@cat-factory/integrations 0.118.1 → 0.120.0

package/dist/modules/capabilityCredentials/CapabilityCredentialsService.d.ts

@@ -30,6 +30,14 @@ export interface CapabilityCredentialsServiceDependencies {
  * `BinaryGeneratorSource` rather than a registry anyway, which only the composition root can
  * supply.
  *
+ * CONCURRENCY: the row is ONE sealed blob holding the whole set, so the per-key writes
+ * ({@link put}, {@link remove}) are read-modify-write over it and ride a rev-guarded
+ * `compareAndSwap`: a blind upsert would let two operators saving DIFFERENT keys silently
+ * destroy each other's, with the loser's save still returning success. On a lost race the
+ * mutation reloads and re-applies on the winner's snapshot (it is a pure single-key edit, so
+ * re-application is trivially idempotent). The whole-set {@link set} stays a blind write on
+ * purpose: replacing whatever is stored IS its semantics.
+ *
  * {@link resolveValues} is the one place a value is decrypted, and its result reaches nothing but
  * the job body.
  */
@@ -47,17 +55,24 @@ export declare class CapabilityCredentialsService {
      *
      * A whole-set REPLACE rather than a merge, because the client cannot merge: it never received
      * the values, so a partial write would have to mean "leave the ones I did not send alone",
-     * which is indistinguishable on the wire from "remove them". {@link remove} is the narrow
-     * operation that would otherwise need that distinction.
+     * which is indistinguishable on the wire from "remove them". {@link put} and {@link remove}
+     * are the narrow operations that would otherwise need that distinction.
      */
     set(workspaceId: string, input: UpsertCapabilityCredentialsInput): Promise<CapabilityCredentialRef[]>;
     /**
-     * Remove ONE stored credential, leaving the rest sealed as they are.
+     * Set ONE credential's value, leaving the rest sealed as they are. Replaces the value when the
+     * key is already stored, appends it otherwise.
      *
-     * Re-seals the survivors rather than editing the blob in place, so this is a read-modify-write
-     * and the last writer wins. That is the right trade for a form an operator edits: the
-     * alternative is a row per key, and a lost update here costs one retyped secret where the N-row
-     * shape costs every dispatch an N-row read.
+     * The narrow twin of {@link remove}, and the write a checklist UI actually performs: the
+     * client holds no values, so it can neither re-send the set nor express "leave the others
+     * alone" through {@link set}. Rev-guarded (see the class doc), so two operators saving
+     * different keys at the same moment both land.
+     */
+    put(workspaceId: string, key: string, value: string): Promise<CapabilityCredentialRef[]>;
+    /**
+     * Remove ONE stored credential, leaving the rest sealed as they are. Re-seals the survivors
+     * rather than editing the blob in place, rev-guarded like {@link put}; emptying the set
+     * deletes the row through the same guard, so a concurrent save's key cannot be swept away.
      */
     remove(workspaceId: string, key: string): Promise<CapabilityCredentialRef[]>;
     /**
@@ -66,7 +81,20 @@ export declare class CapabilityCredentialsService {
      * fallback (where a facade wired one) should answer instead.
      */
     resolveValues(workspaceId: string): Promise<CapabilityCredentialEntry[]>;
-    private write;
+    /**
+     * Apply a pure single-key mutation under OPTIMISTIC CONCURRENCY: load, run `apply`, then
+     * `compareAndSwap` (or the rev-guarded delete when the set empties); on a lost race reload and
+     * re-apply on the winner's snapshot, bounded by {@link MAX_MUTATE_ATTEMPTS}.
+     *
+     * `apply` returns the next entry set, or null for "nothing to change" (a duplicate delete),
+     * which answers with the current summary untouched. `touchedKey` is the one key whose
+     * `updatedAt` this write may honestly stamp: "last set" is a per-key fact, so every OTHER
+     * entry keeps the timestamp the stored summary already carries. A write that re-stamped the
+     * whole set would falsify every neighbour's date.
+     */
+    private mutate;
+    /** Decrypt and validate the sealed entry blob; an absent row is an empty set. */
+    private decryptEntries;
     /** Parse the persisted non-secret summary, tolerating a corrupt row (the view still loads). */
     private parseSummary;
 }

package/dist/modules/capabilityCredentials/CapabilityCredentialsService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CapabilityCredentialsService.d.ts","sourceRoot":"","sources":["../../../src/modules/capabilityCredentials/CapabilityCredentialsService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,8BAA8B,EAC9B,KAAK,EACL,YAAY,EACb,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EACV,yBAAyB,EACzB,uBAAuB,EACvB,gCAAgC,EACjC,MAAM,wBAAwB,CAAA;AAM/B;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,uCAAuC,CAAA;AAEtF,MAAM,WAAW,wCAAwC;IACvD,8BAA8B,EAAE,8BAA8B,CAAA;IAC9D,4FAA4F;IAC5F,YAAY,EAAE,YAAY,CAAA;IAC1B,KAAK,EAAE,KAAK,CAAA;CACb;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,4BAA4B;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,wCAAwC,EAAI;IAE/E;;;OAGG;IACG,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAGxE;IAED;;;;;;;;OAQG;IACG,GAAG,CACP,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAMpC;IAED;;;;;;;OAOG;IACG,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAWjF;IAED;;;;OAIG;IACG,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAM7E;YAEa,KAAK;IAiBnB,+FAA+F;IAC/F,OAAO,CAAC,YAAY;CAerB"}
+{"version":3,"file":"CapabilityCredentialsService.d.ts","sourceRoot":"","sources":["../../../src/modules/capabilityCredentials/CapabilityCredentialsService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,8BAA8B,EAC9B,KAAK,EACL,YAAY,EACb,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EACV,yBAAyB,EACzB,uBAAuB,EACvB,gCAAgC,EACjC,MAAM,wBAAwB,CAAA;AAO/B;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,uCAAuC,CAAA;AAUtF,MAAM,WAAW,wCAAwC;IACvD,8BAA8B,EAAE,8BAA8B,CAAA;IAC9D,4FAA4F;IAC5F,YAAY,EAAE,YAAY,CAAA;IAC1B,KAAK,EAAE,KAAK,CAAA;CACb;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,qBAAa,4BAA4B;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,wCAAwC,EAAI;IAE/E;;;OAGG;IACG,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAGxE;IAED;;;;;;;;OAQG;IACG,GAAG,CACP,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAoBpC;IAED;;;;;;;;OAQG;IACG,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAe7F;IAED;;;;OAIG;IACG,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAQjF;IAED;;;;OAIG;IACG,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAE7E;IAED;;;;;;;;;;OAUG;YACW,MAAM;IA0CpB,iFAAiF;YACnE,cAAc;IAS5B,+FAA+F;IAC/F,OAAO,CAAC,YAAY;CAerB"}

package/dist/modules/capabilityCredentials/CapabilityCredentialsService.js

@@ -1,10 +1,18 @@
-import { capabilityCredentialsSummary, parseCapabilityCredentialEntries, } from '@cat-factory/contracts';
+import { ConflictError, ValidationError } from '@cat-factory/kernel';
+import { MAX_CAPABILITY_CREDENTIALS, capabilityCredentialsSummary, parseCapabilityCredentialEntries, } from '@cat-factory/contracts';
 /**
  * HKDF domain tag separating the sealed capability-credential blob from every other cipher
  * (mirrors {@link TEST_SECRETS_CIPHER_INFO} et al). The facade builds a `WebCryptoSecretCipher`
  * keyed by `ENCRYPTION_KEY` with this info tag.
  */
 export const CAPABILITY_CREDENTIALS_CIPHER_INFO = 'cat-factory:capability-credentials';
+/**
+ * How many times a contended per-key mutation reloads and re-applies before giving up with a
+ * 409. Matches `IterativeReviewService`'s budget: the contending writers here are human saves in
+ * two browser tabs, so a handful of retries covers real contention while still failing loudly on
+ * a pathological hot row.
+ */
+const MAX_MUTATE_ATTEMPTS = 8;
 /**
  * Owns a workspace's capability credentials: the tenant-scoped, sealed home for the secrets a
  * tool server or a generative binary integration declares by name.
@@ -23,6 +31,14 @@ export const CAPABILITY_CREDENTIALS_CIPHER_INFO = 'cat-factory:capability-creden
  * `BinaryGeneratorSource` rather than a registry anyway, which only the composition root can
  * supply.
  *
+ * CONCURRENCY: the row is ONE sealed blob holding the whole set, so the per-key writes
+ * ({@link put}, {@link remove}) are read-modify-write over it and ride a rev-guarded
+ * `compareAndSwap`: a blind upsert would let two operators saving DIFFERENT keys silently
+ * destroy each other's, with the loser's save still returning success. On a lost race the
+ * mutation reloads and re-applies on the winner's snapshot (it is a pure single-key edit, so
+ * re-application is trivially idempotent). The whole-set {@link set} stays a blind write on
+ * purpose: replacing whatever is stored IS its semantics.
+ *
  * {@link resolveValues} is the one place a value is decrypted, and its result reaches nothing but
  * the job body.
  */
@@ -45,36 +61,68 @@ export class CapabilityCredentialsService {
      *
      * A whole-set REPLACE rather than a merge, because the client cannot merge: it never received
      * the values, so a partial write would have to mean "leave the ones I did not send alone",
-     * which is indistinguishable on the wire from "remove them". {@link remove} is the narrow
-     * operation that would otherwise need that distinction.
+     * which is indistinguishable on the wire from "remove them". {@link put} and {@link remove}
+     * are the narrow operations that would otherwise need that distinction.
      */
     async set(workspaceId, input) {
         if (input.entries.length === 0) {
             await this.deps.capabilityCredentialRepository.delete(workspaceId);
             return [];
         }
-        return this.write(workspaceId, input.entries);
+        const now = this.deps.clock.now();
+        const existing = await this.deps.capabilityCredentialRepository.get(workspaceId);
+        // Every value in the set was just (re)typed, so every key is honestly stamped `now`.
+        const summary = capabilityCredentialsSummary(input.entries, now);
+        await this.deps.capabilityCredentialRepository.upsert({
+            workspaceId,
+            credentials: await this.deps.secretCipher.encrypt(JSON.stringify(input.entries)),
+            summary: JSON.stringify(summary),
+            // The insert value; a conflicting update bumps the STORED rev in SQL instead, so the rev
+            // stays monotonic under this blind write and a concurrent compareAndSwap reliably loses.
+            rev: 0,
+            createdAt: existing?.createdAt ?? now,
+            updatedAt: now,
+        });
+        return summary;
     }
     /**
-     * Remove ONE stored credential, leaving the rest sealed as they are.
+     * Set ONE credential's value, leaving the rest sealed as they are. Replaces the value when the
+     * key is already stored, appends it otherwise.
      *
-     * Re-seals the survivors rather than editing the blob in place, so this is a read-modify-write
-     * and the last writer wins. That is the right trade for a form an operator edits: the
-     * alternative is a row per key, and a lost update here costs one retyped secret where the N-row
-     * shape costs every dispatch an N-row read.
+     * The narrow twin of {@link remove}, and the write a checklist UI actually performs: the
+     * client holds no values, so it can neither re-send the set nor express "leave the others
+     * alone" through {@link set}. Rev-guarded (see the class doc), so two operators saving
+     * different keys at the same moment both land.
+     */
+    async put(workspaceId, key, value) {
+        return this.mutate(workspaceId, key, (entries) => {
+            const existing = entries.findIndex((entry) => entry.key === key);
+            if (existing === -1 && entries.length >= MAX_CAPABILITY_CREDENTIALS) {
+                throw new ValidationError(`at most ${MAX_CAPABILITY_CREDENTIALS} capability credentials per workspace`, { reason: 'capability_credential_limit' });
+            }
+            const next = [...entries];
+            // Replace IN PLACE for a known key, so re-typing a value does not reorder the stored set.
+            if (existing === -1)
+                next.push({ key, value });
+            else
+                next[existing] = { key, value };
+            return next;
+        });
+    }
+    /**
+     * Remove ONE stored credential, leaving the rest sealed as they are. Re-seals the survivors
+     * rather than editing the blob in place, rev-guarded like {@link put}; emptying the set
+     * deletes the row through the same guard, so a concurrent save's key cannot be swept away.
      */
     async remove(workspaceId, key) {
-        const entries = await this.resolveValues(workspaceId);
-        const remaining = entries.filter((entry) => entry.key !== key);
-        // Nothing matched: answer with the current state rather than rewriting the blob, so a
-        // duplicate delete is a no-op instead of a pointless re-seal.
-        if (remaining.length === entries.length)
-            return this.listStored(workspaceId);
-        if (remaining.length === 0) {
-            await this.deps.capabilityCredentialRepository.delete(workspaceId);
-            return [];
-        }
-        return this.write(workspaceId, remaining);
+        return this.mutate(workspaceId, null, (entries) => {
+            const remaining = entries.filter((entry) => entry.key !== key);
+            // Nothing matched: answer with the current state rather than rewriting the blob, so a
+            // duplicate delete is a no-op instead of a pointless re-seal.
+            if (remaining.length === entries.length)
+                return null;
+            return remaining;
+        });
     }
     /**
      * The DECRYPTED credential set for a workspace — read once per dispatch by the composed
@@ -82,24 +130,61 @@ export class CapabilityCredentialsService {
      * fallback (where a facade wired one) should answer instead.
      */
     async resolveValues(workspaceId) {
-        const record = await this.deps.capabilityCredentialRepository.get(workspaceId);
+        return this.decryptEntries(await this.deps.capabilityCredentialRepository.get(workspaceId));
+    }
+    /**
+     * Apply a pure single-key mutation under OPTIMISTIC CONCURRENCY: load, run `apply`, then
+     * `compareAndSwap` (or the rev-guarded delete when the set empties); on a lost race reload and
+     * re-apply on the winner's snapshot, bounded by {@link MAX_MUTATE_ATTEMPTS}.
+     *
+     * `apply` returns the next entry set, or null for "nothing to change" (a duplicate delete),
+     * which answers with the current summary untouched. `touchedKey` is the one key whose
+     * `updatedAt` this write may honestly stamp: "last set" is a per-key fact, so every OTHER
+     * entry keeps the timestamp the stored summary already carries. A write that re-stamped the
+     * whole set would falsify every neighbour's date.
+     */
+    async mutate(workspaceId, touchedKey, apply) {
+        const repo = this.deps.capabilityCredentialRepository;
+        for (let attempt = 0; attempt < MAX_MUTATE_ATTEMPTS; attempt++) {
+            const record = await repo.get(workspaceId);
+            const next = apply(await this.decryptEntries(record));
+            if (next === null)
+                return this.parseSummary(record);
+            if (next.length === 0) {
+                if (!record)
+                    return [];
+                if (await repo.deleteIfRev(workspaceId, record.rev))
+                    return [];
+                continue;
+            }
+            const now = this.deps.clock.now();
+            const prior = new Map(this.parseSummary(record).map((ref) => [ref.key, ref.updatedAt]));
+            const summary = next.map((entry) => ({
+                key: entry.key,
+                updatedAt: entry.key === touchedKey ? now : (prior.get(entry.key) ?? now),
+            }));
+            const swapped = await repo.compareAndSwap({
+                workspaceId,
+                credentials: await this.deps.secretCipher.encrypt(JSON.stringify(next)),
+                summary: JSON.stringify(summary),
+                rev: (record?.rev ?? -1) + 1,
+                createdAt: record?.createdAt ?? now,
+                updatedAt: now,
+            }, record?.rev ?? null);
+            if (swapped)
+                return summary;
+            // Lost the race: loop back, reload, re-apply on the winner's snapshot.
+        }
+        // No `reason` code, same call as ReviewContendedError: the SPA has no conflict-specific
+        // handling beyond "retry", which the message already says.
+        throw new ConflictError(`capability credentials for workspace '${workspaceId}' are being modified concurrently; retry`);
+    }
+    /** Decrypt and validate the sealed entry blob; an absent row is an empty set. */
+    async decryptEntries(record) {
         if (!record)
             return [];
         return parseCapabilityCredentialEntries(JSON.parse(await this.deps.secretCipher.decrypt(record.credentials)));
     }
-    async write(workspaceId, entries) {
-        const now = this.deps.clock.now();
-        const existing = await this.deps.capabilityCredentialRepository.get(workspaceId);
-        const summary = capabilityCredentialsSummary(entries, now);
-        await this.deps.capabilityCredentialRepository.upsert({
-            workspaceId,
-            credentials: await this.deps.secretCipher.encrypt(JSON.stringify(entries)),
-            summary: JSON.stringify(summary),
-            createdAt: existing?.createdAt ?? now,
-            updatedAt: now,
-        });
-        return summary;
-    }
     /** Parse the persisted non-secret summary, tolerating a corrupt row (the view still loads). */
     parseSummary(record) {
         if (!record)

package/dist/modules/capabilityCredentials/CapabilityCredentialsService.js.map

@@ -1 +1 @@
-{"version":3,"file":"CapabilityCredentialsService.js","sourceRoot":"","sources":["../../../src/modules/capabilityCredentials/CapabilityCredentialsService.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,wBAAwB,CAAA;AAE/B;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,oCAAoC,CAAA;AAStF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,4BAA4B;IACV,IAAI;IAAjC,YAA6B,IAA8C;oBAA9C,IAAI;IAA6C,CAAC;IAE/E;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,WAAmB;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC9E,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;IAClC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,GAAG,CACP,WAAmB,EACnB,KAAuC;QAEvC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;YAClE,OAAO,EAAE,CAAA;QACX,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IAC/C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,GAAW;QAC3C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAA;QACrD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;QAC9D,sFAAsF;QACtF,8DAA8D;QAC9D,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;QAC5E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;YAClE,OAAO,EAAE,CAAA;QACX,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;IAC3C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,WAAmB;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC9E,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAA;QACtB,OAAO,gCAAgC,CACrC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CACrE,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,KAAK,CACjB,WAAmB,EACnB,OAAoC;QAEpC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAChF,MAAM,OAAO,GAAG,4BAA4B,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAC1D,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC;YACpD,WAAW;YACX,WAAW,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAC1E,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAChC,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,GAAG;YACrC,SAAS,EAAE,GAAG;SACf,CAAC,CAAA;QACF,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,+FAA+F;IACvF,YAAY,CAAC,MAAyC;QAC5D,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAA;QACtB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAY,CAAA;YACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,CAAA;YACrC,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,KAAK,EAAoC,EAAE,CAC1C,CAAC,CAAC,KAAK;gBACP,OAAO,KAAK,KAAK,QAAQ;gBACzB,OAAQ,KAAiC,CAAC,GAAG,KAAK,QAAQ,CAC7D,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"CapabilityCredentialsService.js","sourceRoot":"","sources":["../../../src/modules/capabilityCredentials/CapabilityCredentialsService.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAMpE,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,wBAAwB,CAAA;AAE/B;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,oCAAoC,CAAA;AAEtF;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAA;AAS7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,OAAO,4BAA4B;IACV,IAAI;IAAjC,YAA6B,IAA8C;oBAA9C,IAAI;IAA6C,CAAC;IAE/E;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,WAAmB;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC9E,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;IAClC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,GAAG,CACP,WAAmB,EACnB,KAAuC;QAEvC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;YAClE,OAAO,EAAE,CAAA;QACX,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAChF,qFAAqF;QACrF,MAAM,OAAO,GAAG,4BAA4B,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAChE,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC;YACpD,WAAW;YACX,WAAW,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChF,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAChC,yFAAyF;YACzF,yFAAyF;YACzF,GAAG,EAAE,CAAC;YACN,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,GAAG;YACrC,SAAS,EAAE,GAAG;SACf,CAAC,CAAA;QACF,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,GAAG,CAAC,WAAmB,EAAE,GAAW,EAAE,KAAa;QACvD,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE;YAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;YAChE,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,IAAI,0BAA0B,EAAE,CAAC;gBACpE,MAAM,IAAI,eAAe,CACvB,WAAW,0BAA0B,uCAAuC,EAC5E,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAC1C,CAAA;YACH,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,CAAA;YACzB,0FAA0F;YAC1F,IAAI,QAAQ,KAAK,CAAC,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;;gBACzC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;YACpC,OAAO,IAAI,CAAA;QACb,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,GAAW;QAC3C,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;YAChD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;YAC9D,sFAAsF;YACtF,8DAA8D;YAC9D,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAA;YACpD,OAAO,SAAS,CAAA;QAClB,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,WAAmB;QACrC,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAA;IAC7F,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,MAAM,CAClB,WAAmB,EACnB,UAAyB,EACzB,KAAmF;QAEnF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAA;QACrD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,mBAAmB,EAAE,OAAO,EAAE,EAAE,CAAC;YAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;YAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAA;YACrD,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;YACnD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM;oBAAE,OAAO,EAAE,CAAA;gBACtB,IAAI,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC;oBAAE,OAAO,EAAE,CAAA;gBAC9D,SAAQ;YACV,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;YACjC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;YACvF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACnC,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,SAAS,EAAE,KAAK,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;aAC1E,CAAC,CAAC,CAAA;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CACvC;gBACE,WAAW;gBACX,WAAW,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACvE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gBAChC,GAAG,EAAE,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC5B,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,GAAG;gBACnC,SAAS,EAAE,GAAG;aACf,EACD,MAAM,EAAE,GAAG,IAAI,IAAI,CACpB,CAAA;YACD,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAA;YAC3B,uEAAuE;QACzE,CAAC;QACD,wFAAwF;QACxF,2DAA2D;QAC3D,MAAM,IAAI,aAAa,CACrB,yCAAyC,WAAW,0CAA0C,CAC/F,CAAA;IACH,CAAC;IAED,iFAAiF;IACzE,KAAK,CAAC,cAAc,CAC1B,MAAyC;QAEzC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAA;QACtB,OAAO,gCAAgC,CACrC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CACrE,CAAA;IACH,CAAC;IAED,+FAA+F;IACvF,YAAY,CAAC,MAAyC;QAC5D,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAA;QACtB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAY,CAAA;YACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,CAAA;YACrC,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,KAAK,EAAoC,EAAE,CAC1C,CAAC,CAAC,KAAK;gBACP,OAAO,KAAK,KAAK,QAAQ;gBACzB,OAAQ,KAAiC,CAAC,GAAG,KAAK,QAAQ,CAC7D,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;CACF"}

package/dist/modules/environments/EnvironmentTeardownService.d.ts

@@ -1,9 +1,26 @@
-import type { Clock } from '@cat-factory/kernel';
-import type { EnvironmentRegistryRepository } from '@cat-factory/kernel';
+import type { Clock, Logger, ProvisioningOutcome } from '@cat-factory/kernel';
+import type { EnvironmentRecord, EnvironmentRegistryRepository } from '@cat-factory/kernel';
 import type { SecretCipher } from '@cat-factory/kernel';
 import type { EnvironmentHandle } from '@cat-factory/kernel';
 import type { EnvironmentConnectionService } from './EnvironmentConnectionService.js';
 import type { ProvisioningLogRecorder } from '../provisioning-logs/ProvisioningLogService.js';
+/**
+ * Notified after a teardown ATTEMPT has been recorded in the provisioning log, whether it
+ * succeeded or failed. Its one consumer today is the run's PR verification report, whose
+ * environment-lifecycle proof cannot be closed by the run itself: the TTL sweep that reclaims the
+ * environment fires long after the last step settled, so without this edge the PR says "still
+ * live" about an environment the platform destroyed on schedule.
+ *
+ * The FAILURE edge matters as much as the success one, and for the same reason. A run that has
+ * settled has no step hook left to fire, so an environment the provider refuses to reclaim would
+ * otherwise sit on the PR as "nobody has torn this down yet" rather than as the thing an operator
+ * has to go and do: the same unreachable-leg hole one state over. The hook is therefore fired
+ * from the ONE place that records the attempt, so a future third teardown path cannot forget it.
+ *
+ * Strictly best-effort and swallowed by the service: reclaiming infrastructure must never
+ * depend on a downstream bookkeeping write.
+ */
+export type EnvironmentTeardownRecordedHook = (record: EnvironmentRecord, outcome: ProvisioningOutcome) => Promise<void>;
 export interface EnvironmentTeardownServiceDependencies {
     connectionService: EnvironmentConnectionService;
     environmentRegistryRepository: EnvironmentRegistryRepository;
@@ -11,16 +28,34 @@ export interface EnvironmentTeardownServiceDependencies {
     clock: Clock;
     /** Best-effort provisioning-event log; absent ⇒ teardown is unchanged. */
     provisioningLog?: ProvisioningLogRecorder;
+    /** Structured logger for the best-effort hook below; absent ⇒ its failures are unreported. */
+    logger?: Logger;
 }
 export declare class EnvironmentTeardownService {
     private readonly deps;
+    private readonly log;
+    /**
+     * Late-bound because the engine that consumes it is constructed AFTER this service (it is
+     * injected into the provisioning service, which the engine takes). Same shape as
+     * `setInitiativeLoop` in the composition root, and for the same reason.
+     */
+    private teardownRecordedHook;
     constructor(deps: EnvironmentTeardownServiceDependencies);
+    /** Late-bind the teardown-recorded notification. Unset ⇒ nothing is notified. */
+    setTeardownRecordedHook(hook: EnvironmentTeardownRecordedHook | undefined): void;
     /** Tear down a single environment and tombstone its record. */
     teardown(workspaceId: string, id: string): Promise<EnvironmentHandle>;
     /** Tear down every environment whose TTL has elapsed. Returns the count swept. */
     sweepExpired(now: number): Promise<number>;
     private teardownRecord;
-    private logTeardown;
+    /**
+     * Append the attempt to the provisioning log and then notify, in that order and in ONE place.
+     * The ordering is what makes the notification usable: its consumer reads the log back, so a
+     * hook fired before the row landed would report the state the edge exists to correct. Keeping
+     * both here is what makes the FAILURE edge structural rather than a line someone remembered to
+     * add beside the success one.
+     */
+    private recordTeardownAttempt;
     private decryptFields;
 }
 //# sourceMappingURL=EnvironmentTeardownService.d.ts.map

package/dist/modules/environments/EnvironmentTeardownService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"EnvironmentTeardownService.d.ts","sourceRoot":"","sources":["../../../src/modules/environments/EnvironmentTeardownService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,KAAK,EAAqB,6BAA6B,EAAE,MAAM,qBAAqB,CAAA;AAC3F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAE5D,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAA;AAErF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAA;AAO7F,MAAM,WAAW,sCAAsC;IACrD,iBAAiB,EAAE,4BAA4B,CAAA;IAC/C,6BAA6B,EAAE,6BAA6B,CAAA;IAC5D,YAAY,EAAE,YAAY,CAAA;IAC1B,KAAK,EAAE,KAAK,CAAA;IACZ,0EAA0E;IAC1E,eAAe,CAAC,EAAE,uBAAuB,CAAA;CAC1C;AAED,qBAAa,0BAA0B;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,sCAAsC,EAAI;IAE7E,+DAA+D;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAQ1E;IAED,kFAAkF;IAC5E,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAa/C;YAEa,cAAc;YAqCd,WAAW;YAmBX,aAAa;CAK5B"}
+{"version":3,"file":"EnvironmentTeardownService.d.ts","sourceRoot":"","sources":["../../../src/modules/environments/EnvironmentTeardownService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAC7E,OAAO,KAAK,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAA;AAC3F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAE5D,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAA;AAErF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAA;AAO7F;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,+BAA+B,GAAG,CAC5C,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,mBAAmB,KACzB,OAAO,CAAC,IAAI,CAAC,CAAA;AAElB,MAAM,WAAW,sCAAsC;IACrD,iBAAiB,EAAE,4BAA4B,CAAA;IAC/C,6BAA6B,EAAE,6BAA6B,CAAA;IAC5D,YAAY,EAAE,YAAY,CAAA;IAC1B,KAAK,EAAE,KAAK,CAAA;IACZ,0EAA0E;IAC1E,eAAe,CAAC,EAAE,uBAAuB,CAAA;IACzC,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,qBAAa,0BAA0B;IASzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IARjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAQ;IAC5B;;;;OAIG;IACH,OAAO,CAAC,oBAAoB,CAA6C;IAEzE,YAA6B,IAAI,EAAE,sCAAsC,EAExE;IAED,iFAAiF;IACjF,uBAAuB,CAAC,IAAI,EAAE,+BAA+B,GAAG,SAAS,GAAG,IAAI,CAE/E;IAED,+DAA+D;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAQ1E;IAED,kFAAkF;IAC5E,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAa/C;YAEa,cAAc;IAqC5B;;;;;;OAMG;YACW,qBAAqB;YA2BrB,aAAa;CAK5B"}

package/dist/modules/environments/EnvironmentTeardownService.js

@@ -1,9 +1,21 @@
-import { assertFound } from '@cat-factory/kernel';
+import { assertFound, noopLogger, runBestEffort } from '@cat-factory/kernel';
 import { recordToHandle } from './environments.logic.js';
 export class EnvironmentTeardownService {
     deps;
+    log;
+    /**
+     * Late-bound because the engine that consumes it is constructed AFTER this service (it is
+     * injected into the provisioning service, which the engine takes). Same shape as
+     * `setInitiativeLoop` in the composition root, and for the same reason.
+     */
+    teardownRecordedHook;
     constructor(deps) {
         this.deps = deps;
+        this.log = deps.logger ?? noopLogger;
+    }
+    /** Late-bind the teardown-recorded notification. Unset ⇒ nothing is notified. */
+    setTeardownRecordedHook(hook) {
+        this.teardownRecordedHook = hook;
     }
     /** Tear down a single environment and tombstone its record. */
     async teardown(workspaceId, id) {
@@ -49,14 +61,21 @@ export class EnvironmentTeardownService {
                 // Log the verbatim provider error before it propagates (the sweep swallows
                 // it; an on-demand teardown surfaces it). The local record is NOT tombstoned
                 // on a provider failure, matching the existing retry-next-pass behaviour.
-                await this.logTeardown(record, 'failure', error instanceof Error ? error.message : String(error));
+                await this.recordTeardownAttempt(record, 'failure', error instanceof Error ? error.message : String(error));
                 throw error;
             }
         }
         await this.deps.environmentRegistryRepository.softDelete(record.workspaceId, record.id, this.deps.clock.now());
-        await this.logTeardown(record, 'success', null);
+        await this.recordTeardownAttempt(record, 'success', null);
     }
-    async logTeardown(record, outcome, error) {
+    /**
+     * Append the attempt to the provisioning log and then notify, in that order and in ONE place.
+     * The ordering is what makes the notification usable: its consumer reads the log back, so a
+     * hook fired before the row landed would report the state the edge exists to correct. Keeping
+     * both here is what makes the FAILURE edge structural rather than a line someone remembered to
+     * add beside the success one.
+     */
+    async recordTeardownAttempt(record, outcome, error) {
         await this.deps.provisioningLog?.record({
             workspaceId: record.workspaceId,
             subsystem: 'environment',
@@ -69,6 +88,15 @@ export class EnvironmentTeardownService {
             error,
             detail: null,
         });
+        const hook = this.teardownRecordedHook;
+        if (!hook)
+            return;
+        await runBestEffort(this.log, 'environment.teardownRecordedHook', () => hook(record, outcome), {
+            workspaceId: record.workspaceId,
+            environmentId: record.id,
+            executionId: record.executionId,
+            outcome,
+        });
     }
     async decryptFields(cipher) {
         if (!cipher)

package/dist/modules/environments/EnvironmentTeardownService.js.map

@@ -1 +1 @@
-{"version":3,"file":"EnvironmentTeardownService.js","sourceRoot":"","sources":["../../../src/modules/environments/EnvironmentTeardownService.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAEjD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAiBxD,MAAM,OAAO,0BAA0B;IACR,IAAI;IAAjC,YAA6B,IAA4C;oBAA5C,IAAI;IAA2C,CAAC;IAE7E,+DAA+D;IAC/D,KAAK,CAAC,QAAQ,CAAC,WAAmB,EAAE,EAAU;QAC5C,MAAM,MAAM,GAAG,WAAW,CACxB,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,EAClE,aAAa,EACb,EAAE,CACH,CAAA;QACD,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QACjC,OAAO,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;IAC3D,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,YAAY,CAAC,GAAW;QAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC9E,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;gBACjC,KAAK,EAAE,CAAA;YACT,CAAC;YAAC,MAAM,CAAC;gBACP,wEAAwE;gBACxE,yDAAyD;YAC3D,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,MAAyB;QACpD,8FAA8F;QAC9F,+FAA+F;QAC/F,kCAAkC;QAClC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB;aAC/C,wBAAwB,CAAC,MAAM,CAAC;aAChC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QACpB,0EAA0E;QAC1E,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAA;YAC9E,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oBAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,eAAe;oBACf,aAAa,EAAE,QAAQ,CAAC,aAAa;iBACtC,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,2EAA2E;gBAC3E,6EAA6E;gBAC7E,0EAA0E;gBAC1E,MAAM,IAAI,CAAC,WAAW,CACpB,MAAM,EACN,SAAS,EACT,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAA;gBACD,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,UAAU,CACtD,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,EAAE,EACT,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CACtB,CAAA;QACD,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;IACjD,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,MAAyB,EACzB,OAA8B,EAC9B,KAAoB;QAEpB,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC;YACtC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,aAAa;YACxB,SAAS,EAAE,UAAU;YACrB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,OAAO;YACP,KAAK;YACL,MAAM,EAAE,IAAI;SACb,CAAC,CAAA;IACJ,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,MAAqB;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAA;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;QACvE,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAiC,CAAC,CAAC,CAAC,EAAE,CAAA;IACvF,CAAC;CACF"}
+{"version":3,"file":"EnvironmentTeardownService.js","sourceRoot":"","sources":["../../../src/modules/environments/EnvironmentTeardownService.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAE5E,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAwCxD,MAAM,OAAO,0BAA0B;IASR,IAAI;IARhB,GAAG,CAAQ;IAC5B;;;;OAIG;IACK,oBAAoB,CAA6C;IAEzE,YAA6B,IAA4C;oBAA5C,IAAI;QAC/B,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,UAAU,CAAA;IACtC,CAAC;IAED,iFAAiF;IACjF,uBAAuB,CAAC,IAAiD;QACvE,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAA;IAClC,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,QAAQ,CAAC,WAAmB,EAAE,EAAU;QAC5C,MAAM,MAAM,GAAG,WAAW,CACxB,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,EAClE,aAAa,EACb,EAAE,CACH,CAAA;QACD,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QACjC,OAAO,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;IAC3D,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,YAAY,CAAC,GAAW;QAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC9E,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;gBACjC,KAAK,EAAE,CAAA;YACT,CAAC;YAAC,MAAM,CAAC;gBACP,wEAAwE;gBACxE,yDAAyD;YAC3D,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,MAAyB;QACpD,8FAA8F;QAC9F,+FAA+F;QAC/F,kCAAkC;QAClC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB;aAC/C,wBAAwB,CAAC,MAAM,CAAC;aAChC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QACpB,0EAA0E;QAC1E,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAA;YAC9E,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oBAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,eAAe;oBACf,aAAa,EAAE,QAAQ,CAAC,aAAa;iBACtC,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,2EAA2E;gBAC3E,6EAA6E;gBAC7E,0EAA0E;gBAC1E,MAAM,IAAI,CAAC,qBAAqB,CAC9B,MAAM,EACN,SAAS,EACT,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAA;gBACD,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,UAAU,CACtD,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,EAAE,EACT,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CACtB,CAAA;QACD,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;IAC3D,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,qBAAqB,CACjC,MAAyB,EACzB,OAA4B,EAC5B,KAAoB;QAEpB,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC;YACtC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,aAAa;YACxB,SAAS,EAAE,UAAU;YACrB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,OAAO;YACP,KAAK;YACL,MAAM,EAAE,IAAI;SACb,CAAC,CAAA;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,oBAAoB,CAAA;QACtC,IAAI,CAAC,IAAI;YAAE,OAAM;QACjB,MAAM,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,kCAAkC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;YAC7F,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,aAAa,EAAE,MAAM,CAAC,EAAE;YACxB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,OAAO;SACR,CAAC,CAAA;IACJ,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,MAAqB;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAA;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;QACvE,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAiC,CAAC,CAAC,CAAC,EAAE,CAAA;IACvF,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/integrations",
-  "version": "0.118.1",
+  "version": "0.120.0",
   "description": "External-system integration domain logic for the Agent Architecture Board (GitHub, documents, tasks, environments, runners).",
   "repository": {
     "type": "git",
@@ -27,15 +27,15 @@
     "ai": "^7.0.47",
     "p-map": "^7.0.6",
     "yaml": "^2.9.0",
-    "@cat-factory/contracts": "0.216.0",
-    "@cat-factory/kernel": "0.219.0"
+    "@cat-factory/contracts": "0.218.0",
+    "@cat-factory/kernel": "0.221.0"
   },
   "devDependencies": {
     "typescript": "7.0.2",
     "undici": "^8.9.0",
     "valibot": "^1.4.2",
     "vitest": "^4.1.10",
-    "@cat-factory/caching": "0.13.4"
+    "@cat-factory/caching": "0.13.6"
   },
   "scripts": {
     "build": "tsc -b tsconfig.build.json",