openplanr 1.25.3 → 2.0.0

package/dist/services/connectors/connector-runtime.js

@@ -0,0 +1,1297 @@
+import { createHash } from 'node:crypto';
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+import { sha256CanonicalJson } from '../canonical-json.js';
+import { ConnectorCheckpointCustodyError } from './checkpoint-custody.js';
+import { readConnectorAdapterResultBytesV2 } from './connector-registry.js';
+import { ConnectorCredentialCustodyError } from './credential-custody.js';
+const HASH = /^sha256:[a-f0-9]{64}$/u;
+const ID = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/u;
+const TEXT_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
+const VERSION = /^(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)$/u;
+const PRIVATE_VALUE = /(?:^|[\s"'`(])\/(?:Users|home|private|var|etc|tmp)\/|(?:^|[\s"'`(])[A-Za-z]:[\\/][^\s]+|-----BEGIN [A-Z ]*PRIVATE KEY-----|\b(?:Bearer|Basic)\s+[A-Za-z0-9+/=._-]+|\b(?:api[-_ ]?key|access[-_ ]?token|client[-_ ]?secret|credential(?:Value)?|password|passwd|secret|token)\s*[:=]\s*[^\s]+/iu;
+const SENSITIVE_KEY = /(?:authorization|proxy-authorization|cookie|set-cookie|password|passwd|secret|token|api[-_]?key|client[-_]?secret|credentialValue|private[-_]?key)/iu;
+const RESULT_EFFECTS = Object.freeze([
+    'provider-call',
+    'operate-assignment-submit',
+    'evidence-materialization',
+]);
+export class ConnectorRuntimeErrorV2 extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = code;
+    }
+}
+function fail(code, message) {
+    throw new ConnectorRuntimeErrorV2(code, message);
+}
+function exactKeys(value, expected, label) {
+    if (JSON.stringify(Object.keys(value).sort()) !== JSON.stringify([...expected].sort())) {
+        fail('E_LIVE_EVIDENCE_REQUEST_INVALID', `${label} contains missing or unsupported fields.`);
+    }
+}
+function record(value, label) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        fail('E_LIVE_EVIDENCE_REQUEST_INVALID', `${label} must be one closed object.`);
+    }
+    return value;
+}
+function safePortable(value, key = '', seen = new Set()) {
+    if (SENSITIVE_KEY.test(key)) {
+        fail('E_LIVE_EVIDENCE_PRIVATE_DATA', 'Live-evidence input contains restricted content.');
+    }
+    if (typeof value === 'string') {
+        if (value.length > 2_048 || PRIVATE_VALUE.test(value) || value.includes('\u0000')) {
+            fail('E_LIVE_EVIDENCE_PRIVATE_DATA', 'Live-evidence input contains restricted content.');
+        }
+        return;
+    }
+    if (value === null || typeof value !== 'object')
+        return;
+    if (seen.has(value))
+        fail('E_LIVE_EVIDENCE_REQUEST_INVALID', 'Live-evidence input contains a cycle.');
+    seen.add(value);
+    try {
+        if (Array.isArray(value)) {
+            for (const entry of value)
+                safePortable(entry, key, seen);
+        }
+        else {
+            for (const [nestedKey, nested] of Object.entries(value)) {
+                safePortable(nested, nestedKey, seen);
+            }
+        }
+    }
+    finally {
+        seen.delete(value);
+    }
+}
+function sortedUnique(values, label) {
+    if (values.length < 1 ||
+        values.length > 32 ||
+        values.some((value) => !TEXT_ID.test(value)) ||
+        new Set(values).size !== values.length ||
+        values.some((value, index) => index > 0 && value.localeCompare(values[index - 1]) <= 0)) {
+        fail('E_LIVE_EVIDENCE_REQUEST_INVALID', `${label} must be unique and canonically ordered.`);
+    }
+}
+export function assertConnectorEvidenceRequestV2(value) {
+    const input = record(value, 'Live-evidence request');
+    exactKeys(input, [
+        'accountIdentityHash',
+        'actor',
+        'adapterVersion',
+        'assignmentId',
+        'bounds',
+        'claim',
+        'classification',
+        'consentExpiresAt',
+        'consentRecordId',
+        'kind',
+        'logicalCredentialRef',
+        'operation',
+        'ownerActorId',
+        'provider',
+        'purpose',
+        'queryHash',
+        'schemaVersion',
+        'scope',
+        'scopes',
+        'selectors',
+        'sensitivity',
+        'sourceContract',
+        'submissionId',
+        'window',
+    ], 'Live-evidence request');
+    const actor = record(input.actor, 'Actor');
+    const provider = record(input.provider, 'Provider');
+    const sourceContract = record(input.sourceContract, 'Source contract');
+    const scope = record(input.scope, 'Scope');
+    const window = record(input.window, 'Window');
+    const bounds = record(input.bounds, 'Bounds');
+    const claim = record(input.claim, 'Claim');
+    exactKeys(actor, ['actorId', 'kind', 'runtime'], 'Actor');
+    exactKeys(provider, ['id', 'version'], 'Provider');
+    exactKeys(sourceContract, ['id', 'version'], 'Source contract');
+    exactKeys(scope, ['domainId', 'domainVersion', 'scopeId'], 'Scope');
+    exactKeys(window, ['from', 'to'], 'Window');
+    exactKeys(bounds, ['maxBytes', 'maxCalls', 'maxPages', 'maxRecords'], 'Bounds');
+    exactKeys(claim, ['confidence', 'localClaimId', 'relation'], 'Claim');
+    safePortable(input);
+    if (input.kind !== 'openplanr-live-evidence-request' ||
+        input.schemaVersion !== '1.0.0' ||
+        typeof input.assignmentId !== 'string' ||
+        !/^asg_[A-Za-z0-9][A-Za-z0-9._-]{7,127}$/u.test(input.assignmentId) ||
+        typeof input.submissionId !== 'string' ||
+        !/^sub_[A-Za-z0-9][A-Za-z0-9._-]{7,127}$/u.test(input.submissionId) ||
+        typeof actor.actorId !== 'string' ||
+        !TEXT_ID.test(actor.actorId) ||
+        !['agent', 'human'].includes(String(actor.kind)) ||
+        typeof actor.runtime !== 'string' ||
+        !TEXT_ID.test(actor.runtime) ||
+        typeof input.ownerActorId !== 'string' ||
+        !TEXT_ID.test(input.ownerActorId) ||
+        typeof provider.id !== 'string' ||
+        !ID.test(provider.id) ||
+        typeof provider.version !== 'string' ||
+        !VERSION.test(provider.version) ||
+        typeof input.adapterVersion !== 'string' ||
+        !VERSION.test(input.adapterVersion) ||
+        typeof input.operation !== 'string' ||
+        !ID.test(input.operation) ||
+        typeof sourceContract.id !== 'string' ||
+        !ID.test(sourceContract.id) ||
+        sourceContract.version !== '1.0.0' ||
+        typeof scope.scopeId !== 'string' ||
+        !TEXT_ID.test(scope.scopeId) ||
+        typeof scope.domainId !== 'string' ||
+        !ID.test(scope.domainId) ||
+        typeof scope.domainVersion !== 'string' ||
+        !VERSION.test(scope.domainVersion) ||
+        typeof input.logicalCredentialRef !== 'string' ||
+        !TEXT_ID.test(input.logicalCredentialRef) ||
+        typeof input.consentRecordId !== 'string' ||
+        !/^lcon_[A-Za-z0-9][A-Za-z0-9._-]{7,127}$/u.test(input.consentRecordId) ||
+        typeof input.accountIdentityHash !== 'string' ||
+        !HASH.test(input.accountIdentityHash) ||
+        typeof input.queryHash !== 'string' ||
+        !HASH.test(input.queryHash) ||
+        typeof input.purpose !== 'string' ||
+        input.purpose.length < 1 ||
+        input.purpose.length > 512 ||
+        !['public', 'internal', 'confidential', 'restricted'].includes(String(input.classification)) ||
+        !['public', 'internal', 'confidential', 'restricted'].includes(String(input.sensitivity)) ||
+        typeof window.from !== 'string' ||
+        typeof window.to !== 'string' ||
+        !Number.isFinite(Date.parse(window.from)) ||
+        !Number.isFinite(Date.parse(window.to)) ||
+        Date.parse(window.from) >= Date.parse(window.to) ||
+        typeof input.consentExpiresAt !== 'string' ||
+        !Number.isFinite(Date.parse(input.consentExpiresAt)) ||
+        Date.parse(window.to) >= Date.parse(input.consentExpiresAt) ||
+        typeof claim.localClaimId !== 'string' ||
+        !TEXT_ID.test(claim.localClaimId) ||
+        !['supportedBy', 'contradictedBy'].includes(String(claim.relation)) ||
+        typeof claim.confidence !== 'number' ||
+        !Number.isFinite(claim.confidence) ||
+        claim.confidence < 0 ||
+        claim.confidence > 1) {
+        fail('E_LIVE_EVIDENCE_REQUEST_INVALID', 'Live-evidence request fields are invalid.');
+    }
+    const maxima = { maxCalls: 100, maxPages: 100, maxRecords: 10_000, maxBytes: 10_485_760 };
+    for (const [key, maximum] of Object.entries(maxima)) {
+        const bound = bounds[key];
+        if (!Number.isSafeInteger(bound) || bound < 1 || bound > maximum) {
+            fail('E_LIVE_EVIDENCE_REQUEST_INVALID', 'Live-evidence request bounds are invalid.');
+        }
+    }
+    if (!Array.isArray(input.selectors) || !Array.isArray(input.scopes)) {
+        fail('E_LIVE_EVIDENCE_REQUEST_INVALID', 'Live-evidence selectors and scopes are invalid.');
+    }
+    sortedUnique(input.selectors, 'selectors');
+    sortedUnique(input.scopes, 'scopes');
+    return Object.freeze(structuredClone(input));
+}
+function effects(executed = new Set()) {
+    return Object.freeze(RESULT_EFFECTS.map((id) => Object.freeze({ id, executed: executed.has(id) })));
+}
+function ok(operation, data, executed, nextAction) {
+    return Object.freeze({
+        ok: true,
+        operation,
+        effects: effects(executed),
+        authorityRequired: operation === 'evidence.preview',
+        ownerActionRequired: false,
+        nextAction,
+        data: Object.freeze(structuredClone(data)),
+    });
+}
+function failed(operation, code, problem, executed, options = {}) {
+    return Object.freeze({
+        ok: false,
+        operation,
+        effects: effects(executed),
+        authorityRequired: code.includes('AUTHORITY') || code.includes('CONSENT') || code.includes('OWNER_CONFIRMATION'),
+        ownerActionRequired: options.ownerActionRequired ?? false,
+        nextAction: options.nextAction ??
+            'Inspect the bounded failure and retry only after correcting its cause.',
+        error: Object.freeze({ code, problem }),
+    });
+}
+function digestId(prefix, value) {
+    return `${prefix}_${sha256CanonicalJson(value).slice('sha256:'.length, 38)}`;
+}
+function protocolDocket(request) {
+    return Object.freeze({
+        provider: Object.freeze(structuredClone(request.provider)),
+        adapterVersion: request.adapterVersion,
+        accountIdentityHash: request.accountIdentityHash,
+        selectors: Object.freeze([...request.selectors]),
+        effect: 'provider-call',
+        scopes: Object.freeze([...request.scopes]),
+        queryHash: request.queryHash,
+        window: Object.freeze(structuredClone(request.window)),
+        ceilings: Object.freeze(structuredClone(request.bounds)),
+        classification: request.classification,
+        sensitivity: request.sensitivity,
+        purpose: request.purpose,
+        expiresAt: request.consentExpiresAt,
+        changedRecordDiffHash: null,
+        consequences: Object.freeze(['The provider receives one bounded read-only evidence query.']),
+        authorityBoundary: 'consent-is-not-access-authority',
+        choices: Object.freeze(['approve', 'cancel']),
+        defaultChoice: null,
+        cancelEffect: 'none',
+    });
+}
+function consentRecord(request, docket, issuedAt) {
+    const body = {
+        kind: 'operating-live-evidence-consent-record',
+        schemaVersion: '1.0.0',
+        protocolVersion: '2.0.0',
+        consentRecordId: request.consentRecordId,
+        authority: 'none',
+        decision: 'approved',
+        docket,
+        docketHash: sha256CanonicalJson(docket),
+        actor: { actorId: request.ownerActorId, kind: 'human' },
+        provider: request.provider,
+        adapterVersion: request.adapterVersion,
+        accountIdentityHash: request.accountIdentityHash,
+        selectors: request.selectors,
+        scopes: request.scopes,
+        queryHash: request.queryHash,
+        window: request.window,
+        ceilings: request.bounds,
+        classification: request.classification,
+        purpose: request.purpose,
+        issuedAt,
+        expiresAt: request.consentExpiresAt,
+    };
+    return Object.freeze({ ...body, consentHash: sha256CanonicalJson(body) });
+}
+function exactConsentForRequest(value, request, docket) {
+    return (value.consentRecordId === request.consentRecordId &&
+        value.authority === 'none' &&
+        value.decision === 'approved' &&
+        sha256CanonicalJson(value.docket) === sha256CanonicalJson(docket) &&
+        sha256CanonicalJson(value.provider) === sha256CanonicalJson(request.provider) &&
+        value.adapterVersion === request.adapterVersion &&
+        value.accountIdentityHash === request.accountIdentityHash &&
+        sha256CanonicalJson(value.selectors) === sha256CanonicalJson(request.selectors) &&
+        sha256CanonicalJson(value.scopes) === sha256CanonicalJson(request.scopes) &&
+        value.queryHash === request.queryHash &&
+        sha256CanonicalJson(value.window) === sha256CanonicalJson(request.window) &&
+        sha256CanonicalJson(value.ceilings) === sha256CanonicalJson(request.bounds) &&
+        value.classification === request.classification &&
+        value.purpose === request.purpose &&
+        value.expiresAt === request.consentExpiresAt);
+}
+function selfHashed(body, field) {
+    return Object.freeze({ ...body, [field]: sha256CanonicalJson(body) });
+}
+function checkpointEvent(checkpoint, type, at, patch) {
+    const body = {
+        eventId: digestId('lcev', {
+            checkpointId: checkpoint.checkpointId,
+            generation: checkpoint.generation,
+            type,
+            patch,
+        }),
+        type,
+        expectedGeneration: checkpoint.generation,
+        expectedCheckpointHash: checkpoint.checkpointHash,
+        at,
+        patch,
+    };
+    return Object.freeze({ ...body, eventHash: sha256CanonicalJson(body) });
+}
+function findBaseRecord(records, identity, fields, label) {
+    const matches = records.filter((entry) => fields.every((field) => entry[field] === identity[field]));
+    if (matches.length !== 1)
+        fail('E_LIVE_EVIDENCE_PACKAGE_INVALID', `${label} is not uniquely available.`);
+    return matches[0];
+}
+function asHash(value, label) {
+    if (typeof value !== 'string' || !HASH.test(value)) {
+        fail('E_LIVE_EVIDENCE_PACKAGE_INVALID', `${label} is invalid.`);
+    }
+    return value;
+}
+function sha256Bytes(bytes) {
+    return `sha256:${createHash('sha256').update(bytes).digest('hex')}`;
+}
+export class ConnectorRuntimeV2 {
+    #registry;
+    #credentials;
+    #checkpoints;
+    #contracts;
+    #evidenceRegistry;
+    #operate;
+    #transport;
+    #now;
+    constructor(input) {
+        this.#registry = input.registry;
+        this.#credentials = input.credentials;
+        this.#checkpoints = input.checkpoints;
+        this.#contracts = input.contracts;
+        this.#evidenceRegistry = input.evidenceRegistry;
+        this.#operate = input.operate;
+        this.#transport = input.transport;
+        this.#now = input.now ?? Date.now;
+    }
+    async providers() {
+        const providers = this.#registry.list().map(({ registration, adapter }) => ({
+            provider: adapter.definition.provider,
+            adapterVersion: adapter.definition.adapterVersion,
+            category: adapter.definition.category,
+            operations: adapter.definition.operations.map(({ operation, sourceContracts }) => ({
+                operation,
+                sourceContracts,
+            })),
+            registrationHash: registration.registrationHash,
+        }));
+        return ok('evidence.providers', { providers }, new Set(), 'Preview one exact provider request before collecting evidence.');
+    }
+    async preview(value) {
+        const request = assertConnectorEvidenceRequestV2(value);
+        const selected = this.#registry.resolve({
+            providerId: request.provider.id,
+            providerVersion: request.provider.version,
+            adapterVersion: request.adapterVersion,
+            operation: request.operation,
+            sourceContractId: request.sourceContract.id,
+            domainId: request.scope.domainId,
+        });
+        const docket = protocolDocket(request);
+        return Object.freeze({
+            ok: true,
+            operation: 'evidence.preview',
+            effects: effects(),
+            authorityRequired: true,
+            ownerActionRequired: true,
+            nextAction: 'Ask the named owner to choose approve or cancel on this exact neutral docket.',
+            data: Object.freeze({
+                provider: request.provider,
+                adapterVersion: request.adapterVersion,
+                category: selected.adapter.definition.category,
+                logicalCredentialRef: request.logicalCredentialRef,
+                docket,
+                protocolDocketHash: sha256CanonicalJson(docket),
+            }),
+        });
+    }
+    async status(value) {
+        if (typeof value === 'string') {
+            const snapshot = await this.#checkpoints.readByIdentity(value);
+            const checkpoint = snapshot.checkpoint;
+            return ok('evidence.status', {
+                checkpointId: checkpoint.checkpointId,
+                requestId: checkpoint.requestId,
+                state: checkpoint.state,
+                generation: checkpoint.generation,
+                requestHash: checkpoint.requestHash,
+                artifactId: checkpoint.artifactId,
+                artifactHash: checkpoint.artifactHash,
+                updatedAt: checkpoint.updatedAt,
+            }, new Set(), checkpoint.state === 'committed'
+                ? 'Use the accepted Evidence through normal Operate reads.'
+                : 'Resume only the exact bound collection request.');
+        }
+        const request = assertConnectorEvidenceRequestV2(value);
+        const docket = protocolDocket(request);
+        const protocolBinding = Object.freeze({
+            actorId: request.ownerActorId,
+            credentialRef: request.logicalCredentialRef,
+            consentRecordId: request.consentRecordId,
+            protocolDocketHash: sha256CanonicalJson(docket),
+            provider: request.provider,
+            adapterVersion: request.adapterVersion,
+            accountIdentityHash: request.accountIdentityHash,
+        });
+        try {
+            const consent = await this.#credentials.validatedConsent({
+                ...protocolBinding,
+                requestHash: 'sha256:0000000000000000000000000000000000000000000000000000000000000000',
+            });
+            if (!exactConsentForRequest(consent, request, docket)) {
+                fail('E_LIVE_EVIDENCE_CONSENT_INVALID', 'Stored consent does not match this exact request.');
+            }
+            const protocolBindingHash = await this.#credentials.protocolBindingHash(protocolBinding);
+            const selected = this.#registry.resolve({
+                providerId: request.provider.id,
+                providerVersion: request.provider.version,
+                adapterVersion: request.adapterVersion,
+                operation: request.operation,
+                sourceContractId: request.sourceContract.id,
+                domainId: request.scope.domainId,
+            });
+            const preparation = await this.#operate.prepareLiveEvidenceSubmission({
+                assignmentId: request.assignmentId,
+                submissionId: request.submissionId,
+                actor: request.actor,
+            });
+            const baseEvidenceProvider = findBaseRecord(this.#evidenceRegistry.providers, record(selected.registration.baseEvidenceProvider, 'Provider base reference'), ['providerId', 'providerVersion'], 'Base evidence-provider registration');
+            const baseResolver = findBaseRecord(this.#evidenceRegistry.resolvers, record(selected.registration.baseResolver, 'Resolver base reference'), ['resolverId', 'resolverVersion'], 'Base evidence-resolver registration');
+            const checkpointId = digestId('lchk', { request, protocolBindingHash });
+            const snapshot = await this.#checkpoints.readByIdentity(checkpointId);
+            const context = this.#checkpointContext({
+                request,
+                preparation,
+                registration: selected.registration,
+                baseEvidenceProvider,
+                baseResolver,
+                consent,
+                protocolBindingHash,
+                health: record(snapshot.checkpoint.health, 'Stored provider health'),
+            });
+            const checkpoint = snapshot.checkpoint;
+            this.#assertCheckpointContext(context, checkpoint);
+            return ok('evidence.status', {
+                checkpointId: context.checkpointId,
+                state: checkpoint.state,
+                generation: checkpoint.generation,
+                requestHash: checkpoint.requestHash,
+                artifactId: checkpoint.artifactId,
+                artifactHash: checkpoint.artifactHash,
+                updatedAt: checkpoint.updatedAt,
+            }, new Set(), checkpoint.state === 'committed'
+                ? 'Use the accepted Evidence through normal Operate reads.'
+                : 'Resume the exact collection request; changed inputs will conflict.');
+        }
+        catch (error) {
+            if (error instanceof ConnectorCheckpointCustodyError &&
+                error.code === 'LIVE_EVIDENCE_CHECKPOINT_NOT_FOUND') {
+                return failed('evidence.status', error.code, 'No checkpoint exists for this exact request.', new Set(), { nextAction: 'Preview the request before choosing whether to collect.' });
+            }
+            throw error;
+        }
+    }
+    #checkpointContext(input) {
+        const { request, preparation, registration, baseEvidenceProvider, baseResolver, consent, protocolBindingHash, health, } = input;
+        const sourceIdentityHash = sha256CanonicalJson({
+            provider: request.provider,
+            adapterVersion: request.adapterVersion,
+            accountIdentityHash: request.accountIdentityHash,
+            selectors: request.selectors,
+            sourceContract: request.sourceContract,
+        });
+        const checkpointId = digestId('lchk', { request, protocolBindingHash });
+        const requestId = digestId('lreq', { request, protocolBindingHash });
+        const createdAt = String(consent.issuedAt);
+        const immutable = {
+            kind: 'operating-connector-checkpoint',
+            schemaVersion: '1.0.0',
+            protocolVersion: '2.0.0',
+            checkpointId,
+            requestId,
+            effect: 'provider-call',
+            provider: request.provider,
+            providerRegistrationHash: registration.registrationHash,
+            adapterVersion: request.adapterVersion,
+            sourceIdentityHash,
+            credentialRefHash: sha256CanonicalJson({
+                logicalCredentialRef: request.logicalCredentialRef,
+                protocolDocket: protocolDocket(request),
+            }),
+            boundsHash: sha256CanonicalJson(request.bounds),
+            queryHash: request.queryHash,
+            windowHash: sha256CanonicalJson(request.window),
+            health,
+            redactionVersion: '1.0.0',
+            createdAt,
+        };
+        const provisionalRequesting = selfHashed({
+            ...immutable,
+            generation: 1,
+            lastEventId: digestId('lcev', { checkpointId, type: 'request' }),
+            lastEventHash: sha256CanonicalJson({ checkpointId, type: 'request' }),
+            state: 'requesting',
+            requestHash: 'sha256:0000000000000000000000000000000000000000000000000000000000000000',
+            consentRecordId: consent.consentRecordId,
+            consentRecordHash: consent.consentHash,
+            consentExpiresAt: consent.expiresAt,
+            runtimeCapabilityHash: protocolBindingHash,
+            predecessorDigest: 'sha256:0000000000000000000000000000000000000000000000000000000000000000',
+            watermarkDigest: null,
+            artifactId: null,
+            artifactHash: null,
+            absenceDigest: null,
+            updatedAt: createdAt,
+        }, 'checkpointHash');
+        this.#contracts.assertOperatingConnectorCheckpointV2(provisionalRequesting);
+        const requestHash = this.#contracts.deriveOperatingLiveEvidenceRequestHashV2({
+            assignment: preparation.assignment,
+            consentRecord: consent,
+            connectorCheckpoint: provisionalRequesting,
+            liveProviderRegistration: registration,
+            baseEvidenceProvider,
+            baseResolver,
+            sourceContract: request.sourceContract,
+            classification: request.classification,
+        });
+        const prepared = this.#contracts.assertOperatingConnectorCheckpointV2(selfHashed({
+            ...immutable,
+            generation: 0,
+            lastEventId: null,
+            lastEventHash: null,
+            state: 'prepared',
+            requestHash,
+            consentRecordId: null,
+            consentRecordHash: null,
+            consentExpiresAt: null,
+            runtimeCapabilityHash: null,
+            predecessorDigest: null,
+            watermarkDigest: null,
+            artifactId: null,
+            artifactHash: null,
+            absenceDigest: null,
+            updatedAt: createdAt,
+        }, 'checkpointHash'));
+        return Object.freeze({
+            checkpointId,
+            requestId,
+            requestHash,
+            sourceIdentityHash,
+            health,
+            prepared,
+        });
+    }
+    #assertCheckpointContext(context, checkpoint) {
+        const immutableFields = [
+            'kind',
+            'schemaVersion',
+            'protocolVersion',
+            'checkpointId',
+            'requestId',
+            'effect',
+            'provider',
+            'providerRegistrationHash',
+            'adapterVersion',
+            'sourceIdentityHash',
+            'credentialRefHash',
+            'boundsHash',
+            'queryHash',
+            'windowHash',
+            'health',
+            'redactionVersion',
+            'createdAt',
+            'requestHash',
+        ];
+        if (immutableFields.some((field) => sha256CanonicalJson(checkpoint[field]) !== sha256CanonicalJson(context.prepared[field]))) {
+            fail('E_LIVE_EVIDENCE_CHECKPOINT_CONFLICT', 'Stored checkpoint custody does not match the exact request.');
+        }
+    }
+    #assertPreflightHealth(health) {
+        if (health.status !== 'available' ||
+            !HASH.test(health.proofDigest) ||
+            !Number.isFinite(Date.parse(health.checkedAt)) ||
+            !Number.isFinite(Date.parse(health.freshUntil)) ||
+            Date.parse(health.checkedAt) >= Date.parse(health.freshUntil) ||
+            this.#now() >= Date.parse(health.freshUntil)) {
+            fail('E_LIVE_EVIDENCE_PROVIDER_UNHEALTHY', 'The provider lacks one current trusted available-health proof.');
+        }
+    }
+    async collect(value, options = {}) {
+        const operation = 'evidence.collect';
+        const executed = new Set();
+        const request = assertConnectorEvidenceRequestV2(value);
+        const selected = this.#registry.resolve({
+            providerId: request.provider.id,
+            providerVersion: request.provider.version,
+            adapterVersion: request.adapterVersion,
+            operation: request.operation,
+            sourceContractId: request.sourceContract.id,
+            domainId: request.scope.domainId,
+        });
+        const registration = selected.registration;
+        const operationDefinition = selected.adapter.definition.operations.find((candidate) => candidate.operation === request.operation);
+        if (!operationDefinition) {
+            fail('E_LIVE_EVIDENCE_PROVIDER_INCOMPATIBLE', 'The exact provider operation is unavailable.');
+        }
+        const registrationBounds = record(registration.bounds, 'Registration bounds');
+        for (const key of ['maxCalls', 'maxPages', 'maxRecords', 'maxBytes']) {
+            if (request.bounds[key] > Number(registrationBounds[key])) {
+                return failed(operation, 'E_LIVE_EVIDENCE_SCOPE_EXPANSION', 'The request exceeds the frozen provider bounds.', executed, {
+                    ownerActionRequired: true,
+                    nextAction: 'Ask the owner to approve a separately registered bounded provider scope.',
+                });
+            }
+        }
+        if (!selected.adapter.definition.scopes.every((scope) => request.scopes.includes(scope)) ||
+            !request.scopes.every((scope) => selected.adapter.definition.scopes.includes(scope))) {
+            return failed(operation, 'E_LIVE_EVIDENCE_SCOPE_EXPANSION', 'The request scopes differ from the frozen adapter scopes.', executed, {
+                ownerActionRequired: true,
+                nextAction: 'Ask the owner to approve a separately registered exact scope.',
+            });
+        }
+        const docket = protocolDocket(request);
+        const protocolDocketHash = sha256CanonicalJson(docket);
+        const protocolBinding = Object.freeze({
+            actorId: request.ownerActorId,
+            credentialRef: request.logicalCredentialRef,
+            consentRecordId: request.consentRecordId,
+            protocolDocketHash,
+            provider: request.provider,
+            adapterVersion: request.adapterVersion,
+            accountIdentityHash: request.accountIdentityHash,
+        });
+        const proposedConsent = this.#contracts.assertOperatingLiveEvidenceConsentRecordV2(consentRecord(request, docket, new Date(this.#now()).toISOString()));
+        let currentConsent = null;
+        try {
+            currentConsent = await this.#credentials.validatedConsent({
+                ...protocolBinding,
+                requestHash: 'sha256:0000000000000000000000000000000000000000000000000000000000000000',
+            });
+        }
+        catch (error) {
+            if (!(error instanceof ConnectorCredentialCustodyError) ||
+                !['LIVE_EVIDENCE_CONSENT_INVALID', 'LIVE_EVIDENCE_CONSENT_EXPIRED'].includes(error.code)) {
+                throw error;
+            }
+        }
+        if (currentConsent && !exactConsentForRequest(currentConsent, request, docket)) {
+            currentConsent = null;
+        }
+        if (!currentConsent && !options.allowOwnerConfirmation) {
+            return failed(operation, 'E_LIVE_EVIDENCE_OWNER_CONFIRMATION_REQUIRED', 'The exact current owner consent grant is unavailable or changed.', executed, {
+                ownerActionRequired: true,
+                nextAction: 'Ask the named owner to review the exact neutral consent docket.',
+            });
+        }
+        const preparation = await this.#operate.prepareLiveEvidenceSubmission({
+            assignmentId: request.assignmentId,
+            submissionId: request.submissionId,
+            actor: request.actor,
+        });
+        const baseEvidenceProvider = findBaseRecord(this.#evidenceRegistry.providers, record(registration.baseEvidenceProvider, 'Provider base reference'), ['providerId', 'providerVersion'], 'Base evidence-provider registration');
+        const baseResolver = findBaseRecord(this.#evidenceRegistry.resolvers, record(registration.baseResolver, 'Resolver base reference'), ['resolverId', 'resolverVersion'], 'Base evidence-resolver registration');
+        const consent = currentConsent ?? proposedConsent;
+        const protocolBindingHash = currentConsent
+            ? await this.#credentials.protocolBindingHash(protocolBinding)
+            : sha256CanonicalJson({
+                domain: 'openplanr-local-live-evidence-capability-binding-v2',
+                authority: 'none',
+                bindingHash: sha256CanonicalJson(protocolBinding),
+                consentHash: proposedConsent.consentHash,
+            });
+        const checkpointId = digestId('lchk', { request, protocolBindingHash });
+        let snapshot;
+        let activeContext;
+        try {
+            snapshot = await this.#checkpoints.readByIdentity(checkpointId);
+            activeContext = this.#checkpointContext({
+                request,
+                preparation,
+                registration,
+                baseEvidenceProvider,
+                baseResolver,
+                consent,
+                protocolBindingHash,
+                health: record(snapshot.checkpoint.health, 'Stored provider health'),
+            });
+            this.#assertCheckpointContext(activeContext, snapshot.checkpoint);
+        }
+        catch (error) {
+            if (!(error instanceof ConnectorCheckpointCustodyError) ||
+                error.code !== 'LIVE_EVIDENCE_CHECKPOINT_NOT_FOUND') {
+                throw error;
+            }
+            const preflightHealth = this.#transport.health({ request, registration });
+            this.#assertPreflightHealth(preflightHealth);
+            activeContext = this.#checkpointContext({
+                request,
+                preparation,
+                registration,
+                baseEvidenceProvider,
+                baseResolver,
+                consent,
+                protocolBindingHash,
+                health: preflightHealth,
+            });
+        }
+        const credentialBinding = Object.freeze({
+            ...protocolBinding,
+            requestHash: activeContext.requestHash,
+        });
+        let confirmedCapability;
+        if (!currentConsent) {
+            const confirmation = await this.#credentials.issueOwnerConfirmation({
+                binding: credentialBinding,
+                proposedConsentRecord: proposedConsent,
+            });
+            confirmedCapability = await this.#credentials.issueCapability({
+                binding: credentialBinding,
+                ownerConfirmation: confirmation,
+            });
+            currentConsent = await this.#credentials.validatedConsent(credentialBinding);
+            if (!exactConsentForRequest(currentConsent, request, docket)) {
+                fail('E_LIVE_EVIDENCE_CONSENT_INVALID', 'Confirmed consent does not match the exact request.');
+            }
+            const persistedBindingHash = await this.#credentials.protocolBindingHash(protocolBinding);
+            if (persistedBindingHash !== protocolBindingHash) {
+                fail('E_LIVE_EVIDENCE_CONSENT_INVALID', 'Confirmed consent changed its protocol binding.');
+            }
+        }
+        if (!snapshot) {
+            snapshot = await this.#checkpoints.initialize(activeContext.prepared);
+        }
+        const { sourceIdentityHash } = activeContext;
+        let checkpoint = snapshot.checkpoint;
+        if (checkpoint.state === 'committed') {
+            return ok(operation, this.#acceptedSummary(checkpoint, snapshot.evidence?.bytes), executed, 'Use the existing accepted Evidence; no provider or Store effect was repeated.');
+        }
+        if (checkpoint.state === 'materialized') {
+            return this.#completeMaterialized(request, preparation, registration, baseEvidenceProvider, baseResolver, consent, checkpoint, snapshot.evidence?.bytes, executed, snapshot.checkpointHistory);
+        }
+        this.#assertPreflightHealth(checkpoint.health);
+        const capability = confirmedCapability ??
+            (await this.#credentials.issueCapability({ binding: credentialBinding }));
+        if (checkpoint.state === 'prepared') {
+            const requestedAt = new Date(this.#now()).toISOString();
+            snapshot = await this.#checkpoints.transition({
+                checkpointId,
+                event: checkpointEvent(checkpoint, 'request', requestedAt, {
+                    consentRecordId: consent.consentRecordId,
+                    consentRecordHash: consent.consentHash,
+                    consentExpiresAt: consent.expiresAt,
+                    runtimeCapabilityHash: protocolBindingHash,
+                    health: checkpoint.health,
+                }),
+            });
+            checkpoint = snapshot.checkpoint;
+        }
+        if (checkpoint.state !== 'requesting') {
+            return failed(operation, 'E_LIVE_EVIDENCE_CHECKPOINT_TERMINAL', 'The exact request already reached a non-materialized terminal checkpoint.', executed, { nextAction: 'Inspect the typed absence or uncertainty before creating a new request.' });
+        }
+        let providerResult;
+        try {
+            providerResult = await this.#credentials.withResolvedCredential(capability, credentialBinding, async (credential) => {
+                executed.add('provider-call');
+                return this.#transport.execute({
+                    request,
+                    registration,
+                    collection: operationDefinition.collection,
+                    credential,
+                    expectedHealth: checkpoint.health,
+                });
+            });
+        }
+        catch (error) {
+            if (error instanceof ConnectorCredentialCustodyError)
+                throw error;
+            const observedAt = new Date(this.#now()).toISOString();
+            providerResult = {
+                status: 'uncertain',
+                requestedAt: String(checkpoint.updatedAt),
+                capturedAt: observedAt,
+                freshUntil: new Date(this.#now() + 60_000).toISOString(),
+                health: {
+                    status: 'unavailable',
+                    checkedAt: observedAt,
+                    freshUntil: new Date(this.#now() + 60_000).toISOString(),
+                    proofDigest: sha256CanonicalJson({
+                        domain: 'openplanr-live-evidence-provider-unavailable-v2',
+                        provider: request.provider,
+                        requestHash: checkpoint.requestHash,
+                        observedAt,
+                    }),
+                },
+                payload: {},
+                absence: {
+                    kind: 'provider-unavailable',
+                    reasonCode: 'PROVIDER_UNAVAILABLE',
+                    required: true,
+                    observedAt,
+                    details: { retryable: false },
+                },
+            };
+        }
+        if (providerResult.status === 'materialized' &&
+            (providerResult.health.status !== 'available' ||
+                sha256CanonicalJson(providerResult.health) !== sha256CanonicalJson(checkpoint.health))) {
+            const observedAt = providerResult.capturedAt;
+            providerResult = {
+                ...providerResult,
+                status: 'uncertain',
+                payload: {},
+                absence: {
+                    kind: 'unhealthy',
+                    reasonCode: 'PROVIDER_HEALTH_DIVERGED',
+                    required: true,
+                    observedAt,
+                    details: { expectedProofDigest: checkpoint.health.proofDigest },
+                },
+            };
+        }
+        const adapterResult = selected.adapter.normalize({
+            operation: request.operation,
+            sourceContract: request.sourceContract,
+            requestHash: asHash(checkpoint.requestHash, 'Checkpoint request hash'),
+            sourceIdentityHash,
+            classification: request.classification,
+            status: providerResult.status,
+            requestedAt: providerResult.requestedAt,
+            capturedAt: providerResult.capturedAt,
+            freshUntil: providerResult.freshUntil,
+            health: providerResult.health,
+            bounds: request.bounds,
+            payload: providerResult.payload,
+            ...(providerResult.absence ? { absence: providerResult.absence } : {}),
+        });
+        if (adapterResult.status !== 'materialized') {
+            const absence = adapterResult.absences[0];
+            const terminalType = adapterResult.status === 'uncertain' ? 'uncertain' : 'absent';
+            await this.#checkpoints.transition({
+                checkpointId,
+                event: checkpointEvent(checkpoint, terminalType, adapterResult.sourceTiming.capturedAt, {
+                    absenceDigest: absence.detailsHash,
+                    health: adapterResult.health,
+                }),
+                ...(providerResult.providerCursor ? { providerCursor: providerResult.providerCursor } : {}),
+            });
+            return failed(operation, absence.reasonCode, 'The exact provider returned a typed absence or uncertain result.', executed, { nextAction: 'Resolve the declared provider condition or create a new bounded request.' });
+        }
+        const redactedBytes = readConnectorAdapterResultBytesV2(adapterResult);
+        if (sha256Bytes(redactedBytes) !== adapterResult.redactedBytesDigest) {
+            fail('E_LIVE_EVIDENCE_RESPONSE_INVALID', 'Redacted adapter bytes changed after validation.');
+        }
+        const ingestion = this.#buildIngestion({
+            request,
+            preparation,
+            registration,
+            baseResolver,
+            consent,
+            checkpoint,
+            adapterResult,
+        });
+        const ingestionBytes = Buffer.from(JSON.stringify(ingestion), 'utf8');
+        snapshot = await this.#checkpoints.transition({
+            checkpointId,
+            event: checkpointEvent(checkpoint, 'materialize', adapterResult.sourceTiming.capturedAt, {
+                artifactId: preparation.artifactId,
+                artifactHash: sha256CanonicalJson(ingestion),
+                watermarkDigest: providerResult.providerCursor
+                    ? sha256Bytes(providerResult.providerCursor)
+                    : null,
+                health: adapterResult.health,
+            }),
+            evidenceBytes: ingestionBytes,
+            evidenceFreshness: {
+                capturedAt: adapterResult.sourceTiming.capturedAt,
+                freshUntil: adapterResult.sourceTiming.freshUntil,
+            },
+            ...(providerResult.providerCursor ? { providerCursor: providerResult.providerCursor } : {}),
+        });
+        return this.#completeMaterialized(request, preparation, registration, baseEvidenceProvider, baseResolver, consent, snapshot.checkpoint, snapshot.evidence?.bytes, executed, snapshot.checkpointHistory);
+    }
+    #buildIngestion(input) {
+        const { request, preparation, registration, consent, checkpoint, adapterResult } = input;
+        const assignment = preparation.assignment;
+        const candidate = {
+            kind: 'operating-evidence-candidate',
+            schemaVersion: '1.0.0',
+            protocolVersion: '2.0.0',
+            candidateId: preparation.candidateId,
+            scopeId: request.scope.scopeId,
+            domainId: request.scope.domainId,
+            domainVersion: request.scope.domainVersion,
+            sourceArtifactId: preparation.artifactId,
+            evidenceKind: 'operate-artifact',
+            locator: {
+                artifactId: preparation.artifactId,
+                expectedArtifactType: 'live-evidence-ingestion',
+                expectedSchemaId: 'operating-live-evidence-ingestion',
+                expectedSchemaVersion: '2.0.0',
+            },
+            provider: {
+                id: registration.baseEvidenceProvider.providerId,
+                version: registration.baseEvidenceProvider.providerVersion,
+            },
+            resolver: {
+                id: registration.baseResolver.resolverId,
+                version: registration.baseResolver.resolverVersion,
+            },
+        };
+        const body = {
+            kind: 'operating-live-evidence-ingestion',
+            schemaVersion: '1.0.0',
+            protocolVersion: '2.0.0',
+            ingestionId: preparation.ingestionId,
+            requestId: checkpoint.requestId,
+            requestHash: checkpoint.requestHash,
+            assignment: {
+                assignmentId: assignment.assignmentId,
+                assignmentRevision: 1,
+                assignmentHash: sha256CanonicalJson(assignment),
+                requestHash: checkpoint.requestHash,
+                assignmentKind: 'verification',
+                outputContract: {
+                    schemaId: 'operating-live-evidence-ingestion',
+                    schemaVersion: '2.0.0',
+                },
+            },
+            submission: {
+                operation: 'operate.assignment.submit',
+                submissionId: preparation.submissionId,
+                submittedEventId: preparation.acceptanceEventIds.submitted,
+                artifactCreatedEventId: preparation.acceptanceEventIds.artifactCreated,
+                validatedEventId: preparation.acceptanceEventIds.validated,
+                artifactId: preparation.artifactId,
+                evidenceRefId: preparation.evidenceRefId,
+            },
+            provider: request.provider,
+            providerRegistration: registration.baseEvidenceProvider,
+            providerRegistrationHash: registration.registrationHash,
+            resolverRegistration: registration.baseResolver,
+            resolverRegistrationHash: registration.baseResolver.recordDigest,
+            adapterVersion: request.adapterVersion,
+            status: 'materialized',
+            consentRecordHash: consent.consentHash,
+            runtimeCapabilityHash: checkpoint.runtimeCapabilityHash,
+            checkpoint: {
+                checkpointId: checkpoint.checkpointId,
+                predecessorDigest: checkpoint.predecessorDigest,
+                checkpointHash: checkpoint.checkpointHash,
+            },
+            health: adapterResult.health,
+            boundsHash: sha256CanonicalJson(request.bounds),
+            classification: request.classification,
+            sourceContract: request.sourceContract,
+            sourceTiming: adapterResult.sourceTiming,
+            records: adapterResult.records,
+            absences: [],
+            evidenceCandidates: [candidate],
+            evidenceClaimLinks: [
+                {
+                    candidateId: preparation.candidateId,
+                    sourceArtifactId: preparation.artifactId,
+                    localClaimId: request.claim.localClaimId,
+                    relation: request.claim.relation,
+                    confidence: request.claim.confidence,
+                },
+            ],
+            materialization: {
+                artifactId: preparation.artifactId,
+                artifactCreatedEventId: preparation.acceptanceEventIds.artifactCreated,
+                evidenceRefId: preparation.evidenceRefId,
+                contentDigest: 'sha256:0000000000000000000000000000000000000000000000000000000000000000',
+                redactionVersion: '1.0.0',
+            },
+        };
+        body.materialization.contentDigest =
+            this.#contracts.deriveOperatingLiveEvidenceContentDigestV2(body);
+        body.ingestionHash = sha256CanonicalJson(body);
+        return Object.freeze(body);
+    }
+    #acceptedSummary(checkpoint, bytes) {
+        if (!bytes)
+            fail('E_LIVE_EVIDENCE_CHECKPOINT_INVALID', 'Accepted evidence custody is unavailable.');
+        let ingestion;
+        try {
+            ingestion = record(JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes)), 'Accepted ingestion');
+        }
+        catch {
+            fail('E_LIVE_EVIDENCE_CHECKPOINT_INVALID', 'Accepted evidence custody is invalid.');
+        }
+        const submission = record(ingestion.submission, 'Accepted submission');
+        return Object.freeze({
+            checkpointId: checkpoint.checkpointId,
+            state: checkpoint.state,
+            requestHash: checkpoint.requestHash,
+            artifactId: checkpoint.artifactId,
+            artifactHash: checkpoint.artifactHash,
+            evidenceRefId: submission.evidenceRefId,
+            ingestionId: ingestion.ingestionId,
+            replayed: true,
+        });
+    }
+    async #completeMaterialized(request, preparation, registration, baseEvidenceProvider, baseResolver, consent, checkpoint, bytes, executed, checkpointHistory = []) {
+        if (!bytes)
+            fail('E_LIVE_EVIDENCE_CHECKPOINT_INVALID', 'Materialized evidence bytes are unavailable.');
+        const ingestion = record(JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes)), 'Materialized ingestion');
+        const requestingCheckpoints = checkpointHistory.filter((candidate) => candidate.state === 'requesting');
+        if (requestingCheckpoints.length !== 1) {
+            fail('E_LIVE_EVIDENCE_CHECKPOINT_INVALID', 'Materialized evidence does not retain one exact requesting checkpoint.');
+        }
+        const requestingCheckpoint = requestingCheckpoints[0];
+        this.#contracts.assertOperatingLiveEvidenceIngestionV2(ingestion, {
+            liveProviderRegistration: registration,
+            baseEvidenceProvider,
+            baseResolver,
+            assignment: preparation.assignment,
+            consentRecord: consent,
+            connectorCheckpoint: requestingCheckpoint,
+        });
+        const result = await this.#operate.acceptLiveEvidenceSubmission({
+            assignmentId: request.assignmentId,
+            submissionId: request.submissionId,
+            actor: request.actor,
+            preparationHash: preparation.preparationHash,
+            contentBase64: Buffer.from(bytes).toString('base64'),
+            custody: {
+                issuedAssignment: preparation.assignment,
+                liveProviderRegistration: registration,
+                baseEvidenceProvider,
+                baseResolver,
+                consentRecord: consent,
+                connectorCheckpoint: requestingCheckpoint,
+                resultCheckpoint: checkpoint,
+                checkpointHistory: [],
+            },
+        });
+        executed.add('operate-assignment-submit');
+        executed.add('evidence-materialization');
+        const committedAt = new Date(this.#now()).toISOString();
+        const committed = await this.#checkpoints.transition({
+            checkpointId: String(checkpoint.checkpointId),
+            event: checkpointEvent(checkpoint, 'commit', committedAt, {
+                watermarkDigest: checkpoint.watermarkDigest,
+            }),
+        });
+        return ok('evidence.collect', {
+            checkpointId: committed.checkpoint.checkpointId,
+            state: committed.checkpoint.state,
+            requestHash: committed.checkpoint.requestHash,
+            artifactId: result.artifactId,
+            artifactHash: result.artifactHash,
+            evidenceRefId: result.evidenceRefId,
+            evidenceArtifactId: result.evidenceArtifactId,
+            resolutionId: result.resolutionId,
+            replayed: result.replayed,
+        }, executed, 'Use the accepted Evidence through normal Operate reads.');
+    }
+}
+export function createConnectorRuntimeV2(input) {
+    return new ConnectorRuntimeV2(input);
+}
+function privateAddress(address) {
+    if (address.includes(':')) {
+        const value = address.toLowerCase();
+        const dotted = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/u.exec(value)?.[1];
+        const words = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/u.exec(value);
+        if (dotted)
+            return privateAddress(dotted);
+        if (words) {
+            const high = Number.parseInt(words[1], 16);
+            const low = Number.parseInt(words[2], 16);
+            return privateAddress(`${high >>> 8}.${high & 0xff}.${low >>> 8}.${low & 0xff}`);
+        }
+        return (value === '::' ||
+            value === '::1' ||
+            value.startsWith('fc') ||
+            value.startsWith('fd') ||
+            /^fe[89ab]/u.test(value) ||
+            value.startsWith('ff'));
+    }
+    const parts = address.split('.').map(Number);
+    return (parts[0] === 0 ||
+        parts[0] === 10 ||
+        parts[0] === 127 ||
+        (parts[0] === 169 && parts[1] === 254) ||
+        (parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31) ||
+        (parts[0] === 192 && parts[1] === 168) ||
+        (parts[0] === 100 && parts[1] >= 64 && parts[1] <= 127) ||
+        parts[0] >= 224);
+}
+async function assertTransportTarget(url, allowLoopback, resolveHost) {
+    const exactLoopback = url.hostname === '127.0.0.1' || url.hostname === '[::1]';
+    if (url.username ||
+        url.password ||
+        url.search ||
+        url.hash ||
+        (url.protocol !== 'https:' && !(allowLoopback && exactLoopback && url.protocol === 'http:'))) {
+        fail('E_LIVE_EVIDENCE_TRANSPORT_FORBIDDEN', 'Provider transport target is not allowed.');
+    }
+    const addresses = isIP(url.hostname.replace(/^\[|\]$/gu, ''))
+        ? [{ address: url.hostname.replace(/^\[|\]$/gu, '') }]
+        : await resolveHost(url.hostname);
+    if (addresses.length === 0 ||
+        addresses.some(({ address }) => privateAddress(address) && !(allowLoopback && exactLoopback))) {
+        fail('E_LIVE_EVIDENCE_TRANSPORT_FORBIDDEN', 'Provider address is not allowed.');
+    }
+    return Object.freeze(addresses.map(({ address }) => address.toLowerCase()).sort());
+}
+async function boundedResponseBytes(response, maxBytes) {
+    const declared = response.headers.get('content-length');
+    if (declared && Number(declared) > maxBytes) {
+        fail('E_LIVE_EVIDENCE_RESPONSE_TOO_LARGE', 'Provider response exceeds the exact byte ceiling.');
+    }
+    if (!response.body)
+        fail('E_LIVE_EVIDENCE_RESPONSE_INVALID', 'Provider response body is unavailable.');
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            total += value.byteLength;
+            if (total > maxBytes) {
+                await reader.cancel();
+                fail('E_LIVE_EVIDENCE_RESPONSE_TOO_LARGE', 'Provider response exceeds the exact byte ceiling.');
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const output = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        output.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return output;
+}
+function csvPayload(text, collection, observedAt) {
+    const rows = text.trim().split(/\r?\n/u);
+    if (rows.length < 2)
+        fail('E_LIVE_EVIDENCE_RESPONSE_INVALID', 'CSV response is empty.');
+    const headings = rows[0].split(',').map((value) => value.trim());
+    if (headings.some((value) => !TEXT_ID.test(value))) {
+        fail('E_LIVE_EVIDENCE_RESPONSE_INVALID', 'CSV headings are invalid.');
+    }
+    return {
+        [collection]: rows.slice(1).map((row, index) => {
+            const values = row.split(',').map((value) => value.trim());
+            if (values.length !== headings.length) {
+                fail('E_LIVE_EVIDENCE_RESPONSE_INVALID', 'CSV row shape changed.');
+            }
+            return {
+                id: `row-${index + 1}`,
+                observedAt,
+                data: Object.fromEntries(headings.map((heading, position) => [heading, values[position]])),
+            };
+        }),
+    };
+}
+export function createBoundedFetchConnectorTransportV2(input) {
+    const policies = new Map(input.policies.map((policy) => [policy.providerId, policy]));
+    if (policies.size !== input.policies.length) {
+        fail('E_LIVE_EVIDENCE_TRANSPORT_CONFIG_INVALID', 'Provider transport policy is duplicated.');
+    }
+    const fetchImpl = input.fetchImpl ?? fetch;
+    const now = input.now ?? Date.now;
+    const resolveHost = input.resolveHost ??
+        (async (hostname) => lookup(hostname, { all: true, verbatim: true }));
+    return Object.freeze({
+        health({ request }) {
+            const policy = policies.get(request.provider.id);
+            if (!policy)
+                fail('E_LIVE_EVIDENCE_TRANSPORT_CONFIG_INVALID', 'Provider policy is unavailable.');
+            const checkedAt = new Date(now()).toISOString();
+            const freshUntil = new Date(now() + Math.min(policy.timeoutMs * 2, 300_000)).toISOString();
+            return Object.freeze({
+                status: 'available',
+                checkedAt,
+                freshUntil,
+                proofDigest: sha256CanonicalJson({
+                    domain: 'openplanr-live-evidence-transport-health-v2',
+                    provider: request.provider,
+                    origin: policy.origin,
+                    checkedAt,
+                    freshUntil,
+                }),
+            });
+        },
+        async execute({ request, collection, credential, expectedHealth }) {
+            const policy = policies.get(request.provider.id);
+            if (!policy)
+                fail('E_LIVE_EVIDENCE_TRANSPORT_CONFIG_INVALID', 'Provider policy is unavailable.');
+            const pathname = policy.pathnameByOperation[request.operation];
+            if (typeof pathname !== 'string' || !pathname.startsWith('/') || pathname.includes('?')) {
+                fail('E_LIVE_EVIDENCE_TRANSPORT_CONFIG_INVALID', 'Provider operation path is unavailable.');
+            }
+            const origin = new URL(policy.origin);
+            const beforeAddresses = await assertTransportTarget(origin, policy.allowLoopback, resolveHost);
+            const target = new URL(pathname, origin);
+            if (target.origin !== origin.origin) {
+                fail('E_LIVE_EVIDENCE_TRANSPORT_FORBIDDEN', 'Provider operation escaped its allowed origin.');
+            }
+            const requestedAt = new Date(now()).toISOString();
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), policy.timeoutMs);
+            let response;
+            try {
+                response = await fetchImpl(target, {
+                    method: 'GET',
+                    redirect: 'manual',
+                    headers: {
+                        accept: 'application/json, text/csv',
+                        authorization: `${policy.authorizationScheme} ${Buffer.from(credential).toString('utf8')}`,
+                    },
+                    signal: controller.signal,
+                });
+            }
+            finally {
+                clearTimeout(timeout);
+            }
+            const afterAddresses = await assertTransportTarget(origin, policy.allowLoopback, resolveHost);
+            if (JSON.stringify(afterAddresses) !== JSON.stringify(beforeAddresses)) {
+                fail('E_LIVE_EVIDENCE_DNS_REBINDING', 'Provider address resolution changed during the bounded request.');
+            }
+            if (response.status >= 300 && response.status < 400) {
+                fail('E_LIVE_EVIDENCE_REDIRECT_FORBIDDEN', 'Provider redirects are not followed.');
+            }
+            const capturedAt = new Date(now()).toISOString();
+            const health = Object.freeze({
+                status: response.ok ? 'available' : 'unavailable',
+                checkedAt: capturedAt,
+                freshUntil: new Date(now() + 60_000).toISOString(),
+                proofDigest: sha256CanonicalJson({
+                    domain: 'openplanr-live-evidence-http-health-v2',
+                    provider: request.provider,
+                    status: response.status,
+                    capturedAt,
+                }),
+            });
+            if (!response.ok) {
+                return {
+                    status: 'absent',
+                    requestedAt,
+                    capturedAt,
+                    freshUntil: health.freshUntil,
+                    health,
+                    payload: {},
+                    absence: {
+                        kind: response.status === 429 ? 'rate-limited' : 'provider-unavailable',
+                        reasonCode: response.status === 429 ? 'RATE_LIMITED' : 'PROVIDER_UNAVAILABLE',
+                        required: true,
+                        observedAt: capturedAt,
+                        details: { statusClass: `${Math.floor(response.status / 100)}xx` },
+                    },
+                };
+            }
+            const mediaType = response.headers.get('content-type')?.split(';', 1)[0]?.trim();
+            if (mediaType !== 'application/json' && mediaType !== 'text/csv') {
+                fail('E_LIVE_EVIDENCE_RESPONSE_INVALID', 'Provider response media type is unsupported.');
+            }
+            const bytes = await boundedResponseBytes(response, request.bounds.maxBytes);
+            const text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+            let payload;
+            try {
+                payload =
+                    mediaType === 'text/csv' ? csvPayload(text, collection, capturedAt) : JSON.parse(text);
+            }
+            catch (cause) {
+                if (cause instanceof ConnectorRuntimeErrorV2)
+                    throw cause;
+                fail('E_LIVE_EVIDENCE_RESPONSE_INVALID', 'Provider response is invalid UTF-8 data.');
+            }
+            return {
+                status: 'materialized',
+                requestedAt,
+                capturedAt,
+                freshUntil: new Date(now() + 300_000).toISOString(),
+                health: expectedHealth,
+                payload,
+            };
+        },
+    });
+}
+//# sourceMappingURL=connector-runtime.js.map