@cat-factory/server 0.197.0 → 0.198.0

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,gBAAgB,EAChB,MAAM,EACN,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,KAAK,SAAS,EACd,KAAK,QAAQ,EACb,KAAK,MAAM,GACZ,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAA;AAC1E,OAAO,EACL,wBAAwB,EACxB,WAAW,EACX,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,GACxB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EACL,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAA;AAC9E,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAG7D,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,EAC/B,wBAAwB,GACzB,MAAM,4DAA4D,CAAA;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAA;AAC/E,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,mBAAmB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAE,KAAK,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,SAAS,GACf,MAAM,yCAAyC,CAAA;AAIhD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,EACvC,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,GAC5B,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,uBAAuB,EAAE,KAAK,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAG1F,OAAO,EACL,KAAK,4BAA4B,EACjC,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,iCAAiC,EAGjC,yBAAyB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,GAChC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,2BAA2B,EAC3B,KAAK,4BAA4B,GAClC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,4BAA4B,EAC5B,KAAK,kBAAkB,GACxB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,yBAAyB,EACzB,KAAK,qCAAqC,GAC3C,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,0BAA0B,EAC1B,KAAK,sCAAsC,GAC5C,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,YAAY,GAClB,MAAM,+BAA+B,CAAA;AAGtC,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,qBAAqB,EACrB,KAAK,6BAA6B,GACnC,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EACL,oBAAoB,EACpB,KAAK,gCAAgC,GACtC,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,sBAAsB,GACvB,MAAM,2BAA2B,CAAA;AAIlC,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,6BAA6B,EAC7B,gCAAgC,EAChC,yBAAyB,EACzB,WAAW,GACZ,MAAM,8BAA8B,CAAA;AAKrC,OAAO,EACL,KAAK,4BAA4B,EACjC,KAAK,yBAAyB,EAC9B,KAAK,oCAAoC,EACzC,KAAK,gCAAgC,EACrC,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,yCAAyC,CAAA;AAChD,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,KAAK,iCAAiC,EACtC,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,EAC7B,KAAK,qCAAqC,EAC1C,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,8BAA8B,EAC9B,mCAAmC,EACnC,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,aAAa,EACb,gBAAgB,GACjB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC/F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,UAAU,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,QAAQ,EACR,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAA;AACjG,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EACL,eAAe,EACf,0BAA0B,EAC1B,eAAe,EACf,kBAAkB,EAClB,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAIlG,OAAO,EACL,qBAAqB,EACrB,KAAK,4BAA4B,GAClC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAA;AAEzF,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,mBAAmB,GACzB,MAAM,4BAA4B,CAAA;AAEnC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC3F,OAAO,EACL,aAAa,EACb,KAAK,yBAAyB,EAC9B,mCAAmC,GACpC,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,wBAAwB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AAC1F,OAAO,EACL,8BAA8B,EAC9B,KAAK,6BAA6B,GACnC,MAAM,+BAA+B,CAAA;AAKtC,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,KAAK,6BAA6B,GACnC,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,2BAA2B,EAC3B,KAAK,uCAAuC,GAC7C,MAAM,yCAAyC,CAAA;AAChD,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,oCAAoC,CAAA;AAG3C,OAAO,EACL,6BAA6B,EAC7B,KAAK,yCAAyC,GAC/C,MAAM,2CAA2C,CAAA;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,GACxC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,wBAAwB,EACxB,KAAK,oCAAoC,GAC1C,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,+BAA+B,EAC/B,KAAK,2CAA2C,GACjD,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,KAAK,sCAAsC,GAC5C,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,mBAAmB,EACnB,KAAK,+BAA+B,GACrC,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,uBAAuB,EACvB,KAAK,mCAAmC,GACzC,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,uBAAuB,EACvB,KAAK,mCAAmC,GACzC,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,UAAU,EACV,cAAc,EACd,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,KAAK,QAAQ,EACb,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,YAAY,EACZ,SAAS,EACT,UAAU,EACV,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,yBAAyB,EACzB,UAAU,EACV,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,WAAW,GACZ,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,gCAAgC,EAChC,0BAA0B,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,KAAK,yBAAyB,GAC/B,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EACL,yBAAyB,EACzB,KAAK,0BAA0B,GAChC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,4BAA4B,CAAA;AAInC,cAAc,0BAA0B,CAAA;AACxC,cAAc,kCAAkC,CAAA;AAGhD,cAAc,yBAAyB,CAAA;AAMvC,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,KAAK,oBAAoB,EACzB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qCAAqC,CAAA;AAI5C,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAA;AAIrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAI7E,OAAO,EACL,oCAAoC,EACpC,KAAK,+BAA+B,GACrC,MAAM,gCAAgC,CAAA;AAKvC,OAAO,EACL,uBAAuB,EACvB,KAAK,6BAA6B,GACnC,MAAM,qCAAqC,CAAA;AAI5C,OAAO,EACL,8BAA8B,EAC9B,KAAK,kCAAkC,EACvC,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,8BAA8B,GACpC,MAAM,sCAAsC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,gBAAgB,EAChB,MAAM,EACN,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,KAAK,SAAS,EACd,KAAK,QAAQ,EACb,KAAK,MAAM,GACZ,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAA;AAC1E,OAAO,EACL,wBAAwB,EACxB,WAAW,EACX,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,GACxB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EACL,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAA;AAC9E,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAG7D,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,EAC/B,wBAAwB,GACzB,MAAM,4DAA4D,CAAA;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAA;AAC/E,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,mBAAmB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAE,KAAK,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,SAAS,GACf,MAAM,yCAAyC,CAAA;AAIhD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,EACvC,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,GAC5B,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,uBAAuB,EAAE,KAAK,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAI1F,OAAO,EACL,KAAK,4BAA4B,EACjC,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,yBAAyB,CAAA;AAIhC,OAAO,EACL,iCAAiC,EACjC,0BAA0B,EAC1B,KAAK,kCAAkC,GACxC,MAAM,0CAA0C,CAAA;AACjD,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,EACpC,KAAK,4BAA4B,EACjC,KAAK,6BAA6B,GACnC,MAAM,wDAAwD,CAAA;AAC/D,OAAO,EACL,iCAAiC,EAGjC,yBAAyB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,GAChC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,2BAA2B,EAC3B,KAAK,4BAA4B,GAClC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,4BAA4B,EAC5B,KAAK,kBAAkB,GACxB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,yBAAyB,EACzB,KAAK,qCAAqC,GAC3C,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,0BAA0B,EAC1B,KAAK,sCAAsC,GAC5C,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,YAAY,GAClB,MAAM,+BAA+B,CAAA;AAGtC,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,qBAAqB,EACrB,KAAK,6BAA6B,GACnC,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EACL,oBAAoB,EACpB,KAAK,gCAAgC,GACtC,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,sBAAsB,GACvB,MAAM,2BAA2B,CAAA;AAIlC,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,6BAA6B,EAC7B,gCAAgC,EAChC,yBAAyB,EACzB,WAAW,GACZ,MAAM,8BAA8B,CAAA;AAKrC,OAAO,EACL,KAAK,4BAA4B,EACjC,KAAK,yBAAyB,EAC9B,KAAK,oCAAoC,EACzC,KAAK,gCAAgC,EACrC,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,yCAAyC,CAAA;AAChD,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,KAAK,iCAAiC,EACtC,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,EAC7B,KAAK,qCAAqC,EAC1C,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,8BAA8B,EAC9B,mCAAmC,EACnC,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,aAAa,EACb,gBAAgB,GACjB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC/F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,UAAU,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,QAAQ,EACR,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAA;AACjG,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EACL,eAAe,EACf,0BAA0B,EAC1B,eAAe,EACf,kBAAkB,EAClB,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAIlG,OAAO,EACL,qBAAqB,EACrB,KAAK,4BAA4B,GAClC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAA;AAEzF,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,mBAAmB,GACzB,MAAM,4BAA4B,CAAA;AAEnC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC3F,OAAO,EACL,aAAa,EACb,KAAK,yBAAyB,EAC9B,mCAAmC,GACpC,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,wBAAwB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AAC1F,OAAO,EACL,8BAA8B,EAC9B,KAAK,6BAA6B,GACnC,MAAM,+BAA+B,CAAA;AAKtC,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,KAAK,6BAA6B,GACnC,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,2BAA2B,EAC3B,KAAK,uCAAuC,GAC7C,MAAM,yCAAyC,CAAA;AAChD,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,oCAAoC,CAAA;AAG3C,OAAO,EACL,6BAA6B,EAC7B,KAAK,yCAAyC,GAC/C,MAAM,2CAA2C,CAAA;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,GACxC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,wBAAwB,EACxB,KAAK,oCAAoC,GAC1C,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,+BAA+B,EAC/B,KAAK,2CAA2C,GACjD,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,KAAK,sCAAsC,GAC5C,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,mBAAmB,EACnB,KAAK,+BAA+B,GACrC,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,uBAAuB,EACvB,KAAK,mCAAmC,GACzC,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,uBAAuB,EACvB,KAAK,mCAAmC,GACzC,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,UAAU,EACV,cAAc,EACd,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,KAAK,QAAQ,EACb,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,YAAY,EACZ,SAAS,EACT,UAAU,EACV,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,yBAAyB,EACzB,UAAU,EACV,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,WAAW,GACZ,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,gCAAgC,EAChC,0BAA0B,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,KAAK,yBAAyB,GAC/B,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EACL,yBAAyB,EACzB,KAAK,0BAA0B,GAChC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,4BAA4B,CAAA;AAInC,cAAc,0BAA0B,CAAA;AACxC,cAAc,kCAAkC,CAAA;AAGhD,cAAc,yBAAyB,CAAA;AAMvC,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,KAAK,oBAAoB,EACzB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qCAAqC,CAAA;AAI5C,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAA;AAIrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAI7E,OAAO,EACL,oCAAoC,EACpC,KAAK,+BAA+B,GACrC,MAAM,gCAAgC,CAAA;AAKvC,OAAO,EACL,uBAAuB,EACvB,KAAK,6BAA6B,GACnC,MAAM,qCAAqC,CAAA;AAI5C,OAAO,EACL,8BAA8B,EAC9B,KAAK,kCAAkC,EACvC,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,8BAA8B,GACpC,MAAM,sCAAsC,CAAA"}

package/dist/index.js

@@ -34,8 +34,14 @@ export { ContainerAgentExecutor, } from './agents/ContainerAgentExecutor.js';
 export { ensureWorkBranchViaRest } from './github/ensureWorkBranch.js';
 export { RunnerJobClient } from './agents/RunnerJobClient.js';
 // Tool servers (MCP) for a container dispatch: the resolution the executor runs, plus the
-// deployment-environment credential resolver both facades wire by default.
+// deployment-environment credential resolver every facade wires as the FALLBACK behind the
+// per-workspace store.
 export { createEnvToolSecretResolver, resolveToolServers, } from './agents/toolServers.js';
+// The per-workspace capability-credential resolver and the per-KEY composition that puts it in
+// front of the environment one. See `capabilityCredentialResolver.ts` for why an environment
+// variable is a single-tenant answer, and why the fallback is a real mechanism rather than a shim.
+export { createWorkspaceToolSecretResolver, composeToolSecretResolvers, } from './agents/capabilityCredentialResolver.js';
+export { buildCapabilityCredentialsView, collectDeclaredCapabilityCredentials, } from './modules/capabilityCredentials/declaredCredentials.js';
 export { createScopedModelProviderResolver, 
 // The individual instrumentation / limiter wraps are deliberately NOT exported: their
 // relative order is load-bearing and this composer is what fixes it.

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,gFAAgF;AAChF,8EAA8E;AAC9E,qEAAqE;AACrE,OAAO,EACL,gBAAgB,EAChB,MAAM,EACN,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,GAIZ,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAA;AAC1E,OAAO,EACL,wBAAwB,EACxB,WAAW,GAGZ,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAKN,MAAM,eAAe,CAAA;AACtB,OAAO,EAaN,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAA;AAC9E,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,gGAAgG;AAChG,wEAAwE;AACxE,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,EAC/B,wBAAwB,GACzB,MAAM,4DAA4D,CAAA;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAA;AAC/E,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GAEpB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,WAAW,EAAqB,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,WAAW,GAGZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,WAAW,GAGZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAgC,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GAGvB,MAAM,yCAAyC,CAAA;AAChD,mFAAmF;AACnF,kFAAkF;AAClF,oFAAoF;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EACL,sBAAsB,GASvB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,uBAAuB,EAA8B,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,eAAe,EAA+B,MAAM,6BAA6B,CAAA;AAC1F,0FAA0F;AAC1F,2EAA2E;AAC3E,OAAO,EAIL,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,iCAAiC;AACjC,sFAAsF;AACtF,qEAAqE;AACrE,yBAAyB,GAI1B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,2BAA2B,GAE5B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,4BAA4B,GAE7B,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,yBAAyB,GAE1B,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,0BAA0B,GAE3B,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GAMxB,MAAM,+BAA+B,CAAA;AACtC,qFAAqF;AACrF,4FAA4F;AAC5F,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,qBAAqB,GAEtB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EACL,oBAAoB,GAErB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAIL,sBAAsB,GACvB,MAAM,2BAA2B,CAAA;AAClC,6FAA6F;AAC7F,gGAAgG;AAChG,sFAAsF;AACtF,OAAO,EAGL,6BAA6B,EAC7B,gCAAgC,EAChC,yBAAyB,EACzB,WAAW,GACZ,MAAM,8BAA8B,CAAA;AACrC,4FAA4F;AAC5F,8FAA8F;AAC9F,+FAA+F;AAC/F,2CAA2C;AAC3C,OAAO,EAKL,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,yCAAyC,CAAA;AAChD,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EAKvB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,EAQ7B,8BAA8B,EAC9B,mCAAmC,EACnC,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,aAAa,EACb,gBAAgB,GACjB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC/F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,UAAU,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,QAAQ,GAET,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAA;AACjG,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EACL,eAAe,EACf,0BAA0B,EAC1B,eAAe,EACf,kBAAkB,GAEnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAClG,kFAAkF;AAClF,8EAA8E;AAC9E,kEAAkE;AAClE,OAAO,EACL,qBAAqB,GAEtB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAA;AACzF,kFAAkF;AAClF,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GAEpB,MAAM,4BAA4B,CAAA;AACnC,oFAAoF;AACpF,OAAO,EAAE,aAAa,EAAE,WAAW,EAAuB,MAAM,2BAA2B,CAAA;AAC3F,OAAO,EACL,aAAa,EAEb,mCAAmC,GACpC,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,iBAAiB,GAIlB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,wBAAwB,GAEzB,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AAC1F,OAAO,EACL,8BAA8B,GAE/B,MAAM,+BAA+B,CAAA;AACtC,gFAAgF;AAChF,kFAAkF;AAClF,qFAAqF;AACrF,6BAA6B;AAC7B,OAAO,EACL,iBAAiB,EACjB,cAAc,GAEf,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,2BAA2B,GAE5B,MAAM,yCAAyC,CAAA;AAChD,OAAO,EACL,sBAAsB,GAEvB,MAAM,oCAAoC,CAAA;AAC3C,oFAAoF;AACpF,qEAAqE;AACrE,OAAO,EACL,6BAA6B,GAE9B,MAAM,2CAA2C,CAAA;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,sBAAsB,GAEvB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,wBAAwB,GAEzB,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,+BAA+B,GAEhC,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,GAErB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,mBAAmB,GAEpB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,uBAAuB,GAExB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,uBAAuB,GAExB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,UAAU,EACV,cAAc,GAKf,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,GAGb,MAAM,oBAAoB,CAAA;AA0B3B,OAAO,EACL,gCAAgC,EAChC,0BAA0B,GAE3B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,GAE1B,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EACL,yBAAyB,GAE1B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,4BAA4B,CAAA;AAEnC,mFAAmF;AACnF,iEAAiE;AACjE,cAAc,0BAA0B,CAAA;AACxC,cAAc,kCAAkC,CAAA;AAChD,4FAA4F;AAC5F,6FAA6F;AAC7F,cAAc,yBAAyB,CAAA;AAEvC,6FAA6F;AAC7F,wFAAwF;AACxF,6FAA6F;AAC7F,0EAA0E;AAC1E,OAAO,EAWL,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAEL,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qCAAqC,CAAA;AAC5C,yFAAyF;AACzF,yFAAyF;AACzF,yEAAyE;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAA;AACrF,iGAAiG;AACjG,gGAAgG;AAChG,iCAAiC;AACjC,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAC7E,gGAAgG;AAChG,kGAAkG;AAClG,sEAAsE;AACtE,OAAO,EACL,oCAAoC,GAErC,MAAM,gCAAgC,CAAA;AACvC,yFAAyF;AACzF,wFAAwF;AACxF,2FAA2F;AAC3F,uFAAuF;AACvF,OAAO,EACL,uBAAuB,GAExB,MAAM,qCAAqC,CAAA;AAE5C,2FAA2F;AAC3F,sEAAsE;AACtE,OAAO,EACL,8BAA8B,GAK/B,MAAM,sCAAsC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,gFAAgF;AAChF,8EAA8E;AAC9E,qEAAqE;AACrE,OAAO,EACL,gBAAgB,EAChB,MAAM,EACN,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,GAIZ,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAA;AAC1E,OAAO,EACL,wBAAwB,EACxB,WAAW,GAGZ,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAKN,MAAM,eAAe,CAAA;AACtB,OAAO,EAaN,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAA;AAC9E,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,gGAAgG;AAChG,wEAAwE;AACxE,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,EAC/B,wBAAwB,GACzB,MAAM,4DAA4D,CAAA;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAA;AAC/E,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GAEpB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,WAAW,EAAqB,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,WAAW,GAGZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,WAAW,GAGZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAgC,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GAGvB,MAAM,yCAAyC,CAAA;AAChD,mFAAmF;AACnF,kFAAkF;AAClF,oFAAoF;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EACL,sBAAsB,GASvB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,uBAAuB,EAA8B,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,eAAe,EAA+B,MAAM,6BAA6B,CAAA;AAC1F,0FAA0F;AAC1F,2FAA2F;AAC3F,uBAAuB;AACvB,OAAO,EAIL,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,yBAAyB,CAAA;AAChC,+FAA+F;AAC/F,6FAA6F;AAC7F,mGAAmG;AACnG,OAAO,EACL,iCAAiC,EACjC,0BAA0B,GAE3B,MAAM,0CAA0C,CAAA;AACjD,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,GAGrC,MAAM,wDAAwD,CAAA;AAC/D,OAAO,EACL,iCAAiC;AACjC,sFAAsF;AACtF,qEAAqE;AACrE,yBAAyB,GAI1B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,2BAA2B,GAE5B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,4BAA4B,GAE7B,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,yBAAyB,GAE1B,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,0BAA0B,GAE3B,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GAMxB,MAAM,+BAA+B,CAAA;AACtC,qFAAqF;AACrF,4FAA4F;AAC5F,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,qBAAqB,GAEtB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EACL,oBAAoB,GAErB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAIL,sBAAsB,GACvB,MAAM,2BAA2B,CAAA;AAClC,6FAA6F;AAC7F,gGAAgG;AAChG,sFAAsF;AACtF,OAAO,EAGL,6BAA6B,EAC7B,gCAAgC,EAChC,yBAAyB,EACzB,WAAW,GACZ,MAAM,8BAA8B,CAAA;AACrC,4FAA4F;AAC5F,8FAA8F;AAC9F,+FAA+F;AAC/F,2CAA2C;AAC3C,OAAO,EAKL,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,yCAAyC,CAAA;AAChD,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EAKvB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,EAQ7B,8BAA8B,EAC9B,mCAAmC,EACnC,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,aAAa,EACb,gBAAgB,GACjB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC/F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,UAAU,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,QAAQ,GAET,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAA;AACjG,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EACL,eAAe,EACf,0BAA0B,EAC1B,eAAe,EACf,kBAAkB,GAEnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAClG,kFAAkF;AAClF,8EAA8E;AAC9E,kEAAkE;AAClE,OAAO,EACL,qBAAqB,GAEtB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAA;AACzF,kFAAkF;AAClF,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GAEpB,MAAM,4BAA4B,CAAA;AACnC,oFAAoF;AACpF,OAAO,EAAE,aAAa,EAAE,WAAW,EAAuB,MAAM,2BAA2B,CAAA;AAC3F,OAAO,EACL,aAAa,EAEb,mCAAmC,GACpC,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,iBAAiB,GAIlB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,wBAAwB,GAEzB,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AAC1F,OAAO,EACL,8BAA8B,GAE/B,MAAM,+BAA+B,CAAA;AACtC,gFAAgF;AAChF,kFAAkF;AAClF,qFAAqF;AACrF,6BAA6B;AAC7B,OAAO,EACL,iBAAiB,EACjB,cAAc,GAEf,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,2BAA2B,GAE5B,MAAM,yCAAyC,CAAA;AAChD,OAAO,EACL,sBAAsB,GAEvB,MAAM,oCAAoC,CAAA;AAC3C,oFAAoF;AACpF,qEAAqE;AACrE,OAAO,EACL,6BAA6B,GAE9B,MAAM,2CAA2C,CAAA;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,sBAAsB,GAEvB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,wBAAwB,GAEzB,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,+BAA+B,GAEhC,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,GAErB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,mBAAmB,GAEpB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,uBAAuB,GAExB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,uBAAuB,GAExB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,UAAU,EACV,cAAc,GAKf,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,GAGb,MAAM,oBAAoB,CAAA;AA0B3B,OAAO,EACL,gCAAgC,EAChC,0BAA0B,GAE3B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,GAE1B,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EACL,yBAAyB,GAE1B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,4BAA4B,CAAA;AAEnC,mFAAmF;AACnF,iEAAiE;AACjE,cAAc,0BAA0B,CAAA;AACxC,cAAc,kCAAkC,CAAA;AAChD,4FAA4F;AAC5F,6FAA6F;AAC7F,cAAc,yBAAyB,CAAA;AAEvC,6FAA6F;AAC7F,wFAAwF;AACxF,6FAA6F;AAC7F,0EAA0E;AAC1E,OAAO,EAWL,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAEL,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qCAAqC,CAAA;AAC5C,yFAAyF;AACzF,yFAAyF;AACzF,yEAAyE;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAA;AACrF,iGAAiG;AACjG,gGAAgG;AAChG,iCAAiC;AACjC,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAC7E,gGAAgG;AAChG,kGAAkG;AAClG,sEAAsE;AACtE,OAAO,EACL,oCAAoC,GAErC,MAAM,gCAAgC,CAAA;AACvC,yFAAyF;AACzF,wFAAwF;AACxF,2FAA2F;AAC3F,uFAAuF;AACvF,OAAO,EACL,uBAAuB,GAExB,MAAM,qCAAqC,CAAA;AAE5C,2FAA2F;AAC3F,sEAAsE;AACtE,OAAO,EACL,8BAA8B,GAK/B,MAAM,sCAAsC,CAAA"}

package/dist/modules/capabilityCredentials/CapabilityCredentialsController.d.ts

@@ -0,0 +1,18 @@
+import { Hono } from 'hono';
+import type { AppEnv } from '../../http/env.js';
+/**
+ * The PER-WORKSPACE capability-credential store: the tenant-scoped home for the secrets a
+ * registered tool server or generative binary integration declares by name. Sealed at rest,
+ * delivered to the agent out of band (never a prompt or the telemetry snapshot), and write-only —
+ * the view returns which credentials the deployment DECLARES and which this workspace has stored,
+ * never a value.
+ *
+ * Gated on `secrets.manage`, the same permission the sensitive test-credential store uses, and
+ * that gate covers the READ as well as the writes — unusually, and on purpose. The view carries
+ * the credential KEY NAMES this deployment's capabilities want, which the workspace snapshot's
+ * own generative-integration projection deliberately omits ("a workspace viewer has no business
+ * learning which environment variables the deployment sets"). Moving the value into a row does
+ * not change that judgement.
+ */
+export declare function capabilityCredentialsController(): Hono<AppEnv>;
+//# sourceMappingURL=CapabilityCredentialsController.d.ts.map

package/dist/modules/capabilityCredentials/CapabilityCredentialsController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CapabilityCredentialsController.d.ts","sourceRoot":"","sources":["../../../src/modules/capabilityCredentials/CapabilityCredentialsController.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AA8C/C;;;;;;;;;;;;;GAaG;AACH,wBAAgB,+BAA+B,IAAI,IAAI,CAAC,MAAM,CAAC,CAuB9D"}

package/dist/modules/capabilityCredentials/CapabilityCredentialsController.js

@@ -0,0 +1,67 @@
+import { deleteCapabilityCredentialContract, getCapabilityCredentialsContract, setCapabilityCredentialsContract, } from '@cat-factory/contracts';
+import { buildHonoRoute } from '@toad-contracts/hono';
+import { Hono } from 'hono';
+import { requireWorkspacePermission } from '../../http/workspaceAccess.js';
+import { param } from '../../http/params.js';
+import { requireCapability } from '../../http/guards.js';
+import { buildCapabilityCredentialsView, collectDeclaredCapabilityCredentials, } from './declaredCredentials.js';
+import { logger } from '../../observability/logger.js';
+/** Resolve the capability-credential store, or refuse with a 503 naming what isn't wired. */
+function requireCapabilityCredentials(c) {
+    return requireCapability(c.get('container').capabilityCredentials, 'The capability-credential store is not configured (needs ENCRYPTION_KEY)');
+}
+/**
+ * Compose the view from the two halves: what the deployment's registries DECLARE (read through
+ * `BinaryGeneratorSource`, so a mothership-mode node offers what its runs actually resolve
+ * against) and what this workspace has STORED.
+ */
+async function viewFor(container, stored) {
+    const declarations = await collectDeclaredCapabilityCredentials({
+        agentKindRegistry: container.agentKindRegistry,
+        binaryGenerators: container.binaryGenerators,
+        logger,
+    });
+    return buildCapabilityCredentialsView({
+        declarations,
+        stored,
+        // The facades all keep the deployment-environment resolver behind the store, so an unstored
+        // key may still resolve. Stated rather than assumed, because it decides whether the UI may
+        // call a blank row "missing".
+        environmentFallback: true,
+    });
+}
+/**
+ * The PER-WORKSPACE capability-credential store: the tenant-scoped home for the secrets a
+ * registered tool server or generative binary integration declares by name. Sealed at rest,
+ * delivered to the agent out of band (never a prompt or the telemetry snapshot), and write-only —
+ * the view returns which credentials the deployment DECLARES and which this workspace has stored,
+ * never a value.
+ *
+ * Gated on `secrets.manage`, the same permission the sensitive test-credential store uses, and
+ * that gate covers the READ as well as the writes — unusually, and on purpose. The view carries
+ * the credential KEY NAMES this deployment's capabilities want, which the workspace snapshot's
+ * own generative-integration projection deliberately omits ("a workspace viewer has no business
+ * learning which environment variables the deployment sets"). Moving the value into a row does
+ * not change that judgement.
+ */
+export function capabilityCredentialsController() {
+    const app = new Hono();
+    app.use('*', requireWorkspacePermission('secrets.manage'));
+    buildHonoRoute(app, getCapabilityCredentialsContract, async (c) => {
+        const svc = requireCapabilityCredentials(c);
+        const stored = await svc.listStored(param(c, 'workspaceId'));
+        return c.json(await viewFor(c.get('container'), stored), 200);
+    });
+    buildHonoRoute(app, setCapabilityCredentialsContract, async (c) => {
+        const svc = requireCapabilityCredentials(c);
+        const stored = await svc.set(param(c, 'workspaceId'), c.req.valid('json'));
+        return c.json(await viewFor(c.get('container'), stored), 200);
+    });
+    buildHonoRoute(app, deleteCapabilityCredentialContract, async (c) => {
+        const svc = requireCapabilityCredentials(c);
+        await svc.remove(param(c, 'workspaceId'), c.req.valid('param').key);
+        return c.body(null, 204);
+    });
+    return app;
+}
+//# sourceMappingURL=CapabilityCredentialsController.js.map

package/dist/modules/capabilityCredentials/CapabilityCredentialsController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CapabilityCredentialsController.js","sourceRoot":"","sources":["../../../src/modules/capabilityCredentials/CapabilityCredentialsController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kCAAkC,EAClC,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAI3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAA;AAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,GACrC,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAA;AAItD,6FAA6F;AAC7F,SAAS,4BAA4B,CACnC,CAAa;IAEb,OAAO,iBAAiB,CACtB,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,qBAAqB,EACxC,0EAA0E,CAC3E,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,OAAO,CACpB,SAA0B,EAC1B,MAAiC;IAEjC,MAAM,YAAY,GAAG,MAAM,oCAAoC,CAAC;QAC9D,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;QAC5C,MAAM;KACP,CAAC,CAAA;IACF,OAAO,8BAA8B,CAAC;QACpC,YAAY;QACZ,MAAM;QACN,4FAA4F;QAC5F,2FAA2F;QAC3F,8BAA8B;QAC9B,mBAAmB,EAAE,IAAI;KAC1B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,+BAA+B;IAC7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,0BAA0B,CAAC,gBAAgB,CAAC,CAAC,CAAA;IAE1D,cAAc,CAAC,GAAG,EAAE,gCAAgC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChE,MAAM,GAAG,GAAG,4BAA4B,CAAC,CAAC,CAAC,CAAA;QAC3C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAA;QAC5D,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,gCAAgC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChE,MAAM,GAAG,GAAG,4BAA4B,CAAC,CAAC,CAAC,CAAA;QAC3C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;QAC1E,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,kCAAkC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClE,MAAM,GAAG,GAAG,4BAA4B,CAAC,CAAC,CAAC,CAAA;QAC3C,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAA;QACnE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/modules/capabilityCredentials/declaredCredentials.d.ts

@@ -0,0 +1,43 @@
+import type { BinaryGeneratorSource, Logger } from '@cat-factory/kernel';
+import type { AgentKindRegistry } from '@cat-factory/agents';
+import type { CapabilityCredentialRef, CapabilityCredentialsView } from '@cat-factory/contracts';
+/** One capability's declaration of a credential it needs, flattened for the join below. */
+export interface DeclaredCapabilityCredential {
+    subject: 'tool-server' | 'binary-generator';
+    id: string;
+    label: string;
+    key: string;
+    usage?: string;
+    /** Resolved default, so the fold below need not know each declaration site's own. */
+    required: boolean;
+}
+export interface DeclaredCapabilityCredentials {
+    declared: DeclaredCapabilityCredential[];
+    /**
+     * True when the GENERATOR half could not be read. `BinaryGeneratorSource` throws rather than
+     * answering an empty set when it cannot reach the mothership, and this surface must not turn
+     * that outage into "no integration needs a credential" — the same "absent ≠ zero" rule the
+     * workspace snapshot's picker applies to the same read.
+     */
+    incomplete: boolean;
+}
+export interface CollectDeclaredCredentialsInput {
+    agentKindRegistry: AgentKindRegistry;
+    /** The set a RUN resolves against — this process's registry, or the mothership's. */
+    binaryGenerators: BinaryGeneratorSource;
+    logger?: Logger;
+}
+/** Every credential a registered tool server or generative integration declares. */
+export declare function collectDeclaredCapabilityCredentials(input: CollectDeclaredCredentialsInput): Promise<DeclaredCapabilityCredentials>;
+/**
+ * Join what the deployment DECLARES to what the workspace has STORED.
+ *
+ * Pure, so the two halves can be tested without a container: the store answers `stored`, the
+ * registries answer everything else, and neither knows about the other.
+ */
+export declare function buildCapabilityCredentialsView(input: {
+    declarations: DeclaredCapabilityCredentials;
+    stored: CapabilityCredentialRef[];
+    environmentFallback: boolean;
+}): CapabilityCredentialsView;
+//# sourceMappingURL=declaredCredentials.d.ts.map

package/dist/modules/capabilityCredentials/declaredCredentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"declaredCredentials.d.ts","sourceRoot":"","sources":["../../../src/modules/capabilityCredentials/declaredCredentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAExE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,KAAK,EACV,uBAAuB,EAEvB,yBAAyB,EAC1B,MAAM,wBAAwB,CAAA;AAkB/B,2FAA2F;AAC3F,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,aAAa,GAAG,kBAAkB,CAAA;IAC3C,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,qFAAqF;IACrF,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,EAAE,4BAA4B,EAAE,CAAA;IACxC;;;;;OAKG;IACH,UAAU,EAAE,OAAO,CAAA;CACpB;AAED,MAAM,WAAW,+BAA+B;IAC9C,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,qFAAqF;IACrF,gBAAgB,EAAE,qBAAqB,CAAA;IACvC,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,oFAAoF;AACpF,wBAAsB,oCAAoC,CACxD,KAAK,EAAE,+BAA+B,GACrC,OAAO,CAAC,6BAA6B,CAAC,CAsDxC;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE;IACpD,YAAY,EAAE,6BAA6B,CAAA;IAC3C,MAAM,EAAE,uBAAuB,EAAE,CAAA;IACjC,mBAAmB,EAAE,OAAO,CAAA;CAC7B,GAAG,yBAAyB,CAwC5B"}

package/dist/modules/capabilityCredentials/declaredCredentials.js

@@ -0,0 +1,103 @@
+import { noopLogger, runBestEffort } from '@cat-factory/kernel';
+/** Every credential a registered tool server or generative integration declares. */
+export async function collectDeclaredCapabilityCredentials(input) {
+    const declared = [];
+    const seen = new Set();
+    const push = (entry) => {
+        // Dedupe on (subject, id, key) — the identity of the DECLARATION — rather than on the key
+        // alone, which would drop a second capability's name from `declaredBy` and leave the operator
+        // unable to see who else wants the value they are about to change.
+        const identity = `${entry.subject}:${entry.id}:${entry.key}`;
+        if (seen.has(identity))
+            return;
+        seen.add(identity);
+        declared.push(entry);
+    };
+    // Enumerated through the KINDS rather than off the server registrations, so the list is the
+    // servers some registered kind can actually reach: a server registered by id and attached to
+    // nothing never runs, so a credential for it is a key an operator would fill in for no dispatch.
+    // This resolves inline and by-reference declarations alike — hence the dedupe.
+    for (const kind of input.agentKindRegistry.all()) {
+        for (const server of input.agentKindRegistry.toolServersFor(kind.kind).servers) {
+            for (const secret of server.secretKeys ?? []) {
+                push({
+                    subject: 'tool-server',
+                    id: server.id,
+                    label: server.label ?? server.id,
+                    key: secret.key,
+                    // `required` defaults to TRUE at both declaration sites: a credential a capability
+                    // bothered to declare is one it needs.
+                    required: secret.required !== false,
+                });
+            }
+        }
+    }
+    // Best-effort, and its failure is REPORTED rather than swallowed into an empty list: the caller
+    // renders `incomplete` beside the result, so an unreachable mothership reads as "this list may
+    // be short" instead of "nothing needs a credential".
+    const views = await runBestEffort(input.logger ?? noopLogger, 'read generative integrations for the credential checklist', () => input.binaryGenerators.views());
+    for (const view of views ?? []) {
+        const credential = view.credential;
+        if (!credential)
+            continue;
+        push({
+            subject: 'binary-generator',
+            id: view.id,
+            label: view.name,
+            key: credential.key,
+            ...(credential.usage ? { usage: credential.usage } : {}),
+            required: credential.required !== false,
+        });
+    }
+    return { declared, incomplete: views === undefined };
+}
+/**
+ * Join what the deployment DECLARES to what the workspace has STORED.
+ *
+ * Pure, so the two halves can be tested without a container: the store answers `stored`, the
+ * registries answer everything else, and neither knows about the other.
+ */
+export function buildCapabilityCredentialsView(input) {
+    const stored = new Map(input.stored.map((ref) => [ref.key, ref]));
+    const byKey = new Map();
+    for (const entry of input.declarations.declared) {
+        const group = byKey.get(entry.key);
+        if (group)
+            group.push(entry);
+        else
+            byKey.set(entry.key, [entry]);
+    }
+    const declared = [...byKey.entries()].map(([key, group]) => {
+        const ref = stored.get(key);
+        return {
+            key,
+            declaredBy: group.map((entry) => ({
+                subject: entry.subject,
+                id: entry.id,
+                label: entry.label,
+                ...(entry.usage ? { usage: entry.usage } : {}),
+            })),
+            // Required if ANY declarer requires it: the capability that needs it is dropped otherwise,
+            // and calling the key optional because a second capability tolerates its absence would
+            // understate what a missing value costs.
+            required: group.some((entry) => entry.required),
+            stored: ref !== undefined,
+            ...(ref ? { updatedAt: ref.updatedAt } : {}),
+        };
+    });
+    // A stored key nothing declares is a live secret nobody will ever ask for — which happens
+    // whenever the deployment retires an integration or renames a variable. Reported as its own
+    // list rather than dropped from the view, because only the operator can tell "delete this" from
+    // "the deployment regressed". Suppressed while the declaration read is INCOMPLETE, or an
+    // unreachable mothership would report every generator credential as orphaned.
+    const orphaned = input.declarations.incomplete
+        ? []
+        : input.stored.filter((ref) => !byKey.has(ref.key));
+    return {
+        declared: declared.sort((a, b) => a.key.localeCompare(b.key)),
+        orphaned: orphaned.sort((a, b) => a.key.localeCompare(b.key)),
+        environmentFallback: input.environmentFallback,
+        declarationsIncomplete: input.declarations.incomplete,
+    };
+}
+//# sourceMappingURL=declaredCredentials.js.map

package/dist/modules/capabilityCredentials/declaredCredentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"declaredCredentials.js","sourceRoot":"","sources":["../../../src/modules/capabilityCredentials/declaredCredentials.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAqD/D,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAAsC;IAEtC,MAAM,QAAQ,GAAmC,EAAE,CAAA;IACnD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,IAAI,GAAG,CAAC,KAAmC,EAAQ,EAAE;QACzD,0FAA0F;QAC1F,8FAA8F;QAC9F,mEAAmE;QACnE,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,CAAA;QAC5D,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAM;QAC9B,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAClB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC,CAAA;IAED,4FAA4F;IAC5F,6FAA6F;IAC7F,iGAAiG;IACjG,+EAA+E;IAC/E,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,iBAAiB,CAAC,GAAG,EAAE,EAAE,CAAC;QACjD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC/E,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;gBAC7C,IAAI,CAAC;oBACH,OAAO,EAAE,aAAa;oBACtB,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,EAAE;oBAChC,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,mFAAmF;oBACnF,uCAAuC;oBACvC,QAAQ,EAAE,MAAM,CAAC,QAAQ,KAAK,KAAK;iBACpC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,gGAAgG;IAChG,+FAA+F;IAC/F,qDAAqD;IACrD,MAAM,KAAK,GAAG,MAAM,aAAa,CAC/B,KAAK,CAAC,MAAM,IAAI,UAAU,EAC1B,2DAA2D,EAC3D,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,CACrC,CAAA;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QAClC,IAAI,CAAC,UAAU;YAAE,SAAQ;QACzB,IAAI,CAAC;YACH,OAAO,EAAE,kBAAkB;YAC3B,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,IAAI;YAChB,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,QAAQ,EAAE,UAAU,CAAC,QAAQ,KAAK,KAAK;SACxC,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,KAAK,SAAS,EAAE,CAAA;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAAC,KAI9C;IACC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;IACjE,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0C,CAAA;IAC/D,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;;YACvB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;IACpC,CAAC;IACD,MAAM,QAAQ,GAAiC,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QACvF,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC3B,OAAO;YACL,GAAG;YACH,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAChC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/C,CAAC,CAAC;YACH,2FAA2F;YAC3F,uFAAuF;YACvF,yCAAyC;YACzC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC/C,MAAM,EAAE,GAAG,KAAK,SAAS;YACzB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAA;IACH,CAAC,CAAC,CAAA;IACF,0FAA0F;IAC1F,4FAA4F;IAC5F,gGAAgG;IAChG,yFAAyF;IACzF,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAC,UAAU;QAC5C,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;IACrD,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC7D,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC7D,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,sBAAsB,EAAE,KAAK,CAAC,YAAY,CAAC,UAAU;KACtD,CAAA;AACH,CAAC"}

package/dist/persistence/binaryGenerators.d.ts

@@ -24,13 +24,20 @@ import type { BinaryGeneratorSource, BinaryGeneratorView } from '@cat-factory/ke
  *
  * **On what the reply is trusted to name.** A definition carries its credential's KEY NAME, and
  * this node resolves that key against its OWN environment before the value rides a job body into
- * an agent process. That is a real widening of `createEnvToolSecretResolver`'s default over the
- * standalone case, where the key was named by code this process itself runs — but not a new
- * grant: a mothership already supplies the pipelines, prompts and repo targets of every run this
- * node executes, so it can already reach the laptop's environment through any agent it dispatches.
- * The lever for a deployment that wants the narrower boundary anyway (or simply wants a
- * mis-declared key to fail loudly instead of siphoning a developer's own token) is
- * `EnvToolSecretResolverOptions.allowKeys`, which gates this subject family too.
+ * an agent process. That is a real widening over the standalone case, where the key was named by
+ * code this process itself runs, and it is why the reserved-key floor is enforced at the
+ * dispatch call site rather than only at registration: this node boot-validates nothing it reads
+ * here (see `isGeneratorView` below — the elements are checked for SHAPE, because re-validating a
+ * definition the mothership already boot-checked is not this client's job), so a check that only
+ * ran on the mothership would be a check a node one build behind could not rely on. What the
+ * floor guarantees is the part the trust relationship should never have included: the node's own
+ * half of the security material between the two processes (`ENCRYPTION_KEY`,
+ * `HARNESS_SHARED_SECRET`) is unreachable through this path, with no configuration.
+ *
+ * Everything OUTSIDE the platform's own configuration is a different question and stays a
+ * DEPLOYMENT's to answer, because only it knows which of a developer's own variables an
+ * integration may see: `EnvToolSecretResolverOptions.allowKeys` is that bound, reachable through
+ * every facade's `createToolSecretResolver` option.
  *
  * There is no cache here on purpose, for the reason its sibling gives: the reads are already
  * bounded by the callers in front of them, and the set changes only when the mothership is

package/dist/persistence/binaryGenerators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"binaryGenerators.d.ts","sourceRoot":"","sources":["../../src/persistence/binaryGenerators.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AACjE,OAAO,KAAK,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AASrF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,qBAAa,yBAA0B,YAAW,qBAAqB;IAEnE,OAAO,CAAC,QAAQ,CAAC,IAAI;IADvB,YACmB,IAAI,EAAE;QACrB,OAAO,EAAE,MAAM,CAAA;QACf;;;;WAIG;QACH,KAAK,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAA;QACrC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;KACzB,EACC;IAEE,KAAK,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAiB5C;IAEK,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAgB7E;YAEa,IAAI;CA4CnB"}
+{"version":3,"file":"binaryGenerators.d.ts","sourceRoot":"","sources":["../../src/persistence/binaryGenerators.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AACjE,OAAO,KAAK,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AASrF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,qBAAa,yBAA0B,YAAW,qBAAqB;IAEnE,OAAO,CAAC,QAAQ,CAAC,IAAI;IADvB,YACmB,IAAI,EAAE;QACrB,OAAO,EAAE,MAAM,CAAA;QACf;;;;WAIG;QACH,KAAK,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAA;QACrC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;KACzB,EACC;IAEE,KAAK,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAiB5C;IAEK,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAgB7E;YAEa,IAAI;CA4CnB"}

package/dist/persistence/binaryGenerators.js

@@ -28,13 +28,20 @@ import { UnavailableError, describeError } from '@cat-factory/kernel';
  *
  * **On what the reply is trusted to name.** A definition carries its credential's KEY NAME, and
  * this node resolves that key against its OWN environment before the value rides a job body into
- * an agent process. That is a real widening of `createEnvToolSecretResolver`'s default over the
- * standalone case, where the key was named by code this process itself runs — but not a new
- * grant: a mothership already supplies the pipelines, prompts and repo targets of every run this
- * node executes, so it can already reach the laptop's environment through any agent it dispatches.
- * The lever for a deployment that wants the narrower boundary anyway (or simply wants a
- * mis-declared key to fail loudly instead of siphoning a developer's own token) is
- * `EnvToolSecretResolverOptions.allowKeys`, which gates this subject family too.
+ * an agent process. That is a real widening over the standalone case, where the key was named by
+ * code this process itself runs, and it is why the reserved-key floor is enforced at the
+ * dispatch call site rather than only at registration: this node boot-validates nothing it reads
+ * here (see `isGeneratorView` below — the elements are checked for SHAPE, because re-validating a
+ * definition the mothership already boot-checked is not this client's job), so a check that only
+ * ran on the mothership would be a check a node one build behind could not rely on. What the
+ * floor guarantees is the part the trust relationship should never have included: the node's own
+ * half of the security material between the two processes (`ENCRYPTION_KEY`,
+ * `HARNESS_SHARED_SECRET`) is unreachable through this path, with no configuration.
+ *
+ * Everything OUTSIDE the platform's own configuration is a different question and stays a
+ * DEPLOYMENT's to answer, because only it knows which of a developer's own variables an
+ * integration may see: `EnvToolSecretResolverOptions.allowKeys` is that bound, reachable through
+ * every facade's `createToolSecretResolver` option.
  *
  * There is no cache here on purpose, for the reason its sibling gives: the reads are already
  * bounded by the callers in front of them, and the set changes only when the mothership is

package/dist/persistence/binaryGenerators.js.map

@@ -1 +1 @@
-{"version":3,"file":"binaryGenerators.js","sourceRoot":"","sources":["../../src/persistence/binaryGenerators.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAErE,0EAA0E;AAC1E,+FAA+F;AAC/F,2FAA2F;AAC3F,gGAAgG;AAChG,uFAAuF;AAEvF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,OAAO,yBAAyB;IAEjB,IAAI;IADvB,YACmB,IAShB;oBATgB,IAAI;IAUpB,CAAC;IAEJ,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAA2B,6BAA6B,CAAC,CAAA;QACrF,yFAAyF;QACzF,sFAAsF;QACtF,4FAA4F;QAC5F,2FAA2F;QAC3F,iDAAiD;QACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,MAAM,UAAU,CAAC,YAAY,CAAC,CAAA;QACnE,yFAAyF;QACzF,4FAA4F;QAC5F,4FAA4F;QAC5F,sFAAsF;QACtF,4FAA4F;QAC5F,sFAAsF;QACtF,6FAA6F;QAC7F,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC;YAAE,MAAM,UAAU,CAAC,YAAY,CAAC,CAAA;QAC3E,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAa;QAC9B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,GAAG,EAAE,CAAA;QACtC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAA0B,uCAAuC,EAAE;YAC7F,GAAG;SACJ,CAAC,CAAA;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;QAChC,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5E,MAAM,UAAU,CAAC,WAAW,CAAC,CAAA;QAC/B,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACzC,wFAAwF;QACxF,2FAA2F;QAC3F,2FAA2F;QAC3F,yFAAyF;QACzF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAAE,MAAM,UAAU,CAAC,WAAW,CAAC,CAAA;QACpF,OAAO,IAAI,GAAG,CAAC,OAA4C,CAAC,CAAA;IAC9D,CAAC;IAEO,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,OAAiB;QACnD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;QAC9C,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAA;QACzF,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,CAAA;QAC5D,kFAAkF;QAClF,qFAAqF;QACrF,MAAM,IAAI,GAAgB,OAAO;YAC/B,CAAC,CAAC;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,KAAK,IAAI,EAAE,EAAE;oBACtC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;aAC9B;YACH,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,IAAI,EAAE,EAAE,EAAE,EAAE,CAAA;QAC3D,IAAI,GAAa,CAAA;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wFAAwF;YACxF,sFAAsF;YACtF,MAAM,IAAI,gBAAgB,CACxB,gFAAgF,EAChF,+BAA+B;YAC/B,uFAAuF;YACvF,+CAA+C;YAC/C,aAAa,CAAC,KAAK,CAAC,CACrB,CAAA;QACH,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,wFAAwF;YACxF,wFAAwF;YACxF,yFAAyF;YACzF,MAAM,IAAI,gBAAgB,CACxB,wDAAwD,EACxD,+BAA+B,EAC/B,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CACvB,CAAA;QACH,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAa,CAAA;QAC7D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,MAAM,UAAU,CAAC,MAAM,CAAC,CAAA;QAC/D,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACrD,MAAM,IAAI,GAAG,KAAqC,CAAA;IAClD,OAAO,CACL,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAChG,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,gBAAgB,CACzB,kEAAkE,EAClE,+BAA+B,EAC/B,EAAE,KAAK,EAAE,CACV,CAAA;AACH,CAAC"}
+{"version":3,"file":"binaryGenerators.js","sourceRoot":"","sources":["../../src/persistence/binaryGenerators.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAErE,0EAA0E;AAC1E,+FAA+F;AAC/F,2FAA2F;AAC3F,gGAAgG;AAChG,uFAAuF;AAEvF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,MAAM,OAAO,yBAAyB;IAEjB,IAAI;IADvB,YACmB,IAShB;oBATgB,IAAI;IAUpB,CAAC;IAEJ,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAA2B,6BAA6B,CAAC,CAAA;QACrF,yFAAyF;QACzF,sFAAsF;QACtF,4FAA4F;QAC5F,2FAA2F;QAC3F,iDAAiD;QACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,MAAM,UAAU,CAAC,YAAY,CAAC,CAAA;QACnE,yFAAyF;QACzF,4FAA4F;QAC5F,4FAA4F;QAC5F,sFAAsF;QACtF,4FAA4F;QAC5F,sFAAsF;QACtF,6FAA6F;QAC7F,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC;YAAE,MAAM,UAAU,CAAC,YAAY,CAAC,CAAA;QAC3E,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAa;QAC9B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,GAAG,EAAE,CAAA;QACtC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAA0B,uCAAuC,EAAE;YAC7F,GAAG;SACJ,CAAC,CAAA;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;QAChC,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5E,MAAM,UAAU,CAAC,WAAW,CAAC,CAAA;QAC/B,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACzC,wFAAwF;QACxF,2FAA2F;QAC3F,2FAA2F;QAC3F,yFAAyF;QACzF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAAE,MAAM,UAAU,CAAC,WAAW,CAAC,CAAA;QACpF,OAAO,IAAI,GAAG,CAAC,OAA4C,CAAC,CAAA;IAC9D,CAAC;IAEO,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,OAAiB;QACnD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;QAC9C,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAA;QACzF,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,CAAA;QAC5D,kFAAkF;QAClF,qFAAqF;QACrF,MAAM,IAAI,GAAgB,OAAO;YAC/B,CAAC,CAAC;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,KAAK,IAAI,EAAE,EAAE;oBACtC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;aAC9B;YACH,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,IAAI,EAAE,EAAE,EAAE,EAAE,CAAA;QAC3D,IAAI,GAAa,CAAA;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wFAAwF;YACxF,sFAAsF;YACtF,MAAM,IAAI,gBAAgB,CACxB,gFAAgF,EAChF,+BAA+B;YAC/B,uFAAuF;YACvF,+CAA+C;YAC/C,aAAa,CAAC,KAAK,CAAC,CACrB,CAAA;QACH,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,wFAAwF;YACxF,wFAAwF;YACxF,yFAAyF;YACzF,MAAM,IAAI,gBAAgB,CACxB,wDAAwD,EACxD,+BAA+B,EAC/B,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CACvB,CAAA;QACH,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAa,CAAA;QAC7D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,MAAM,UAAU,CAAC,MAAM,CAAC,CAAA;QAC/D,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACrD,MAAM,IAAI,GAAG,KAAqC,CAAA;IAClD,OAAO,CACL,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAChG,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,gBAAgB,CACzB,kEAAkE,EAClE,+BAA+B,EAC/B,EAAE,KAAK,EAAE,CACV,CAAA;AACH,CAAC"}

package/dist/persistence/rpc-allowlist.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc-allowlist.d.ts","sourceRoot":"","sources":["../../src/persistence/rpc-allowlist.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AAgBtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,0BAA0B,EAAE,sBAqkCxC,CAAA;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,oCAAoC,YAC/C,yBAAyB,EACzB,gCAAgC,EAChC,4BAA4B,EAC5B,2BAA2B,EAC3B,kCAAkC,CAC1B,CAAA;AAEV,yEAAyE;AACzE,MAAM,MAAM,+BAA+B,GAAG,CAAC,OAAO,oCAAoC,CAAC,CAAC,MAAM,CAAC,CAAA"}
+{"version":3,"file":"rpc-allowlist.d.ts","sourceRoot":"","sources":["../../src/persistence/rpc-allowlist.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AAgBtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,0BAA0B,EAAE,sBAmlCxC,CAAA;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,oCAAoC,YAC/C,yBAAyB,EACzB,gCAAgC,EAChC,4BAA4B,EAC5B,2BAA2B,EAC3B,kCAAkC,CAC1B,CAAA;AAEV,yEAAyE;AACzE,MAAM,MAAM,+BAA+B,GAAG,CAAC,OAAO,oCAAoC,CAAC,CAAC,MAAM,CAAC,CAAA"}

package/dist/persistence/rpc-allowlist.js

@@ -790,6 +790,20 @@ export const REMOTE_PERSISTENCE_METHODS = {
         upsert: { scope: { kind: 'workspaceField', arg: 0 } },
         deleteByBlock: { scope: { kind: 'workspace', arg: 0 } },
     },
+    // The PER-WORKSPACE CAPABILITY CREDENTIALS — the tenant-scoped home for the secrets a registered
+    // tool server / generative binary integration declares by name. `credentials` rides a SEALED
+    // blob (sealed/decrypted in the service under the LOCAL key), so no plaintext crosses the
+    // machine API — the same precedent as `testSecretsRepository` above. This is org state a RUN
+    // resolves, so `remote` is the only bucket that works: a mothership-mode node has no `db` of its
+    // own, and a credential the operator set on the mothership must reach the dispatch that needs
+    // it. The settings CRUD (`get`/`upsert`/`delete`) and the dispatch-time read are the SAME three
+    // methods, all workspace-scoped on arg0 except the record-based `upsert`, which binds on its
+    // `workspaceId` FIELD.
+    capabilityCredentialRepository: {
+        get: { scope: { kind: 'workspace', arg: 0 } },
+        upsert: { scope: { kind: 'workspaceField', arg: 0 } },
+        delete: { scope: { kind: 'workspace', arg: 0 } },
+    },
     // The per-service PRE-PR VALIDATION CHECKS, keyed by service-frame block like
     // `releaseHealthConfigRepository` above. Nothing sealed — the commands are operator-authored
     // shell strings that run inside the run's own container — so the plain record crosses the