@cat-factory/integrations 0.118.0 → 0.119.0

package/dist/modules/capabilityCredentials/CapabilityCredentialsService.d.ts

@@ -30,6 +30,14 @@ export interface CapabilityCredentialsServiceDependencies {
  * `BinaryGeneratorSource` rather than a registry anyway, which only the composition root can
  * supply.
  *
+ * CONCURRENCY: the row is ONE sealed blob holding the whole set, so the per-key writes
+ * ({@link put}, {@link remove}) are read-modify-write over it and ride a rev-guarded
+ * `compareAndSwap`: a blind upsert would let two operators saving DIFFERENT keys silently
+ * destroy each other's, with the loser's save still returning success. On a lost race the
+ * mutation reloads and re-applies on the winner's snapshot (it is a pure single-key edit, so
+ * re-application is trivially idempotent). The whole-set {@link set} stays a blind write on
+ * purpose: replacing whatever is stored IS its semantics.
+ *
  * {@link resolveValues} is the one place a value is decrypted, and its result reaches nothing but
  * the job body.
  */
@@ -47,17 +55,24 @@ export declare class CapabilityCredentialsService {
      *
      * A whole-set REPLACE rather than a merge, because the client cannot merge: it never received
      * the values, so a partial write would have to mean "leave the ones I did not send alone",
-     * which is indistinguishable on the wire from "remove them". {@link remove} is the narrow
-     * operation that would otherwise need that distinction.
+     * which is indistinguishable on the wire from "remove them". {@link put} and {@link remove}
+     * are the narrow operations that would otherwise need that distinction.
      */
     set(workspaceId: string, input: UpsertCapabilityCredentialsInput): Promise<CapabilityCredentialRef[]>;
     /**
-     * Remove ONE stored credential, leaving the rest sealed as they are.
+     * Set ONE credential's value, leaving the rest sealed as they are. Replaces the value when the
+     * key is already stored, appends it otherwise.
      *
-     * Re-seals the survivors rather than editing the blob in place, so this is a read-modify-write
-     * and the last writer wins. That is the right trade for a form an operator edits: the
-     * alternative is a row per key, and a lost update here costs one retyped secret where the N-row
-     * shape costs every dispatch an N-row read.
+     * The narrow twin of {@link remove}, and the write a checklist UI actually performs: the
+     * client holds no values, so it can neither re-send the set nor express "leave the others
+     * alone" through {@link set}. Rev-guarded (see the class doc), so two operators saving
+     * different keys at the same moment both land.
+     */
+    put(workspaceId: string, key: string, value: string): Promise<CapabilityCredentialRef[]>;
+    /**
+     * Remove ONE stored credential, leaving the rest sealed as they are. Re-seals the survivors
+     * rather than editing the blob in place, rev-guarded like {@link put}; emptying the set
+     * deletes the row through the same guard, so a concurrent save's key cannot be swept away.
      */
     remove(workspaceId: string, key: string): Promise<CapabilityCredentialRef[]>;
     /**
@@ -66,7 +81,20 @@ export declare class CapabilityCredentialsService {
      * fallback (where a facade wired one) should answer instead.
      */
     resolveValues(workspaceId: string): Promise<CapabilityCredentialEntry[]>;
-    private write;
+    /**
+     * Apply a pure single-key mutation under OPTIMISTIC CONCURRENCY: load, run `apply`, then
+     * `compareAndSwap` (or the rev-guarded delete when the set empties); on a lost race reload and
+     * re-apply on the winner's snapshot, bounded by {@link MAX_MUTATE_ATTEMPTS}.
+     *
+     * `apply` returns the next entry set, or null for "nothing to change" (a duplicate delete),
+     * which answers with the current summary untouched. `touchedKey` is the one key whose
+     * `updatedAt` this write may honestly stamp: "last set" is a per-key fact, so every OTHER
+     * entry keeps the timestamp the stored summary already carries. A write that re-stamped the
+     * whole set would falsify every neighbour's date.
+     */
+    private mutate;
+    /** Decrypt and validate the sealed entry blob; an absent row is an empty set. */
+    private decryptEntries;
     /** Parse the persisted non-secret summary, tolerating a corrupt row (the view still loads). */
     private parseSummary;
 }

package/dist/modules/capabilityCredentials/CapabilityCredentialsService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CapabilityCredentialsService.d.ts","sourceRoot":"","sources":["../../../src/modules/capabilityCredentials/CapabilityCredentialsService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,8BAA8B,EAC9B,KAAK,EACL,YAAY,EACb,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EACV,yBAAyB,EACzB,uBAAuB,EACvB,gCAAgC,EACjC,MAAM,wBAAwB,CAAA;AAM/B;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,uCAAuC,CAAA;AAEtF,MAAM,WAAW,wCAAwC;IACvD,8BAA8B,EAAE,8BAA8B,CAAA;IAC9D,4FAA4F;IAC5F,YAAY,EAAE,YAAY,CAAA;IAC1B,KAAK,EAAE,KAAK,CAAA;CACb;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,4BAA4B;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,wCAAwC,EAAI;IAE/E;;;OAGG;IACG,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAGxE;IAED;;;;;;;;OAQG;IACG,GAAG,CACP,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAMpC;IAED;;;;;;;OAOG;IACG,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAWjF;IAED;;;;OAIG;IACG,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAM7E;YAEa,KAAK;IAiBnB,+FAA+F;IAC/F,OAAO,CAAC,YAAY;CAerB"}
+{"version":3,"file":"CapabilityCredentialsService.d.ts","sourceRoot":"","sources":["../../../src/modules/capabilityCredentials/CapabilityCredentialsService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,8BAA8B,EAC9B,KAAK,EACL,YAAY,EACb,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EACV,yBAAyB,EACzB,uBAAuB,EACvB,gCAAgC,EACjC,MAAM,wBAAwB,CAAA;AAO/B;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,uCAAuC,CAAA;AAUtF,MAAM,WAAW,wCAAwC;IACvD,8BAA8B,EAAE,8BAA8B,CAAA;IAC9D,4FAA4F;IAC5F,YAAY,EAAE,YAAY,CAAA;IAC1B,KAAK,EAAE,KAAK,CAAA;CACb;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,qBAAa,4BAA4B;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,wCAAwC,EAAI;IAE/E;;;OAGG;IACG,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAGxE;IAED;;;;;;;;OAQG;IACG,GAAG,CACP,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAoBpC;IAED;;;;;;;;OAQG;IACG,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAe7F;IAED;;;;OAIG;IACG,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAQjF;IAED;;;;OAIG;IACG,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAE7E;IAED;;;;;;;;;;OAUG;YACW,MAAM;IA0CpB,iFAAiF;YACnE,cAAc;IAS5B,+FAA+F;IAC/F,OAAO,CAAC,YAAY;CAerB"}

package/dist/modules/capabilityCredentials/CapabilityCredentialsService.js

@@ -1,10 +1,18 @@
-import { capabilityCredentialsSummary, parseCapabilityCredentialEntries, } from '@cat-factory/contracts';
+import { ConflictError, ValidationError } from '@cat-factory/kernel';
+import { MAX_CAPABILITY_CREDENTIALS, capabilityCredentialsSummary, parseCapabilityCredentialEntries, } from '@cat-factory/contracts';
 /**
  * HKDF domain tag separating the sealed capability-credential blob from every other cipher
  * (mirrors {@link TEST_SECRETS_CIPHER_INFO} et al). The facade builds a `WebCryptoSecretCipher`
  * keyed by `ENCRYPTION_KEY` with this info tag.
  */
 export const CAPABILITY_CREDENTIALS_CIPHER_INFO = 'cat-factory:capability-credentials';
+/**
+ * How many times a contended per-key mutation reloads and re-applies before giving up with a
+ * 409. Matches `IterativeReviewService`'s budget: the contending writers here are human saves in
+ * two browser tabs, so a handful of retries covers real contention while still failing loudly on
+ * a pathological hot row.
+ */
+const MAX_MUTATE_ATTEMPTS = 8;
 /**
  * Owns a workspace's capability credentials: the tenant-scoped, sealed home for the secrets a
  * tool server or a generative binary integration declares by name.
@@ -23,6 +31,14 @@ export const CAPABILITY_CREDENTIALS_CIPHER_INFO = 'cat-factory:capability-creden
  * `BinaryGeneratorSource` rather than a registry anyway, which only the composition root can
  * supply.
  *
+ * CONCURRENCY: the row is ONE sealed blob holding the whole set, so the per-key writes
+ * ({@link put}, {@link remove}) are read-modify-write over it and ride a rev-guarded
+ * `compareAndSwap`: a blind upsert would let two operators saving DIFFERENT keys silently
+ * destroy each other's, with the loser's save still returning success. On a lost race the
+ * mutation reloads and re-applies on the winner's snapshot (it is a pure single-key edit, so
+ * re-application is trivially idempotent). The whole-set {@link set} stays a blind write on
+ * purpose: replacing whatever is stored IS its semantics.
+ *
  * {@link resolveValues} is the one place a value is decrypted, and its result reaches nothing but
  * the job body.
  */
@@ -45,36 +61,68 @@ export class CapabilityCredentialsService {
      *
      * A whole-set REPLACE rather than a merge, because the client cannot merge: it never received
      * the values, so a partial write would have to mean "leave the ones I did not send alone",
-     * which is indistinguishable on the wire from "remove them". {@link remove} is the narrow
-     * operation that would otherwise need that distinction.
+     * which is indistinguishable on the wire from "remove them". {@link put} and {@link remove}
+     * are the narrow operations that would otherwise need that distinction.
      */
     async set(workspaceId, input) {
         if (input.entries.length === 0) {
             await this.deps.capabilityCredentialRepository.delete(workspaceId);
             return [];
         }
-        return this.write(workspaceId, input.entries);
+        const now = this.deps.clock.now();
+        const existing = await this.deps.capabilityCredentialRepository.get(workspaceId);
+        // Every value in the set was just (re)typed, so every key is honestly stamped `now`.
+        const summary = capabilityCredentialsSummary(input.entries, now);
+        await this.deps.capabilityCredentialRepository.upsert({
+            workspaceId,
+            credentials: await this.deps.secretCipher.encrypt(JSON.stringify(input.entries)),
+            summary: JSON.stringify(summary),
+            // The insert value; a conflicting update bumps the STORED rev in SQL instead, so the rev
+            // stays monotonic under this blind write and a concurrent compareAndSwap reliably loses.
+            rev: 0,
+            createdAt: existing?.createdAt ?? now,
+            updatedAt: now,
+        });
+        return summary;
     }
     /**
-     * Remove ONE stored credential, leaving the rest sealed as they are.
+     * Set ONE credential's value, leaving the rest sealed as they are. Replaces the value when the
+     * key is already stored, appends it otherwise.
      *
-     * Re-seals the survivors rather than editing the blob in place, so this is a read-modify-write
-     * and the last writer wins. That is the right trade for a form an operator edits: the
-     * alternative is a row per key, and a lost update here costs one retyped secret where the N-row
-     * shape costs every dispatch an N-row read.
+     * The narrow twin of {@link remove}, and the write a checklist UI actually performs: the
+     * client holds no values, so it can neither re-send the set nor express "leave the others
+     * alone" through {@link set}. Rev-guarded (see the class doc), so two operators saving
+     * different keys at the same moment both land.
+     */
+    async put(workspaceId, key, value) {
+        return this.mutate(workspaceId, key, (entries) => {
+            const existing = entries.findIndex((entry) => entry.key === key);
+            if (existing === -1 && entries.length >= MAX_CAPABILITY_CREDENTIALS) {
+                throw new ValidationError(`at most ${MAX_CAPABILITY_CREDENTIALS} capability credentials per workspace`, { reason: 'capability_credential_limit' });
+            }
+            const next = [...entries];
+            // Replace IN PLACE for a known key, so re-typing a value does not reorder the stored set.
+            if (existing === -1)
+                next.push({ key, value });
+            else
+                next[existing] = { key, value };
+            return next;
+        });
+    }
+    /**
+     * Remove ONE stored credential, leaving the rest sealed as they are. Re-seals the survivors
+     * rather than editing the blob in place, rev-guarded like {@link put}; emptying the set
+     * deletes the row through the same guard, so a concurrent save's key cannot be swept away.
      */
     async remove(workspaceId, key) {
-        const entries = await this.resolveValues(workspaceId);
-        const remaining = entries.filter((entry) => entry.key !== key);
-        // Nothing matched: answer with the current state rather than rewriting the blob, so a
-        // duplicate delete is a no-op instead of a pointless re-seal.
-        if (remaining.length === entries.length)
-            return this.listStored(workspaceId);
-        if (remaining.length === 0) {
-            await this.deps.capabilityCredentialRepository.delete(workspaceId);
-            return [];
-        }
-        return this.write(workspaceId, remaining);
+        return this.mutate(workspaceId, null, (entries) => {
+            const remaining = entries.filter((entry) => entry.key !== key);
+            // Nothing matched: answer with the current state rather than rewriting the blob, so a
+            // duplicate delete is a no-op instead of a pointless re-seal.
+            if (remaining.length === entries.length)
+                return null;
+            return remaining;
+        });
     }
     /**
      * The DECRYPTED credential set for a workspace — read once per dispatch by the composed
@@ -82,24 +130,61 @@ export class CapabilityCredentialsService {
      * fallback (where a facade wired one) should answer instead.
      */
     async resolveValues(workspaceId) {
-        const record = await this.deps.capabilityCredentialRepository.get(workspaceId);
+        return this.decryptEntries(await this.deps.capabilityCredentialRepository.get(workspaceId));
+    }
+    /**
+     * Apply a pure single-key mutation under OPTIMISTIC CONCURRENCY: load, run `apply`, then
+     * `compareAndSwap` (or the rev-guarded delete when the set empties); on a lost race reload and
+     * re-apply on the winner's snapshot, bounded by {@link MAX_MUTATE_ATTEMPTS}.
+     *
+     * `apply` returns the next entry set, or null for "nothing to change" (a duplicate delete),
+     * which answers with the current summary untouched. `touchedKey` is the one key whose
+     * `updatedAt` this write may honestly stamp: "last set" is a per-key fact, so every OTHER
+     * entry keeps the timestamp the stored summary already carries. A write that re-stamped the
+     * whole set would falsify every neighbour's date.
+     */
+    async mutate(workspaceId, touchedKey, apply) {
+        const repo = this.deps.capabilityCredentialRepository;
+        for (let attempt = 0; attempt < MAX_MUTATE_ATTEMPTS; attempt++) {
+            const record = await repo.get(workspaceId);
+            const next = apply(await this.decryptEntries(record));
+            if (next === null)
+                return this.parseSummary(record);
+            if (next.length === 0) {
+                if (!record)
+                    return [];
+                if (await repo.deleteIfRev(workspaceId, record.rev))
+                    return [];
+                continue;
+            }
+            const now = this.deps.clock.now();
+            const prior = new Map(this.parseSummary(record).map((ref) => [ref.key, ref.updatedAt]));
+            const summary = next.map((entry) => ({
+                key: entry.key,
+                updatedAt: entry.key === touchedKey ? now : (prior.get(entry.key) ?? now),
+            }));
+            const swapped = await repo.compareAndSwap({
+                workspaceId,
+                credentials: await this.deps.secretCipher.encrypt(JSON.stringify(next)),
+                summary: JSON.stringify(summary),
+                rev: (record?.rev ?? -1) + 1,
+                createdAt: record?.createdAt ?? now,
+                updatedAt: now,
+            }, record?.rev ?? null);
+            if (swapped)
+                return summary;
+            // Lost the race: loop back, reload, re-apply on the winner's snapshot.
+        }
+        // No `reason` code, same call as ReviewContendedError: the SPA has no conflict-specific
+        // handling beyond "retry", which the message already says.
+        throw new ConflictError(`capability credentials for workspace '${workspaceId}' are being modified concurrently; retry`);
+    }
+    /** Decrypt and validate the sealed entry blob; an absent row is an empty set. */
+    async decryptEntries(record) {
         if (!record)
             return [];
         return parseCapabilityCredentialEntries(JSON.parse(await this.deps.secretCipher.decrypt(record.credentials)));
     }
-    async write(workspaceId, entries) {
-        const now = this.deps.clock.now();
-        const existing = await this.deps.capabilityCredentialRepository.get(workspaceId);
-        const summary = capabilityCredentialsSummary(entries, now);
-        await this.deps.capabilityCredentialRepository.upsert({
-            workspaceId,
-            credentials: await this.deps.secretCipher.encrypt(JSON.stringify(entries)),
-            summary: JSON.stringify(summary),
-            createdAt: existing?.createdAt ?? now,
-            updatedAt: now,
-        });
-        return summary;
-    }
     /** Parse the persisted non-secret summary, tolerating a corrupt row (the view still loads). */
     parseSummary(record) {
         if (!record)

package/dist/modules/capabilityCredentials/CapabilityCredentialsService.js.map

@@ -1 +1 @@
-{"version":3,"file":"CapabilityCredentialsService.js","sourceRoot":"","sources":["../../../src/modules/capabilityCredentials/CapabilityCredentialsService.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,wBAAwB,CAAA;AAE/B;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,oCAAoC,CAAA;AAStF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,4BAA4B;IACV,IAAI;IAAjC,YAA6B,IAA8C;oBAA9C,IAAI;IAA6C,CAAC;IAE/E;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,WAAmB;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC9E,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;IAClC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,GAAG,CACP,WAAmB,EACnB,KAAuC;QAEvC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;YAClE,OAAO,EAAE,CAAA;QACX,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IAC/C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,GAAW;QAC3C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAA;QACrD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;QAC9D,sFAAsF;QACtF,8DAA8D;QAC9D,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;QAC5E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;YAClE,OAAO,EAAE,CAAA;QACX,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;IAC3C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,WAAmB;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC9E,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAA;QACtB,OAAO,gCAAgC,CACrC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CACrE,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,KAAK,CACjB,WAAmB,EACnB,OAAoC;QAEpC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAChF,MAAM,OAAO,GAAG,4BAA4B,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAC1D,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC;YACpD,WAAW;YACX,WAAW,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAC1E,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAChC,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,GAAG;YACrC,SAAS,EAAE,GAAG;SACf,CAAC,CAAA;QACF,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,+FAA+F;IACvF,YAAY,CAAC,MAAyC;QAC5D,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAA;QACtB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAY,CAAA;YACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,CAAA;YACrC,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,KAAK,EAAoC,EAAE,CAC1C,CAAC,CAAC,KAAK;gBACP,OAAO,KAAK,KAAK,QAAQ;gBACzB,OAAQ,KAAiC,CAAC,GAAG,KAAK,QAAQ,CAC7D,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"CapabilityCredentialsService.js","sourceRoot":"","sources":["../../../src/modules/capabilityCredentials/CapabilityCredentialsService.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAMpE,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,wBAAwB,CAAA;AAE/B;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,oCAAoC,CAAA;AAEtF;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAA;AAS7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,OAAO,4BAA4B;IACV,IAAI;IAAjC,YAA6B,IAA8C;oBAA9C,IAAI;IAA6C,CAAC;IAE/E;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,WAAmB;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC9E,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;IAClC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,GAAG,CACP,WAAmB,EACnB,KAAuC;QAEvC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;YAClE,OAAO,EAAE,CAAA;QACX,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAChF,qFAAqF;QACrF,MAAM,OAAO,GAAG,4BAA4B,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAChE,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC;YACpD,WAAW;YACX,WAAW,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChF,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAChC,yFAAyF;YACzF,yFAAyF;YACzF,GAAG,EAAE,CAAC;YACN,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,GAAG;YACrC,SAAS,EAAE,GAAG;SACf,CAAC,CAAA;QACF,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,GAAG,CAAC,WAAmB,EAAE,GAAW,EAAE,KAAa;QACvD,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE;YAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;YAChE,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,IAAI,0BAA0B,EAAE,CAAC;gBACpE,MAAM,IAAI,eAAe,CACvB,WAAW,0BAA0B,uCAAuC,EAC5E,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAC1C,CAAA;YACH,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,CAAA;YACzB,0FAA0F;YAC1F,IAAI,QAAQ,KAAK,CAAC,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;;gBACzC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;YACpC,OAAO,IAAI,CAAA;QACb,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,GAAW;QAC3C,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;YAChD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;YAC9D,sFAAsF;YACtF,8DAA8D;YAC9D,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAA;YACpD,OAAO,SAAS,CAAA;QAClB,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,WAAmB;QACrC,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAA;IAC7F,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,MAAM,CAClB,WAAmB,EACnB,UAAyB,EACzB,KAAmF;QAEnF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAA;QACrD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,mBAAmB,EAAE,OAAO,EAAE,EAAE,CAAC;YAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;YAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAA;YACrD,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;YACnD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM;oBAAE,OAAO,EAAE,CAAA;gBACtB,IAAI,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC;oBAAE,OAAO,EAAE,CAAA;gBAC9D,SAAQ;YACV,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;YACjC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;YACvF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACnC,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,SAAS,EAAE,KAAK,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;aAC1E,CAAC,CAAC,CAAA;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CACvC;gBACE,WAAW;gBACX,WAAW,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACvE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gBAChC,GAAG,EAAE,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC5B,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,GAAG;gBACnC,SAAS,EAAE,GAAG;aACf,EACD,MAAM,EAAE,GAAG,IAAI,IAAI,CACpB,CAAA;YACD,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAA;YAC3B,uEAAuE;QACzE,CAAC;QACD,wFAAwF;QACxF,2DAA2D;QAC3D,MAAM,IAAI,aAAa,CACrB,yCAAyC,WAAW,0CAA0C,CAC/F,CAAA;IACH,CAAC;IAED,iFAAiF;IACzE,KAAK,CAAC,cAAc,CAC1B,MAAyC;QAEzC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAA;QACtB,OAAO,gCAAgC,CACrC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CACrE,CAAA;IACH,CAAC;IAED,+FAA+F;IACvF,YAAY,CAAC,MAAyC;QAC5D,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAA;QACtB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAY,CAAA;YACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,CAAA;YACrC,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,KAAK,EAAoC,EAAE,CAC1C,CAAC,CAAC,KAAK;gBACP,OAAO,KAAK,KAAK,QAAQ;gBACzB,OAAQ,KAAiC,CAAC,GAAG,KAAK,QAAQ,CAC7D,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/integrations",
-  "version": "0.118.0",
+  "version": "0.119.0",
   "description": "External-system integration domain logic for the Agent Architecture Board (GitHub, documents, tasks, environments, runners).",
   "repository": {
     "type": "git",
@@ -27,15 +27,15 @@
     "ai": "^7.0.47",
     "p-map": "^7.0.6",
     "yaml": "^2.9.0",
-    "@cat-factory/contracts": "0.215.0",
-    "@cat-factory/kernel": "0.218.0"
+    "@cat-factory/contracts": "0.217.0",
+    "@cat-factory/kernel": "0.220.0"
   },
   "devDependencies": {
     "typescript": "7.0.2",
     "undici": "^8.9.0",
     "valibot": "^1.4.2",
     "vitest": "^4.1.10",
-    "@cat-factory/caching": "0.13.3"
+    "@cat-factory/caching": "0.13.5"
   },
   "scripts": {
     "build": "tsc -b tsconfig.build.json",