@cat-factory/contracts 0.318.0 → 0.320.0

package/dist/binary-generators.d.ts

@@ -1,4 +1,5 @@
 import * as v from 'valibot';
+import { type CapabilityCredential } from './capability-credentials.js';
 /**
  * The registry id of the ONE integration the platform itself ships: Google's Gemini image models,
  * defined in `@cat-factory/binary-generators` and installed by every facade's default registry.
@@ -15,106 +16,23 @@ import * as v from 'valibot';
  */
 export declare const NANO_BANANA_GENERATOR_ID = "nano-banana";
 /**
- * ONE credential a generative integration needs, declared by NAME only, never a value.
+ * The credential declaration a generative integration uses: the shared
+ * {@link capabilityCredentialSchema}, unchanged.
  *
- * The value is resolved per dispatch through the facade-wired `ToolSecretResolver` port (the
- * same port a tool server's credentials go through) and written straight onto the job body,
- * where the harness injects it into THIS JOB's agent environment. It never reaches
- * `AgentRunContext`, a prompt, or the telemetry snapshot: only the key NAME does, because the
- * agent has to know which variable to read.
- *
- * An integration declares a LIST of these ({@link binaryGeneratorDefinitionSchema}'s
- * `credentials`), because a vendor's account is not always one string. HTTP Basic over a
- * key/secret pair is the ordinary case that breaks a single field, and it is common enough to be
- * a shape rather than one vendor's eccentricity. Under one field the two halves have to be
- * colon-joined into a single variable, which rotates them together, hands the operator one
- * checklist row where their vendor console shows two values, and turns a mis-joined value into a
- * 401 indistinguishable from a wrong key.
+ * An ALIAS rather than a copy, and named here because the brief, the picker and the checklist all
+ * speak of "the integration's credentials". The shape moved out when a foundational STORAGE
+ * service needed the same declaration: the two names a credential carries, and the reserved-key
+ * and toolchain floors over them, are properties of the injection CHANNEL rather than of what
+ * declared it, and a second copy is the first place two declarers could disagree about a reserved
+ * key.
  */
 export declare const binaryGeneratorCredentialSchema: v.ObjectSchema<{
-    /**
-     * The credential's LOOKUP key: what the secret resolver is asked for, and what a workspace
-     * stores its own value under. Also the ENVIRONMENT VARIABLE the agent reads it from unless
-     * {@link envName} says otherwise, so it must be a valid POSIX variable name either way: a
-     * generator declaring `x-rd-token` would resolve fine and then be dropped by the harness's env
-     * validation, which is a silent "the integration just 401s" at run time.
-     *
-     * It may NOT name a variable the platform's own configuration owns
-     * ({@link isReservedPlatformEnvKey}). The resolver reads the key off the deployment's
-     * environment and the value is injected into an agent process, so an integration declaring
-     * `ENCRYPTION_KEY` would hand a prompt-injectable agent the deployment's master sealing key.
-     * Refused here so a deployment learns at boot, and again at dispatch, since a mothership-mode
-     * node boot-validates none of the definitions it resolves.
-     */
     readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 128, undefined>, v.RegexAction<string, "must be a valid environment variable name">, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>]>;
-    /**
-     * The environment variable the value is injected as, when that differs from {@link key}. This
-     * is the name the agent is told to read, and it is what a vendor SDK that auto-reads its own
-     * documented variable needs.
-     *
-     * Held to the toolchain rule rather than the reserved-platform one, because it reads nothing:
-     * the floor above is about what may be READ off the deployment's environment, and an injection
-     * name only decides what a variable is called inside this job's agent process. That is what lets
-     * an integration keep a vendor's documented name even when a platform prefix family covers it.
-     */
     readonly envName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 128, undefined>, v.RegexAction<string, "must be a valid environment variable name">, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>]>, undefined>;
-    /**
-     * How the integration expects the credential to be presented (`X-RD-Token: <value>`,
-     * `Authorization: Bearer <value>`). Folded into the brief verbatim: the agent writes the
-     * request itself, and a key with no stated header is a key it has to guess the use of.
-     */
     readonly usage: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 400, undefined>]>, undefined>;
-    /**
-     * When true (the default), an integration whose credential does not resolve is reported to
-     * the agent as UNAVAILABLE rather than offered. Set false only for an endpoint that genuinely
-     * works unauthenticated — an agent handed an API whose first call 401s burns a run
-     * discovering it.
-     */
     readonly required: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
 }, undefined>;
-export type BinaryGeneratorCredential = v.InferOutput<typeof binaryGeneratorCredentialSchema>;
-/**
- * The two names a credential carries, which is all the fallback below reads.
- *
- * Structural rather than {@link BinaryGeneratorCredential} itself, because the DISPATCH projection
- * carries a narrower shape (kernel's `ResolvedBinaryGeneratorCredential`, which drops `usage` and
- * every other prose field the container executor has no use for) and would otherwise have to
- * either widen or re-spell the fallback. A parameter type nothing outside the two names can
- * satisfy is what makes the "one place" claim below enforceable rather than aspirational.
- */
-export interface BinaryCredentialNames {
-    key: string;
-    envName?: string;
-}
-/**
- * The environment variable one credential arrives as: its {@link BinaryGeneratorCredential.envName}
- * when it declares one, else its lookup key.
- *
- * The ONE place that fallback is written, because three layers apply it (the schema's uniqueness
- * check below, the dispatch-time resolver that keys the job body, and the brief that tells the
- * agent which variable to read) and a copy that drifted would name a variable that is never set:
- * an integration reported as unavailable on every run, with nothing to see at either end.
- */
-export declare function binaryCredentialInjectionName(credential: BinaryCredentialNames): string;
-/**
- * The form an injection name is COMPARED in, which is not the form it is injected under.
- *
- * Case-folded, the same way {@link isReservedPlatformEnvKey} folds the lookup key it screens, and
- * for the reason that floor has: environment lookup is case-insensitive on Windows, so `ACME_KEY`
- * and `acme_key` are two variables in the declaration and one variable in the process that reads
- * them. A rule comparing them exactly would call that pair distinct and let one value overwrite
- * the other on the one platform where it matters.
- */
-export declare function comparableCredentialInjectionName(credential: BinaryCredentialNames): string;
-/**
- * Whether every credential in a declaration arrives as its own variable.
- *
- * Exported so the boot check and the schema share one implementation rather than agreeing by
- * hand. Duplicate LOOKUP keys are deliberately allowed: an integration wanting one stored value
- * delivered under two names is odd but honest, and nothing is lost. A duplicate INJECTION name
- * loses a value, which is why only that one is refused.
- */
-export declare function uniqueCredentialInjectionNames(credentials: readonly BinaryGeneratorCredential[]): boolean;
+export type BinaryGeneratorCredential = CapabilityCredential;
 /**
  * HOW an integration is reached, which decides what the rest of the definition may say.
  *
@@ -238,44 +156,9 @@ export declare const binaryGeneratorDefinitionSchema: v.SchemaWithPipe<readonly
      * half of a pair.
      */
     readonly credentials: v.OptionalSchema<v.SchemaWithPipe<readonly [v.ArraySchema<v.ObjectSchema<{
-        /**
-         * The credential's LOOKUP key: what the secret resolver is asked for, and what a workspace
-         * stores its own value under. Also the ENVIRONMENT VARIABLE the agent reads it from unless
-         * {@link envName} says otherwise, so it must be a valid POSIX variable name either way: a
-         * generator declaring `x-rd-token` would resolve fine and then be dropped by the harness's env
-         * validation, which is a silent "the integration just 401s" at run time.
-         *
-         * It may NOT name a variable the platform's own configuration owns
-         * ({@link isReservedPlatformEnvKey}). The resolver reads the key off the deployment's
-         * environment and the value is injected into an agent process, so an integration declaring
-         * `ENCRYPTION_KEY` would hand a prompt-injectable agent the deployment's master sealing key.
-         * Refused here so a deployment learns at boot, and again at dispatch, since a mothership-mode
-         * node boot-validates none of the definitions it resolves.
-         */
         readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 128, undefined>, v.RegexAction<string, "must be a valid environment variable name">, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>]>;
-        /**
-         * The environment variable the value is injected as, when that differs from {@link key}. This
-         * is the name the agent is told to read, and it is what a vendor SDK that auto-reads its own
-         * documented variable needs.
-         *
-         * Held to the toolchain rule rather than the reserved-platform one, because it reads nothing:
-         * the floor above is about what may be READ off the deployment's environment, and an injection
-         * name only decides what a variable is called inside this job's agent process. That is what lets
-         * an integration keep a vendor's documented name even when a platform prefix family covers it.
-         */
         readonly envName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 128, undefined>, v.RegexAction<string, "must be a valid environment variable name">, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>]>, undefined>;
-        /**
-         * How the integration expects the credential to be presented (`X-RD-Token: <value>`,
-         * `Authorization: Bearer <value>`). Folded into the brief verbatim: the agent writes the
-         * request itself, and a key with no stated header is a key it has to guess the use of.
-         */
         readonly usage: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 400, undefined>]>, undefined>;
-        /**
-         * When true (the default), an integration whose credential does not resolve is reported to
-         * the agent as UNAVAILABLE rather than offered. Set false only for an endpoint that genuinely
-         * works unauthenticated — an agent handed an API whose first call 401s burns a run
-         * discovering it.
-         */
         readonly required: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
     }, undefined>, undefined>, v.MaxLengthAction<{
         key: string;

package/dist/binary-generators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"binary-generators.d.ts","sourceRoot":"","sources":["../src/binary-generators.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAkC5B;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB,gBAAgB,CAAA;AAUrD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,+BAA+B;IAC1C;;;;;;;;;;;;;OAaG;;IAYH;;;;;;;;;OASG;;IAcH;;;;OAIG;;IAEH;;;;;OAKG;;aAEH,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,+BAA+B,CAAC,CAAA;AAE7F;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,UAAU,EAAE,qBAAqB,GAAG,MAAM,CAEvF;AAED;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAAC,UAAU,EAAE,qBAAqB,GAAG,MAAM,CAE3F;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,WAAW,EAAE,SAAS,yBAAyB,EAAE,GAChD,OAAO,CAGT;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,8BAA8B,iDAAiC,CAAA;AAC5E,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,8BAA8B,CAAC,CAAA;AAE3F;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B;IAExC,iFAAiF;;;IAGjF,2DAA2D;;IAE3D;;;OAGG;;IAEH;;;OAGG;;IAEH;;;;OAIG;;IAEH;;;;;;;;;;;;;;OAcG;;IAEH;;;;;;;;;;;;;;OAcG;;;;;;;;;;;;;;;IAEH;;;;OAIG;;IAEH;;;;OAIG;;IAEH;;;;;;;;;;;;;;;OAeG;;QArOL;;;;;;;;;;;;;WAaG;;QAYH;;;;;;;;;WASG;;QAcH;;;;WAIG;;QAEH;;;;;WAKG;;;;;;;;;;;;;IA2LD;;;;OAIG;;;;;;;IAEH;;;OAGG;;IAEH;;;;;;;;OAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iHA0BN,CAAA;AACD,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,+BAA+B,CAAC,CAAA;AAE7F;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAAE,SAAS,CAAC,EAAE,wBAAwB,CAAA;CAAE,GAAG,OAAO,CAE7F;AAED;;;;;;;;GAQG;AACH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,+BAA+B;;;;IAI1C,0FAA0F;;IAE1F,gGAAgG;;IAEhG;;;;;;;;;OASG;;IAEH;;;;;;OAMG;;;;;;;;;;;;;;;IAEH;;;;;;;;OAQG;;;aAGH,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,+BAA+B,CAAC,CAAA;AAE7F,wBAAgB,+BAA+B,CAAC,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE,CAO7E"}
+{"version":3,"file":"binary-generators.d.ts","sourceRoot":"","sources":["../src/binary-generators.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAC5B,OAAO,EACL,KAAK,oBAAoB,EAG1B,MAAM,6BAA6B,CAAA;AA4BpC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB,gBAAgB,CAAA;AAUrD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,+BAA+B;;;;;aAA6B,CAAA;AACzE,MAAM,MAAM,yBAAyB,GAAG,oBAAoB,CAAA;AAE5D;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,8BAA8B,iDAAiC,CAAA;AAC5E,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,8BAA8B,CAAC,CAAA;AAE3F;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B;IAExC,iFAAiF;;;IAGjF,2DAA2D;;IAE3D;;;OAGG;;IAEH;;;OAGG;;IAEH;;;;OAIG;;IAEH;;;;;;;;;;;;;;OAcG;;IAEH;;;;;;;;;;;;;;OAcG;;;;;;;;;;;;;;;IAEH;;;;OAIG;;IAEH;;;;OAIG;;IAEH;;;;;;;;;;;;;;;OAeG;;;;;;;;;;;;;;;;;IAiBH;;;;OAIG;;;;;;;IAEH;;;OAGG;;IAEH;;;;;;;;OAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iHA0BN,CAAA;AACD,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,+BAA+B,CAAC,CAAA;AAE7F;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAAE,SAAS,CAAC,EAAE,wBAAwB,CAAA;CAAE,GAAG,OAAO,CAE7F;AAED;;;;;;;;GAQG;AACH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,+BAA+B;;;;IAI1C,0FAA0F;;IAE1F,gGAAgG;;IAEhG;;;;;;;;;OASG;;IAEH;;;;;;OAMG;;;;;;;;;;;;;;;IAEH;;;;;;;;OAQG;;;aAGH,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,+BAA+B,CAAC,CAAA;AAE7F,wBAAgB,+BAA+B,CAAC,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE,CAO7E"}

package/dist/binary-generators.js

@@ -1,8 +1,8 @@
 import * as v from 'valibot';
+import { capabilityCredentialSchema, uniqueCredentialInjectionNames, } from './capability-credentials.js';
 import { binaryGeneratorAcceptsSchema, binaryGeneratorCapabilitySchema, } from './binary-capabilities.js';
 import { binaryModalitySchema, mediaTypeSchema } from './binary-modalities.js';
 import { uploadApiContractSchema } from './foundational-services.js';
-import { isReservedPlatformEnvKey, isToolchainEnvName, reservedEnvKeyMessage, toolchainEnvNameMessage, } from './reserved-env-keys.js';
 // ---------------------------------------------------------------------------
 // Wire vocabulary for GENERATIVE BINARY INTEGRATIONS — the third-party (or in-house) APIs a
 // binary-generating agent kind calls to PRODUCE its deliverable: an image generator, a
@@ -39,99 +39,17 @@ import { isReservedPlatformEnvKey, isToolchainEnvName, reservedEnvKeyMessage, to
 export const NANO_BANANA_GENERATOR_ID = 'nano-banana';
 const slug = v.pipe(v.string(), v.trim(), v.minLength(1), v.maxLength(64), v.regex(/^[a-z0-9][a-z0-9-]*$/, 'must be a lower-kebab slug'));
 /**
- * ONE credential a generative integration needs, declared by NAME only, never a value.
+ * The credential declaration a generative integration uses: the shared
+ * {@link capabilityCredentialSchema}, unchanged.
  *
- * The value is resolved per dispatch through the facade-wired `ToolSecretResolver` port (the
- * same port a tool server's credentials go through) and written straight onto the job body,
- * where the harness injects it into THIS JOB's agent environment. It never reaches
- * `AgentRunContext`, a prompt, or the telemetry snapshot: only the key NAME does, because the
- * agent has to know which variable to read.
- *
- * An integration declares a LIST of these ({@link binaryGeneratorDefinitionSchema}'s
- * `credentials`), because a vendor's account is not always one string. HTTP Basic over a
- * key/secret pair is the ordinary case that breaks a single field, and it is common enough to be
- * a shape rather than one vendor's eccentricity. Under one field the two halves have to be
- * colon-joined into a single variable, which rotates them together, hands the operator one
- * checklist row where their vendor console shows two values, and turns a mis-joined value into a
- * 401 indistinguishable from a wrong key.
- */
-export const binaryGeneratorCredentialSchema = v.object({
-    /**
-     * The credential's LOOKUP key: what the secret resolver is asked for, and what a workspace
-     * stores its own value under. Also the ENVIRONMENT VARIABLE the agent reads it from unless
-     * {@link envName} says otherwise, so it must be a valid POSIX variable name either way: a
-     * generator declaring `x-rd-token` would resolve fine and then be dropped by the harness's env
-     * validation, which is a silent "the integration just 401s" at run time.
-     *
-     * It may NOT name a variable the platform's own configuration owns
-     * ({@link isReservedPlatformEnvKey}). The resolver reads the key off the deployment's
-     * environment and the value is injected into an agent process, so an integration declaring
-     * `ENCRYPTION_KEY` would hand a prompt-injectable agent the deployment's master sealing key.
-     * Refused here so a deployment learns at boot, and again at dispatch, since a mothership-mode
-     * node boot-validates none of the definitions it resolves.
-     */
-    key: v.pipe(v.string(), v.trim(), v.minLength(1), v.maxLength(128), v.regex(/^[A-Za-z_][A-Za-z0-9_]*$/, 'must be a valid environment variable name'), v.check((key) => !isReservedPlatformEnvKey(key), (issue) => reservedEnvKeyMessage(String(issue.input)))),
-    /**
-     * The environment variable the value is injected as, when that differs from {@link key}. This
-     * is the name the agent is told to read, and it is what a vendor SDK that auto-reads its own
-     * documented variable needs.
-     *
-     * Held to the toolchain rule rather than the reserved-platform one, because it reads nothing:
-     * the floor above is about what may be READ off the deployment's environment, and an injection
-     * name only decides what a variable is called inside this job's agent process. That is what lets
-     * an integration keep a vendor's documented name even when a platform prefix family covers it.
-     */
-    envName: v.optional(v.pipe(v.string(), v.trim(), v.minLength(1), v.maxLength(128), v.regex(/^[A-Za-z_][A-Za-z0-9_]*$/, 'must be a valid environment variable name'), v.check((name) => !isToolchainEnvName(name), (issue) => toolchainEnvNameMessage(String(issue.input))))),
-    /**
-     * How the integration expects the credential to be presented (`X-RD-Token: <value>`,
-     * `Authorization: Bearer <value>`). Folded into the brief verbatim: the agent writes the
-     * request itself, and a key with no stated header is a key it has to guess the use of.
-     */
-    usage: v.optional(v.pipe(v.string(), v.trim(), v.maxLength(400))),
-    /**
-     * When true (the default), an integration whose credential does not resolve is reported to
-     * the agent as UNAVAILABLE rather than offered. Set false only for an endpoint that genuinely
-     * works unauthenticated — an agent handed an API whose first call 401s burns a run
-     * discovering it.
-     */
-    required: v.optional(v.boolean()),
-});
-/**
- * The environment variable one credential arrives as: its {@link BinaryGeneratorCredential.envName}
- * when it declares one, else its lookup key.
- *
- * The ONE place that fallback is written, because three layers apply it (the schema's uniqueness
- * check below, the dispatch-time resolver that keys the job body, and the brief that tells the
- * agent which variable to read) and a copy that drifted would name a variable that is never set:
- * an integration reported as unavailable on every run, with nothing to see at either end.
- */
-export function binaryCredentialInjectionName(credential) {
-    return credential.envName ?? credential.key;
-}
-/**
- * The form an injection name is COMPARED in, which is not the form it is injected under.
- *
- * Case-folded, the same way {@link isReservedPlatformEnvKey} folds the lookup key it screens, and
- * for the reason that floor has: environment lookup is case-insensitive on Windows, so `ACME_KEY`
- * and `acme_key` are two variables in the declaration and one variable in the process that reads
- * them. A rule comparing them exactly would call that pair distinct and let one value overwrite
- * the other on the one platform where it matters.
- */
-export function comparableCredentialInjectionName(credential) {
-    return binaryCredentialInjectionName(credential).toUpperCase();
-}
-/**
- * Whether every credential in a declaration arrives as its own variable.
- *
- * Exported so the boot check and the schema share one implementation rather than agreeing by
- * hand. Duplicate LOOKUP keys are deliberately allowed: an integration wanting one stored value
- * delivered under two names is odd but honest, and nothing is lost. A duplicate INJECTION name
- * loses a value, which is why only that one is refused.
+ * An ALIAS rather than a copy, and named here because the brief, the picker and the checklist all
+ * speak of "the integration's credentials". The shape moved out when a foundational STORAGE
+ * service needed the same declaration: the two names a credential carries, and the reserved-key
+ * and toolchain floors over them, are properties of the injection CHANNEL rather than of what
+ * declared it, and a second copy is the first place two declarers could disagree about a reserved
+ * key.
  */
-export function uniqueCredentialInjectionNames(credentials) {
-    const names = credentials.map(comparableCredentialInjectionName);
-    return new Set(names).size === names.length;
-}
+export const binaryGeneratorCredentialSchema = capabilityCredentialSchema;
 /**
  * HOW an integration is reached, which decides what the rest of the definition may say.
  *

package/dist/binary-generators.js.map

@@ -1 +1 @@
-{"version":3,"file":"binary-generators.js","sourceRoot":"","sources":["../src/binary-generators.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAC5B,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAA;AACpE,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,wBAAwB,CAAA;AAE/B,8EAA8E;AAC9E,4FAA4F;AAC5F,uFAAuF;AACvF,6CAA6C;AAC7C,EAAE;AACF,+FAA+F;AAC/F,+FAA+F;AAC/F,8FAA8F;AAC9F,8FAA8F;AAC9F,8FAA8F;AAC9F,6FAA6F;AAC7F,+FAA+F;AAC/F,iCAAiC;AACjC,EAAE;AACF,+FAA+F;AAC/F,+FAA+F;AAC/F,uFAAuF;AACvF,2CAA2C;AAC3C,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,aAAa,CAAA;AAErD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CACjB,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,IAAI,EAAE,EACR,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EACd,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,EACf,CAAC,CAAC,KAAK,CAAC,sBAAsB,EAAE,4BAA4B,CAAC,CAC9D,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD;;;;;;;;;;;;;OAaG;IACH,GAAG,EAAE,CAAC,CAAC,IAAI,CACT,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,IAAI,EAAE,EACR,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EACd,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,EAChB,CAAC,CAAC,KAAK,CAAC,0BAA0B,EAAE,2CAA2C,CAAC,EAChF,CAAC,CAAC,KAAK,CACL,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,wBAAwB,CAAC,GAAG,CAAC,EACvC,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CACtD,CACF;IACD;;;;;;;;;OASG;IACH,OAAO,EAAE,CAAC,CAAC,QAAQ,CACjB,CAAC,CAAC,IAAI,CACJ,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,IAAI,EAAE,EACR,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EACd,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,EAChB,CAAC,CAAC,KAAK,CAAC,0BAA0B,EAAE,2CAA2C,CAAC,EAChF,CAAC,CAAC,KAAK,CACL,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EACnC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CACxD,CACF,CACF;IACD;;;;OAIG;IACH,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;CAClC,CAAC,CAAA;AAiBF;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CAAC,UAAiC;IAC7E,OAAO,UAAU,CAAC,OAAO,IAAI,UAAU,CAAC,GAAG,CAAA;AAC7C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iCAAiC,CAAC,UAAiC;IACjF,OAAO,6BAA6B,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAA;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAC5C,WAAiD;IAEjD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAA;IAChE,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAA;AAC7C,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAA;AAG5E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,IAAI,CACnD,CAAC,CAAC,MAAM,CAAC;IACP,iFAAiF;IACjF,EAAE,EAAE,IAAI;IACR,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpE,2DAA2D;IAC3D,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACvE;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9D;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACjE;;;;OAIG;IACH,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAChD;;;;;;;;;;;;;;OAcG;IACH,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAClE;;;;;;;;;;;;;;OAcG;IACH,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC;IACjD;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACrF;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE;;;;;;;;;;;;;;;OAeG;IACH,WAAW,EAAE,CAAC,CAAC,QAAQ,CACrB,CAAC,CAAC,IAAI,CACJ,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC;IACxC,4FAA4F;IAC5F,2FAA2F;IAC3F,aAAa;IACb,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACd,0FAA0F;IAC1F,uFAAuF;IACvF,+CAA+C;IAC/C,CAAC,CAAC,KAAK,CACL,CAAC,WAAW,EAAE,EAAE,CAAC,8BAA8B,CAAC,WAAW,CAAC,EAC5D,6DAA6D,CAC9D,CACF,CACF;IACD;;;;OAIG;IACH,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACvD;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,8BAA8B,CAAC;IACrD;;;;;;;;OAQG;IACH,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;CACnF,CAAC;AACF,4FAA4F;AAC5F,8FAA8F;AAC9F,+FAA+F;AAC/F,wEAAwE;AACxE,CAAC,CAAC,KAAK,CACL,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EACjF,wEAAwE,CACzE,EACD,CAAC,CAAC,KAAK,CACL,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,OAAO,EACzE,2DAA2D,CAC5D;AACD,+FAA+F;AAC/F,8FAA8F;AAC9F,0FAA0F;AAC1F,0FAA0F;AAC1F,2EAA2E;AAC3E,CAAC,CAAC,KAAK,CACL,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,SAAS,KAAK,SAAS;IAClC,CAAC,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,EAC5F,2GAA2G,CAC5G,CACF,CAAA;AAGD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAiD;IAClF,OAAO,OAAO,CAAC,SAAS,KAAK,SAAS,CAAA;AACxC,CAAC;AAED;;;;;;;;GAQG;AACH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,EAAE,EAAE,IAAI;IACR,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,0FAA0F;IAC1F,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;IACzC,gGAAgG;IAChG,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAChD;;;;;;;;;OASG;IACH,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAClE;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC;IACjD;;;;;;;;OAQG;IACH,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,8BAA8B,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAChC,CAAC,CAAA;AAGF,MAAM,UAAU,+BAA+B,CAAC,UAAmB;IACjE,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,+BAA+B,EAAE,UAAU,CAAC,CAAA;IACvE,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,CAAA;IAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACxE,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAA;IAC3D,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"binary-generators.js","sourceRoot":"","sources":["../src/binary-generators.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAC5B,OAAO,EAEL,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,6BAA6B,CAAA;AACpC,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAA;AAEpE,8EAA8E;AAC9E,4FAA4F;AAC5F,uFAAuF;AACvF,6CAA6C;AAC7C,EAAE;AACF,+FAA+F;AAC/F,+FAA+F;AAC/F,8FAA8F;AAC9F,8FAA8F;AAC9F,8FAA8F;AAC9F,6FAA6F;AAC7F,+FAA+F;AAC/F,iCAAiC;AACjC,EAAE;AACF,+FAA+F;AAC/F,+FAA+F;AAC/F,uFAAuF;AACvF,2CAA2C;AAC3C,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,aAAa,CAAA;AAErD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CACjB,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,IAAI,EAAE,EACR,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EACd,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,EACf,CAAC,CAAC,KAAK,CAAC,sBAAsB,EAAE,4BAA4B,CAAC,CAC9D,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,0BAA0B,CAAA;AAGzE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAA;AAG5E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,IAAI,CACnD,CAAC,CAAC,MAAM,CAAC;IACP,iFAAiF;IACjF,EAAE,EAAE,IAAI;IACR,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpE,2DAA2D;IAC3D,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACvE;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9D;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACjE;;;;OAIG;IACH,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAChD;;;;;;;;;;;;;;OAcG;IACH,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAClE;;;;;;;;;;;;;;OAcG;IACH,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC;IACjD;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACrF;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE;;;;;;;;;;;;;;;OAeG;IACH,WAAW,EAAE,CAAC,CAAC,QAAQ,CACrB,CAAC,CAAC,IAAI,CACJ,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC;IACxC,4FAA4F;IAC5F,2FAA2F;IAC3F,aAAa;IACb,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACd,0FAA0F;IAC1F,uFAAuF;IACvF,+CAA+C;IAC/C,CAAC,CAAC,KAAK,CACL,CAAC,WAAW,EAAE,EAAE,CAAC,8BAA8B,CAAC,WAAW,CAAC,EAC5D,6DAA6D,CAC9D,CACF,CACF;IACD;;;;OAIG;IACH,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACvD;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,8BAA8B,CAAC;IACrD;;;;;;;;OAQG;IACH,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;CACnF,CAAC;AACF,4FAA4F;AAC5F,8FAA8F;AAC9F,+FAA+F;AAC/F,wEAAwE;AACxE,CAAC,CAAC,KAAK,CACL,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EACjF,wEAAwE,CACzE,EACD,CAAC,CAAC,KAAK,CACL,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,OAAO,EACzE,2DAA2D,CAC5D;AACD,+FAA+F;AAC/F,8FAA8F;AAC9F,0FAA0F;AAC1F,0FAA0F;AAC1F,2EAA2E;AAC3E,CAAC,CAAC,KAAK,CACL,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,SAAS,KAAK,SAAS;IAClC,CAAC,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,EAC5F,2GAA2G,CAC5G,CACF,CAAA;AAGD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAiD;IAClF,OAAO,OAAO,CAAC,SAAS,KAAK,SAAS,CAAA;AACxC,CAAC;AAED;;;;;;;;GAQG;AACH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,EAAE,EAAE,IAAI;IACR,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,0FAA0F;IAC1F,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;IACzC,gGAAgG;IAChG,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAChD;;;;;;;;;OASG;IACH,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAClE;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC;IACjD;;;;;;;;OAQG;IACH,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,8BAA8B,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAChC,CAAC,CAAA;AAGF,MAAM,UAAU,+BAA+B,CAAC,UAAmB;IACjE,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,+BAA+B,EAAE,UAAU,CAAC,CAAA;IACvE,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,CAAA;IAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACxE,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAA;IAC3D,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/binary-outputs.d.ts

@@ -160,6 +160,28 @@ export declare const binaryOutputArtifactSchema: v.ObjectSchema<{
      * NAMED in the report rather than dropped.
      */
     readonly generator: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    /**
+     * What ran over the generated bytes AFTER the integration produced them and BEFORE they were
+     * stored, in the agent's own words (`pixel-snapper`, `sharp resize`).
+     *
+     * A post-processing pass gives an artifact two producers, and {@link generator} can name only
+     * one. Both single answers are wrong: naming the integration records a producer of something
+     * that is not what is stored (the bytes are not the ones it returned, and neither are the
+     * dimensions), and naming nothing loses the vendor attribution the field exists for, along with
+     * the spend story behind it. So the delivery gets its own hole rather than a contested one.
+     *
+     * A FREE STRING rather than a registry reference, deliberately. A post-processor is not a
+     * registered thing and must not become one: `binaryGeneratorCapabilitySchema` admits a member
+     * only when it partitions an ENDPOINT's request, and a step's choice to snap a render onto a
+     * pixel grid is a property of the WORK, whose home is the step's own prompt. There is nothing to
+     * check this against, so it is recorded verbatim (capped) and judged by whoever reads the run,
+     * exactly as `location` is. It gets no `unknownGenerators`-style report for the same reason.
+     *
+     * The same epistemic status as everything else the agent declares here, and the same third
+     * state: ABSENT means "not stated", which is what every artifact recorded before this field
+     * existed says, and is never evidence that nothing ran.
+     */
+    readonly processedBy: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
     /**
      * The CONTENT TYPE of the artifact, DERIVED in code from {@link contentType} — never read off
      * the model's prose. Absent when no media type was declared, or when the declared one is not
@@ -231,6 +253,28 @@ export declare const binaryOutputReportSchema: v.ObjectSchema<{
          * NAMED in the report rather than dropped.
          */
         readonly generator: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        /**
+         * What ran over the generated bytes AFTER the integration produced them and BEFORE they were
+         * stored, in the agent's own words (`pixel-snapper`, `sharp resize`).
+         *
+         * A post-processing pass gives an artifact two producers, and {@link generator} can name only
+         * one. Both single answers are wrong: naming the integration records a producer of something
+         * that is not what is stored (the bytes are not the ones it returned, and neither are the
+         * dimensions), and naming nothing loses the vendor attribution the field exists for, along with
+         * the spend story behind it. So the delivery gets its own hole rather than a contested one.
+         *
+         * A FREE STRING rather than a registry reference, deliberately. A post-processor is not a
+         * registered thing and must not become one: `binaryGeneratorCapabilitySchema` admits a member
+         * only when it partitions an ENDPOINT's request, and a step's choice to snap a render onto a
+         * pixel grid is a property of the WORK, whose home is the step's own prompt. There is nothing to
+         * check this against, so it is recorded verbatim (capped) and judged by whoever reads the run,
+         * exactly as `location` is. It gets no `unknownGenerators`-style report for the same reason.
+         *
+         * The same epistemic status as everything else the agent declares here, and the same third
+         * state: ABSENT means "not stated", which is what every artifact recorded before this field
+         * existed says, and is never evidence that nothing ran.
+         */
+        readonly processedBy: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
         /**
          * The CONTENT TYPE of the artifact, DERIVED in code from {@link contentType} — never read off
          * the model's prose. Absent when no media type was declared, or when the declared one is not

package/dist/binary-outputs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"binary-outputs.d.ts","sourceRoot":"","sources":["../src/binary-outputs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAyB5B;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB;IACnC;;;;OAIG;;IAEH;;;;;;OAMG;;IAEH;;;;;;;;;OASG;;IAEH;;;;;;;;;;OAUG;;IAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;;IAEH;;;;;;;;;;;;;;;OAeG;;IAEH;;;;;;;;;OASG;;;;;aAEH,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,wBAAwB,CAAC,CAAA;AAE/E,+FAA+F;AAC/F,eAAO,MAAM,0BAA0B;IACrC;;;;;OAKG;;IAEH;;;OAGG;;IAEH,8FAA8F;;IAE9F,uEAAuE;;IAEvE,oDAAoD;;IAEpD;;;;;;;;;;;;;;OAcG;;;;;IAEH;;;;;;OAMG;;IAEH;;;;;OAKG;;aAEH,CAAA;AACF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,0BAA0B,CAAC,CAAA;AAEnF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,wBAAwB;;QAnEnC;;;;;WAKG;;QAEH;;;WAGG;;QAEH,8FAA8F;;QAE9F,uEAAuE;;QAEvE,oDAAoD;;QAEpD;;;;;;;;;;;;;;WAcG;;;;;QAEH;;;;;;WAMG;;QAEH;;;;;WAKG;;;IAsBH,0FAA0F;;IAE1F;;;;;;OAMG;;IAEH;;;;;;;;OAQG;;IAEH,2FAA2F;;IAE3F,qDAAqD;;IAErD,0FAA0F;;IAE1F,qEAAqE;;aAErE,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,wBAAwB,CAAC,CAAA"}
+{"version":3,"file":"binary-outputs.d.ts","sourceRoot":"","sources":["../src/binary-outputs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAyB5B;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB;IACnC;;;;OAIG;;IAEH;;;;;;OAMG;;IAEH;;;;;;;;;OASG;;IAEH;;;;;;;;;;OAUG;;IAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;;IAEH;;;;;;;;;;;;;;;OAeG;;IAEH;;;;;;;;;OASG;;;;;aAEH,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,wBAAwB,CAAC,CAAA;AAE/E,+FAA+F;AAC/F,eAAO,MAAM,0BAA0B;IACrC;;;;;OAKG;;IAEH;;;OAGG;;IAEH,8FAA8F;;IAE9F,uEAAuE;;IAEvE,oDAAoD;;IAEpD;;;;;;;;;;;;;;OAcG;;;;;IAEH;;;;;;OAMG;;IAEH;;;;;;;;;;;;;;;;;;;;OAoBG;;IAEH;;;;;OAKG;;aAEH,CAAA;AACF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,0BAA0B,CAAC,CAAA;AAEnF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,wBAAwB;;QAzFnC;;;;;WAKG;;QAEH;;;WAGG;;QAEH,8FAA8F;;QAE9F,uEAAuE;;QAEvE,oDAAoD;;QAEpD;;;;;;;;;;;;;;WAcG;;;;;QAEH;;;;;;WAMG;;QAEH;;;;;;;;;;;;;;;;;;;;WAoBG;;QAEH;;;;;WAKG;;;IAsBH,0FAA0F;;IAE1F;;;;;;OAMG;;IAEH;;;;;;;;OAQG;;IAEH,2FAA2F;;IAE3F,qDAAqD;;IAErD,0FAA0F;;IAE1F,qEAAqE;;aAErE,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,wBAAwB,CAAC,CAAA"}

package/dist/binary-outputs.js

@@ -168,6 +168,28 @@ export const binaryOutputArtifactSchema = v.object({
      * NAMED in the report rather than dropped.
      */
     generator: v.optional(v.string()),
+    /**
+     * What ran over the generated bytes AFTER the integration produced them and BEFORE they were
+     * stored, in the agent's own words (`pixel-snapper`, `sharp resize`).
+     *
+     * A post-processing pass gives an artifact two producers, and {@link generator} can name only
+     * one. Both single answers are wrong: naming the integration records a producer of something
+     * that is not what is stored (the bytes are not the ones it returned, and neither are the
+     * dimensions), and naming nothing loses the vendor attribution the field exists for, along with
+     * the spend story behind it. So the delivery gets its own hole rather than a contested one.
+     *
+     * A FREE STRING rather than a registry reference, deliberately. A post-processor is not a
+     * registered thing and must not become one: `binaryGeneratorCapabilitySchema` admits a member
+     * only when it partitions an ENDPOINT's request, and a step's choice to snap a render onto a
+     * pixel grid is a property of the WORK, whose home is the step's own prompt. There is nothing to
+     * check this against, so it is recorded verbatim (capped) and judged by whoever reads the run,
+     * exactly as `location` is. It gets no `unknownGenerators`-style report for the same reason.
+     *
+     * The same epistemic status as everything else the agent declares here, and the same third
+     * state: ABSENT means "not stated", which is what every artifact recorded before this field
+     * existed says, and is never evidence that nothing ran.
+     */
+    processedBy: v.optional(v.string()),
     /**
      * The CONTENT TYPE of the artifact, DERIVED in code from {@link contentType} — never read off
      * the model's prose. Absent when no media type was declared, or when the declared one is not

package/dist/binary-outputs.js.map

@@ -1 +1 @@
-{"version":3,"file":"binary-outputs.js","sourceRoot":"","sources":["../src/binary-outputs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAC5B,OAAO,EAAE,6BAA6B,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AAChG,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAA;AACxE,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAE9E,0GAA0G;AAC1G,+FAA+F;AAC/F,gGAAgG;AAChG,qFAAqF;AACrF,2FAA2F;AAC3F,gGAAgG;AAChG,+FAA+F;AAC/F,4FAA4F;AAC5F,gGAAgG;AAChG,iGAAiG;AACjG,aAAa;AAEb,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,CACtB,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,IAAI,EAAE,EACR,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EACd,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,EACf,CAAC,CAAC,KAAK,CAAC,sBAAsB,EAAE,4BAA4B,CAAC,CAC9D,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C;;;;OAIG;IACH,gBAAgB,EAAE,SAAS;IAC3B;;;;;;OAMG;IACH,iBAAiB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjD;;;;;;;;;OASG;IACH,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5C;;;;;;;;;;OAUG;IACH,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAChD;;;;;;;;;;;;;;;OAeG;IACH,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IACrD;;;;;;;;;OASG;IACH,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,+BAA+B,CAAC;CACxD,CAAC,CAAA;AAGF,+FAA+F;AAC/F,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD;;;;;OAKG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB;;;OAGG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,8FAA8F;IAC9F,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9B,uEAAuE;IACvE,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,oDAAoD;IACpD,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC;;;;;;;;;;;;;;OAcG;IACH,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IAC9C;;;;;;OAMG;IACH,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;CAC3C,CAAC,CAAA;AAGF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC;IAC3C,0FAA0F;IAC1F,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC;;;;;;OAMG;IACH,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACtC;;;;;;;;OAQG;IACH,oBAAoB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,2FAA2F;IAC3F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,qDAAqD;IACrD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,0FAA0F;IAC1F,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACpC,qEAAqE;IACrE,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;CACpC,CAAC,CAAA"}
+{"version":3,"file":"binary-outputs.js","sourceRoot":"","sources":["../src/binary-outputs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAC5B,OAAO,EAAE,6BAA6B,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AAChG,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAA;AACxE,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAE9E,0GAA0G;AAC1G,+FAA+F;AAC/F,gGAAgG;AAChG,qFAAqF;AACrF,2FAA2F;AAC3F,gGAAgG;AAChG,+FAA+F;AAC/F,4FAA4F;AAC5F,gGAAgG;AAChG,iGAAiG;AACjG,aAAa;AAEb,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,CACtB,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,IAAI,EAAE,EACR,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EACd,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,EACf,CAAC,CAAC,KAAK,CAAC,sBAAsB,EAAE,4BAA4B,CAAC,CAC9D,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C;;;;OAIG;IACH,gBAAgB,EAAE,SAAS;IAC3B;;;;;;OAMG;IACH,iBAAiB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjD;;;;;;;;;OASG;IACH,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5C;;;;;;;;;;OAUG;IACH,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAChD;;;;;;;;;;;;;;;OAeG;IACH,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IACrD;;;;;;;;;OASG;IACH,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,+BAA+B,CAAC;CACxD,CAAC,CAAA;AAGF,+FAA+F;AAC/F,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD;;;;;OAKG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB;;;OAGG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,8FAA8F;IAC9F,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9B,uEAAuE;IACvE,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,oDAAoD;IACpD,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC;;;;;;;;;;;;;;OAcG;IACH,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IAC9C;;;;;;OAMG;IACH,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;CAC3C,CAAC,CAAA;AAGF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC;IAC3C,0FAA0F;IAC1F,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC;;;;;;OAMG;IACH,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACtC;;;;;;;;OAQG;IACH,oBAAoB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,2FAA2F;IAC3F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,qDAAqD;IACrD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,0FAA0F;IAC1F,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACpC,qEAAqE;IACrE,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;CACpC,CAAC,CAAA"}

package/dist/capability-credentials.d.ts

@@ -74,7 +74,7 @@ export declare const capabilityCredentialStatusSchema: v.ObjectSchema<{
     readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 128, undefined>, v.RegexAction<string, "must be a valid environment variable name (letters, digits and underscores, not starting with a digit)">, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>]>;
     /** Which capabilities want it — id + label, so the UI can say who a key is for. */
     readonly declaredBy: v.ArraySchema<v.ObjectSchema<{
-        readonly subject: v.PicklistSchema<["tool-server", "binary-generator"], undefined>;
+        readonly subject: v.PicklistSchema<["tool-server", "binary-generator", "foundational-service"], undefined>;
         readonly id: v.StringSchema<undefined>;
         readonly label: v.StringSchema<undefined>;
         /** The definition's own note on how the value is presented, when it states one. */
@@ -127,7 +127,7 @@ export declare const capabilityCredentialsViewSchema: v.ObjectSchema<{
         readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 128, undefined>, v.RegexAction<string, "must be a valid environment variable name (letters, digits and underscores, not starting with a digit)">, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>]>;
         /** Which capabilities want it — id + label, so the UI can say who a key is for. */
         readonly declaredBy: v.ArraySchema<v.ObjectSchema<{
-            readonly subject: v.PicklistSchema<["tool-server", "binary-generator"], undefined>;
+            readonly subject: v.PicklistSchema<["tool-server", "binary-generator", "foundational-service"], undefined>;
             readonly id: v.StringSchema<undefined>;
             readonly label: v.StringSchema<undefined>;
             /** The definition's own note on how the value is presented, when it states one. */
@@ -182,4 +182,144 @@ export declare const capabilityCredentialEntriesSchema: v.ArraySchema<v.ObjectSc
 export declare function parseCapabilityCredentialEntries(raw: unknown): CapabilityCredentialEntry[];
 /** The non-secret summary persisted beside the sealed values, so a read decrypts nothing. */
 export declare function capabilityCredentialsSummary(entries: CapabilityCredentialEntry[], updatedAt: number): CapabilityCredentialRef[];
+/**
+ * ONE credential a registered capability needs, declared by NAME only, never a value.
+ *
+ * The value is resolved per dispatch through the facade-wired `ToolSecretResolver` port (the
+ * same port a tool server's credentials go through) and written straight onto the job body,
+ * where the harness injects it into THIS JOB's agent environment. It never reaches
+ * `AgentRunContext`, a prompt, or the telemetry snapshot: only the key NAME does, because the
+ * agent has to know which variable to read.
+ *
+ * A declarer states a LIST of these, because a vendor's account is not always one string. HTTP Basic over a
+ * key/secret pair is the ordinary case that breaks a single field, and it is common enough to be
+ * a shape rather than one vendor's eccentricity. Under one field the two halves have to be
+ * colon-joined into a single variable, which rotates them together, hands the operator one
+ * checklist row where their vendor console shows two values, and turns a mis-joined value into a
+ * 401 indistinguishable from a wrong key.
+ */
+export declare const capabilityCredentialSchema: v.ObjectSchema<{
+    /**
+     * The credential's LOOKUP key: what the secret resolver is asked for, and what a workspace
+     * stores its own value under. Also the ENVIRONMENT VARIABLE the agent reads it from unless
+     * {@link envName} says otherwise, so it must be a valid POSIX variable name either way: a
+     * generator declaring `x-rd-token` would resolve fine and then be dropped by the harness's env
+     * validation, which is a silent "the integration just 401s" at run time.
+     *
+     * It may NOT name a variable the platform's own configuration owns
+     * ({@link isReservedPlatformEnvKey}). The resolver reads the key off the deployment's
+     * environment and the value is injected into an agent process, so an integration declaring
+     * `ENCRYPTION_KEY` would hand a prompt-injectable agent the deployment's master sealing key.
+     * Refused here so a deployment learns at boot, and again at dispatch, since a mothership-mode
+     * node boot-validates none of the definitions it resolves.
+     */
+    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 128, undefined>, v.RegexAction<string, "must be a valid environment variable name">, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>]>;
+    /**
+     * The environment variable the value is injected as, when that differs from {@link key}. This
+     * is the name the agent is told to read, and it is what a vendor SDK that auto-reads its own
+     * documented variable needs.
+     *
+     * Held to the toolchain rule rather than the reserved-platform one, because it reads nothing:
+     * the floor above is about what may be READ off the deployment's environment, and an injection
+     * name only decides what a variable is called inside this job's agent process. That is what lets
+     * a declaration keep a vendor's documented name even when a platform prefix family covers it.
+     */
+    readonly envName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 128, undefined>, v.RegexAction<string, "must be a valid environment variable name">, v.CheckAction<string, (issue: v.CheckIssue<string>) => string>]>, undefined>;
+    /**
+     * How the capability expects the credential to be presented (`X-RD-Token: <value>`,
+     * `Authorization: Bearer <value>`). Folded into the brief verbatim: the agent writes the
+     * request itself, and a key with no stated header is a key it has to guess the use of.
+     */
+    readonly usage: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 400, undefined>]>, undefined>;
+    /**
+     * When true (the default), a capability whose credential does not resolve is reported to
+     * the agent as UNAVAILABLE rather than offered. Set false only for an endpoint that genuinely
+     * works unauthenticated — an agent handed an API whose first call 401s burns a run
+     * discovering it.
+     */
+    readonly required: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+}, undefined>;
+export type CapabilityCredential = v.InferOutput<typeof capabilityCredentialSchema>;
+/**
+ * The two names a credential carries, which is all the fallback below reads.
+ *
+ * Structural rather than {@link CapabilityCredential} itself, because the DISPATCH projection
+ * carries a narrower shape (kernel's `ResolvedBinaryGeneratorCredential`, which drops `usage` and
+ * every other prose field the container executor has no use for) and would otherwise have to
+ * either widen or re-spell the fallback. A parameter type nothing outside the two names can
+ * satisfy is what makes the "one place" claim below enforceable rather than aspirational.
+ */
+export interface CapabilityCredentialNames {
+    key: string;
+    envName?: string;
+}
+/**
+ * The environment variable one credential arrives as: its {@link CapabilityCredential.envName}
+ * when it declares one, else its lookup key.
+ *
+ * The ONE place that fallback is written, because three layers apply it (the schemas' uniqueness
+ * checks, the dispatch-time resolvers that key the job body, and the briefs that tell the
+ * agent which variable to read) and a copy that drifted would name a variable that is never set:
+ * a capability reported as unavailable on every run, with nothing to see at either end.
+ */
+export declare function credentialInjectionName(credential: CapabilityCredentialNames): string;
+/**
+ * The form an injection name is COMPARED in, which is not the form it is injected under.
+ *
+ * Case-folded, the same way {@link isReservedPlatformEnvKey} folds the lookup key it screens, and
+ * for the reason that floor has: environment lookup is case-insensitive on Windows, so `ACME_KEY`
+ * and `acme_key` are two variables in the declaration and one variable in the process that reads
+ * them. A rule comparing them exactly would call that pair distinct and let one value overwrite
+ * the other on the one platform where it matters.
+ */
+export declare function comparableCredentialInjectionName(credential: CapabilityCredentialNames): string;
+/**
+ * Whether every credential in a declaration arrives as its own variable.
+ *
+ * Exported so the boot checks and the schemas share one implementation rather than agreeing by
+ * hand. Duplicate LOOKUP keys are deliberately allowed: a capability wanting one stored value
+ * delivered under two names is odd but honest, and nothing is lost. A duplicate INJECTION name
+ * loses a value, which is why only that one is refused.
+ */
+export declare function uniqueCredentialInjectionNames(credentials: readonly CapabilityCredentialNames[]): boolean;
+/** One capability that claims environment variables, as {@link credentialInjectionCollisions} reads it. */
+export interface CredentialInjectionClaimant {
+    /**
+     * How this claimant is NAMED in the fault message, qualified by what it is: `integration "x"`,
+     * `service "y"`. The rule spans registries, so an id alone would leave an operator hunting for
+     * which registry to edit.
+     */
+    owner: string;
+    credentials?: readonly CapabilityCredentialNames[];
+}
+/** One environment variable two or more claimants want to hold different values. */
+export interface CredentialInjectionCollision {
+    /** The variable, in the spelling the deployment wrote (comparison is case-folded; injection is not). */
+    envName: string;
+    message: string;
+}
+/**
+ * The rule that spans DECLARATIONS: two capabilities may not inject different values into one
+ * environment variable.
+ *
+ * The across-declaration twin of {@link uniqueCredentialInjectionNames}, and stated over CLAIMANTS
+ * rather than over any one registry's definition type because the variable is the shared resource
+ * and the registries cannot see each other. A generative integration, a foundational service and
+ * an MCP tool server are registered independently, and the pair only meets when a step selects
+ * both, so a rule scoped to one registry answers a question narrower than the fault: the same
+ * collision graded twice, once per registry, produces two remediations for one variable.
+ *
+ * A SHARED name is legitimate and common, because one vendor behind an image endpoint and a music
+ * endpoint is one account: what makes that safe is that both look the value up under the SAME key,
+ * so whichever resolves first sets the variable to exactly what the other wanted. Different keys
+ * behind one name is the opposite, and there is no arbitration that makes it right. Serving the
+ * first claimant sets the variable the second capability's brief tells the agent to read, so the
+ * agent authenticates one thing with another's credential; withholding it (what dispatch does,
+ * since a mothership node validates nothing) costs both capabilities every run. Only a
+ * disagreement about the VALUE is reported.
+ *
+ * Takes the claimants that PARSED. Reading a malformed definition's credentials would restate a
+ * fault already reported as a second, more confusing one.
+ */
+export declare function credentialInjectionCollisions(claimants: readonly CredentialInjectionClaimant[]): CredentialInjectionCollision[];
 //# sourceMappingURL=capability-credentials.d.ts.map

package/dist/capability-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability-credentials.d.ts","sourceRoot":"","sources":["../src/capability-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAiC5B;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,6BAA6B,2ZAiBzC,CAAA;AAED,8FAA8F;AAC9F,eAAO,MAAM,+BAA+B;;;aAG1C,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,+BAA+B,CAAC,CAAA;AAE7F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B;;aAExC,CAAA;AACF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,6BAA6B,CAAC,CAAA;AAE9F;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B;;IAExC,2FAA2F;;aAE3F,CAAA;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,6BAA6B,CAAC,CAAA;AAEzF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,gCAAgC;;IAE3C,mFAAmF;;;;;QAM/E,mFAAmF;;;IAIvF,uEAAuE;;IAEvE,iDAAiD;;IAEjD,6EAA6E;;aAE7E,CAAA;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,gCAAgC,CAAC,CAAA;AAE/F;;;GAGG;AACH,eAAO,MAAM,0BAA0B,MAAM,CAAA;AAE7C,wFAAwF;AACxF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;wDAU7C,CAAA;AACD,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,WAAW,CAC1D,OAAO,iCAAiC,CACzC,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,+BAA+B;;;QApD1C,mFAAmF;;;;;YAM/E,mFAAmF;;;QAIvF,uEAAuE;;QAEvE,iDAAiD;;QAEjD,6EAA6E;;;IAwC7E,qDAAqD;;;QA5ErD,2FAA2F;;;IA8E3F;;;;;;;;;;;;;OAaG;;IAEH;;;;;;;;;OASG;;aAEH,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,+BAA+B,CAAC,CAAA;AAE7F,gGAAgG;AAChG,eAAO,MAAM,iCAAiC;;;yBAA2C,CAAA;AACzF,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,OAAO,GAAG,yBAAyB,EAAE,CAE1F;AAED,6FAA6F;AAC7F,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,yBAAyB,EAAE,EACpC,SAAS,EAAE,MAAM,GAChB,uBAAuB,EAAE,CAE3B"}
+{"version":3,"file":"capability-credentials.d.ts","sourceRoot":"","sources":["../src/capability-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAiC5B;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,6BAA6B,2ZAiBzC,CAAA;AAED,8FAA8F;AAC9F,eAAO,MAAM,+BAA+B;;;aAG1C,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,+BAA+B,CAAC,CAAA;AAE7F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B;;aAExC,CAAA;AACF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,6BAA6B,CAAC,CAAA;AAE9F;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B;;IAExC,2FAA2F;;aAE3F,CAAA;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,6BAA6B,CAAC,CAAA;AAEzF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,gCAAgC;;IAE3C,mFAAmF;;;;;QAM/E,mFAAmF;;;IAIvF,uEAAuE;;IAEvE,iDAAiD;;IAEjD,6EAA6E;;aAE7E,CAAA;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,gCAAgC,CAAC,CAAA;AAE/F;;;GAGG;AACH,eAAO,MAAM,0BAA0B,MAAM,CAAA;AAE7C,wFAAwF;AACxF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;wDAU7C,CAAA;AACD,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,WAAW,CAC1D,OAAO,iCAAiC,CACzC,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,+BAA+B;;;QApD1C,mFAAmF;;;;;YAM/E,mFAAmF;;;QAIvF,uEAAuE;;QAEvE,iDAAiD;;QAEjD,6EAA6E;;;IAwC7E,qDAAqD;;;QA5ErD,2FAA2F;;;IA8E3F;;;;;;;;;;;;;OAaG;;IAEH;;;;;;;;;OASG;;aAEH,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,+BAA+B,CAAC,CAAA;AAE7F,gGAAgG;AAChG,eAAO,MAAM,iCAAiC;;;yBAA2C,CAAA;AACzF,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,OAAO,GAAG,yBAAyB,EAAE,CAE1F;AAED,6FAA6F;AAC7F,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,yBAAyB,EAAE,EACpC,SAAS,EAAE,MAAM,GAChB,uBAAuB,EAAE,CAE3B;AAkBD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,0BAA0B;IACrC;;;;;;;;;;;;;OAaG;;IAYH;;;;;;;;;OASG;;IAcH;;;;OAIG;;IAEH;;;;;OAKG;;aAEH,CAAA;AACF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,0BAA0B,CAAC,CAAA;AAEnF;;;;;;;;GAQG;AACH,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,yBAAyB,GAAG,MAAM,CAErF;AAED;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAAC,UAAU,EAAE,yBAAyB,GAAG,MAAM,CAE/F;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,WAAW,EAAE,SAAS,yBAAyB,EAAE,GAChD,OAAO,CAGT;AAED,2GAA2G;AAC3G,MAAM,WAAW,2BAA2B;IAC1C;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,SAAS,yBAAyB,EAAE,CAAA;CACnD;AAED,oFAAoF;AACpF,MAAM,WAAW,4BAA4B;IAC3C,wGAAwG;IACxG,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,SAAS,2BAA2B,EAAE,GAChD,4BAA4B,EAAE,CAkChC"}