACxC,cAAc,eAAe,CAAA;AAC7B,cAAc,0BAA0B,CAAA;AACxC,cAAc,cAAc,CAAA;AAC5B,cAAc,sBAAsB,CAAA;AACpC,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,uBAAuB,CAAA;AACrC,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,qBAAqB,CAAA;AACnC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,0BAA0B,CAAA;AACxC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,cAAc,CAAA;AAC5B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,wBAAwB,CAAA;AACtC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA;AAChC,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,WAAW,CAAA;AACzB,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,cAAc,CAAA;AAC5B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,WAAW,CAAA;AACzB,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,uBAAuB,CAAA;AACrC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,yBAAyB,CAAA;AACvC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,2BAA2B,CAAA;AACzC,cAAc,wBAAwB,CAAA;AACtC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,oBAAoB,CAAA;AAClC,cAAc,YAAY,CAAA;AAC1B,cAAc,oBAAoB,CAAA;AAClC,cAAc,cAAc,CAAA;AAC5B,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,uBAAuB,CAAA;AACrC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,kBAAkB,CAAA;AAChC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,0BAA0B,CAAA;AACxC,cAAc,eAAe,CAAA;AAC7B,cAAc,0BAA0B,CAAA;AACxC,cAAc,cAAc,CAAA;AAC5B,cAAc,sBAAsB,CAAA;AACpC,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,uBAAuB,CAAA;AACrC,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,qBAAqB,CAAA;AACnC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,0BAA0B,CAAA;AACxC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,cAAc,CAAA;AAC5B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,wBAAwB,CAAA;AACtC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA;AAChC,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,WAAW,CAAA;AACzB,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,cAAc,CAAA;AAC5B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,WAAW,CAAA;AACzB,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,uBAAuB,CAAA;AACrC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,yBAAyB,CAAA;AACvC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,2BAA2B,CAAA;AACzC,cAAc,wBAAwB,CAAA;AACtC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,oBAAoB,CAAA;AAClC,cAAc,YAAY,CAAA;AAC1B,cAAc,oBAAoB,CAAA;AAClC,cAAc,cAAc,CAAA;AAC5B,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,uBAAuB,CAAA;AACrC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,kBAAkB,CAAA;AAChC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA"}

package/dist/index.js

@@ -19,6 +19,8 @@ export * from './skill-library.js';
 export * from './foundational-services.js';
 export * from './binary-modalities.js';
 export * from './binary-generators.js';
+export * from './reserved-env-keys.js';
+export * from './capability-credentials.js';
 export * from './binary-outputs.js';
 export * from './accounts.js';
 export * from './workspace-members.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,0BAA0B,CAAA;AACxC,cAAc,eAAe,CAAA;AAC7B,cAAc,0BAA0B,CAAA;AACxC,cAAc,cAAc,CAAA;AAC5B,cAAc,sBAAsB,CAAA;AACpC,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,uBAAuB,CAAA;AACrC,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,qBAAqB,CAAA;AACnC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,0BAA0B,CAAA;AACxC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,cAAc,CAAA;AAC5B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,wBAAwB,CAAA;AACtC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA;AAChC,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,WAAW,CAAA;AACzB,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,cAAc,CAAA;AAC5B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,WAAW,CAAA;AACzB,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,uBAAuB,CAAA;AACrC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,yBAAyB,CAAA;AACvC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,2BAA2B,CAAA;AACzC,cAAc,wBAAwB,CAAA;AACtC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,oBAAoB,CAAA;AAClC,cAAc,YAAY,CAAA;AAC1B,cAAc,oBAAoB,CAAA;AAClC,cAAc,cAAc,CAAA;AAC5B,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,uBAAuB,CAAA;AACrC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,kBAAkB,CAAA;AAChC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,0BAA0B,CAAA;AACxC,cAAc,eAAe,CAAA;AAC7B,cAAc,0BAA0B,CAAA;AACxC,cAAc,cAAc,CAAA;AAC5B,cAAc,sBAAsB,CAAA;AACpC,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,uBAAuB,CAAA;AACrC,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,qBAAqB,CAAA;AACnC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,0BAA0B,CAAA;AACxC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,cAAc,CAAA;AAC5B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,wBAAwB,CAAA;AACtC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA;AAChC,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,WAAW,CAAA;AACzB,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,cAAc,CAAA;AAC5B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,WAAW,CAAA;AACzB,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,uBAAuB,CAAA;AACrC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,yBAAyB,CAAA;AACvC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,2BAA2B,CAAA;AACzC,cAAc,wBAAwB,CAAA;AACtC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,oBAAoB,CAAA;AAClC,cAAc,YAAY,CAAA;AAC1B,cAAc,oBAAoB,CAAA;AAClC,cAAc,cAAc,CAAA;AAC5B,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,uBAAuB,CAAA;AACrC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,kBAAkB,CAAA;AAChC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA"}

package/dist/reserved-env-keys.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Name PREFIXES the platform's own configuration owns (compared case-insensitively).
+ *
+ * These carry the drift protection: a variable added inside one of these families is reserved the
+ * day it is read, with no edit here. `scripts/check-reserved-env-keys.mjs` fails CI when a
+ * variable documented in `docs/environment-variables.md` is covered by neither this list nor
+ * {@link PLATFORM_RESERVED_ENV_KEYS}, so the exact-name list below cannot silently fall behind
+ * either.
+ */
+export declare const PLATFORM_RESERVED_ENV_PREFIXES: readonly string[];
+/**
+ * The platform's own variables that no {@link PLATFORM_RESERVED_ENV_PREFIXES} family covers —
+ * every remaining name read by a facade's config loader, a sweeper, or a model provider.
+ *
+ * Upper-case by convention; the comparison in {@link isReservedPlatformEnvKey} is
+ * case-insensitive, which is load-bearing rather than tidy: `process.env` lookup is
+ * case-INSENSITIVE on Windows, so a declaration spelled `encryption_key` would otherwise resolve
+ * the real key on a developer's laptop while passing a case-sensitive check.
+ */
+export declare const PLATFORM_RESERVED_ENV_KEYS: readonly string[];
+/**
+ * Whether `key` names a variable the platform's own configuration owns, so a tool server or a
+ * generative integration declaring it is refused rather than resolved.
+ *
+ * Binds the LOOKUP name only: the name a resolver is asked for, and therefore the name that could
+ * be read off the deployment's environment. It deliberately does NOT bind the name a resolved
+ * value is injected UNDER in the agent's process ({@link isToolchainEnvName} is that rule), and
+ * conflating the two is what makes a family like `GITHUB_` unusable for the third-party servers
+ * that legitimately own names inside it.
+ *
+ * Case-insensitive and whitespace-tolerant, because both are ways the same variable is reached:
+ * see {@link PLATFORM_RESERVED_ENV_KEYS} on Windows, and the schema trims before it validates.
+ */
+export declare function isReservedPlatformEnvKey(key: string): boolean;
+/**
+ * The one operator-facing sentence every refusal of a reserved key uses — the schema issue, the
+ * boot problem, and the dispatch-time log line alike.
+ *
+ * Shared so the three cannot describe the same fault three ways, and phrased as the REMEDY it is:
+ * an operator who reads "reserved" without being told to declare a variable of the integration's
+ * own tends to try `allowKeys` next, which cannot widen this floor.
+ */
+export declare function reservedEnvKeyMessage(key: string): string;
+/** Whether `name` is a toolchain variable, so injecting a value under it would reconfigure the run. */
+export declare function isToolchainEnvName(name: string): boolean;
+/** The one operator-facing sentence every refusal of a toolchain injection name uses. */
+export declare function toolchainEnvNameMessage(name: string): string;
+/** Whether `name` is shaped like an environment variable at all. */
+export declare function isEnvVariableName(name: string): boolean;
+//# sourceMappingURL=reserved-env-keys.d.ts.map

package/dist/reserved-env-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reserved-env-keys.d.ts","sourceRoot":"","sources":["../src/reserved-env-keys.ts"],"names":[],"mappings":"AA4DA;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAqC3D,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAAS,MAAM,EAiBvD,CAAA;AAKD;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAK7D;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQzD;AAgDD,uGAAuG;AACvG,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAKxD;AAED,yFAAyF;AACzF,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAM5D;AAED,oEAAoE;AACpE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD"}

package/dist/reserved-env-keys.js

@@ -0,0 +1,234 @@
+// ---------------------------------------------------------------------------
+// What a registered capability's credential may be NAMED.
+//
+// A credential has two names and this module holds the rule for each. The LOOKUP name (`key`) is
+// what a `ToolSecretResolver` is asked for, so it can reach the deployment's own environment; it
+// may not name a variable the platform's own configuration owns, which is the first half below.
+// The INJECTED name (`envName`, defaulting to the lookup name) is what the resolved value is set
+// as in the agent's or the MCP server's process; it reads nothing, so it is held only to the
+// narrower toolchain rule in the second half.
+//
+// First half: the environment variable names a DEPLOYMENT'S OWN CONFIGURATION owns, and which a
+// registered capability's credential may therefore never be looked up by.
+//
+// The platform already holds one invariant about its environment: it never reaches an agent
+// process. A container's environment is COMPOSED (the harness is handed exactly the job body's
+// pairs), and the local NATIVE transport — where the harness is a child of the orchestrator and
+// would otherwise inherit `process.env` wholesale — projects through the allow-list in
+// `runtimes/local/src/childEnv.ts`, whose header names the assets at stake: `DATABASE_URL`,
+// `ENCRYPTION_KEY`, `AUTH_SESSION_SECRET`, `GITHUB_PAT`, the provider API keys.
+//
+// The `ToolSecretResolver`'s env-backed default is the SECOND path between those two
+// environments, and it was the one with no such statement. It reads whatever key a registration
+// declares, and a registration names both the key it wants AND the endpoint that key is sent to
+// — so `{ key: 'ENCRYPTION_KEY', usage: 'Authorization: Bearer <value>' }` was a valid tool
+// server / generative integration that booted clean and shipped the deployment's master sealing
+// key into a prompt-injectable agent process. In MOTHERSHIP mode that declaration is authored by
+// the mothership and the environment read is a developer's own laptop, which is what turns a
+// hygiene problem into a boundary one: `ENCRYPTION_KEY` and `HARNESS_SHARED_SECRET` are the keys
+// to the split BETWEEN the two processes, held by the side that is meant to keep them.
+//
+// So: a capability credential may not name a variable the platform itself reads. Refused where
+// the declaration is made (the generative-integration schema, and boot validation for a tool
+// server) and again where a declared key becomes a lookup, because a mothership-mode node never
+// boot-validates the definitions it resolves — they arrive per dispatch over
+// `/internal/binary-generators`, so a check that only ran on the mothership is a check the node
+// cannot rely on.
+//
+// WHY THIS SET IS THE PLATFORM'S WHOLE ENVIRONMENT, not just its secrets. Splitting "secret" from
+// "not secret" needs a judgement per variable, and the judgement is wrong the moment a var gains
+// a sensitive use — while over-reserving costs a deployment nothing, because nobody names an
+// integration credential `PORT`. The provider keys are the case that looks like over-reach and is
+// not: `OPENAI_API_KEY` is billable and exfiltratable, and an integration that wants to call
+// OpenAI on the deployment's account should say so in its own variable rather than silently
+// inherit the one the model router spends.
+//
+// WHY NOT A PREFIX MANDATE ON THE OTHER SIDE (`GEN_…` / `TOOL_…` for every credential, so the
+// platform's names are excluded by construction). It reads as the sounder positive rule and it is
+// not available here: a subject credential's `key` is not only what the resolver is asked for, it
+// is the ENVIRONMENT VARIABLE NAME the agent reads the value from. Mandating a prefix renames the
+// variable inside the agent's process, so an integration whose SDK auto-reads its vendor's
+// documented name stops working, and every deployment renames its `.env` to buy it. The same
+// positive rule applied to the side that ALREADY has a namespace — the platform's own vars, which
+// really do cluster into families — costs nobody a rename and is what {@link
+// PLATFORM_RESERVED_ENV_PREFIXES} is.
+//
+// This lives in `@cat-factory/contracts` because it is the only layer every enforcement point can
+// see: the valibot credential schema here, kernel's capability types, the server's dispatch-time
+// resolution, and orchestration's boot validation.
+// ---------------------------------------------------------------------------
+/**
+ * Name PREFIXES the platform's own configuration owns (compared case-insensitively).
+ *
+ * These carry the drift protection: a variable added inside one of these families is reserved the
+ * day it is read, with no edit here. `scripts/check-reserved-env-keys.mjs` fails CI when a
+ * variable documented in `docs/environment-variables.md` is covered by neither this list nor
+ * {@link PLATFORM_RESERVED_ENV_KEYS}, so the exact-name list below cannot silently fall behind
+ * either.
+ */
+export const PLATFORM_RESERVED_ENV_PREFIXES = [
+    'AGENT_',
+    'AUTH_',
+    'AWS_',
+    'BEDROCK_',
+    'BUDGET_',
+    'CI_',
+    'CLOUDFLARE_',
+    'CONSENSUS_',
+    'CONTAINER_',
+    'CORS_',
+    'DB_',
+    'DECISION_',
+    'EMAIL_SYSTEM_',
+    'ENVIRONMENTS_',
+    'EXECUTION_',
+    'GITHUB_',
+    'GITLAB_',
+    'GOOGLE_OAUTH_',
+    'INFRA_REACHABILITY_',
+    'INLINE_WEB_SEARCH_',
+    'JOB_',
+    'LANGFUSE_',
+    'LITELLM_',
+    'LLM_',
+    'LOCAL_',
+    'NOTIFICATION_WEBHOOK_',
+    'OBSERVABILITY_',
+    'OPENROUTER_',
+    'OTEL_',
+    'PLATFORM_ALERTS_',
+    'REDIS_',
+    'RUNNERS_',
+    'SLACK_',
+    'STALE_RUN_',
+    'TOKEN_USAGE_',
+    'WEB_SEARCH_',
+];
+/**
+ * The platform's own variables that no {@link PLATFORM_RESERVED_ENV_PREFIXES} family covers —
+ * every remaining name read by a facade's config loader, a sweeper, or a model provider.
+ *
+ * Upper-case by convention; the comparison in {@link isReservedPlatformEnvKey} is
+ * case-insensitive, which is load-bearing rather than tidy: `process.env` lookup is
+ * case-INSENSITIVE on Windows, so a declaration spelled `encryption_key` would otherwise resolve
+ * the real key on a developer's laptop while passing a case-sensitive check.
+ */
+export const PLATFORM_RESERVED_ENV_KEYS = [
+    'ANTHROPIC_API_KEY',
+    'APP_BASE_URL',
+    'DATABASE_URL',
+    'DEEPSEEK_API_KEY',
+    'ENCRYPTION_KEY',
+    'ENVIRONMENT',
+    'HARNESS_SHARED_SECRET',
+    'HOST',
+    'LOG_LEVEL',
+    'MOONSHOT_API_KEY',
+    'OPENAI_API_KEY',
+    'PORT',
+    'PUBLIC_URL',
+    'QWEN_API_KEY',
+    'REALTIME_NODE_ID',
+    'WORKER_PUBLIC_URL',
+];
+const RESERVED = new Set(PLATFORM_RESERVED_ENV_KEYS.map((key) => key.toUpperCase()));
+const RESERVED_PREFIXES = PLATFORM_RESERVED_ENV_PREFIXES.map((prefix) => prefix.toUpperCase());
+/**
+ * Whether `key` names a variable the platform's own configuration owns, so a tool server or a
+ * generative integration declaring it is refused rather than resolved.
+ *
+ * Binds the LOOKUP name only: the name a resolver is asked for, and therefore the name that could
+ * be read off the deployment's environment. It deliberately does NOT bind the name a resolved
+ * value is injected UNDER in the agent's process ({@link isToolchainEnvName} is that rule), and
+ * conflating the two is what makes a family like `GITHUB_` unusable for the third-party servers
+ * that legitimately own names inside it.
+ *
+ * Case-insensitive and whitespace-tolerant, because both are ways the same variable is reached:
+ * see {@link PLATFORM_RESERVED_ENV_KEYS} on Windows, and the schema trims before it validates.
+ */
+export function isReservedPlatformEnvKey(key) {
+    const upper = key.trim().toUpperCase();
+    if (!upper)
+        return false;
+    if (RESERVED.has(upper))
+        return true;
+    return RESERVED_PREFIXES.some((prefix) => upper.startsWith(prefix));
+}
+/**
+ * The one operator-facing sentence every refusal of a reserved key uses — the schema issue, the
+ * boot problem, and the dispatch-time log line alike.
+ *
+ * Shared so the three cannot describe the same fault three ways, and phrased as the REMEDY it is:
+ * an operator who reads "reserved" without being told to declare a variable of the integration's
+ * own tends to try `allowKeys` next, which cannot widen this floor.
+ */
+export function reservedEnvKeyMessage(key) {
+    return (`"${key}" is an environment variable the platform's own configuration owns, so it cannot be ` +
+        `the key a capability credential is looked up by: its value would be read off the deployment's ` +
+        `environment and injected into an agent process. Look the credential up under a name of the ` +
+        `integration's own (e.g. "ACME_IMAGE_API_KEY"); if the process reading it needs a specific ` +
+        `variable name, set "envName" to that name, which is not held to this list.`);
+}
+// ---------------------------------------------------------------------------
+// The OTHER half of the rule: names a resolved value may not be INJECTED under.
+//
+// A credential has two names, and only the first is a boundary. The LOOKUP name is what a
+// resolver is asked for, so it can reach the platform's own environment: that one is held to
+// `isReservedPlatformEnvKey` above. The INJECTED name is what the value is set as in the agent's
+// (or the MCP server's) process, and it reads nothing at all, so the reserved list must not bind
+// it. It has its own, narrower rule: a name that RECONFIGURES the process instead of
+// authenticating a call.
+//
+// Keeping them apart is what makes both rules affordable. An `http` tool server has always had the
+// split (`key` is the lookup, `header` is where the value goes), and it is the stdio and
+// generative-integration cases that conflated them: with one name, reserving the `GITHUB_` family
+// also reserved `GITHUB_PERSONAL_ACCESS_TOKEN`, which the platform does not read and the GitHub
+// MCP server requires. Renaming it is not open to a deployment either, since the server's own SDK
+// reads its documented name, which is exactly the argument against mandating a `TOOL_` prefix on
+// the lookup side.
+// ---------------------------------------------------------------------------
+/**
+ * Toolchain-critical names, which must never be injected into an agent's environment because
+ * doing so reconfigures the process rather than authenticating a call: the loader and search
+ * paths, the shell's own hooks, npm's and git's config families.
+ *
+ * The harness carries its own copy (`RESERVED_ENV_NAMES` in `job.ts`) and drops these
+ * defensively at parse, because the image builds from `src/` plus typescript and can depend on no
+ * workspace package. That copy stays a pinned-by-convention duplicate. This one is shared across
+ * the declaration surfaces INSIDE contracts (the stored credential, the tool-server registration,
+ * the generative-integration schema) rather than copied per surface, because refusing at the write
+ * boundary is what turns "silently never injected" into an error while the operator is typing.
+ */
+const TOOLCHAIN_ENV_NAMES = new Set([
+    'PATH',
+    'HOME',
+    'NODE_OPTIONS',
+    'NODE_PATH',
+    'NODE_EXTRA_CA_CERTS',
+    'LD_PRELOAD',
+    'LD_LIBRARY_PATH',
+    'BASH_ENV',
+    'ENV',
+    'SHELL',
+    'IFS',
+]);
+const TOOLCHAIN_ENV_PREFIXES = ['npm_config_', 'git_'];
+/** Whether `name` is a toolchain variable, so injecting a value under it would reconfigure the run. */
+export function isToolchainEnvName(name) {
+    const trimmed = name.trim();
+    if (TOOLCHAIN_ENV_NAMES.has(trimmed))
+        return true;
+    const lower = trimmed.toLowerCase();
+    return TOOLCHAIN_ENV_PREFIXES.some((prefix) => lower.startsWith(prefix));
+}
+/** The one operator-facing sentence every refusal of a toolchain injection name uses. */
+export function toolchainEnvNameMessage(name) {
+    return (`"${name}" is a toolchain environment variable, so a credential injected under it would ` +
+        `reconfigure the agent's process instead of authenticating a call. Use the name the ` +
+        `integration's own client reads (e.g. "ACME_API_KEY").`);
+}
+/** Whether `name` is shaped like an environment variable at all. */
+export function isEnvVariableName(name) {
+    return /^[A-Za-z_][A-Za-z0-9_]*$/.test(name);
+}
+//# sourceMappingURL=reserved-env-keys.js.map

package/dist/reserved-env-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reserved-env-keys.js","sourceRoot":"","sources":["../src/reserved-env-keys.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,0DAA0D;AAC1D,EAAE;AACF,iGAAiG;AACjG,iGAAiG;AACjG,gGAAgG;AAChG,iGAAiG;AACjG,6FAA6F;AAC7F,8CAA8C;AAC9C,EAAE;AACF,gGAAgG;AAChG,0EAA0E;AAC1E,EAAE;AACF,4FAA4F;AAC5F,+FAA+F;AAC/F,gGAAgG;AAChG,uFAAuF;AACvF,4FAA4F;AAC5F,gFAAgF;AAChF,EAAE;AACF,qFAAqF;AACrF,gGAAgG;AAChG,gGAAgG;AAChG,4FAA4F;AAC5F,gGAAgG;AAChG,iGAAiG;AACjG,6FAA6F;AAC7F,iGAAiG;AACjG,uFAAuF;AACvF,EAAE;AACF,+FAA+F;AAC/F,6FAA6F;AAC7F,gGAAgG;AAChG,6EAA6E;AAC7E,gGAAgG;AAChG,kBAAkB;AAClB,EAAE;AACF,kGAAkG;AAClG,iGAAiG;AACjG,6FAA6F;AAC7F,kGAAkG;AAClG,6FAA6F;AAC7F,4FAA4F;AAC5F,2CAA2C;AAC3C,EAAE;AACF,8FAA8F;AAC9F,kGAAkG;AAClG,kGAAkG;AAClG,kGAAkG;AAClG,2FAA2F;AAC3F,6FAA6F;AAC7F,kGAAkG;AAClG,6EAA6E;AAC7E,sCAAsC;AACtC,EAAE;AACF,kGAAkG;AAClG,iGAAiG;AACjG,mDAAmD;AACnD,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAsB;IAC/D,QAAQ;IACR,OAAO;IACP,MAAM;IACN,UAAU;IACV,SAAS;IACT,KAAK;IACL,aAAa;IACb,YAAY;IACZ,YAAY;IACZ,OAAO;IACP,KAAK;IACL,WAAW;IACX,eAAe;IACf,eAAe;IACf,YAAY;IACZ,SAAS;IACT,SAAS;IACT,eAAe;IACf,qBAAqB;IACrB,oBAAoB;IACpB,MAAM;IACN,WAAW;IACX,UAAU;IACV,MAAM;IACN,QAAQ;IACR,uBAAuB;IACvB,gBAAgB;IAChB,aAAa;IACb,OAAO;IACP,kBAAkB;IAClB,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,cAAc;IACd,aAAa;CACd,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,mBAAmB;IACnB,cAAc;IACd,cAAc;IACd,kBAAkB;IAClB,gBAAgB;IAChB,aAAa;IACb,uBAAuB;IACvB,MAAM;IACN,WAAW;IACX,kBAAkB;IAClB,gBAAgB;IAChB,MAAM;IACN,YAAY;IACZ,cAAc;IACd,kBAAkB;IAClB,mBAAmB;CACpB,CAAA;AAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;AACpF,MAAM,iBAAiB,GAAG,8BAA8B,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;AAE9F;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACtC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACxB,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACpC,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,CACL,IAAI,GAAG,sFAAsF;QAC7F,gGAAgG;QAChG,6FAA6F;QAC7F,4FAA4F;QAC5F,4EAA4E,CAC7E,CAAA;AACH,CAAC;AAED,8EAA8E;AAC9E,gFAAgF;AAChF,EAAE;AACF,0FAA0F;AAC1F,6FAA6F;AAC7F,iGAAiG;AACjG,iGAAiG;AACjG,qFAAqF;AACrF,yBAAyB;AACzB,EAAE;AACF,mGAAmG;AACnG,yFAAyF;AACzF,kGAAkG;AAClG,gGAAgG;AAChG,kGAAkG;AAClG,iGAAiG;AACjG,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,MAAM;IACN,MAAM;IACN,cAAc;IACd,WAAW;IACX,qBAAqB;IACrB,YAAY;IACZ,iBAAiB;IACjB,UAAU;IACV,KAAK;IACL,OAAO;IACP,KAAK;CACN,CAAC,CAAA;AACF,MAAM,sBAAsB,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAA;AAEtD,uGAAuG;AACvG,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IACjD,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAA;IACnC,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;AAC1E,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,CACL,IAAI,IAAI,iFAAiF;QACzF,qFAAqF;QACrF,uDAAuD,CACxD,CAAA;AACH,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC9C,CAAC"}

package/dist/routes/capability-credentials.d.ts

@@ -0,0 +1,148 @@
+import { ContractNoBody } from '@toad-contracts/valibot';
+export declare const getCapabilityCredentialsContract: {
+    readonly method: "get";
+    readonly pathResolver: () => string;
+    readonly responsesByStatusCode: {
+        readonly '4xx': import("valibot").ObjectSchema<{
+            readonly error: import("valibot").ObjectSchema<{
+                readonly code: import("valibot").StringSchema<undefined>;
+                readonly message: import("valibot").StringSchema<undefined>;
+                readonly details: import("valibot").OptionalSchema<import("valibot").UnknownSchema, undefined>;
+                readonly issues: import("valibot").OptionalSchema<import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                    readonly path: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                    readonly message: import("valibot").StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly '5xx': import("valibot").ObjectSchema<{
+            readonly error: import("valibot").ObjectSchema<{
+                readonly code: import("valibot").StringSchema<undefined>;
+                readonly message: import("valibot").StringSchema<undefined>;
+                readonly details: import("valibot").OptionalSchema<import("valibot").UnknownSchema, undefined>;
+                readonly issues: import("valibot").OptionalSchema<import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                    readonly path: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                    readonly message: import("valibot").StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly 200: import("valibot").ObjectSchema<{
+            readonly declared: import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                readonly key: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").TrimAction, import("valibot").MinLengthAction<string, 1, undefined>, import("valibot").MaxLengthAction<string, 128, undefined>, import("valibot").RegexAction<string, "must be a valid environment variable name (letters, digits and underscores, not starting with a digit)">, import("valibot").CheckAction<string, (issue: import("valibot").CheckIssue<string>) => string>, import("valibot").CheckAction<string, (issue: import("valibot").CheckIssue<string>) => string>]>;
+                readonly declaredBy: import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                    readonly subject: import("valibot").PicklistSchema<["tool-server", "binary-generator"], undefined>;
+                    readonly id: import("valibot").StringSchema<undefined>;
+                    readonly label: import("valibot").StringSchema<undefined>;
+                    readonly usage: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+                readonly required: import("valibot").BooleanSchema<undefined>;
+                readonly stored: import("valibot").BooleanSchema<undefined>;
+                readonly updatedAt: import("valibot").OptionalSchema<import("valibot").NumberSchema<undefined>, undefined>;
+            }, undefined>, undefined>;
+            readonly orphaned: import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                readonly key: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").TrimAction, import("valibot").MinLengthAction<string, 1, undefined>, import("valibot").MaxLengthAction<string, 128, undefined>, import("valibot").RegexAction<string, "must be a valid environment variable name (letters, digits and underscores, not starting with a digit)">, import("valibot").CheckAction<string, (issue: import("valibot").CheckIssue<string>) => string>, import("valibot").CheckAction<string, (issue: import("valibot").CheckIssue<string>) => string>]>;
+                readonly updatedAt: import("valibot").NumberSchema<undefined>;
+            }, undefined>, undefined>;
+            readonly environmentFallback: import("valibot").BooleanSchema<undefined>;
+            readonly declarationsIncomplete: import("valibot").BooleanSchema<undefined>;
+        }, undefined>;
+    };
+};
+export declare const setCapabilityCredentialsContract: {
+    readonly method: "put";
+    readonly pathResolver: () => string;
+    readonly requestBodySchema: import("valibot").SchemaWithPipe<readonly [import("valibot").ObjectSchema<{
+        readonly entries: import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+            readonly key: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").TrimAction, import("valibot").MinLengthAction<string, 1, undefined>, import("valibot").MaxLengthAction<string, 128, undefined>, import("valibot").RegexAction<string, "must be a valid environment variable name (letters, digits and underscores, not starting with a digit)">, import("valibot").CheckAction<string, (issue: import("valibot").CheckIssue<string>) => string>, import("valibot").CheckAction<string, (issue: import("valibot").CheckIssue<string>) => string>]>;
+            readonly value: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").MinLengthAction<string, 1, undefined>, import("valibot").MaxLengthAction<string, 8192, undefined>]>;
+        }, undefined>, undefined>;
+    }, undefined>, import("valibot").CheckAction<{
+        entries: {
+            key: string;
+            value: string;
+        }[];
+    }, "capability credential keys must be unique within a workspace">, import("valibot").CheckAction<{
+        entries: {
+            key: string;
+            value: string;
+        }[];
+    }, "at most 100 capability credentials per workspace">]>;
+    readonly responsesByStatusCode: {
+        readonly '4xx': import("valibot").ObjectSchema<{
+            readonly error: import("valibot").ObjectSchema<{
+                readonly code: import("valibot").StringSchema<undefined>;
+                readonly message: import("valibot").StringSchema<undefined>;
+                readonly details: import("valibot").OptionalSchema<import("valibot").UnknownSchema, undefined>;
+                readonly issues: import("valibot").OptionalSchema<import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                    readonly path: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                    readonly message: import("valibot").StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly '5xx': import("valibot").ObjectSchema<{
+            readonly error: import("valibot").ObjectSchema<{
+                readonly code: import("valibot").StringSchema<undefined>;
+                readonly message: import("valibot").StringSchema<undefined>;
+                readonly details: import("valibot").OptionalSchema<import("valibot").UnknownSchema, undefined>;
+                readonly issues: import("valibot").OptionalSchema<import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                    readonly path: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                    readonly message: import("valibot").StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly 200: import("valibot").ObjectSchema<{
+            readonly declared: import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                readonly key: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").TrimAction, import("valibot").MinLengthAction<string, 1, undefined>, import("valibot").MaxLengthAction<string, 128, undefined>, import("valibot").RegexAction<string, "must be a valid environment variable name (letters, digits and underscores, not starting with a digit)">, import("valibot").CheckAction<string, (issue: import("valibot").CheckIssue<string>) => string>, import("valibot").CheckAction<string, (issue: import("valibot").CheckIssue<string>) => string>]>;
+                readonly declaredBy: import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                    readonly subject: import("valibot").PicklistSchema<["tool-server", "binary-generator"], undefined>;
+                    readonly id: import("valibot").StringSchema<undefined>;
+                    readonly label: import("valibot").StringSchema<undefined>;
+                    readonly usage: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+                readonly required: import("valibot").BooleanSchema<undefined>;
+                readonly stored: import("valibot").BooleanSchema<undefined>;
+                readonly updatedAt: import("valibot").OptionalSchema<import("valibot").NumberSchema<undefined>, undefined>;
+            }, undefined>, undefined>;
+            readonly orphaned: import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                readonly key: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").TrimAction, import("valibot").MinLengthAction<string, 1, undefined>, import("valibot").MaxLengthAction<string, 128, undefined>, import("valibot").RegexAction<string, "must be a valid environment variable name (letters, digits and underscores, not starting with a digit)">, import("valibot").CheckAction<string, (issue: import("valibot").CheckIssue<string>) => string>, import("valibot").CheckAction<string, (issue: import("valibot").CheckIssue<string>) => string>]>;
+                readonly updatedAt: import("valibot").NumberSchema<undefined>;
+            }, undefined>, undefined>;
+            readonly environmentFallback: import("valibot").BooleanSchema<undefined>;
+            readonly declarationsIncomplete: import("valibot").BooleanSchema<undefined>;
+        }, undefined>;
+    };
+};
+export declare const deleteCapabilityCredentialContract: {
+    readonly method: "delete";
+    readonly requestPathParamsSchema: import("valibot").ObjectSchema<{
+        key: import("valibot").StringSchema<undefined>;
+    }, undefined> & import("@toad-contracts/core").StandardObjectKeysV1<unknown, unknown>;
+    readonly pathResolver: ({ key }: {
+        key: string;
+    }) => string;
+    readonly responsesByStatusCode: {
+        readonly '4xx': import("valibot").ObjectSchema<{
+            readonly error: import("valibot").ObjectSchema<{
+                readonly code: import("valibot").StringSchema<undefined>;
+                readonly message: import("valibot").StringSchema<undefined>;
+                readonly details: import("valibot").OptionalSchema<import("valibot").UnknownSchema, undefined>;
+                readonly issues: import("valibot").OptionalSchema<import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                    readonly path: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                    readonly message: import("valibot").StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly '5xx': import("valibot").ObjectSchema<{
+            readonly error: import("valibot").ObjectSchema<{
+                readonly code: import("valibot").StringSchema<undefined>;
+                readonly message: import("valibot").StringSchema<undefined>;
+                readonly details: import("valibot").OptionalSchema<import("valibot").UnknownSchema, undefined>;
+                readonly issues: import("valibot").OptionalSchema<import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                    readonly path: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                    readonly message: import("valibot").StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly 204: typeof ContractNoBody;
+    };
+};
+//# sourceMappingURL=capability-credentials.d.ts.map

package/dist/routes/capability-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-credentials.d.ts","sourceRoot":"","sources":["../../src/routes/capability-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAqB,MAAM,yBAAyB,CAAA;AAkB3E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAI3C,CAAA;AAEF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAK3C,CAAA;AAMF,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAK7C,CAAA"}

package/dist/routes/capability-credentials.js

@@ -0,0 +1,34 @@
+import { ContractNoBody, defineApiContract } from '@toad-contracts/valibot';
+import { capabilityCredentialsViewSchema, upsertCapabilityCredentialsSchema, } from '../capability-credentials.js';
+import { errorResponses, singleStringParam } from './_shared.js';
+// ---------------------------------------------------------------------------
+// Per-workspace CAPABILITY CREDENTIAL route contracts. Mounted under
+// `/workspaces/:workspaceId`, so the paths here are relative to that prefix.
+//
+// Values are write-only (never read back); the view returns which credentials this deployment's
+// registered capabilities DECLARE, which of them this workspace has stored, and which stored keys
+// nothing declares any more. See CapabilityCredentialsController.
+// ---------------------------------------------------------------------------
+const keyParams = singleStringParam('key');
+export const getCapabilityCredentialsContract = defineApiContract({
+    method: 'get',
+    pathResolver: () => '/capability-credentials',
+    responsesByStatusCode: { 200: capabilityCredentialsViewSchema, ...errorResponses },
+});
+export const setCapabilityCredentialsContract = defineApiContract({
+    method: 'put',
+    pathResolver: () => '/capability-credentials',
+    requestBodySchema: upsertCapabilityCredentialsSchema,
+    responsesByStatusCode: { 200: capabilityCredentialsViewSchema, ...errorResponses },
+});
+// A per-KEY delete beside the whole-set PUT, because the two are different operations for an
+// operator: the PUT replaces the set (what a form submit does), while removing one orphaned
+// credential must not require re-sending every other value — which the client cannot do, since
+// it never received them.
+export const deleteCapabilityCredentialContract = defineApiContract({
+    method: 'delete',
+    requestPathParamsSchema: keyParams,
+    pathResolver: ({ key }) => `/capability-credentials/${key}`,
+    responsesByStatusCode: { 204: ContractNoBody, ...errorResponses },
+});
+//# sourceMappingURL=capability-credentials.js.map

package/dist/routes/capability-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-credentials.js","sourceRoot":"","sources":["../../src/routes/capability-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAC3E,OAAO,EACL,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAEhE,8EAA8E;AAC9E,qEAAqE;AACrE,6EAA6E;AAC7E,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,kEAAkE;AAClE,8EAA8E;AAE9E,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAA;AAE1C,MAAM,CAAC,MAAM,gCAAgC,GAAG,iBAAiB,CAAC;IAChE,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,yBAAyB;IAC7C,qBAAqB,EAAE,EAAE,GAAG,EAAE,+BAA+B,EAAE,GAAG,cAAc,EAAE;CACnF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,gCAAgC,GAAG,iBAAiB,CAAC;IAChE,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,yBAAyB;IAC7C,iBAAiB,EAAE,iCAAiC;IACpD,qBAAqB,EAAE,EAAE,GAAG,EAAE,+BAA+B,EAAE,GAAG,cAAc,EAAE;CACnF,CAAC,CAAA;AAEF,6FAA6F;AAC7F,4FAA4F;AAC5F,+FAA+F;AAC/F,0BAA0B;AAC1B,MAAM,CAAC,MAAM,kCAAkC,GAAG,iBAAiB,CAAC;IAClE,MAAM,EAAE,QAAQ;IAChB,uBAAuB,EAAE,SAAS;IAClC,YAAY,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,2BAA2B,GAAG,EAAE;IAC3D,qBAAqB,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,cAAc,EAAE;CAClE,CAAC,CAAA"}

package/dist/routes/index.d.ts

@@ -59,6 +59,7 @@ export * from './sandbox.js';
 export * from './service-fragment-defaults.js';
 export * from './services.js';
 export * from './test-secrets.js';
+export * from './capability-credentials.js';
 export * from './validation-checks.js';
 export * from './slack.js';
 export * from './spec.js';

package/dist/routes/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/routes/index.ts"],"names":[],"mappings":"AAGA,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,eAAe,CAAA;AAC7B,cAAc,WAAW,CAAA;AACzB,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,mBAAmB,CAAA;AACjC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,gBAAgB,CAAA;AAC9B,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,UAAU,CAAA;AACxB,cAAc,mBAAmB,CAAA;AACjC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,qBAAqB,CAAA;AACnC,cAAc,0BAA0B,CAAA;AACxC,cAAc,aAAa,CAAA;AAC3B,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,YAAY,CAAA;AAC1B,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,aAAa,CAAA;AAC3B,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,yBAAyB,CAAA;AACvC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,gBAAgB,CAAA;AAC9B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,uBAAuB,CAAA;AACrC,cAAc,wBAAwB,CAAA;AACtC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,uBAAuB,CAAA;AACrC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,mBAAmB,CAAA;AACjC,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,gCAAgC,CAAA;AAC9C,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,yBAAyB,CAAA;AACvC,cAAc,wBAAwB,CAAA;AACtC,cAAc,yBAAyB,CAAA;AACvC,cAAc,iBAAiB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/routes/index.ts"],"names":[],"mappings":"AAGA,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,eAAe,CAAA;AAC7B,cAAc,WAAW,CAAA;AACzB,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,mBAAmB,CAAA;AACjC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,gBAAgB,CAAA;AAC9B,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,UAAU,CAAA;AACxB,cAAc,mBAAmB,CAAA;AACjC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,qBAAqB,CAAA;AACnC,cAAc,0BAA0B,CAAA;AACxC,cAAc,aAAa,CAAA;AAC3B,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,YAAY,CAAA;AAC1B,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,aAAa,CAAA;AAC3B,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,yBAAyB,CAAA;AACvC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,gBAAgB,CAAA;AAC9B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,uBAAuB,CAAA;AACrC,cAAc,wBAAwB,CAAA;AACtC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,uBAAuB,CAAA;AACrC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,mBAAmB,CAAA;AACjC,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,gCAAgC,CAAA;AAC9C,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,wBAAwB,CAAA;AACtC,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,yBAAyB,CAAA;AACvC,cAAc,wBAAwB,CAAA;AACtC,cAAc,yBAAyB,CAAA;AACvC,cAAc,iBAAiB,CAAA"}

package/dist/routes/index.js

@@ -62,6 +62,7 @@ export * from './sandbox.js';
 export * from './service-fragment-defaults.js';
 export * from './services.js';
 export * from './test-secrets.js';
+export * from './capability-credentials.js';
 export * from './validation-checks.js';
 export * from './slack.js';
 export * from './spec.js';

package/dist/routes/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/routes/index.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,+EAA+E;AAC/E,oDAAoD;AACpD,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,eAAe,CAAA;AAC7B,cAAc,WAAW,CAAA;AACzB,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,mBAAmB,CAAA;AACjC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,gBAAgB,CAAA;AAC9B,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,UAAU,CAAA;AACxB,cAAc,mBAAmB,CAAA;AACjC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,qBAAqB,CAAA;AACnC,cAAc,0BAA0B,CAAA;AACxC,cAAc,aAAa,CAAA;AAC3B,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,YAAY,CAAA;AAC1B,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,aAAa,CAAA;AAC3B,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,yBAAyB,CAAA;AACvC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,gBAAgB,CAAA;AAC9B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,uBAAuB,CAAA;AACrC,cAAc,wBAAwB,CAAA;AACtC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,uBAAuB,CAAA;AACrC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,mBAAmB,CAAA;AACjC,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,gCAAgC,CAAA;AAC9C,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,yBAAyB,CAAA;AACvC,cAAc,wBAAwB,CAAA;AACtC,cAAc,yBAAyB,CAAA;AACvC,cAAc,iBAAiB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/routes/index.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,+EAA+E;AAC/E,oDAAoD;AACpD,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,eAAe,CAAA;AAC7B,cAAc,WAAW,CAAA;AACzB,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,mBAAmB,CAAA;AACjC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,gBAAgB,CAAA;AAC9B,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,UAAU,CAAA;AACxB,cAAc,mBAAmB,CAAA;AACjC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,qBAAqB,CAAA;AACnC,cAAc,0BAA0B,CAAA;AACxC,cAAc,aAAa,CAAA;AAC3B,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,YAAY,CAAA;AAC1B,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,aAAa,CAAA;AAC3B,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,yBAAyB,CAAA;AACvC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,gBAAgB,CAAA;AAC9B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,uBAAuB,CAAA;AACrC,cAAc,wBAAwB,CAAA;AACtC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,uBAAuB,CAAA;AACrC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,mBAAmB,CAAA;AACjC,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,gCAAgC,CAAA;AAC9C,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,wBAAwB,CAAA;AACtC,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,yBAAyB,CAAA;AACvC,cAAc,wBAAwB,CAAA;AACtC,cAAc,yBAAyB,CAAA;AACvC,cAAc,iBAAiB,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/contracts",
-  "version": "0.214.0",
+  "version": "0.215.0",
   "description": "Valibot wire contract shared between the Agent Architecture Board frontend and backend.",
   "repository": {
     "type": "git",