@open-everywhere/core 0.1.0

package/dist/agent/access/consequence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consequence.js","sourceRoot":"","sources":["../../../agent/access/consequence.ts"],"names":[],"mappings":"AAAA,sRAAsR;AACtR,iPAAiP;AACjP,wSAAwS;AAKxS,qKAAqK;AACrK,6RAA6R;AAC7R,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU;IACrE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU;CAC7E,CAAC;AAEF;;;qEAGqE;AACrE,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnD,CAAC;AAED,uTAAuT;AACvT,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,gGAAgG;AAChG,2OAA2O;AAE3O,uRAAuR;AACvR,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AAEzE;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,QAAQ,CAAC,MAAM,IAAI,CAAC,IAAI,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACjF,CAAC;AAcD,qRAAqR;AACrR,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC,CAAC,kDAAkD;QAC/F,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;AAChE,CAAC;AAED,uPAAuP;AACvP,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,OAAO,uBAAuB,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC;AAC/E,CAAC;AASD;4GAC4G;AAC5G,MAAM,CAAC,MAAM,2BAA2B,GAAsB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAEzI;;kEAEkE;AAClE,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;IACvG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ;IACzG,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ;IACxG,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ;CAC1G,CAAC;AAYF;;;GAGG;AACH,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACjF,MAAM,MAAM,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QACZ,2EAA2E;QAC3E,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;YAC/D,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3F,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AACpD,CAAC;AAED,kPAAkP;AAClP,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,MAAM,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACvE,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/C,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAClE,CAAC;AAQD;uGACuG;AACvG,MAAM,kBAAkB,GAAmD;IACzE,WAAW,EAAE,kBAAkB;IAC/B,KAAK,EAAE,YAAY;IACnB,IAAI,EAAE,WAAW;CAClB,CAAC;AAQF;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,QAAgB;IAC7D,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC3D,kGAAkG;IAClG,gCAAgC;IAChC,IAAI,IAAiC,CAAC;IACtC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,2BAA2B,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,IAAI,GAAG,aAAa,CAAC;YACrB,MAAM;QACR,CAAC;QACD,IAAI,qBAAqB,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,IAAI,GAAG,OAAO,CAAC;aACrD,IAAI,IAAI,KAAK,SAAS,IAAI,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,IAAI,GAAG,MAAM,CAAC;IACrF,CAAC;IACD,mSAAmS;IACnS,oNAAoN;IACpN,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC7B,IAAI,2BAA2B,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChD,IAAI,GAAG,aAAa,CAAC;gBACrB,MAAM;YACR,CAAC;YACD,IAAI,IAAI,KAAK,MAAM,IAAI,qBAAqB,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,IAAI,GAAG,OAAO,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,kFAAkF;IAClF,MAAM,KAAK,GAAgB,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC1F,0FAA0F;IAC1F,mGAAmG;IACnG,KAAK,MAAM,KAAK,IAAI,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClD,IAAI,2BAA2B,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QACvF,IAAI,IAAI,KAAK,MAAM,IAAI,qBAAqB,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,IAAI,GAAG,OAAO,CAAC;IAC/E,CAAC;IACD,6EAA6E;IAC7E,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,aAAa,EAAE,KAAK,EAAE,CAAC;AAChD,CAAC;AAED,mMAAmM;AACnM,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,OAAO,8BAA8B,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAWD;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAuB,CAAC,EAAE,EAAE,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;AAE1G;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACpC,KAAK,KAAK,CAAC;QACX,KAAK,MAAM,CAAC;QACZ,KAAK,SAAS;YACZ,OAAO,MAAM,CAAC;QAChB,KAAK,MAAM,CAAC;QACZ,KAAK,KAAK,CAAC;QACX,KAAK,OAAO;YACV,OAAO,OAAO,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,aAAa,CAAC;QACvB;YACE,OAAO,aAAa,CAAC,CAAC,yCAAyC;IACnE,CAAC;AACH,CAAC;AA+CD;;gGAEgG;AAChG,MAAM,UAAU,qBAAqB,CAAC,OAAoC;IACxE,OAAO,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,SAAS,CAAC;AACrD,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,MAAc,EAAoB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AACrG;;;6EAG6E;AAC7E,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,MAAc,EAAE,MAAc,EAAoB,EAAE,CAAC,CAAC;IACvF,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE;IAChD,MAAM;CACP,CAAC,CAAC;AACH,kLAAkL;AAClL,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,KAAqB,EAAE,MAAc,EAAoB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AAC3K,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,KAAqB,EAAE,MAAc,EAAoB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AACzK,8MAA8M;AAC9M,MAAM,YAAY,GAAG,CAAC,KAAuB,EAAoB,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;AACrG,0PAA0P;AAC1P,MAAM,QAAQ,GAAG,CAAC,OAAwB,EAAE,KAAuB,EAAoB,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC;AAEnI;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC;AAEpC,yKAAyK;AACzK,MAAM,CAAC,MAAM,gBAAgB,GAA+C;IAC1E,+MAA+M;IAC/M,sGAAsG;IACtG,IAAI,EAAE,IAAI,CAAC,iFAAiF,CAAC;IAC7F,GAAG,EAAE,IAAI,CACP,iyCAAiyC,CAClyC;IACD,IAAI,EAAE,IAAI,CAAC,4BAA4B,CAAC;IACxC,IAAI,EAAE,IAAI,CAAC,2BAA2B,CAAC;IACvC,SAAS,EAAE,IAAI,CAAC,oBAAoB,CAAC;IACrC,UAAU,EAAE,IAAI,CAAC,kEAAkE,CAAC;IACpF,aAAa,EAAE,IAAI,CACjB,6MAA6M,CAC9M;IAED,UAAU,EAAE,IAAI,CAAC,oEAAoE,CAAC;IACtF,YAAY,EAAE,IAAI,CAAC,wEAAwE,CAAC;IAC5F,IAAI,EAAE,IAAI,CAAC,0FAA0F,CAAC;IACtG,UAAU,EAAE,IAAI,CAAC,sIAAsI,CAAC;IACxJ,iBAAiB,EAAE,IAAI,CAAC,mIAAmI,CAAC;IAE5J,kVAAkV;IAClV,2JAA2J;IAC3J,WAAW,EAAE,IAAI,CACf,4VAA4V,CAC7V;IAED,qSAAqS;IACrS,kMAAkM;IAClM,iBAAiB,EAAE,IAAI,CACrB,2NAA2N,CAC5N;IAED,eAAe,EAAE,IAAI,CAAC,sBAAsB,CAAC;IAC7C,eAAe,EAAE,IAAI,CAAC,qLAAqL,CAAC;IAC5M,OAAO,EAAE,IAAI,CACX,o1BAAo1B,CACr1B;IACD,mBAAmB,EAAE,IAAI,CACvB,qpCAAqpC,CACtpC;IACD,aAAa,EAAE,IAAI,CAAC,wFAAwF,CAAC;IAC7G,cAAc,EAAE,IAAI,CAAC,oDAAoD,CAAC;IAC1E,UAAU,EAAE,IAAI,CAAC,kCAAkC,CAAC;IACpD,aAAa,EAAE,IAAI,CAAC,qCAAqC,CAAC;IAC1D,uBAAuB,EAAE,IAAI,CAC3B,w+BAAw+B,CACz+B;IACD,WAAW,EAAE,IAAI,CAAC,iCAAiC,CAAC;IACpD,SAAS,EAAE,IAAI,CACb,wfAAwf,CACzf;IACD,gBAAgB,EAAE,IAAI,CAAC,sJAAsJ,CAAC;IAC9K,gBAAgB,EAAE,IAAI,CACpB,kaAAka,CACna;IACD,aAAa,EAAE,IAAI,CACjB,qVAAqV,CACtV;IACD,MAAM,EAAE,IAAI,CACV,klBAAklB,CACnlB;IACD,oBAAoB,EAAE,IAAI,CAAC,2GAA2G,CAAC;IACvI,iBAAiB,EAAE,IAAI,CAAC,6IAA6I,CAAC;IACtK,SAAS,EAAE,IAAI,CAAC,qJAAqJ,CAAC;IACtK,YAAY,EAAE,IAAI,CAAC,+HAA+H,CAAC;IACnJ,WAAW,EAAE,IAAI,CAAC,sGAAsG,CAAC;IACzH,iBAAiB,EAAE,IAAI,CACrB,0XAA0X,CAC3X;IACD,gBAAgB,EAAE,IAAI,CAAC,uIAAuI,CAAC;IAC/J,YAAY,EAAE,IAAI,CAAC,kCAAkC,CAAC;IACtD,aAAa,EAAE,IAAI,CACjB,8SAA8S,CAC/S;IACD,kBAAkB,EAAE,IAAI,CACtB,guBAAguB,CACjuB;IACD,qBAAqB,EAAE,IAAI,CACzB,8uBAA8uB,CAC/uB;IACD,YAAY,EAAE,SAAS,CACrB,oBAAoB,EACpB,wCAAwC,EACxC,wYAAwY,CACzY;IACD,YAAY,EAAE,SAAS,CACrB,oBAAoB,EACpB,wCAAwC,EACxC,kKAAkK,CACnK;IACD,eAAe,EAAE,SAAS,CACxB,uBAAuB,EACvB,+CAA+C,EAC/C,oZAAoZ,CACrZ;IACD,qRAAqR;IACrR,uJAAuJ;IACvJ,SAAS,EAAE,IAAI,CACb,uUAAuU,CACxU;IAED,QAAQ,EAAE,IAAI,CAAC,uCAAuC,CAAC;IACvD,KAAK,EAAE,IAAI,CAAC,6BAA6B,CAAC;IAC1C,KAAK,EAAE,IAAI,CAAC,qGAAqG,CAAC;IAClH,UAAU,EAAE,IAAI,CACd,0kBAA0kB,CAC3kB;IACD,aAAa,EAAE,IAAI,CAAC,0CAA0C,CAAC;IAC/D,SAAS,EAAE,IAAI,CACb,oiBAAoiB,CACriB;IACD,aAAa,EAAE,IAAI,CACjB,gwBAAgwB,CACjwB;IACD,SAAS,EAAE;QACT,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;QACzB,MAAM,EACJ,mGAAmG;YACnG,qGAAqG;YACrG,yFAAyF;YACzF,8FAA8F;YAC9F,4FAA4F;KAC/F;IAED,cAAc,EAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,EACjE,mZAAmZ,CACpZ,CAAC;IACF,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,EAC1D,gsBAAgsB,CACjsB,CAAC;IACF,cAAc,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,EAC9D,ugBAAugB,CACxgB,CAAC;IACF,YAAY,EAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,EAC7D,uVAAuV,CACxV,CAAC;IACF,gBAAgB,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,oBAAoB,EAAE,MAAM,EACpE,60CAA60C,CAC90C,CAAC;IACF,mBAAmB,EAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,uBAAuB,EAAE,MAAM,EAC7E,mqBAAmqB,CACpqB,CAAC;IAEF,mOAAmO;IACnO,iNAAiN;IACjN,eAAe,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,EAAE,MAAM,EAChE,kmCAAkmC,CACnmC,CAAC;IACF,cAAc,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,EAC9D,urCAAurC,CACxrC,CAAC;IACF,aAAa,EAAE,IAAI,CACjB,oqBAAoqB,CACrqB;IACD,oBAAoB,EAAE,IAAI,CACxB,yvCAAyvC,CAC1vC;IACD,kBAAkB,EAAE,IAAI,CACtB,2iDAA2iD,CAC5iD;IACD,cAAc,EAAE,IAAI,CAClB,qqCAAqqC,CACtqC;IAED,mVAAmV;IACnV,kBAAkB,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,wGAAwG,CAAC,CAAC;IACpJ,gBAAgB,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,uGAAuG,CAAC,CAAC;IACjJ,iBAAiB,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CACtC,wpBAAwpB,CACzpB,CAAC;IACF,gBAAgB,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,6JAA6J,CAAC,CAAC;IACvM,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CACjC,kUAAkU,CACnU,CAAC;IACF,kGAAkG;IAClG,mGAAmG;IACnG,+EAA+E;IAC/E,YAAY,EAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,CACtC,4lCAA4lC,CAC7lC,CAAC;IACF,eAAe,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CACpC,43BAA43B,CAC73B,CAAC;IACF,0BAA0B,EAAE,IAAI,CAC9B,omBAAomB,CACrmB;IACD,qBAAqB,EAAE,IAAI,CAAC,0FAA0F,CAAC;IACvH,oBAAoB,EAAE,IAAI,CACxB,8WAA8W,CAC/W;IACD,eAAe,EAAE,IAAI,CACnB,0UAA0U,CAC3U;IACD,gBAAgB,EAAE,IAAI,CACpB,6ZAA6Z,CAC9Z;IACD,mBAAmB,EAAE,IAAI,CACvB,0oBAA0oB,CAC3oB;IACD,eAAe,EAAE,IAAI,CACnB,glBAAglB,CACjlB;IACD,UAAU,EAAE,IAAI,CACd,2cAA2c,CAC5c;IACD,KAAK,EAAE,IAAI,CACT,8eAA8e,CAC/e;IACD,WAAW,EAAE,IAAI,CACf,46BAA46B,CAC76B;IACD,wBAAwB,EAAE,IAAI,CAC5B,wnDAAwnD,CACznD;IAED,uBAAuB,EAAE,IAAI,CAC3B,84BAA84B,CAC/4B;IAED,aAAa,EAAE,IAAI,CACjB,seAAse,CACve;IACD,YAAY,EAAE,IAAI,CAChB,ogBAAogB,CACrgB;IACD,eAAe,EAAE,IAAI,CACnB,qfAAqf,CACtf;IAED,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,EAC1D,4fAA4f,CAC7f,CAAC;IACF,uQAAuQ;IACvQ,0IAA0I;IAC1I,cAAc,EAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,EAC3E,sWAAsW,CACvW,CAAC,CAAC;IACH,uPAAuP;IACvP,mMAAmM;IACnM,YAAY,EAAE,YAAY,CAAC,MAAM,CAAC,cAAc,EAAE,UAAU,EAAE,iIAAiI,CAAC,CAAC;IACjM,4FAA4F;IAC5F,2FAA2F;IAC3F,yFAAyF;IACzF,iBAAiB,EAAE,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,EAC1D,sJAAsJ,CACvJ,CAAC;IACF,6FAA6F;IAC7F,8FAA8F;IAC9F,+FAA+F;IAC/F,uFAAuF;IACvF,cAAc,EAAE,YAAY,CAAC,MAAM,CAAC,gBAAgB,EAAE,UAAU,EAAE,sIAAsI,CAAC,CAAC;IAC1M,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,EAC1D,siBAAsiB,CACviB,CAAC;IACF,SAAS,EAAE,MAAM,CAAC,kBAAkB,EAAE,UAAU,EAAE,8KAA8K,CAAC;IACjO,MAAM,EAAE,MAAM,CAAC,eAAe,EAAE,UAAU,EAAE,6IAA6I,CAAC;IAC1L,aAAa,EAAE,MAAM,CAAC,eAAe,EAAE,UAAU,EAC/C,kSAAkS,CACnS;IACD,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,UAAU,EAC1C,gXAAgX,CACjX;IACD,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,UAAU,EACrC,mvBAAmvB,CACpvB;IAED,qTAAqT;IACrT,+PAA+P;IAC/P,eAAe,EAAE,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU,EAAE,4DAA4D,CAAC,CAAC;IAC3H,iBAAiB,EAAE,KAAK,CAAC,aAAa,EAAE,UAAU,EAAE,mDAAmD,CAAC;IACxG,gBAAgB,EAAE,KAAK,CAAC,kBAAkB,EAAE,UAAU,EAAE,mEAAmE,CAAC;IAC5H,wBAAwB,EAAE,KAAK,CAAC,iBAAiB,EAAE,UAAU,EAAE,uDAAuD,CAAC;IACvH,IAAI,EAAE,IAAI,CACR,u5BAAu5B,CACx5B;IACD,CAAC,WAAW,CAAC,EAAE,KAAK,CAClB,aAAa,EACb,UAAU,EACV,gdAAgd,CACjd;IACD,iBAAiB,EAAE;QACjB,IAAI,EAAE,YAAY;QAClB,GAAG,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC5B,KAAK,EAAE,UAAU;QACjB,MAAM,EAAE,sIAAsI;KAC/I;IACD,iBAAiB,EAAE;QACjB,IAAI,EAAE,YAAY;QAClB,GAAG,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC5B,KAAK,EAAE,UAAU;QACjB,MAAM,EAAE,oGAAoG;KAC7G;CACF,CAAC;AAEF,0QAA0Q;AAC1Q,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,iBAAiB,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,gBAAgB,CAAC,IAAI,CAAC,EAAE,UAAU,KAAK,IAAI,CAAC;AACrD,CAAC;AAYD;8FAC8F;AAC9F,MAAM,CAAC,MAAM,qBAAqB,GAA8C;IAC9E,oBAAoB,EAAE;QACpB,IAAI,EAAE,aAAa;QACnB,MAAM,EACJ,0bAA0b;KAC7b;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,aAAa;QACnB,MAAM,EACJ,wiBAAwiB;KAC3iB;CACF,CAAC;AAEF,2TAA2T;AAC3T,MAAM,UAAU,uBAAuB,CACrC,eAAkC,EAClC,QAA4D,EAC5D,YAAY,GAA+C,gBAAgB,EAC3E,eAAe,GAA8C,qBAAqB;IAElF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,aAAa;YAAE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/C,QAAQ,CAAC,IAAI,CACX,eAAe,IAAI,kCAAkC,IAAI,qLAAqL,CAC/O,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS,CAAC,uBAAuB;QACzD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CACX,eAAe,IAAI,mOAAmO,CACvP,CAAC;YACF,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QACnE,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CACX,eAAe,IAAI,eAAe,MAAM,CAAC,IAAI,2DAA2D,MAAM,IAAI,QAAQ,kDAAkD,CAC7K,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CACX,+BAA+B,IAAI,uHAAuH,CAC3J,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAiBD;+EAC+E;AAC/E,MAAM,aAAa,GAAG,8CAA8C,CAAC;AACrE,MAAM,SAAS,GAAG,gEAAgE,CAAC;AACnF;;+FAE+F;AAC/F,MAAM,aAAa,GAAG,kDAAkD,CAAC;AACzE,MAAM,YAAY,GAAG,kEAAkE,CAAC;AAExF,qRAAqR;AACrR,MAAM,UAAU,2BAA2B,CAAC,IAAY,EAAE,MAAc;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACxB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;gBAC/C,wFAAwF;gBACxF,yEAAyE;gBACzE,IAAI,KAAK,KAAK,SAAS;oBAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YACD,uFAAuF;YACvF,sFAAsF;YACtF,gCAAgC;YAChC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO;QACrC,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAA6B,EAAE,CAAC;IAC3C,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACxB,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACvB,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gSAAgS;AAChS,MAAM,UAAU,uBAAuB,CACrC,aAAgD,EAChD,eAAkC;IAElC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,+FAA+F;QAC/F,8FAA8F;QAC9F,OAAO;YACL,sMAAsM;SACvM,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CACX,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,2BAA2B,CAAC,CAAC,KAAK,sBAAsB,CAAC,CAAC,KAAK,iQAAiQ,CACpV,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CACX,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,0BAA0B,CAAC,CAAC,IAAI,oSAAoS,CAAC,CAAC,IAAI,kCAAkC,CAChY,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,iSAAiS;AACjS,8TAA8T;AAE9T,8FAA8F;AAC9F,MAAM,CAAC,MAAM,uBAAuB,GAAqC;IACvE,2CAA2C,EACzC,q2BAAq2B;IACv2B,wCAAwC,EACtC,mTAAmT;IACrT,4CAA4C,EAC1C,oPAAoP;CACvP,CAAC;AAQF,iPAAiP;AACjP,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,MAAc;IAC/D,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACrC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wNAAwN;AACxN,MAAM,UAAU,kBAAkB,CAChC,KAA8B,EAC9B,QAAQ,GAAqC,uBAAuB;IAEpE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CACX,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,kUAAkU,CAC5V,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CACX,yCAAyC,IAAI,mIAAmI,CACjL,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,wSAAwS;AACxS,gOAAgO;AAEhO;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,YAAY;IACZ,eAAe;IACf,eAAe;IACf,gBAAgB;IAChB,mBAAmB;IACnB,gBAAgB;IAChB,sBAAsB;IACtB,eAAe;CAChB,CAAC;AAQF;;;GAGG;AACH,MAAM,0BAA0B,GAAqC;IACnE,uOAAuO;IACvO,0CAA0C,EAAE,oGAAoG;IAChJ,2CAA2C,EAAE,oJAAoJ;IACjM,8CAA8C,EAAE,yJAAyJ;IACzM,uCAAuC,EAAE,8HAA8H;IACvK,uCAAuC,EAAE,gFAAgF;CAC1H,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAU,EAAE,CAAC,IAAI,MAAM,CAAC,4BAA4B,SAAS,SAAS,CAAC,CAAC;AAC7G,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAU,EAAE,CAAC,IAAI,MAAM,CAAC,eAAe,SAAS,SAAS,CAAC,CAAC;AAEhG;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,MAAc;IACjE,MAAM,KAAK,GAAwB,EAAE,CAAC;IACtC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACrC,KAAK,MAAM,SAAS,IAAI,0BAA0B,EAAE,CAAC;YACnD,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC/C,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mGAAmG;AACnG,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,CAAC,GAAG,qDAAqD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3E,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAA4B,EAC5B,cAA4C,EAC5C,aAAgD,EAChD,QAAQ,GAA+C,gBAAgB,EACvE,cAAc,GAAqC,0BAA0B;IAE7E,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,8FAA8F;IAC9F,yFAAyF;IACzF,+FAA+F;IAC/F,MAAM,WAAW,GAAG,IAAI,GAAG,EAAoB,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,aAAa;YAAE,SAAS;QAC/C,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChB,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IACD,gGAAgG;IAChG,mFAAmF;IACnF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAoB,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS,CAAC,2DAA2D;QAC/F,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAClB,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IAED;;qFAEiF;IACjF,MAAM,SAAS,GAAG,IAAI,GAAG,EAA+B,CAAC;IACzD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,IAAuB,EAAQ,EAAE;QAC5D,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvH,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC;IAEF,uFAAuF;IACvF,qFAAqF;IACrF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,sBAAsB,CAAC,GAAG,IAAI,CAAC,IAAI,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/G,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,gQAAgQ;YAChQ,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/B,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAClB,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBACjC,QAAQ,CAAC,IAAI,CACX,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,+BAA+B,IAAI,CAAC,SAAS,wDAAwD,IAAI,8FAA8F,CACjO,CAAC;YACJ,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/B,KAAK,MAAM,KAAK,IAAI,MAAM;gBAAE,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC/C,SAAS;QACX,CAAC;QACD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YAC5C,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CACX,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,+BAA+B,IAAI,CAAC,SAAS,6XAA6X,CACpc,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS,CAAC,oDAAoD;QACvF,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnF,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CACX,SAAS,IAAI,wCAAwC,KAAK,+PAA+P,CAC1T,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,qBAAqB,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YAC3E,QAAQ,CAAC,IAAI,CACX,SAAS,IAAI,kCAAkC,KAAK,CAAC,eAAe,oBAAoB,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,GAAG,oBAAoB,KAAK,CAAC,eAAe,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,uHAAuH,CAClV,CAAC;QACJ,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAChE,QAAQ,CAAC,IAAI,CACX,SAAS,IAAI,kCAAkC,KAAK,CAAC,eAAe,6PAA6P,CAClU,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CACX,4CAA4C,IAAI,2HAA2H,CAC5K,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAQD,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAClD,MAAM,WAAW,GAAG,gFAAgF,CAAC;AACrG;;oEAEoE;AACpE,MAAM,QAAQ,GAAG,8BAA8B,CAAC;AAEhD;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAA4B,EAC5B,kBAAqC,EACrC,QAA4D,EAC5D,QAAQ,GAA+C,gBAAgB;AACvE;;;iDAGiD;AACjD,aAAa,GAAsB,EAAE;AACrC,qTAAqT;AACrT,aAAa,GAAgC,IAAI,GAAG,EAAE;IAEtD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACnD,gGAAgG;IAChG,iGAAiG;IACjG,gFAAgF;IAChF,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,iBAAiB;YAAE,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CACX,SAAS,IAAI,CAAC,IAAI,+HAA+H,CAClJ,CAAC;YACF,SAAS;QACX,CAAC;QAED,wQAAwQ;QACxQ,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACvD,QAAQ,CAAC,IAAI,CACX,SAAS,IAAI,CAAC,IAAI,eAAe,KAAK,CAAC,IAAI,oOAAoO,CAChR,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE3C,QAAQ,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACvB,KAAK,MAAM;gBACT,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBAC1B,QAAQ,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,cAAc,KAAK,CAAC,IAAI,mFAAmF,CAAC,CAAC;gBAC/I,CAAC;gBACD,IAAI,UAAU,IAAI,QAAQ,IAAI,OAAO,EAAE,CAAC;oBACtC,QAAQ,CAAC,IAAI,CACX,SAAS,IAAI,CAAC,IAAI,yEAAyE,CAAC,UAAU,IAAI,iBAAiB,EAAE,QAAQ,IAAI,mBAAmB,EAAE,OAAO,IAAI,eAAe,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,qEAAqE,CAC1R,CAAC;gBACJ,CAAC;gBACD,0FAA0F;gBAC1F,wFAAwF;gBACxF,0FAA0F;gBAC1F,oFAAoF;gBACpF,KAAK,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,gBAAgB,EAAE,CAAC;oBACpD,IAAI,IAAI,MAAM,CAAC,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;wBACxD,QAAQ,CAAC,IAAI,CACX,SAAS,IAAI,CAAC,IAAI,yCAAyC,MAAM,aAAa,UAAU,4IAA4I,CACrO,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,MAAM;YACR,KAAK,aAAa,EAAE,CAAC;gBACnB,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,QAAQ,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,cAAc,KAAK,CAAC,IAAI,oBAAoB,KAAK,CAAC,GAAG,CAAC,MAAM,6FAA6F,CAAC,CAAC;gBAC7L,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACnD,QAAQ,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,0BAA0B,KAAK,CAAC,GAAG,CAAC,MAAM,iGAAiG,CAAC,CAAC;gBAC/K,CAAC;gBACD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,QAAQ,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,0BAA0B,KAAK,CAAC,GAAG,CAAC,MAAM,8FAA8F,CAAC,CAAC;gBAC5K,CAAC;qBAAM,CAAC;oBACN,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;oBACxG,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;wBACtB,QAAQ,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,kFAAkF,CAAC,CAAC;oBACtH,CAAC;yBAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;wBAC/B,QAAQ,CAAC,IAAI,CACX,SAAS,IAAI,CAAC,IAAI,cAAc,KAAK,CAAC,IAAI,oBAAoB,KAAK,CAAC,GAAG,CAAC,MAAM,+BAA+B,MAAM,mDAAmD,CACvK,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,aAAa;gBAChB,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBACzD,QAAQ,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,cAAc,KAAK,CAAC,IAAI,kIAAkI,CAAC,CAAC;gBAC9L,CAAC;gBACD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,QAAQ,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,mIAAmI,CAAC,CAAC;gBACvK,CAAC;gBACD,MAAM;YACR,KAAK,iBAAiB,EAAE,CAAC;gBACvB,uFAAuF;gBACvF,gFAAgF;gBAChF,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBACzD,QAAQ,CAAC,IAAI,CACX,SAAS,IAAI,CAAC,IAAI,cAAc,KAAK,CAAC,IAAI,0KAA0K,CACrN,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBACnE,QAAQ,CAAC,IAAI,CACX,SAAS,IAAI,CAAC,IAAI,wCAAwC,KAAK,CAAC,GAAG,CAAC,MAAM,iGAAiG,CAC5K,CAAC;gBACJ,CAAC;gBACD,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACzD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;oBAC/B,QAAQ,CAAC,IAAI,CACX,SAAS,IAAI,CAAC,IAAI,4BAA4B,KAAK,CAAC,GAAG,CAAC,MAAM,qIAAqI,CACpM,CAAC;gBACJ,CAAC;qBAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC3C,QAAQ,CAAC,IAAI,CACX,SAAS,IAAI,CAAC,IAAI,4BAA4B,KAAK,CAAC,GAAG,CAAC,MAAM,kKAAkK,CACjO,CAAC;gBACJ,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,UAAU;gBACb,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBAC1B,QAAQ,CAAC,IAAI,CACX,SAAS,IAAI,CAAC,IAAI,cAAc,KAAK,CAAC,IAAI,yIAAyI,CACpL,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,QAAQ,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,oHAAoH,CAAC,CAAC;gBACxJ,CAAC;gBACD,MAAM;QACV,CAAC;IACH,CAAC;IAED,wFAAwF;IACxF,0FAA0F;IAC1F,0FAA0F;IAC1F,uDAAuD;IACvD,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACtC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS,CAAC,kDAAkD;QACpF,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CACX,mBAAmB,IAAI,yKAAyK,CACjM,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,CAAC;YAC1D,QAAQ,CAAC,IAAI,CACX,mBAAmB,IAAI,iBAAiB,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,sJAAsJ,IAAI,sDAAsD,CACrR,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS,CAAC,6DAA6D;QAC/F,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CACX,sBAAsB,IAAI,sBAAsB,IAAI,gLAAgL,CACrO,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,CAAC;YAC1D,QAAQ,CAAC,IAAI,CACX,sBAAsB,IAAI,iBAAiB,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,qJAAqJ,IAAI,kBAAkB,CACnP,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CACX,+BAA+B,IAAI,wIAAwI,CAC5K,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/agent/access/credential-bindings-codemod.d.ts

@@ -0,0 +1,63 @@
+import type { ConnectorCredentials, ConnectorCredential } from "./connector-credentials.js";
+/** One custody re-stamp: connector C's credential K resolves through this home from now on. A future vendor home registers its own codec in OVERLAY_HOMES with no edit here. */
+export interface CredentialBindingOverride {
+    readonly connector: string;
+    readonly credential: string;
+    readonly broker?: string;
+    /** Broker home: the new secret ref under that broker (stage 5: a `db:<connector>:<credential>` ref). */
+    readonly secretRef?: string;
+}
+export interface CredentialBindingsFile {
+    readonly overrides: readonly CredentialBindingOverride[];
+}
+/** A codemod refusal — invalid file or invalid override. Distinct type so callers can tell
+ *  "refused by design" from an unexpected failure (mirrors GrantsCodemodError). */
+export declare class CredentialBindingsCodemodError extends Error {
+}
+export declare function emptyCredentialBindingsFile(): CredentialBindingsFile;
+/** One overlay home kind — how the codemod recognises, validates, serialises, compares, and applies it.
+ *  🔴 EXPORT KEPT FOR A CONSUMER OUTSIDE THIS REPO (OPE-1455): the argument type of
+ *  {@link registerOverlayHome}, so a self-host's own vendor adapter can name what it registers. */
+export interface OverlayHomeCodec {
+    readonly kind: string;
+    readonly display: string;
+    readonly emptyHint: string;
+    claimsRaw(o: Record<string, unknown>): boolean;
+    /** Validate + extract THIS home's fields from raw JSON into the override's home portion. Throws
+     *  {@link CredentialBindingsCodemodError} on a malformed instance. `where` is the quoted `"P/C"` id. */
+    parseRaw(o: Record<string, unknown>, where: string): Partial<CredentialBindingOverride>;
+    /** Does a PARSED override use THIS home? Exactly one codec claims any validated override. */
+    claims(o: CredentialBindingOverride): boolean;
+    /** The canonical, ORDERED serialised home portion (merged after connector/credential in the emitted
+     *  override) — the bytes must stay stable for a home kind across versions (idempotency). */
+    serialize(o: CredentialBindingOverride): Record<string, unknown>;
+    sameHome(a: CredentialBindingOverride, b: CredentialBindingOverride): boolean;
+    /** Re-stamp a ConnectorCredential to this home (setting its fields + stripping the other homes'). */
+    apply(cred: ConnectorCredential, o: CredentialBindingOverride): ConnectorCredential;
+}
+/** Register an overlay home codec. Idempotent overwrite (last wins), mirroring registerBroker. A vendor
+ *  adapter registers its overlay home this way — parse/stringify/sameHome/apply need no edit.
+ *  🔴 EXPORT KEPT FOR A CONSUMER OUTSIDE THIS REPO (OPE-1455): that vendor adapter. Core registers
+ *  its own homes in this file, so no in-repo caller names this function. */
+export declare function registerOverlayHome(codec: OverlayHomeCodec): void;
+/** Strict and fail-loud: an unknown top-level key, a non-array `overrides`, a missing or blank field, or a `:` in a connector/credential id all throw. The overlay is machine-written, so a silently mis-parsed custody overlay is the security bug. */
+export declare function parseCredentialBindingsFile(value: unknown): CredentialBindingsFile;
+/** Canonical serialisation: overrides sorted by (connector, credential), 2-space indent, trailing newline. The round trip must stay byte-stable, because the 422-update PR path depends on it. */
+export declare function stringifyCredentialBindings(file: CredentialBindingsFile): string;
+export declare function emitCredentialBindingsModule(file: CredentialBindingsFile): string;
+/** Verifies the round trip: a file whose own data does not re-emit identically has been hand-edited, and is refused rather than silently rewritten into a custody diff nobody authored. `npm run lint:overlays` runs the same check. */
+export declare function parseCredentialBindingsModule(text: string): CredentialBindingsFile;
+/** LENIENT re-emit for `npm run overlays:normalize`: take whatever well-shaped data the module
+ *  carries and return the canonical module text. The only path allowed to accept a non-canonical
+ *  file — its whole job is to produce the canonical one. */
+export declare function renormalizeCredentialBindingsModule(text: string): string;
+export interface ApplyBindingOverrideResult {
+    readonly file: CredentialBindingsFile;
+    /** False when the override's whole effect was already present (idempotent re-apply). */
+    readonly changed: boolean;
+}
+/** Upsert keyed by (connector, credential): an identical stamp is a no-op, a different one replaces. Pure and deterministic; the caller re-validates the merged connector set before any PR opens. */
+export declare function applyBindingOverride(file: CredentialBindingsFile, override: CredentialBindingOverride): ApplyBindingOverrideResult;
+/** Applies the overlay over a base catalogue set, re-stamping each matching credential through its own home codec. An override that matches no credential is inert, and the caller re-runs assertConnectorCredentialsValid on the result. */
+export declare function applyOverridesToConnectorCredentials(catalogues: readonly ConnectorCredentials[], overrides: readonly CredentialBindingOverride[]): readonly ConnectorCredentials[];
+//# sourceMappingURL=credential-bindings-codemod.d.ts.map

package/dist/agent/access/credential-bindings-codemod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-bindings-codemod.d.ts","sourceRoot":"","sources":["../../../agent/access/credential-bindings-codemod.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAG5F,gLAAgL;AAChL,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,wGAAwG;IACxG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,SAAS,yBAAyB,EAAE,CAAC;CAC1D;AAED;mFACmF;AACnF,qBAAa,8BAA+B,SAAQ,KAAK;CAAG;AAE5D,wBAAgB,2BAA2B,IAAI,sBAAsB,CAEpE;AAID;;mGAEmG;AACnG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;IAC/C;4GACwG;IACxG,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACxF,6FAA6F;IAC7F,MAAM,CAAC,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC;IAC9C;gGAC4F;IAC5F,SAAS,CAAC,CAAC,EAAE,yBAAyB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjE,QAAQ,CAAC,CAAC,EAAE,yBAAyB,EAAE,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC;IAC9E,qGAAqG;IACrG,KAAK,CAAC,IAAI,EAAE,mBAAmB,EAAE,CAAC,EAAE,yBAAyB,GAAG,mBAAmB,CAAC;CACrF;AAID;;;4EAG4E;AAC5E,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAEjE;AA0CD,wPAAwP;AACxP,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,sBAAsB,CA0ClF;AAED,kMAAkM;AAClM,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,sBAAsB,GAAG,MAAM,CAQhF;AAYD,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,sBAAsB,GAAG,MAAM,CAEjF;AAED,wOAAwO;AACxO,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,sBAAsB,CAUlF;AAED;;4DAE4D;AAC5D,wBAAgB,mCAAmC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIxE;AAWD,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,sMAAsM;AACtM,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,yBAAyB,GAAG,0BAA0B,CAUlI;AAED,6OAA6O;AAC7O,wBAAgB,oCAAoC,CAClD,UAAU,EAAE,SAAS,oBAAoB,EAAE,EAC3C,SAAS,EAAE,SAAS,yBAAyB,EAAE,GAC9C,SAAS,oBAAoB,EAAE,CAkBjC"}

package/dist/agent/access/credential-bindings-codemod.js

@@ -0,0 +1,179 @@
+// The only writer of the credential-bindings overlay: pure, deterministic and idempotent, so the same inputs give byte-identical output. An override carries references only (connector, credential, broker, secretRef), never a secret value.
+import { overlayModuleHeader, unwrapOverlayModule, wrapOverlayModule } from "./overlay-module.js";
+/** A codemod refusal — invalid file or invalid override. Distinct type so callers can tell
+ *  "refused by design" from an unexpected failure (mirrors GrantsCodemodError). */
+export class CredentialBindingsCodemodError extends Error {
+}
+export function emptyCredentialBindingsFile() {
+    return { overrides: [] };
+}
+const OVERLAY_HOMES = new Map();
+/** Register an overlay home codec. Idempotent overwrite (last wins), mirroring registerBroker. A vendor
+ *  adapter registers its overlay home this way — parse/stringify/sameHome/apply need no edit.
+ *  🔴 EXPORT KEPT FOR A CONSUMER OUTSIDE THIS REPO (OPE-1455): that vendor adapter. Core registers
+ *  its own homes in this file, so no in-repo caller names this function. */
+export function registerOverlayHome(codec) {
+    OVERLAY_HOMES.set(codec.kind, codec);
+}
+/** The codec a PARSED override uses (exactly one claims a validated override), or undefined for an
+ *  override with no recognised home (never happens post-parse — a guard against a hand-built override). */
+function overlayHomeFor(o) {
+    for (const codec of OVERLAY_HOMES.values())
+        if (codec.claims(o))
+            return codec;
+    return undefined;
+}
+function registerCoreOverlayHomes() {
+    registerOverlayHome({
+        kind: "broker",
+        display: "a broker home",
+        emptyHint: "{ broker, secretRef }",
+        claimsRaw: (o) => "broker" in o || "secretRef" in o,
+        claims: (o) => o.broker !== undefined || o.secretRef !== undefined,
+        parseRaw: (o, where) => {
+            if (typeof o.broker !== "string" || typeof o.secretRef !== "string") {
+                throw new CredentialBindingsCodemodError("every override needs string { connector, credential, broker, secretRef }");
+            }
+            if (!o.broker || !o.secretRef) {
+                throw new CredentialBindingsCodemodError(`override for ${where} has a blank field — connector/credential/broker/secretRef are all required`);
+            }
+            return { broker: o.broker, secretRef: o.secretRef };
+        },
+        // ORDERED: { broker, secretRef } — byte-identical to before R1/R2.
+        serialize: (o) => ({ broker: o.broker, secretRef: o.secretRef }),
+        sameHome: (a, b) => a.broker === b.broker && a.secretRef === b.secretRef,
+        // Re-stamp broker+secretRef; drop any prior `home` bag so the broker stamp is the ONE home
+        // (assertConnectorCredentialsValid's mutual exclusivity — a re-home from a registered vendor home to a broker).
+        apply: (c, ov) => {
+            const { home: _h, ...rest } = c;
+            return { ...rest, broker: ov.broker, secretRef: ov.secretRef };
+        },
+    });
+}
+registerCoreOverlayHomes();
+function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/** Strict and fail-loud: an unknown top-level key, a non-array `overrides`, a missing or blank field, or a `:` in a connector/credential id all throw. The overlay is machine-written, so a silently mis-parsed custody overlay is the security bug. */
+export function parseCredentialBindingsFile(value) {
+    if (!isRecord(value))
+        throw new CredentialBindingsCodemodError("credential-bindings file must be a JSON object with an `overrides` array");
+    const keys = Object.keys(value).filter((k) => k !== "$comment");
+    const unknown = keys.filter((k) => k !== "overrides");
+    if (unknown.length > 0)
+        throw new CredentialBindingsCodemodError(`credential-bindings file has unknown top-level key(s): ${unknown.join(", ")}`);
+    if (!Array.isArray(value.overrides))
+        throw new CredentialBindingsCodemodError("credential-bindings file needs an `overrides` array (use [] when empty)");
+    const overrides = [];
+    const seen = new Set();
+    for (const o of value.overrides) {
+        if (!isRecord(o) || typeof o.connector !== "string" || typeof o.credential !== "string") {
+            throw new CredentialBindingsCodemodError("every override needs string { connector, credential } and exactly one home (broker+secretRef)");
+        }
+        if (!o.connector || !o.credential) {
+            throw new CredentialBindingsCodemodError(`override for "${o.connector}/${o.credential}" has a blank connector/credential — both are required`);
+        }
+        if (o.connector.includes(":") || o.credential.includes(":")) {
+            throw new CredentialBindingsCodemodError(`override connector/credential ids must not contain ":" (got "${o.connector}"/"${o.credential}")`);
+        }
+        const where = `"${o.connector}/${o.credential}"`;
+        // Exactly one home, resolved through the OVERLAY_HOMES registry. A raw override may declare AT
+        // MOST one registered home; zero and >1 both fail loud.
+        const claimed = [...OVERLAY_HOMES.values()].filter((h) => h.claimsRaw(o));
+        if (claimed.length > 1) {
+            const phrase = claimed.length === 2
+                ? `has BOTH ${claimed[0].display} and ${claimed[1].display}`
+                : `declares more than one home (${claimed.map((h) => h.display).join(", ")})`;
+            throw new CredentialBindingsCodemodError(`override for ${where} ${phrase} — exactly one is allowed (one home per credential)`);
+        }
+        if (claimed.length === 0) {
+            throw new CredentialBindingsCodemodError(`override for ${where} has no home — set ${[...OVERLAY_HOMES.values()].map((h) => h.emptyHint).join(" or ")}`);
+        }
+        const dupKey = `${o.connector} ${o.credential}`;
+        if (seen.has(dupKey))
+            throw new CredentialBindingsCodemodError(`credential-bindings file has a duplicate override for "${o.connector}/${o.credential}" — one home per credential`);
+        seen.add(dupKey);
+        overrides.push({ connector: o.connector, credential: o.credential, ...claimed[0].parseRaw(o, where) });
+    }
+    return { overrides };
+}
+/** Canonical serialisation: overrides sorted by (connector, credential), 2-space indent, trailing newline. The round trip must stay byte-stable, because the 422-update PR path depends on it. */
+export function stringifyCredentialBindings(file) {
+    const overrides = [...file.overrides]
+        .sort((a, b) => a.connector.localeCompare(b.connector) || a.credential.localeCompare(b.credential))
+        .map((o) => {
+        const home = overlayHomeFor(o);
+        return { connector: o.connector, credential: o.credential, ...(home ? home.serialize(o) : {}) };
+    });
+    return JSON.stringify({ overrides }, null, 2) + "\n";
+}
+// The overlay ships as a machine-owned TS module rather than JSON, so the deployer config has one authoring language. See access/overlay-module.ts for the grammar.
+/** This overlay's fixed module grammar. Constants only: the emitted bytes depend on the data alone. */
+const CREDENTIAL_BINDINGS_MODULE = {
+    what: "credential-bindings overlay",
+    header: overlayModuleHeader("credential-bindings overlay", "packages/core/agent/access/credential-bindings-codemod.ts"),
+    typeImport: 'import type { CredentialBindingsFile } from "@open-everywhere/core/agent/access/credential-bindings-codemod.js";',
+    typeName: "CredentialBindingsFile",
+};
+export function emitCredentialBindingsModule(file) {
+    return wrapOverlayModule(CREDENTIAL_BINDINGS_MODULE, stringifyCredentialBindings(file));
+}
+/** Verifies the round trip: a file whose own data does not re-emit identically has been hand-edited, and is refused rather than silently rewritten into a custody diff nobody authored. `npm run lint:overlays` runs the same check. */
+export function parseCredentialBindingsModule(text) {
+    const file = parseCredentialBindingsFile(unwrapOverlayModule(CREDENTIAL_BINDINGS_MODULE, text, (m) => new CredentialBindingsCodemodError(m)));
+    if (emitCredentialBindingsModule(file) !== text) {
+        throw new CredentialBindingsCodemodError("credential-bindings overlay is not in canonical form — re-emitting its own data does not reproduce the file, so it has been hand-edited. Run `npm run overlays:normalize` and commit the result (the codemod refuses to rewrite a file it did not write).");
+    }
+    return file;
+}
+/** LENIENT re-emit for `npm run overlays:normalize`: take whatever well-shaped data the module
+ *  carries and return the canonical module text. The only path allowed to accept a non-canonical
+ *  file — its whole job is to produce the canonical one. */
+export function renormalizeCredentialBindingsModule(text) {
+    return emitCredentialBindingsModule(parseCredentialBindingsFile(unwrapOverlayModule(CREDENTIAL_BINDINGS_MODULE, text, (m) => new CredentialBindingsCodemodError(m))));
+}
+/** True iff two overrides name the SAME home — same home KIND and, per that codec, the same address.
+ *  A differing home kind ⇒ not the same (a re-stamp). */
+function sameHome(a, b) {
+    const ca = overlayHomeFor(a);
+    const cb = overlayHomeFor(b);
+    if (!ca || !cb || ca.kind !== cb.kind)
+        return false;
+    return ca.sameHome(a, b);
+}
+/** Upsert keyed by (connector, credential): an identical stamp is a no-op, a different one replaces. Pure and deterministic; the caller re-validates the merged connector set before any PR opens. */
+export function applyBindingOverride(file, override) {
+    if (override.connector.includes(":") || override.credential.includes(":")) {
+        throw new CredentialBindingsCodemodError(`override connector/credential ids must not contain ":" (got "${override.connector}"/"${override.credential}")`);
+    }
+    const existing = file.overrides.find((o) => o.connector === override.connector && o.credential === override.credential);
+    if (existing && sameHome(existing, override)) {
+        return { file, changed: false };
+    }
+    const others = file.overrides.filter((o) => !(o.connector === override.connector && o.credential === override.credential));
+    return { file: { overrides: [...others, { ...override }] }, changed: true };
+}
+/** Applies the overlay over a base catalogue set, re-stamping each matching credential through its own home codec. An override that matches no credential is inert, and the caller re-runs assertConnectorCredentialsValid on the result. */
+export function applyOverridesToConnectorCredentials(catalogues, overrides) {
+    if (overrides.length === 0)
+        return catalogues;
+    const byConnector = new Map();
+    for (const o of overrides) {
+        const list = byConnector.get(o.connector) ?? [];
+        list.push(o);
+        byConnector.set(o.connector, list);
+    }
+    return catalogues.map((p) => {
+        const forThis = byConnector.get(p.connector);
+        if (!forThis)
+            return p;
+        const credentials = p.credentials.map((c) => {
+            const ov = forThis.find((o) => o.credential === c.id);
+            if (!ov)
+                return c;
+            return overlayHomeFor(ov)?.apply(c, ov) ?? c;
+        });
+        return { ...p, credentials };
+    });
+}
+//# sourceMappingURL=credential-bindings-codemod.js.map

package/dist/agent/access/credential-bindings-codemod.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-bindings-codemod.js","sourceRoot":"","sources":["../../../agent/access/credential-bindings-codemod.ts"],"names":[],"mappings":"AAAA,+OAA+O;AAG/O,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,iBAAiB,EAA6B,MAAM,qBAAqB,CAAC;AAe7H;mFACmF;AACnF,MAAM,OAAO,8BAA+B,SAAQ,KAAK;CAAG;AAE5D,MAAM,UAAU,2BAA2B;IACzC,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAC3B,CAAC;AAyBD,MAAM,aAAa,GAAG,IAAI,GAAG,EAA4B,CAAC;AAE1D;;;4EAG4E;AAC5E,MAAM,UAAU,mBAAmB,CAAC,KAAuB;IACzD,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvC,CAAC;AAED;2GAC2G;AAC3G,SAAS,cAAc,CAAC,CAA4B;IAClD,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,MAAM,EAAE;QAAE,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAC9E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,wBAAwB;IAC/B,mBAAmB,CAAC;QAClB,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,eAAe;QACxB,SAAS,EAAE,uBAAuB;QAClC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,IAAI,CAAC,IAAI,WAAW,IAAI,CAAC;QACnD,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;QAClE,QAAQ,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE;YACrB,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBACpE,MAAM,IAAI,8BAA8B,CAAC,0EAA0E,CAAC,CAAC;YACvH,CAAC;YACD,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;gBAC9B,MAAM,IAAI,8BAA8B,CAAC,gBAAgB,KAAK,6EAA6E,CAAC,CAAC;YAC/I,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;QACtD,CAAC;QACD,mEAAmE;QACnE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;QAChE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS;QACxE,2FAA2F;QAC3F,gHAAgH;QAChH,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;YAChC,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC;QACjE,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AACD,wBAAwB,EAAE,CAAC;AAE3B,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,wPAAwP;AACxP,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACxD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,8BAA8B,CAAC,0EAA0E,CAAC,CAAC;IAC3I,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,8BAA8B,CAAC,0DAA0D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjJ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,8BAA8B,CAAC,yEAAyE,CAAC,CAAC;IAEzJ,MAAM,SAAS,GAAgC,EAAE,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACxF,MAAM,IAAI,8BAA8B,CAAC,+FAA+F,CAAC,CAAC;QAC5I,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;YAClC,MAAM,IAAI,8BAA8B,CAAC,iBAAiB,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,UAAU,wDAAwD,CAAC,CAAC;QACjJ,CAAC;QACD,IAAI,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,8BAA8B,CAAC,gEAAgE,CAAC,CAAC,SAAS,MAAM,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC;QAC9I,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,UAAU,GAAG,CAAC;QACjD,+FAA+F;QAC/F,wDAAwD;QACxD,MAAM,OAAO,GAAG,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,KAAK,CAAC;gBAClB,CAAC,CAAC,YAAY,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,QAAQ,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;gBAC5D,CAAC,CAAC,gCAAgC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YAClF,MAAM,IAAI,8BAA8B,CAAC,gBAAgB,KAAK,IAAI,MAAM,qDAAqD,CAAC,CAAC;QACjI,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,8BAA8B,CACtC,gBAAgB,KAAK,sBAAsB,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAC9G,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QAChD,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,8BAA8B,CAAC,0DAA0D,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,UAAU,6BAA6B,CAAC,CAAC;QACnL,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEjB,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,CAAC;AACvB,CAAC;AAED,kMAAkM;AAClM,MAAM,UAAU,2BAA2B,CAAC,IAA4B;IACtE,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;SAClC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;SAClG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAC/B,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAClG,CAAC,CAAC,CAAC;IACL,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AACvD,CAAC;AAED,oKAAoK;AAEpK,uGAAuG;AACvG,MAAM,0BAA0B,GAAyB;IACvD,IAAI,EAAE,6BAA6B;IACnC,MAAM,EAAE,mBAAmB,CAAC,6BAA6B,EAAE,2DAA2D,CAAC;IACvH,UAAU,EAAE,kHAAkH;IAC9H,QAAQ,EAAE,wBAAwB;CACnC,CAAC;AAEF,MAAM,UAAU,4BAA4B,CAAC,IAA4B;IACvE,OAAO,iBAAiB,CAAC,0BAA0B,EAAE,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,wOAAwO;AACxO,MAAM,UAAU,6BAA6B,CAAC,IAAY;IACxD,MAAM,IAAI,GAAG,2BAA2B,CACtC,mBAAmB,CAAC,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,8BAA8B,CAAC,CAAC,CAAC,CAAC,CACpG,CAAC;IACF,IAAI,4BAA4B,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,8BAA8B,CACtC,2PAA2P,CAC5P,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;4DAE4D;AAC5D,MAAM,UAAU,mCAAmC,CAAC,IAAY;IAC9D,OAAO,4BAA4B,CACjC,2BAA2B,CAAC,mBAAmB,CAAC,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC,CACjI,CAAC;AACJ,CAAC;AAED;yDACyD;AACzD,SAAS,QAAQ,CAAC,CAA4B,EAAE,CAA4B;IAC1E,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACpD,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3B,CAAC;AAQD,sMAAsM;AACtM,MAAM,UAAU,oBAAoB,CAAC,IAA4B,EAAE,QAAmC;IACpG,IAAI,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,8BAA8B,CAAC,gEAAgE,QAAQ,CAAC,SAAS,MAAM,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC;IAC5J,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,CAAC,CAAC;IACxH,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3H,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,GAAG,MAAM,EAAE,EAAE,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC9E,CAAC;AAED,6OAA6O;AAC7O,MAAM,UAAU,oCAAoC,CAClD,UAA2C,EAC3C,SAA+C;IAE/C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuC,CAAC;IACnE,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1B,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC;QACvB,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAuB,EAAE;YAC/D,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YACtD,IAAI,CAAC,EAAE;gBAAE,OAAO,CAAC,CAAC;YAClB,OAAO,cAAc,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/agent/access/credential-endpoints.d.ts

@@ -0,0 +1,47 @@
+import type { HttpMethod } from "./bundle.js";
+export declare const CREDENTIAL_HTTP_METHODS: readonly HttpMethod[];
+/** This credential may be attached to a request to one of `hosts`, whose path starts with one of `pathPrefixes`, using one of `methods`. An omitted optional field narrows nothing; `hosts` is required and non-empty, because a rule naming no host blocks everything. */
+export interface CredentialEndpointRules {
+    /** The exact hostnames this credential may be sent to. REQUIRED, non-empty, NEVER wildcarded. */
+    readonly hosts: readonly string[];
+    /** Optional path narrowing — the request path must start with one of these. Absent ⇒ every path. */
+    readonly pathPrefixes?: readonly string[];
+    /** Optional method narrowing — the standard read-only shape is `["GET","HEAD"]`. Absent ⇒ every method. */
+    readonly methods?: readonly HttpMethod[];
+}
+/** Thrown when a request would carry a credential outside its declared endpoint rules. Carries the
+ *  refused origin, path and method — NEVER the token, and never the query string (a query can hold
+ *  operator data, and nothing about the verdict depends on it).
+ *
+ *  🔴 IT IS A DEFINITIVE FAILURE, AND IT SAYS SO IN ITS OWN SHAPE (OPE-1753). The fence throws
+ *  BEFORE any byte leaves this host, so the platform provably did nothing. `applied: false` is the
+ *  field `channels/platform-failure.ts` reads for exactly that claim; without it this error carried
+ *  no status and no flag, and that module's fail-closed default classed it AMBIGUOUS. The cost was
+ *  measured on soak `soak-2026-09-12-a`: a Notion edit refused by this fence told the model "the edit
+ *  was sent but notion did not confirm it" — false in both halves, and the copy that follows from it
+ *  tells the model NOT to post the correction a definitive failure entitles it to.
+ *  The field is declared here rather than stamped by `markNotApplied` at each throw site so it cannot
+ *  be forgotten by a new one, and it keeps this module free of any import from the channels plane. */
+export declare class CredentialEndpointError extends Error {
+    readonly applied: false;
+}
+/** A verdict on one request. `allowed: false` always carries a `reason` naming what failed. */
+export interface CredentialEndpointVerdict {
+    readonly allowed: boolean;
+    readonly reason?: string;
+}
+/** Reports every shape problem in one rule set as operator-facing lines. It validates the RULE, never a request, and returns [] both for a well-formed set and for undefined, since declaring no rules is the ordinary state. */
+export declare function credentialEndpointProblems(rules: CredentialEndpointRules | undefined, where: string): readonly string[];
+/** Pure and total, and the single place the three narrowings are decided. Undefined rules allow, and `method` defaults to GET to match fetch's own default, so a caller that omits it is checked against the request that would really be made. */
+export declare function credentialEndpointVerdict(rules: CredentialEndpointRules | undefined, url: string, method?: string): CredentialEndpointVerdict;
+/** Checks ONLY the host, for the MCP transport boot check: once a connection is wired to a directUrl, eve's MCP client owns every request, so OE sees no path or method. Deliberately narrower than credentialEndpointVerdict, so a path rule written for a REST fence cannot reject a legitimate directUrl. */
+export declare function credentialEndpointHostVerdict(rules: CredentialEndpointRules | undefined, url: string): CredentialEndpointVerdict;
+/** Throws on a refusal; `where` names the connection and credential, so the message identifies WHICH credential was about to be bound to WHICH transport URL. */
+export declare function assertCredentialEndpointHostAllowed(rules: CredentialEndpointRules | undefined, url: string, where: string): void;
+/** Throws on a refusal; `where` names the credential, so the message identifies which one was about to go somewhere it may not. The message carries the origin, the path and the method — never the query string and never the token. */
+export declare function assertCredentialEndpointAllowed(rules: CredentialEndpointRules | undefined, url: string, method: string, where: string): void;
+/** The subset of `fetch` the guard wraps — the same shape the provider REST helpers already inject. */
+export type GuardableFetch = (input: string, init?: RequestInit) => Promise<Response>;
+/** Wraps a fetch so every call is checked before dispatch: the caller holds one function and cannot reach the network through it without passing the check. Undefined rules return `base` UNCHANGED, not an always-allowing wrapper, so an unnarrowed credential keeps even its object identity. */
+export declare function guardCredentialFetch(rules: CredentialEndpointRules | undefined, where: string, base: GuardableFetch): GuardableFetch;
+//# sourceMappingURL=credential-endpoints.d.ts.map

package/dist/agent/access/credential-endpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-endpoints.d.ts","sourceRoot":"","sources":["../../../agent/access/credential-endpoints.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAY9C,eAAO,MAAM,uBAAuB,EAAqC,SAAS,UAAU,EAAE,CAAC;AAE/F,2QAA2Q;AAC3Q,MAAM,WAAW,uBAAuB;IACtC,iGAAiG;IACjG,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,oGAAoG;IACpG,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,2GAA2G;IAC3G,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;CAC1C;AAED;;;;;;;;;;;;sGAYsG;AACtG,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,OAAO,QAAkB;CACnC;AAED,+FAA+F;AAC/F,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAUD,iOAAiO;AACjO,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,uBAAuB,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAkEvH;AAaD,mPAAmP;AACnP,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,uBAAuB,GAAG,SAAS,EAC1C,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,MAAc,GACrB,yBAAyB,CAqD3B;AAED,gTAAgT;AAChT,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,uBAAuB,GAAG,SAAS,EAC1C,GAAG,EAAE,MAAM,GACV,yBAAyB,CAsB3B;AAED,iKAAiK;AACjK,wBAAgB,mCAAmC,CAAC,KAAK,EAAE,uBAAuB,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAUhI;AAED,yOAAyO;AACzO,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,uBAAuB,GAAG,SAAS,EAC1C,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,IAAI,CAgBN;AAED,uGAAuG;AACvG,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEtF,oSAAoS;AACpS,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,uBAAuB,GAAG,SAAS,EAC1C,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,cAAc,GACnB,cAAc,CAMhB"}

package/dist/agent/access/credential-endpoints.js

@@ -0,0 +1,211 @@
+// Per-credential endpoint rules for the CONNECTOR plane: which hosts, paths and methods one host-side credential may be attached to, enforced in-process because the token is attached host-side where no firewall sees it. Rules are OPTIONAL and absent means unnarrowed; a host entry is one exact hostname with no wildcard and no implicit subdomain match, and ports are not part of the fence.
+/** Exhaustive over the HttpMethod union, so adding a method there fails the typecheck here until it is added below. */
+const METHOD_VOCABULARY = {
+    GET: true,
+    HEAD: true,
+    POST: true,
+    PUT: true,
+    PATCH: true,
+    DELETE: true,
+};
+export const CREDENTIAL_HTTP_METHODS = Object.keys(METHOD_VOCABULARY);
+/** Thrown when a request would carry a credential outside its declared endpoint rules. Carries the
+ *  refused origin, path and method — NEVER the token, and never the query string (a query can hold
+ *  operator data, and nothing about the verdict depends on it).
+ *
+ *  🔴 IT IS A DEFINITIVE FAILURE, AND IT SAYS SO IN ITS OWN SHAPE (OPE-1753). The fence throws
+ *  BEFORE any byte leaves this host, so the platform provably did nothing. `applied: false` is the
+ *  field `channels/platform-failure.ts` reads for exactly that claim; without it this error carried
+ *  no status and no flag, and that module's fail-closed default classed it AMBIGUOUS. The cost was
+ *  measured on soak `soak-2026-09-12-a`: a Notion edit refused by this fence told the model "the edit
+ *  was sent but notion did not confirm it" — false in both halves, and the copy that follows from it
+ *  tells the model NOT to post the correction a definitive failure entitles it to.
+ *  The field is declared here rather than stamped by `markNotApplied` at each throw site so it cannot
+ *  be forgotten by a new one, and it keeps this module free of any import from the channels plane. */
+export class CredentialEndpointError extends Error {
+    applied = false;
+}
+const ALLOWED = { allowed: true };
+/** Normalise a host for comparison: trim + lowercase. Hostnames are case-insensitive, so a rule
+ *  written `API.Vendor.com` and a URL of `api.vendor.com` are the same host. */
+function normalizeHost(host) {
+    return host.trim().toLowerCase();
+}
+/** Reports every shape problem in one rule set as operator-facing lines. It validates the RULE, never a request, and returns [] both for a well-formed set and for undefined, since declaring no rules is the ordinary state. */
+export function credentialEndpointProblems(rules, where) {
+    if (rules === undefined)
+        return [];
+    const bad = [];
+    if (!Array.isArray(rules.hosts) || rules.hosts.length === 0) {
+        bad.push(`${where}: endpoints.hosts must be a non-empty array — a credential rule that names no host blocks every request, which is a config error rather than a posture. Omit \`endpoints\` entirely to leave the credential unnarrowed.`);
+    }
+    else {
+        const seen = new Set();
+        for (const raw of rules.hosts) {
+            if (typeof raw !== "string" || raw.trim().length === 0) {
+                bad.push(`${where}: endpoints.hosts contains a non-string or empty entry — each entry is one exact hostname`);
+                continue;
+            }
+            const host = normalizeHost(raw);
+            if (host.includes("*")) {
+                bad.push(`${where}: endpoints.hosts entry "${raw}" contains a wildcard — hosts are NEVER wildcardable. Name each host you need: a subdomain wildcard admits every name a vendor (or whoever registers one under it) serves.`);
+            }
+            if (host.includes("/") || host.includes(":") || /\s/.test(host)) {
+                bad.push(`${where}: endpoints.hosts entry "${raw}" is not a bare hostname — write "api.vendor.com", not a URL, a scheme, or a host:port (ports are not part of the fence).`);
+            }
+            if (seen.has(host))
+                bad.push(`${where}: endpoints.hosts lists "${host}" more than once`);
+            seen.add(host);
+        }
+    }
+    if (rules.pathPrefixes !== undefined) {
+        if (!Array.isArray(rules.pathPrefixes) || rules.pathPrefixes.length === 0) {
+            bad.push(`${where}: endpoints.pathPrefixes must be a non-empty array when present — omit the field to admit every path`);
+        }
+        else {
+            for (const p of rules.pathPrefixes) {
+                if (typeof p !== "string" || !p.startsWith("/")) {
+                    bad.push(`${where}: endpoints.pathPrefixes entry ${JSON.stringify(p)} must be a string starting with "/"`);
+                }
+                else if (p.includes("*")) {
+                    bad.push(`${where}: endpoints.pathPrefixes entry "${p}" contains a wildcard — a prefix already matches everything below it, so "*" only makes the rule read wider than it is`);
+                }
+            }
+        }
+    }
+    if (rules.methods !== undefined) {
+        if (!Array.isArray(rules.methods) || rules.methods.length === 0) {
+            bad.push(`${where}: endpoints.methods must be a non-empty array when present — omit the field to admit every method`);
+        }
+        else {
+            for (const m of rules.methods) {
+                if (!CREDENTIAL_HTTP_METHODS.includes(m)) {
+                    bad.push(`${where}: endpoints.methods entry ${JSON.stringify(m)} is not an HTTP method — the vocabulary is ${CREDENTIAL_HTTP_METHODS.join(", ")}`);
+                }
+            }
+        }
+    }
+    return bad;
+}
+/** MEASURED against Node's WHATWG URL parser: a literal `..`, and a wholly percent-encoded one, are already collapsed by new URL(), but an encoded SLASH is not — so `%2e%2e%2f` passes a pathname-only prefix check and decodes outside the prefix at the far end. Decode once and refuse any `..` segment; a pathname that will not decode is refused too, because a fence must not guess. */
+function pathEscapesPrefix(pathname) {
+    let decoded;
+    try {
+        decoded = decodeURIComponent(pathname);
+    }
+    catch {
+        return true; // malformed percent-encoding — refuse rather than guess
+    }
+    return decoded.split("/").includes("..");
+}
+/** Pure and total, and the single place the three narrowings are decided. Undefined rules allow, and `method` defaults to GET to match fetch's own default, so a caller that omits it is checked against the request that would really be made. */
+export function credentialEndpointVerdict(rules, url, method = "GET") {
+    if (rules === undefined)
+        return ALLOWED;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return { allowed: false, reason: `refusing to attach a scoped credential to an unparseable URL` };
+    }
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+        return {
+            allowed: false,
+            reason: `refusing to attach a scoped credential to a "${parsed.protocol}" URL — endpoint rules govern http(s) requests only`,
+        };
+    }
+    const host = normalizeHost(parsed.hostname);
+    const allowedHosts = rules.hosts.map(normalizeHost);
+    if (!allowedHosts.includes(host)) {
+        return {
+            allowed: false,
+            reason: `host "${host}" is not in this credential's allowed hosts (${allowedHosts.join(", ")}) — ` +
+                `hosts match exactly, with no subdomain or wildcard widening`,
+        };
+    }
+    const requestMethod = method.toUpperCase();
+    if (rules.methods !== undefined && !rules.methods.includes(requestMethod)) {
+        return {
+            allowed: false,
+            reason: `method ${requestMethod} is not in this credential's allowed methods (${rules.methods.join(", ")})`,
+        };
+    }
+    if (rules.pathPrefixes !== undefined) {
+        const path = parsed.pathname;
+        if (pathEscapesPrefix(path)) {
+            return {
+                allowed: false,
+                reason: `path "${path}" contains an encoded parent-directory segment — refusing a path that decodes outside the prefix it matches`,
+            };
+        }
+        if (!rules.pathPrefixes.some((p) => path.startsWith(p))) {
+            return {
+                allowed: false,
+                reason: `path "${path}" does not start with any of this credential's allowed prefixes (${rules.pathPrefixes.join(", ")})`,
+            };
+        }
+    }
+    return ALLOWED;
+}
+/** Checks ONLY the host, for the MCP transport boot check: once a connection is wired to a directUrl, eve's MCP client owns every request, so OE sees no path or method. Deliberately narrower than credentialEndpointVerdict, so a path rule written for a REST fence cannot reject a legitimate directUrl. */
+export function credentialEndpointHostVerdict(rules, url) {
+    if (rules === undefined)
+        return ALLOWED;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return { allowed: false, reason: `refusing to bind a scoped credential to an unparseable URL` };
+    }
+    const host = normalizeHost(parsed.hostname);
+    const allowedHosts = rules.hosts.map(normalizeHost);
+    if (!allowedHosts.includes(host)) {
+        return {
+            allowed: false,
+            reason: `host "${host}" is not in this credential's allowed hosts (${allowedHosts.join(", ")}) — ` +
+                `hosts match exactly, with no subdomain or wildcard widening`,
+        };
+    }
+    return ALLOWED;
+}
+/** Throws on a refusal; `where` names the connection and credential, so the message identifies WHICH credential was about to be bound to WHICH transport URL. */
+export function assertCredentialEndpointHostAllowed(rules, url, where) {
+    const verdict = credentialEndpointHostVerdict(rules, url);
+    if (verdict.allowed)
+        return;
+    throw new CredentialEndpointError(`${where}: BLOCKED MCP transport to ${url} — ${verdict.reason}. ` +
+        `The credential was NOT returned. This is the connector plane's boot-time transport check ` +
+        `(access/credential-endpoints.ts), so it blocks a wrong-credential/wrong-connection bug before ` +
+        `eve's MCP client ever dials out. Correct the connection's directUrl, or widen the credential's ` +
+        `\`endpoints.hosts\` in agent/access/connector-credentials.ts.`);
+}
+/** Throws on a refusal; `where` names the credential, so the message identifies which one was about to go somewhere it may not. The message carries the origin, the path and the method — never the query string and never the token. */
+export function assertCredentialEndpointAllowed(rules, url, method, where) {
+    const verdict = credentialEndpointVerdict(rules, url, method);
+    if (verdict.allowed)
+        return;
+    let target = "(unparseable URL)";
+    try {
+        const parsed = new URL(url);
+        target = `${parsed.origin}${parsed.pathname}`;
+    }
+    catch {
+        /* keep the placeholder — the verdict already says the URL would not parse */
+    }
+    throw new CredentialEndpointError(`${where}: BLOCKED ${method.toUpperCase()} ${target} — ${verdict.reason}. ` +
+        `The credential was NOT attached. This is an endpoint rule on the credential itself ` +
+        `(access/credential-endpoints.ts), so it blocks a wrong-credential bug in the calling code rather ` +
+        `than a network policy. Correct the call, or widen the credential's \`endpoints\` in agent/access/connector-credentials.ts.`);
+}
+/** Wraps a fetch so every call is checked before dispatch: the caller holds one function and cannot reach the network through it without passing the check. Undefined rules return `base` UNCHANGED, not an always-allowing wrapper, so an unnarrowed credential keeps even its object identity. */
+export function guardCredentialFetch(rules, where, base) {
+    if (rules === undefined)
+        return base;
+    return async (input, init) => {
+        assertCredentialEndpointAllowed(rules, input, init?.method ?? "GET", where);
+        return base(input, init);
+    };
+}
+//# sourceMappingURL=credential-endpoints.js.map

package/dist/agent/access/credential-endpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-endpoints.js","sourceRoot":"","sources":["../../../agent/access/credential-endpoints.ts"],"names":[],"mappings":"AAAA,sYAAsY;AAMtY,uHAAuH;AACvH,MAAM,iBAAiB,GAA6B;IAClD,GAAG,EAAE,IAAI;IACT,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,IAAI;IACT,KAAK,EAAE,IAAI;IACX,MAAM,EAAE,IAAI;CACb,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAA0B,CAAC;AAY/F;;;;;;;;;;;;sGAYsG;AACtG,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,OAAO,GAAG,KAAc,CAAC;CACnC;AAQD,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,IAAI,EAAW,CAAC;AAE3C;gFACgF;AAChF,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACnC,CAAC;AAED,iOAAiO;AACjO,MAAM,UAAU,0BAA0B,CAAC,KAA0C,EAAE,KAAa;IAClG,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,GAAG,GAAa,EAAE,CAAC;IAEzB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,IAAI,CACN,GAAG,KAAK,yNAAyN,CAClO,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,2FAA2F,CAAC,CAAC;gBAC9G,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,GAAG,CAAC,IAAI,CACN,GAAG,KAAK,4BAA4B,GAAG,4KAA4K,CACpN,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChE,GAAG,CAAC,IAAI,CACN,GAAG,KAAK,4BAA4B,GAAG,2HAA2H,CACnK,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,4BAA4B,IAAI,kBAAkB,CAAC,CAAC;YACzF,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,IAAI,CACN,GAAG,KAAK,sGAAsG,CAC/G,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;gBACnC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAChD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,kCAAkC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC;gBAC7G,CAAC;qBAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC3B,GAAG,CAAC,IAAI,CACN,GAAG,KAAK,mCAAmC,CAAC,wHAAwH,CACrK,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,IAAI,CACN,GAAG,KAAK,mGAAmG,CAC5G,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAC9B,IAAI,CAAE,uBAA6C,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChE,GAAG,CAAC,IAAI,CACN,GAAG,KAAK,6BAA6B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,8CAA8C,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzI,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gYAAgY;AAChY,SAAS,iBAAiB,CAAC,QAAgB;IACzC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,wDAAwD;IACvE,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,mPAAmP;AACnP,MAAM,UAAU,yBAAyB,CACvC,KAA0C,EAC1C,GAAW,EACX,MAAM,GAAW,KAAK;IAEtB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAExC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,8DAA8D,EAAE,CAAC;IACpG,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChE,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,gDAAgD,MAAM,CAAC,QAAQ,qDAAqD;SAC7H,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACpD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EACJ,SAAS,IAAI,gDAAgD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;gBAC1F,6DAA6D;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAE,KAAK,CAAC,OAA6B,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACjG,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,UAAU,aAAa,iDAAiD,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SAC5G,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC7B,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,IAAI,6GAA6G;aACnI,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,IAAI,oEAAoE,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aAC1H,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gTAAgT;AAChT,MAAM,UAAU,6BAA6B,CAC3C,KAA0C,EAC1C,GAAW;IAEX,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAExC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,4DAA4D,EAAE,CAAC;IAClG,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACpD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EACJ,SAAS,IAAI,gDAAgD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;gBAC1F,6DAA6D;SAChE,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iKAAiK;AACjK,MAAM,UAAU,mCAAmC,CAAC,KAA0C,EAAE,GAAW,EAAE,KAAa;IACxH,MAAM,OAAO,GAAG,6BAA6B,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO;IAC5B,MAAM,IAAI,uBAAuB,CAC/B,GAAG,KAAK,8BAA8B,GAAG,MAAM,OAAO,CAAC,MAAM,IAAI;QAC/D,2FAA2F;QAC3F,gGAAgG;QAChG,iGAAiG;QACjG,+DAA+D,CAClE,CAAC;AACJ,CAAC;AAED,yOAAyO;AACzO,MAAM,UAAU,+BAA+B,CAC7C,KAA0C,EAC1C,GAAW,EACX,MAAc,EACd,KAAa;IAEb,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO;IAC5B,IAAI,MAAM,GAAG,mBAAmB,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;IAC/E,CAAC;IACD,MAAM,IAAI,uBAAuB,CAC/B,GAAG,KAAK,aAAa,MAAM,CAAC,WAAW,EAAE,IAAI,MAAM,MAAM,OAAO,CAAC,MAAM,IAAI;QACzE,qFAAqF;QACrF,mGAAmG;QACnG,4HAA4H,CAC/H,CAAC;AACJ,CAAC;AAKD,oSAAoS;AACpS,MAAM,UAAU,oBAAoB,CAClC,KAA0C,EAC1C,KAAa,EACb,IAAoB;IAEpB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC3B,+BAA+B,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK,EAAE,KAAK,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC;AACJ,CAAC"}