@cat-factory/integrations 0.150.0 → 0.152.0

package/dist/modules/email/emailNotification.logic.js

@@ -0,0 +1,155 @@
+// Pure helpers for the email notification transport: the per-type subject label, the
+// plain-text + HTML bodies, and the deep link back into the app. No I/O, so both facades
+// and the tests agree without a mail provider.
+//
+// Plain-text first, assembled from the notification's OWN machine-readable fields. There is
+// no template engine and no prose the backend invents: the card the inbox renders is the
+// source of truth, and an email that says something the card does not is a second version of
+// the truth to keep in step. The backend also does not localize (see CLAUDE.md), so this is
+// deliberately English until per-user locale becomes a slice of its own.
+/** A short per-type subject prefix, so a mailbox reader can triage without opening. */
+const TYPE_LABEL = {
+    merge_review: 'Merge review',
+    pipeline_complete: 'Pipeline complete',
+    merge_tag_request: 'Tag review effort',
+    ci_failed: 'CI failed',
+    test_failed: 'Tests failed',
+    requirement_review: 'Requirement review',
+    clarity_review: 'Bug-report triage',
+    release_regression: 'Release regression',
+    decision_required: 'Decision needed',
+    human_test_ready: 'Ready for human testing',
+    visual_confirmation_ready: 'Ready for visual confirmation',
+    human_review: 'Awaiting code review',
+    followup_pending: 'Follow-ups to decide',
+    fork_decision_pending: 'Choose an implementation approach',
+    judge_review: 'Review verdict needs a decision',
+    pr_review_ready: 'PR review findings',
+    initiative: 'Initiative update',
+    platform_health: 'Platform health alert',
+    budget_paused: 'Runs paused: spend budget reached',
+    budget_threshold: 'Spend budget warning',
+    key_drift: 'Encryption-key drift: credentials need re-entry',
+    infra_unreachable: 'Infrastructure unreachable',
+};
+/** The subject label for a notification type. */
+export function notificationTypeLabel(type) {
+    return TYPE_LABEL[type];
+}
+/**
+ * The board deep link for a notification, or null when the deployment has no public base
+ * URL configured. Null is why every body is written to stand on its own: an email whose
+ * only content was "click here" would be useless on a deployment that never told the
+ * backend where "here" is.
+ */
+export function notificationDeepLink(appBaseUrl, workspaceId, notification) {
+    const base = appBaseUrl?.trim();
+    if (!base)
+        return null;
+    // The same `?ws=&block=&run=` shape the PR verification report deep-links with, built by
+    // hand for the same reason: this package is runtime-neutral and compiles without the DOM,
+    // so `URLSearchParams` is not in its type surface.
+    const query = Object.entries({
+        ws: workspaceId,
+        ...(notification.blockId ? { block: notification.blockId } : {}),
+        ...(notification.executionId ? { run: notification.executionId } : {}),
+    })
+        .map(([key, value]) => `${key}=${encodeURIComponent(value)}`)
+        .join('&');
+    return `${base.replace(/\/$/, '')}/?${query}`;
+}
+/**
+ * Render a notification into a subject/body pair.
+ *
+ * Only fields the card itself carries are used, and the payload contributes the same
+ * context lines the Slack transport shows (pipeline, finding count, PR link). Nothing from
+ * an agent context, a prompt or a credential is reachable from here — the notification
+ * payload is the redacted projection the inbox already renders to every member of the board.
+ */
+export function renderNotificationEmail(notification, options = { link: null }) {
+    const label = notificationTypeLabel(notification.type);
+    const scope = options.workspaceName?.trim();
+    const subject = scope
+        ? `[${scope}] ${label}: ${notification.title}`
+        : `${label}: ${notification.title}`;
+    const lines = [notification.title];
+    if (notification.body)
+        lines.push('', notification.body);
+    const context = contextLines(notification);
+    if (context.length)
+        lines.push('', ...context);
+    if (options.link)
+        lines.push('', `Open in cat-factory: ${options.link}`);
+    const html = [
+        `<p><strong>${escapeHtml(label)}</strong></p>`,
+        `<p><strong>${escapeHtml(notification.title)}</strong></p>`,
+        ...(notification.body ? [`<p>${escapeHtml(notification.body)}</p>`] : []),
+        ...(context.length
+            ? [`<ul>${context.map((line) => `<li>${escapeHtml(line)}</li>`).join('')}</ul>`]
+            : []),
+        ...(options.link
+            ? [`<p><a href="${escapeHtml(options.link)}">Open in cat-factory</a></p>`]
+            : []),
+    ].join('');
+    return { subject, text: lines.join('\n'), html };
+}
+/** The payload-derived context lines, in the order a reader wants them. */
+function contextLines(notification) {
+    const payload = notification.payload;
+    if (!payload)
+        return [];
+    const lines = [];
+    if (payload.pipelineName)
+        lines.push(`Pipeline: ${payload.pipelineName}`);
+    if (typeof payload.findingCount === 'number') {
+        lines.push(`${payload.findingCount} open finding${payload.findingCount === 1 ? '' : 's'}`);
+    }
+    if (payload.assessment) {
+        const a = payload.assessment;
+        lines.push(`Complexity ${pct(a.complexity)} · Risk ${pct(a.risk)} · Impact ${pct(a.impact)}`);
+    }
+    if (payload.prUrl)
+        lines.push(`Pull request: ${payload.prUrl}`);
+    return lines;
+}
+function pct(score) {
+    return `${Math.round(score * 100)}%`;
+}
+/**
+ * Escape the five characters that change how HTML parses. The bodies here are
+ * model- and user-authored (a task title, an agent's assessment prose), and the HTML part
+ * is a rendered surface exactly as a PR body is — an unescaped `<` there is markup someone
+ * else's mail client executes the layout of.
+ */
+function escapeHtml(value) {
+    return value.replace(/[&<>"']/g, (ch) => HTML_ENTITIES[ch] ?? ch);
+}
+const HTML_ENTITIES = {
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#39;',
+};
+/**
+ * The addresses a delivery targets: every non-empty email in the audience, de-duplicated
+ * case-insensitively and in a stable order. A user with no email (a GitHub-only identity
+ * with no public address) simply contributes none — there is nothing to send to, and it is
+ * not a failure of this delivery.
+ */
+export function resolveRecipientAddresses(emails) {
+    const seen = new Set();
+    const out = [];
+    for (const email of emails) {
+        const trimmed = email?.trim();
+        if (!trimmed)
+            continue;
+        const key = trimmed.toLowerCase();
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push(trimmed);
+    }
+    return out;
+}
+//# sourceMappingURL=emailNotification.logic.js.map

package/dist/modules/email/emailNotification.logic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emailNotification.logic.js","sourceRoot":"","sources":["../../../src/modules/email/emailNotification.logic.ts"],"names":[],"mappings":"AAEA,qFAAqF;AACrF,yFAAyF;AACzF,+CAA+C;AAC/C,EAAE;AACF,4FAA4F;AAC5F,yFAAyF;AACzF,6FAA6F;AAC7F,4FAA4F;AAC5F,yEAAyE;AAEzE,uFAAuF;AACvF,MAAM,UAAU,GAAqC;IACnD,YAAY,EAAE,cAAc;IAC5B,iBAAiB,EAAE,mBAAmB;IACtC,iBAAiB,EAAE,mBAAmB;IACtC,SAAS,EAAE,WAAW;IACtB,WAAW,EAAE,cAAc;IAC3B,kBAAkB,EAAE,oBAAoB;IACxC,cAAc,EAAE,mBAAmB;IACnC,kBAAkB,EAAE,oBAAoB;IACxC,iBAAiB,EAAE,iBAAiB;IACpC,gBAAgB,EAAE,yBAAyB;IAC3C,yBAAyB,EAAE,+BAA+B;IAC1D,YAAY,EAAE,sBAAsB;IACpC,gBAAgB,EAAE,sBAAsB;IACxC,qBAAqB,EAAE,mCAAmC;IAC1D,YAAY,EAAE,iCAAiC;IAC/C,eAAe,EAAE,oBAAoB;IACrC,UAAU,EAAE,mBAAmB;IAC/B,eAAe,EAAE,uBAAuB;IACxC,aAAa,EAAE,mCAAmC;IAClD,gBAAgB,EAAE,sBAAsB;IACxC,SAAS,EAAE,iDAAiD;IAC5D,iBAAiB,EAAE,4BAA4B;CAChD,CAAA;AAED,iDAAiD;AACjD,MAAM,UAAU,qBAAqB,CAAC,IAAsB;IAC1D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAA8B,EAC9B,WAAmB,EACnB,YAA0B;IAE1B,MAAM,IAAI,GAAG,UAAU,EAAE,IAAI,EAAE,CAAA;IAC/B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,yFAAyF;IACzF,0FAA0F;IAC1F,mDAAmD;IACnD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC;QAC3B,EAAE,EAAE,WAAW;QACf,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvE,CAAC;SACC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;SAC5D,IAAI,CAAC,GAAG,CAAC,CAAA;IACZ,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAA;AAC/C,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,YAA0B,EAC1B,OAAO,GAA2D,EAAE,IAAI,EAAE,IAAI,EAAE;IAEhF,MAAM,KAAK,GAAG,qBAAqB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IACtD,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,CAAA;IAC3C,MAAM,OAAO,GAAG,KAAK;QACnB,CAAC,CAAC,IAAI,KAAK,KAAK,KAAK,KAAK,YAAY,CAAC,KAAK,EAAE;QAC9C,CAAC,CAAC,GAAG,KAAK,KAAK,YAAY,CAAC,KAAK,EAAE,CAAA;IAErC,MAAM,KAAK,GAAa,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;IAC5C,IAAI,YAAY,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;IACxD,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;IAC1C,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,CAAA;IAC9C,IAAI,OAAO,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,wBAAwB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;IAExE,MAAM,IAAI,GAAG;QACX,cAAc,UAAU,CAAC,KAAK,CAAC,eAAe;QAC9C,cAAc,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,eAAe;QAC3D,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,MAAM;YAChB,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;YAChF,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,IAAI;YACd,CAAC,CAAC,CAAC,eAAe,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC;YAC1E,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEV,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAA;AAClD,CAAC;AAED,2EAA2E;AAC3E,SAAS,YAAY,CAAC,YAA0B;IAC9C,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAA;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAA;IACvB,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,OAAO,CAAC,YAAY;QAAE,KAAK,CAAC,IAAI,CAAC,aAAa,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;IACzE,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,YAAY,gBAAgB,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;IAC5F,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,OAAO,CAAC,UAAU,CAAA;QAC5B,KAAK,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAC/F,CAAC;IACD,IAAI,OAAO,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;IAC/D,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,GAAG,CAAC,KAAa;IACxB,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,GAAG,CAAA;AACtC,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAA;AACnE,CAAC;AAED,MAAM,aAAa,GAA2B;IAC5C,GAAG,EAAE,OAAO;IACZ,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,OAAO;CACb,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAqC;IAC7E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAA;QAC7B,IAAI,CAAC,OAAO;YAAE,SAAQ;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,EAAE,CAAA;QACjC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC3B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACb,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACnB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/modules/github/GitHubService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GitHubService.d.ts","sourceRoot":"","sources":["../../../src/modules/github/GitHubService.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AACzE,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,qBAAqB,CAAA;AACtE,OAAO,KAAK,EACV,0BAA0B,EAC1B,yBAAyB,EACzB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,UAAU,EACV,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAW5B,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,YAAY,CAAA;IAC1B,wBAAwB,EAAE,wBAAwB,CAAA;IAClD,0BAA0B,EAAE,0BAA0B,CAAA;IACtD,+BAA+B,EAAE,+BAA+B,CAAA;IAChE,yBAAyB,EAAE,yBAAyB,CAAA;IACpD,KAAK,EAAE,KAAK,CAAA;CACb;AAuBD,0DAA0D;AAC1D,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,uBAAuB,CAAA;CACpC;AAED,sEAAsE;AACtE,MAAM,WAAW,sBAAsB;IACrC,8FAA8F;IAC9F,UAAU,EAAE,IAAI,GAAG,aAAa,CAAA;IAChC,KAAK,EAAE,oBAAoB,EAAE,CAAA;IAC7B,4DAA4D;IAC5D,YAAY,EAAE,MAAM,CAAA;CACrB;AAQD,qBAAa,aAAa;IACZ,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,yBAAyB,EAAI;IAIhE,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAEpD;IAED,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAE/E;IAED,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAElE;IAED,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAEtD;IAID;;;;;;;;;;;;;;;;;;OAkBG;IACG,4BAA4B,CAChC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,GACxD,OAAO,CAAC,sBAAsB,CAAC,CAkCjC;IAIK,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,CAAC,CAYvB;IAEK,WAAW,CACf,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAG1B;IAEK,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CAK5B;IAEK,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,qBAAqB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAGf;IAEK,OAAO,CACX,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,MAAM,EACvB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAGf;YAEa,OAAO;CAYtB"}
+{"version":3,"file":"GitHubService.d.ts","sourceRoot":"","sources":["../../../src/modules/github/GitHubService.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AACzE,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,qBAAqB,CAAA;AACtE,OAAO,KAAK,EACV,0BAA0B,EAC1B,yBAAyB,EACzB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,UAAU,EACV,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAW5B,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,YAAY,CAAA;IAC1B,wBAAwB,EAAE,wBAAwB,CAAA;IAClD,0BAA0B,EAAE,0BAA0B,CAAA;IACtD,+BAA+B,EAAE,+BAA+B,CAAA;IAChE,yBAAyB,EAAE,yBAAyB,CAAA;IACpD,KAAK,EAAE,KAAK,CAAA;CACb;AAuBD,0DAA0D;AAC1D,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,uBAAuB,CAAA;CACpC;AAED,sEAAsE;AACtE,MAAM,WAAW,sBAAsB;IACrC,8FAA8F;IAC9F,UAAU,EAAE,IAAI,GAAG,aAAa,CAAA;IAChC,KAAK,EAAE,oBAAoB,EAAE,CAAA;IAC7B,4DAA4D;IAC5D,YAAY,EAAE,MAAM,CAAA;CACrB;AAQD,qBAAa,aAAa;IACZ,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,yBAAyB,EAAI;IAIhE,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAEpD;IAED,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAE/E;IAED,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAElE;IAED,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAEtD;IAID;;;;;;;;;;;;;;;;;;OAkBG;IACG,4BAA4B,CAChC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,GACxD,OAAO,CAAC,sBAAsB,CAAC,CAkDjC;IAIK,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,CAAC,CAYvB;IAEK,WAAW,CACf,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAG1B;IAEK,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CAK5B;IAEK,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,qBAAqB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAGf;IAEK,OAAO,CACX,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,MAAM,EACvB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAGf;YAEa,OAAO;CAYtB"}

package/dist/modules/github/GitHubService.js

@@ -1,5 +1,5 @@
 import pMap from 'p-map';
-import { assertFound } from '@cat-factory/kernel';
+import { assertFound, VcsCapabilityUnsupportedError } from '@cat-factory/kernel';
 /**
  * How many repositories one preflight probes. Each repo costs one or two live GitHub reads, so
  * an unbounded fan-out on a large installation would both stall the request and burn rate
@@ -62,23 +62,41 @@ export class GitHubService {
         if (!probe)
             return { capability: 'unavailable', repos: [], omittedRepos: 0 };
         const all = await this.deps.repoProjectionRepository.list(workspaceId);
+        // A provider-routing client advertises the union of what its backing clients implement, so
+        // `probe` being present does NOT mean the workspace's own provider can answer: it may route
+        // to a client that omits it (GitLab has no branch-protection API). That is the same FACT this
+        // method's `capability: 'unavailable'` already states, so the first such refusal reports it
+        // rather than failing the request. A workspace has exactly one VCS installation, so every row
+        // here routes to the same provider and one refusal settles the whole report.
+        //
+        // Scoped to this ONE cause on purpose: any other probe failure still belongs to its own row,
+        // where `getBranchProtection` reports it per repo. Swallowing more here would let a rate limit
+        // or a revoked token read as "your provider doesn't offer this".
         const max = options.maxRepos ?? DEFAULT_PROTECTION_PROBE_LIMIT;
         const probed = all.slice(0, max);
         // `pMap` preserves INPUT order, which the surface depends on: a row must not move because
         // its probe happened to be slow.
-        const repos = await pMap(probed, async (repo) => {
-            // The projection can carry no default branch (a repo linked before its first sync). The
-            // probe then reports `branch_not_found` against this guess, which is the honest answer —
-            // an omitted row would read as one fewer repository to check.
-            const defaultBranch = repo.defaultBranch ?? 'main';
-            return {
-                repoGithubId: repo.githubId,
-                owner: repo.owner,
-                name: repo.name,
-                defaultBranch,
-                protection: await probe.call(this.deps.githubClient, repo.installationId, { owner: repo.owner, repo: repo.name }, defaultBranch),
-            };
-        }, { concurrency: options.concurrency ?? PROTECTION_PROBE_CONCURRENCY });
+        let repos;
+        try {
+            repos = await pMap(probed, async (repo) => {
+                // The projection can carry no default branch (a repo linked before its first sync). The
+                // probe then reports `branch_not_found` against this guess, which is the honest answer:
+                // an omitted row would read as one fewer repository to check.
+                const defaultBranch = repo.defaultBranch ?? 'main';
+                return {
+                    repoGithubId: repo.githubId,
+                    owner: repo.owner,
+                    name: repo.name,
+                    defaultBranch,
+                    protection: await probe.call(this.deps.githubClient, repo.installationId, { owner: repo.owner, repo: repo.name }, defaultBranch),
+                };
+            }, { concurrency: options.concurrency ?? PROTECTION_PROBE_CONCURRENCY });
+        }
+        catch (error) {
+            if (!(error instanceof VcsCapabilityUnsupportedError))
+                throw error;
+            return { capability: 'unavailable', repos: [], omittedRepos: 0 };
+        }
         // A cap that silently truncated would read as "these are all your repositories", which on a
         // security report is the same failure as reporting an unprobed repo as protected.
         return { capability: 'ok', repos, omittedRepos: all.length - probed.length };

package/dist/modules/github/GitHubService.js.map

@@ -1 +1 @@
-{"version":3,"file":"GitHubService.js","sourceRoot":"","sources":["../../../src/modules/github/GitHubService.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,OAAO,CAAA;AAkBxB,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAmBjD;;;;GAIG;AACH,MAAM,8BAA8B,GAAG,GAAG,CAAA;AAE1C;;;;;;;;;;;GAWG;AACH,MAAM,4BAA4B,GAAG,CAAC,CAAA;AA0BtC,MAAM,OAAO,aAAa;IACK,IAAI;IAAjC,YAA6B,IAA+B;oBAA/B,IAAI;IAA8B,CAAC;IAEhE,4EAA4E;IAE5E,SAAS,CAAC,WAAmB;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAC7D,CAAC;IAED,YAAY,CAAC,WAAmB,EAAE,YAAoB;QACpD,OAAO,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;IACnF,CAAC;IAED,gBAAgB,CAAC,WAAmB;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAAC,eAAe,CAAC,WAAW,CAAC,CAAA;IAC/E,CAAC;IAED,UAAU,CAAC,WAAmB;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAA;IACzE,CAAC;IAED,4EAA4E;IAE5E;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,4BAA4B,CAChC,WAAmB,EACnB,OAAO,GAAgD,EAAE;QAEzD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAA;QACxD,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,CAAA;QAE5E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACtE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,IAAI,8BAA8B,CAAA;QAC9D,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAChC,0FAA0F;QAC1F,iCAAiC;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CACtB,MAAM,EACN,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,wFAAwF;YACxF,yFAAyF;YACzF,8DAA8D;YAC9D,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,MAAM,CAAA;YAClD,OAAO;gBACL,YAAY,EAAE,IAAI,CAAC,QAAQ;gBAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,aAAa;gBACb,UAAU,EAAE,MAAM,KAAK,CAAC,IAAI,CAC1B,IAAI,CAAC,IAAI,CAAC,YAAY,EACtB,IAAI,CAAC,cAAc,EACnB,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EACtC,aAAa,CACd;aACF,CAAA;QACH,CAAC,EACD,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,4BAA4B,EAAE,CACrE,CAAA;QACD,4FAA4F;QAC5F,kFAAkF;QAClF,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAA;IAC9E,CAAC;IAED,4EAA4E;IAE5E,KAAK,CAAC,YAAY,CAChB,WAAmB,EACnB,YAAoB,EACpB,IAAY,EACZ,OAAe;QAEf,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;QAC7E,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QAC7E,MAAM,MAAM,GAAiB;YAC3B,YAAY;YACZ,IAAI;YACJ,OAAO,EAAE,OAAO;YAChB,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SAChC,CAAA;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;QAC5E,OAAO,MAAM,CAAA;IACf,CAAC;IAED,KAAK,CAAC,WAAW,CACf,WAAmB,EACnB,YAAoB,EACpB,KAAuB;QAEvB,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;QAC7E,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,cAAc,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IACvE,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,WAAmB,EACnB,YAAoB,EACpB,KAA2B;QAE3B,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;QAC7E,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,cAAc,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;QACnF,MAAM,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;QAC7E,OAAO,EAAE,CAAA;IACX,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,WAAmB,EACnB,YAAoB,EACpB,MAAc,EACd,KAA6B;QAE7B,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;QAC7E,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;IACnF,CAAC;IAED,KAAK,CAAC,OAAO,CACX,WAAmB,EACnB,YAAoB,EACpB,eAAuB,EACvB,IAAY;QAEZ,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;QAC7E,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,CAAC,CAAA;IAClF,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,WAAmB,EAAE,YAAoB;QAC7D,MAAM,IAAI,GAAG,WAAW,CACtB,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,EACvE,YAAY,EACZ,MAAM,CAAC,YAAY,CAAC,CACrB,CAAA;QACD,OAAO;YACL,IAAI;YACJ,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;SAC5C,CAAA;IACH,CAAC;CACF"}
+{"version":3,"file":"GitHubService.js","sourceRoot":"","sources":["../../../src/modules/github/GitHubService.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,OAAO,CAAA;AAkBxB,OAAO,EAAE,WAAW,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAA;AAmBhF;;;;GAIG;AACH,MAAM,8BAA8B,GAAG,GAAG,CAAA;AAE1C;;;;;;;;;;;GAWG;AACH,MAAM,4BAA4B,GAAG,CAAC,CAAA;AA0BtC,MAAM,OAAO,aAAa;IACK,IAAI;IAAjC,YAA6B,IAA+B;oBAA/B,IAAI;IAA8B,CAAC;IAEhE,4EAA4E;IAE5E,SAAS,CAAC,WAAmB;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAC7D,CAAC;IAED,YAAY,CAAC,WAAmB,EAAE,YAAoB;QACpD,OAAO,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;IACnF,CAAC;IAED,gBAAgB,CAAC,WAAmB;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAAC,eAAe,CAAC,WAAW,CAAC,CAAA;IAC/E,CAAC;IAED,UAAU,CAAC,WAAmB;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAA;IACzE,CAAC;IAED,4EAA4E;IAE5E;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,4BAA4B,CAChC,WAAmB,EACnB,OAAO,GAAgD,EAAE;QAEzD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAA;QACxD,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,CAAA;QAE5E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACtE,2FAA2F;QAC3F,4FAA4F;QAC5F,8FAA8F;QAC9F,4FAA4F;QAC5F,8FAA8F;QAC9F,6EAA6E;QAC7E,EAAE;QACF,6FAA6F;QAC7F,+FAA+F;QAC/F,iEAAiE;QACjE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,IAAI,8BAA8B,CAAA;QAC9D,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAChC,0FAA0F;QAC1F,iCAAiC;QACjC,IAAI,KAAsC,CAAA;QAC1C,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAChB,MAAM,EACN,KAAK,EAAE,IAAI,EAAE,EAAE;gBACb,wFAAwF;gBACxF,wFAAwF;gBACxF,8DAA8D;gBAC9D,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,MAAM,CAAA;gBAClD,OAAO;oBACL,YAAY,EAAE,IAAI,CAAC,QAAQ;oBAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,aAAa;oBACb,UAAU,EAAE,MAAM,KAAK,CAAC,IAAI,CAC1B,IAAI,CAAC,IAAI,CAAC,YAAY,EACtB,IAAI,CAAC,cAAc,EACnB,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EACtC,aAAa,CACd;iBACF,CAAA;YACH,CAAC,EACD,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,4BAA4B,EAAE,CACrE,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,6BAA6B,CAAC;gBAAE,MAAM,KAAK,CAAA;YAClE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,CAAA;QAClE,CAAC;QACD,4FAA4F;QAC5F,kFAAkF;QAClF,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAA;IAC9E,CAAC;IAED,4EAA4E;IAE5E,KAAK,CAAC,YAAY,CAChB,WAAmB,EACnB,YAAoB,EACpB,IAAY,EACZ,OAAe;QAEf,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;QAC7E,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QAC7E,MAAM,MAAM,GAAiB;YAC3B,YAAY;YACZ,IAAI;YACJ,OAAO,EAAE,OAAO;YAChB,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SAChC,CAAA;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;QAC5E,OAAO,MAAM,CAAA;IACf,CAAC;IAED,KAAK,CAAC,WAAW,CACf,WAAmB,EACnB,YAAoB,EACpB,KAAuB;QAEvB,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;QAC7E,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,cAAc,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IACvE,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,WAAmB,EACnB,YAAoB,EACpB,KAA2B;QAE3B,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;QAC7E,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,cAAc,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;QACnF,MAAM,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;QAC7E,OAAO,EAAE,CAAA;IACX,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,WAAmB,EACnB,YAAoB,EACpB,MAAc,EACd,KAA6B;QAE7B,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;QAC7E,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;IACnF,CAAC;IAED,KAAK,CAAC,OAAO,CACX,WAAmB,EACnB,YAAoB,EACpB,eAAuB,EACvB,IAAY;QAEZ,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;QAC7E,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,CAAC,CAAA;IAClF,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,WAAmB,EAAE,YAAoB;QAC7D,MAAM,IAAI,GAAG,WAAW,CACtB,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,EACvE,YAAY,EACZ,MAAM,CAAC,YAAY,CAAC,CACrB,CAAA;QACD,OAAO;YACL,IAAI;YACJ,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;SAC5C,CAAA;IACH,CAAC;CACF"}

package/dist/modules/notificationWebhook/WebhookNotificationChannel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"WebhookNotificationChannel.d.ts","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/WebhookNotificationChannel.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,KAAK,EACL,YAAY,EACZ,mBAAmB,EAGnB,6BAA6B,EAC7B,kBAAkB,EAClB,YAAY,EACZ,eAAe,EAChB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAqBjE,MAAM,WAAW,sCAAsC;IACrD,6BAA6B,EAAE,6BAA6B,CAAA;IAC5D,YAAY,EAAE,YAAY,CAAA;IAC1B,KAAK,EAAE,KAAK,CAAA;IACZ,oFAAoF;IACpF,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,yFAAyF;IACzF,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CACR,KAAK,EAAE,OAAO,EACd,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,KACvF,IAAI,CAAA;IACT;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;CACxC;AAED,qBAAa,0BAA2B,YAAW,mBAAmB;IACxD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,sCAAsC,EAAI;IAEvE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAa5E;YAEa,IAAI;IA8BlB,OAAO,CAAC,aAAa;CAqBtB;AAcD,OAAO,EAAE,yBAAyB,EAAE,CAAA"}
+{"version":3,"file":"WebhookNotificationChannel.d.ts","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/WebhookNotificationChannel.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,KAAK,EACL,YAAY,EACZ,mBAAmB,EAGnB,6BAA6B,EAC7B,kBAAkB,EAClB,YAAY,EACZ,eAAe,EAChB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAqBjE,MAAM,WAAW,sCAAsC;IACrD,6BAA6B,EAAE,6BAA6B,CAAA;IAC5D,YAAY,EAAE,YAAY,CAAA;IAC1B,KAAK,EAAE,KAAK,CAAA;IACZ,oFAAoF;IACpF,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,yFAAyF;IACzF,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CACR,KAAK,EAAE,OAAO,EACd,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,KACvF,IAAI,CAAA;IACT;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;CACxC;AAED,qBAAa,0BAA2B,YAAW,mBAAmB;IACxD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,sCAAsC,EAAI;IAOvE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAa5E;YAEa,IAAI;IA8BlB,OAAO,CAAC,aAAa;CAqBtB;AAcD,OAAO,EAAE,yBAAyB,EAAE,CAAA"}

package/dist/modules/notificationWebhook/WebhookNotificationChannel.js

@@ -6,6 +6,11 @@ export class WebhookNotificationChannel {
     constructor(deps) {
         this.deps = deps;
     }
+    // Takes EVERY delivery edge, unlike the alert transports (email, Slack) that gate on
+    // `isAlertingDelivery`. A receiver here is a machine, and a card settling is data it acts on
+    // (ADR 0047's headless clarification loop closes on exactly that edge), not an interruption it
+    // regrets. The edge is therefore not a parameter this channel reads: `notification.status`
+    // already carries what a receiver needs, and it is what the delivery id is keyed on.
     async deliver(workspaceId, notification) {
         try {
             await this.post(workspaceId, notification);

package/dist/modules/notificationWebhook/WebhookNotificationChannel.js.map

@@ -1 +1 @@
-{"version":3,"file":"WebhookNotificationChannel.js","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/WebhookNotificationChannel.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kCAAkC,GAEnC,MAAM,wBAAwB,CAAA;AAY/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAuDjE,MAAM,OAAO,0BAA0B;IACR,IAAI;IAAjC,YAA6B,IAA4C;oBAA5C,IAAI;IAA2C,CAAC;IAE7E,KAAK,CAAC,OAAO,CAAC,WAAmB,EAAE,YAA0B;QAC3D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sFAAsF;YACtF,2FAA2F;YAC3F,yFAAyF;YACzF,EAAE;YACF,yFAAyF;YACzF,4FAA4F;YAC5F,+DAA+D;YAC/D,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,YAAY,CAAC,CAAA;QACtD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,WAAmB,EAAE,YAA0B;QAChE,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CACxF,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,CACzE,CAAA;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QAElC,MAAM,IAAI,GAAgC;YACxC,6FAA6F;YAC7F,4FAA4F;YAC5F,sFAAsF;YACtF,EAAE;YACF,wFAAwF;YACxF,wFAAwF;YACxF,uFAAuF;YACvF,yDAAyD;YACzD,UAAU,EAAE,GAAG,YAAY,CAAC,EAAE,IAAI,YAAY,CAAC,MAAM,EAAE;YACvD,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC7B,WAAW;YACX,KAAK,EAAE,YAAY,CAAC,WAAW;YAC/B,MAAM,EAAE,YAAY,CAAC,OAAO;YAC5B,YAAY;SACb,CAAA;QACD,MAAM,mBAAmB,CACvB,IAAI,CAAC,IAAI,EACT,SAAS,EACT,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EACtD,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC,CACnF,CAAA;IACH,CAAC;IAEO,aAAa,CACnB,KAAc,EACd,WAAmB,EACnB,YAA0B,EAC1B,SAAkB;QAElB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE;YACzB,WAAW;YACX,cAAc,EAAE,YAAY,CAAC,EAAE;YAC/B,IAAI,EAAE,YAAY,CAAC,IAAI;YACvB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;SAClD,CAAC,CAAA;QACF,uFAAuF;QACvF,qFAAqF;QACrF,4FAA4F;QAC5F,2FAA2F;QAC3F,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,8BAA8B,EAAE;YACtE,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,YAAY,CAAC,IAAI;SACxB,CAAC,CAAA;IACJ,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,OAAkC,EAAE,IAAsB;IAC9E,MAAM,KAAK,GAAgC,OAAO,CAAC,KAAK,CAAC,MAAM;QAC7D,CAAC,CAAC,OAAO,CAAC,KAAK;QACf,CAAC,CAAC,kCAAkC,CAAA;IACtC,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AAC7B,CAAC;AAED,OAAO,EAAE,yBAAyB,EAAE,CAAA"}
+{"version":3,"file":"WebhookNotificationChannel.js","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/WebhookNotificationChannel.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kCAAkC,GAEnC,MAAM,wBAAwB,CAAA;AAY/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAuDjE,MAAM,OAAO,0BAA0B;IACR,IAAI;IAAjC,YAA6B,IAA4C;oBAA5C,IAAI;IAA2C,CAAC;IAE7E,qFAAqF;IACrF,6FAA6F;IAC7F,+FAA+F;IAC/F,2FAA2F;IAC3F,qFAAqF;IACrF,KAAK,CAAC,OAAO,CAAC,WAAmB,EAAE,YAA0B;QAC3D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sFAAsF;YACtF,2FAA2F;YAC3F,yFAAyF;YACzF,EAAE;YACF,yFAAyF;YACzF,4FAA4F;YAC5F,+DAA+D;YAC/D,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,YAAY,CAAC,CAAA;QACtD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,WAAmB,EAAE,YAA0B;QAChE,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CACxF,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,CACzE,CAAA;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QAElC,MAAM,IAAI,GAAgC;YACxC,6FAA6F;YAC7F,4FAA4F;YAC5F,sFAAsF;YACtF,EAAE;YACF,wFAAwF;YACxF,wFAAwF;YACxF,uFAAuF;YACvF,yDAAyD;YACzD,UAAU,EAAE,GAAG,YAAY,CAAC,EAAE,IAAI,YAAY,CAAC,MAAM,EAAE;YACvD,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC7B,WAAW;YACX,KAAK,EAAE,YAAY,CAAC,WAAW;YAC/B,MAAM,EAAE,YAAY,CAAC,OAAO;YAC5B,YAAY;SACb,CAAA;QACD,MAAM,mBAAmB,CACvB,IAAI,CAAC,IAAI,EACT,SAAS,EACT,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EACtD,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC,CACnF,CAAA;IACH,CAAC;IAEO,aAAa,CACnB,KAAc,EACd,WAAmB,EACnB,YAA0B,EAC1B,SAAkB;QAElB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE;YACzB,WAAW;YACX,cAAc,EAAE,YAAY,CAAC,EAAE;YAC/B,IAAI,EAAE,YAAY,CAAC,IAAI;YACvB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;SAClD,CAAC,CAAA;QACF,uFAAuF;QACvF,qFAAqF;QACrF,4FAA4F;QAC5F,2FAA2F;QAC3F,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,8BAA8B,EAAE;YACtE,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,YAAY,CAAC,IAAI;SACxB,CAAC,CAAA;IACJ,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,OAAkC,EAAE,IAAsB;IAC9E,MAAM,KAAK,GAAgC,OAAO,CAAC,KAAK,CAAC,MAAM;QAC7D,CAAC,CAAC,OAAO,CAAC,KAAK;QACf,CAAC,CAAC,kCAAkC,CAAA;IACtC,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AAC7B,CAAC;AAED,OAAO,EAAE,yBAAyB,EAAE,CAAA"}

package/dist/modules/providers/ApiKeyService.d.ts

@@ -1,4 +1,11 @@
 import type { ApiKeyProvider, ApiKeyScope, Clock, IdGenerator, ProviderApiKeyRepository, SecretCipher, WorkspaceRepository } from '@cat-factory/kernel';
+/**
+ * HKDF domain tag separating the sealed provider API keys from every other cipher (mirrors
+ * {@link TEST_SECRETS_CIPHER_INFO} et al). Both facades build their `WebCryptoSecretCipher` from
+ * this constant: the tag derives the key, so a facade spelling it differently seals credentials
+ * its sibling cannot unseal.
+ */
+export declare const PROVIDER_API_KEYS_CIPHER_INFO = "cat-factory:provider-api-keys";
 export interface ApiKeyServiceDependencies {
     providerApiKeyRepository: ProviderApiKeyRepository;
     workspaceRepository: WorkspaceRepository;

package/dist/modules/providers/ApiKeyService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyService.d.ts","sourceRoot":"","sources":["../../../src/modules/providers/ApiKeyService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,WAAW,EAEX,KAAK,EACL,WAAW,EAEX,wBAAwB,EACxB,YAAY,EACZ,mBAAmB,EACpB,MAAM,qBAAqB,CAAA;AAmB5B,MAAM,WAAW,yBAAyB;IACxC,wBAAwB,EAAE,wBAAwB,CAAA;IAClD,mBAAmB,EAAE,mBAAmB,CAAA;IACxC,YAAY,EAAE,YAAY,CAAA;IAC1B,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,KAAK,CAAA;IACZ,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,yDAAyD;AACzD,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,WAAW,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,cAAc,CAAA;IACxB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,cAAc,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC5B,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACvB;AAED,qBAAa,aAAa;IACZ,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,yBAAyB,EAAI;IAEhE,OAAO,KAAK,QAAQ,GAEnB;IAED,mCAAmC;IAC7B,MAAM,CACV,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;QAAE,QAAQ,EAAE,cAAc,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAC9D,OAAO,CAAC,aAAa,CAAC,CAiCxB;IAED,kFAAkF;IAC5E,QAAQ,CACZ,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,cAAc,GACxB,OAAO,CAAC,aAAa,EAAE,CAAC,CAG1B;IAED;;;;OAIG;IACG,SAAS,CACb,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAChD,OAAO,CAAC,aAAa,CAAC,CAgBxB;IAED,0CAA0C;IACpC,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9E;IAED;;;OAGG;YACW,UAAU;IAWxB,wEAAwE;IAClE,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,cAAc,EACxB,IAAI,CAAC,EAAE,aAAa,GACnB,OAAO,CAAC,OAAO,CAAC,CAIlB;IAED,4EAA4E;IACtE,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAG9F;IAED;;;;;OAKG;IACG,KAAK,CACT,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,cAAc,EACxB,IAAI,CAAC,EAAE,aAAa,GACnB,OAAO,CAAC,YAAY,CAAC,CAgCvB;IAED,mFAAmF;IAC7E,WAAW,CACf,KAAK,EAAE,MAAM,EACb,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GACnD,OAAO,CAAC,IAAI,CAAC,CAOf;CACF"}
+{"version":3,"file":"ApiKeyService.d.ts","sourceRoot":"","sources":["../../../src/modules/providers/ApiKeyService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,WAAW,EAEX,KAAK,EACL,WAAW,EAEX,wBAAwB,EACxB,YAAY,EACZ,mBAAmB,EACpB,MAAM,qBAAqB,CAAA;AAmB5B;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,kCAAkC,CAAA;AAE5E,MAAM,WAAW,yBAAyB;IACxC,wBAAwB,EAAE,wBAAwB,CAAA;IAClD,mBAAmB,EAAE,mBAAmB,CAAA;IACxC,YAAY,EAAE,YAAY,CAAA;IAC1B,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,KAAK,CAAA;IACZ,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,yDAAyD;AACzD,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,WAAW,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,cAAc,CAAA;IACxB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,cAAc,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC5B,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACvB;AAED,qBAAa,aAAa;IACZ,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,yBAAyB,EAAI;IAEhE,OAAO,KAAK,QAAQ,GAEnB;IAED,mCAAmC;IAC7B,MAAM,CACV,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;QAAE,QAAQ,EAAE,cAAc,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAC9D,OAAO,CAAC,aAAa,CAAC,CAiCxB;IAED,kFAAkF;IAC5E,QAAQ,CACZ,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,cAAc,GACxB,OAAO,CAAC,aAAa,EAAE,CAAC,CAG1B;IAED;;;;OAIG;IACG,SAAS,CACb,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAChD,OAAO,CAAC,aAAa,CAAC,CAgBxB;IAED,0CAA0C;IACpC,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9E;IAED;;;OAGG;YACW,UAAU;IAWxB,wEAAwE;IAClE,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,cAAc,EACxB,IAAI,CAAC,EAAE,aAAa,GACnB,OAAO,CAAC,OAAO,CAAC,CAIlB;IAED,4EAA4E;IACtE,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAG9F;IAED;;;;;OAKG;IACG,KAAK,CACT,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,cAAc,EACxB,IAAI,CAAC,EAAE,aAAa,GACnB,OAAO,CAAC,YAAY,CAAC,CAgCvB;IAED,mFAAmF;IAC7E,WAAW,CACf,KAAK,EAAE,MAAM,EACb,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GACnD,OAAO,CAAC,IAAI,CAAC,CAOf;CACF"}

package/dist/modules/providers/ApiKeyService.js

@@ -13,6 +13,13 @@ import { DEFAULT_USAGE_WINDOW_MS } from './providers.logic.js';
 // meant to hold a handful of keys for quota headroom; a generous ceiling keeps the
 // feature usable while bounding accidental/abusive unbounded growth.
 const MAX_KEYS_PER_PROVIDER = 25;
+/**
+ * HKDF domain tag separating the sealed provider API keys from every other cipher (mirrors
+ * {@link TEST_SECRETS_CIPHER_INFO} et al). Both facades build their `WebCryptoSecretCipher` from
+ * this constant: the tag derives the key, so a facade spelling it differently seals credentials
+ * its sibling cannot unseal.
+ */
+export const PROVIDER_API_KEYS_CIPHER_INFO = 'cat-factory:provider-api-keys';
 export class ApiKeyService {
     deps;
     constructor(deps) {

package/dist/modules/providers/ApiKeyService.js.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyService.js","sourceRoot":"","sources":["../../../src/modules/providers/ApiKeyService.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAE9D,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,gFAAgF;AAChF,EAAE;AACF,kFAAkF;AAClF,kFAAkF;AAClF,8EAA8E;AAC9E,mFAAmF;AAEnF,gFAAgF;AAChF,mFAAmF;AACnF,qEAAqE;AACrE,MAAM,qBAAqB,GAAG,EAAE,CAAA;AA2ChC,MAAM,OAAO,aAAa;IACK,IAAI;IAAjC,YAA6B,IAA+B;oBAA/B,IAAI;IAA8B,CAAC;IAEhE,IAAY,QAAQ;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,uBAAuB,CAAA;IAC3D,CAAC;IAED,mCAAmC;IACnC,KAAK,CAAC,MAAM,CACV,KAAkB,EAClB,OAAe,EACf,KAA+D;QAE/D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,WAAW,CACnE,KAAK,EACL,OAAO,EACP,KAAK,CAAC,QAAQ,CACf,CAAA;QACD,IAAI,QAAQ,CAAC,MAAM,IAAI,qBAAqB,EAAE,CAAC;YAC7C,MAAM,IAAI,aAAa,CACrB,QAAQ,KAAK,+BAA+B,qBAAqB,GAAG;gBAClE,GAAG,KAAK,CAAC,QAAQ,6CAA6C,CACjE,CAAA;QACH,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,MAAM,GAAyB;YACnC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;YACxC,KAAK;YACL,OAAO;YACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS;YACT,SAAS,EAAE,GAAG;YACd,UAAU,EAAE,IAAI;YAChB,eAAe,EAAE,IAAI;YACrB,WAAW,EAAE,CAAC;YACd,YAAY,EAAE,CAAC;YACf,YAAY,EAAE,CAAC;YACf,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,IAAI;SAChB,CAAA;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACpD,OAAO,SAAS,CAAC,MAAM,CAAC,CAAA;IAC1B,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,QAAQ,CACZ,KAAkB,EAClB,OAAe,EACf,QAAyB;QAEzB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC3F,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAC5B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CACb,KAAkB,EAClB,OAAe,EACf,EAAU,EACV,KAAiD;QAEjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAA;QAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;QACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,aAAa,CAAC,GAAG,KAAK,UAAU,EAAE,EAAE,CAAC,CAAA;QACjD,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;QAC1D,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;QAC9D,CAAC;aAAM,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC3D,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QAChE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;QACtD,OAAO,SAAS,CAAC,OAAO,IAAI,QAAQ,CAAC,CAAA;IACvC,CAAC;IAED,0CAA0C;IAC1C,KAAK,CAAC,SAAS,CAAC,KAAkB,EAAE,OAAe,EAAE,EAAU;QAC7D,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;IAChG,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,UAAU,CAAC,WAAmB,EAAE,IAAoB;QAChE,MAAM,MAAM,GAAqB,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAA;QAC/E,MAAM,SAAS,GACb,IAAI,EAAE,SAAS,KAAK,SAAS;YAC3B,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,WAAW,CAAC;YAC5D,CAAC,CAAC,IAAI,CAAC,SAAS,CAAA;QACpB,IAAI,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAA;QACpE,IAAI,IAAI,EAAE,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;QACtE,OAAO,MAAM,CAAA;IACf,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,MAAM,CACV,WAAmB,EACnB,QAAwB,EACxB,IAAoB;QAEpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;QACvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACnF,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAA;IACxB,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,mBAAmB,CAAC,WAAmB,EAAE,IAAoB;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;QACvD,OAAO,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAA;IAC3E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CACT,WAAmB,EACnB,QAAwB,EACxB,IAAoB;QAEpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;QACvD,wFAAwF;QACxF,yFAAyF;QACzF,wFAAwF;QACxF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,cAAc,CACpE,MAAM,EACN,QAAQ,EACR,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EACrB,IAAI,CAAC,QAAQ,CACd,CAAA;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,aAAa,CACrB,MAAM,QAAQ,sEAAsE,CACrF,CAAA;QACH,CAAC;QACD,IAAI,MAAc,CAAA;QAClB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QACjE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,qFAAqF;YACrF,oFAAoF;YACpF,+EAA+E;YAC/E,yEAAyE;YACzE,MAAM,IAAI,KAAK,CACb,iCAAiC,QAAQ,cAAc,MAAM,CAAC,EAAE,MAC9D,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAC3C,EAAE,EACF,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAA;QACH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;IAC/C,CAAC;IAED,mFAAmF;IACnF,KAAK,CAAC,WAAW,CACf,KAAa,EACb,KAAoD;QAEpD,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,WAAW,CAClD,KAAK,EACL,KAAK,EACL,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EACrB,IAAI,CAAC,QAAQ,CACd,CAAA;IACH,CAAC;CACF;AAED,SAAS,SAAS,CAAC,MAA4B;IAC7C,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAA;AACH,CAAC"}
+{"version":3,"file":"ApiKeyService.js","sourceRoot":"","sources":["../../../src/modules/providers/ApiKeyService.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAE9D,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,gFAAgF;AAChF,EAAE;AACF,kFAAkF;AAClF,kFAAkF;AAClF,8EAA8E;AAC9E,mFAAmF;AAEnF,gFAAgF;AAChF,mFAAmF;AACnF,qEAAqE;AACrE,MAAM,qBAAqB,GAAG,EAAE,CAAA;AAEhC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,+BAA+B,CAAA;AA2C5E,MAAM,OAAO,aAAa;IACK,IAAI;IAAjC,YAA6B,IAA+B;oBAA/B,IAAI;IAA8B,CAAC;IAEhE,IAAY,QAAQ;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,uBAAuB,CAAA;IAC3D,CAAC;IAED,mCAAmC;IACnC,KAAK,CAAC,MAAM,CACV,KAAkB,EAClB,OAAe,EACf,KAA+D;QAE/D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,WAAW,CACnE,KAAK,EACL,OAAO,EACP,KAAK,CAAC,QAAQ,CACf,CAAA;QACD,IAAI,QAAQ,CAAC,MAAM,IAAI,qBAAqB,EAAE,CAAC;YAC7C,MAAM,IAAI,aAAa,CACrB,QAAQ,KAAK,+BAA+B,qBAAqB,GAAG;gBAClE,GAAG,KAAK,CAAC,QAAQ,6CAA6C,CACjE,CAAA;QACH,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,MAAM,GAAyB;YACnC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;YACxC,KAAK;YACL,OAAO;YACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS;YACT,SAAS,EAAE,GAAG;YACd,UAAU,EAAE,IAAI;YAChB,eAAe,EAAE,IAAI;YACrB,WAAW,EAAE,CAAC;YACd,YAAY,EAAE,CAAC;YACf,YAAY,EAAE,CAAC;YACf,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,IAAI;SAChB,CAAA;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACpD,OAAO,SAAS,CAAC,MAAM,CAAC,CAAA;IAC1B,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,QAAQ,CACZ,KAAkB,EAClB,OAAe,EACf,QAAyB;QAEzB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC3F,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAC5B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CACb,KAAkB,EAClB,OAAe,EACf,EAAU,EACV,KAAiD;QAEjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAA;QAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;QACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,aAAa,CAAC,GAAG,KAAK,UAAU,EAAE,EAAE,CAAC,CAAA;QACjD,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;QAC1D,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;QAC9D,CAAC;aAAM,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC3D,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QAChE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;QACtD,OAAO,SAAS,CAAC,OAAO,IAAI,QAAQ,CAAC,CAAA;IACvC,CAAC;IAED,0CAA0C;IAC1C,KAAK,CAAC,SAAS,CAAC,KAAkB,EAAE,OAAe,EAAE,EAAU;QAC7D,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;IAChG,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,UAAU,CAAC,WAAmB,EAAE,IAAoB;QAChE,MAAM,MAAM,GAAqB,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAA;QAC/E,MAAM,SAAS,GACb,IAAI,EAAE,SAAS,KAAK,SAAS;YAC3B,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,WAAW,CAAC;YAC5D,CAAC,CAAC,IAAI,CAAC,SAAS,CAAA;QACpB,IAAI,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAA;QACpE,IAAI,IAAI,EAAE,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;QACtE,OAAO,MAAM,CAAA;IACf,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,MAAM,CACV,WAAmB,EACnB,QAAwB,EACxB,IAAoB;QAEpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;QACvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACnF,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAA;IACxB,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,mBAAmB,CAAC,WAAmB,EAAE,IAAoB;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;QACvD,OAAO,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAA;IAC3E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CACT,WAAmB,EACnB,QAAwB,EACxB,IAAoB;QAEpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;QACvD,wFAAwF;QACxF,yFAAyF;QACzF,wFAAwF;QACxF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,cAAc,CACpE,MAAM,EACN,QAAQ,EACR,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EACrB,IAAI,CAAC,QAAQ,CACd,CAAA;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,aAAa,CACrB,MAAM,QAAQ,sEAAsE,CACrF,CAAA;QACH,CAAC;QACD,IAAI,MAAc,CAAA;QAClB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QACjE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,qFAAqF;YACrF,oFAAoF;YACpF,+EAA+E;YAC/E,yEAAyE;YACzE,MAAM,IAAI,KAAK,CACb,iCAAiC,QAAQ,cAAc,MAAM,CAAC,EAAE,MAC9D,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAC3C,EAAE,EACF,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAA;QACH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;IAC/C,CAAC;IAED,mFAAmF;IACnF,KAAK,CAAC,WAAW,CACf,KAAa,EACb,KAAoD;QAEpD,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,WAAW,CAClD,KAAK,EACL,KAAK,EACL,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EACrB,IAAI,CAAC,QAAQ,CACd,CAAA;IACH,CAAC;CACF;AAED,SAAS,SAAS,CAAC,MAA4B;IAC7C,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAA;AACH,CAAC"}

package/dist/modules/providers/LocalModelEndpointService.d.ts

@@ -1,6 +1,13 @@
 import type { Clock, LocalModelEndpointRepository, SecretCipher } from '@cat-factory/kernel';
 import type { LocalModelEndpoint, LocalModelEndpointTestResult, LocalRunner, TestLocalModelEndpointInput, UpsertLocalModelEndpointInput } from '@cat-factory/contracts';
 import { type LocalRunnerUrlRefusal } from './localModelUrl.js';
+/**
+ * HKDF domain tag separating a local runner's sealed bearer key from every other cipher (mirrors
+ * {@link TEST_SECRETS_CIPHER_INFO} et al). Both facades build their `WebCryptoSecretCipher` from
+ * this constant: the tag derives the key, so a facade spelling it differently seals credentials
+ * its sibling cannot unseal.
+ */
+export declare const LOCAL_MODEL_ENDPOINTS_CIPHER_INFO = "cat-factory:local-model-endpoints";
 export interface LocalModelEndpointServiceDependencies {
     localModelEndpointRepository: LocalModelEndpointRepository;
     /** System encryption layer (master key) for the optional bearer key at rest. */

package/dist/modules/providers/LocalModelEndpointService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"LocalModelEndpointService.d.ts","sourceRoot":"","sources":["../../../src/modules/providers/LocalModelEndpointService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EAEL,4BAA4B,EAC5B,YAAY,EACb,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EACV,kBAAkB,EAClB,4BAA4B,EAC5B,WAAW,EAEX,2BAA2B,EAC3B,6BAA6B,EAC9B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAGL,KAAK,qBAAqB,EAG3B,MAAM,oBAAoB,CAAA;AAa3B,MAAM,WAAW,qCAAqC;IACpD,4BAA4B,EAAE,4BAA4B,CAAA;IAC1D,gFAAgF;IAChF,YAAY,EAAE,YAAY,CAAA;IAC1B,KAAK,EAAE,KAAK,CAAA;IACZ,wDAAwD;IACxD,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IACpB;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED,wFAAwF;AACxF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,WAAW,CAAA;IACrB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CACtB;AAED,qBAAa,yBAAyB;IAIxB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;IAEhD,YAA6B,IAAI,EAAE,qCAAqC,EAEvE;IAED;;;;;OAKG;IACG,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAGxD;IAED,qFAAqF;IACrF,OAAO,CAAC,aAAa;IAIrB,0DAA0D;IACpD,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAgC9F;IAED,+CAA+C;IACzC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjE;IAED;;;OAGG;IACG,eAAe,CACnB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,QAAQ,EAAE,WAAW,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC,CAYvE;IAED;;;OAGG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAUrF;IAED;;;OAGG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAUnE;IAED;;;;;OAKG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAEhE;IAED;;;;;OAKG;IACH,WAAW,CACT,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,IAAI,MAAM,EAAE,GACnB;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,qBAAqB,CAAA;KAAE,CAEtD;IAED;;;;OAIG;IACG,cAAc,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,4BAA4B,CAAC,CA+B9F;CACF"}
+{"version":3,"file":"LocalModelEndpointService.d.ts","sourceRoot":"","sources":["../../../src/modules/providers/LocalModelEndpointService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EAEL,4BAA4B,EAC5B,YAAY,EACb,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EACV,kBAAkB,EAClB,4BAA4B,EAC5B,WAAW,EAEX,2BAA2B,EAC3B,6BAA6B,EAC9B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAGL,KAAK,qBAAqB,EAG3B,MAAM,oBAAoB,CAAA;AAa3B;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,sCAAsC,CAAA;AAEpF,MAAM,WAAW,qCAAqC;IACpD,4BAA4B,EAAE,4BAA4B,CAAA;IAC1D,gFAAgF;IAChF,YAAY,EAAE,YAAY,CAAA;IAC1B,KAAK,EAAE,KAAK,CAAA;IACZ,wDAAwD;IACxD,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IACpB;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED,wFAAwF;AACxF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,WAAW,CAAA;IACrB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CACtB;AAED,qBAAa,yBAAyB;IAIxB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;IAEhD,YAA6B,IAAI,EAAE,qCAAqC,EAEvE;IAED;;;;;OAKG;IACG,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAGxD;IAED,qFAAqF;IACrF,OAAO,CAAC,aAAa;IAIrB,0DAA0D;IACpD,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAgC9F;IAED,+CAA+C;IACzC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjE;IAED;;;OAGG;IACG,eAAe,CACnB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,QAAQ,EAAE,WAAW,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC,CAYvE;IAED;;;OAGG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAUrF;IAED;;;OAGG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAUnE;IAED;;;;;OAKG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAEhE;IAED;;;;;OAKG;IACH,WAAW,CACT,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,IAAI,MAAM,EAAE,GACnB;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,qBAAqB,CAAA;KAAE,CAEtD;IAED;;;;OAIG;IACG,cAAc,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,4BAA4B,CAAC,CA+B9F;CACF"}

package/dist/modules/providers/LocalModelEndpointService.js

@@ -1,6 +1,23 @@
 import { getErrorMessage, ValidationError } from '@cat-factory/kernel';
 import { LOCAL_RUNNER_LABELS } from '@cat-factory/contracts';
 import { fetchLocalRunner, localRunnerUrlRefusal, runnerRequestUrl, } from './localModelUrl.js';
+// LocalModelEndpointService: owns each USER's locally-run model endpoints (Ollama / LM
+// Studio / llama.cpp / vLLM / a custom OpenAI-compatible server) — the per-user analogue
+// of the workspace API-key pool, but for self-hosted runners. A runner lives on the
+// user's own machine, so endpoints are scoped to the user and resolved by the RUN
+// INITIATOR at execution time (mirroring personal subscriptions).
+//
+// The optional bearer key (most local runners ignore auth) is encrypted at rest with the
+// system SecretCipher and never returned to the SPA. `testConnection` probes the runner's
+// OpenAI-compatible `/models` server-side so the UI can validate a base URL and list the
+// models the runner actually serves before the user enables them.
+/**
+ * HKDF domain tag separating a local runner's sealed bearer key from every other cipher (mirrors
+ * {@link TEST_SECRETS_CIPHER_INFO} et al). Both facades build their `WebCryptoSecretCipher` from
+ * this constant: the tag derives the key, so a facade spelling it differently seals credentials
+ * its sibling cannot unseal.
+ */
+export const LOCAL_MODEL_ENDPOINTS_CIPHER_INFO = 'cat-factory:local-model-endpoints';
 export class LocalModelEndpointService {
     deps;
     /** The deployment's runner-host policy, normalised once from the deps flag. */

package/dist/modules/providers/LocalModelEndpointService.js.map

@@ -1 +1 @@
-{"version":3,"file":"LocalModelEndpointService.js","sourceRoot":"","sources":["../../../src/modules/providers/LocalModelEndpointService.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAStE,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,EACL,gBAAgB,EAGhB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,oBAAoB,CAAA;AAoC3B,MAAM,OAAO,yBAAyB;IAIP,IAAI;IAHjC,+EAA+E;IAC9D,SAAS,CAAsB;IAEhD,YAA6B,IAA2C;oBAA3C,IAAI;QAC/B,IAAI,CAAC,SAAS,GAAG,EAAE,eAAe,EAAE,IAAI,CAAC,oBAAoB,IAAI,KAAK,EAAE,CAAA;IAC1E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,IAAI,CAAC,MAAc;QACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QAC5E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAClE,CAAC;IAED,qFAAqF;IAC7E,aAAa,CAAC,OAAe;QACnC,OAAO,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,IAAI,IAAI,CAAA;IACvE,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,KAAoC;QAC/D,qFAAqF;QACrF,sFAAsF;QACtF,oFAAoF;QACpF,iEAAiE;QACjE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QACrE,IAAI,QAAQ;YAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QACtF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,iBAAiB,CAC7E,MAAM,EACN,KAAK,CAAC,QAAQ,CACf,CAAA;QACD,8EAA8E;QAC9E,MAAM,YAAY,GAChB,KAAK,CAAC,MAAM,KAAK,SAAS;YACxB,CAAC,CAAC,CAAC,QAAQ,EAAE,YAAY,IAAI,IAAI,CAAC;YAClC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;gBACvB,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;gBACpD,CAAC,CAAC,IAAI,CAAA;QACZ,MAAM,MAAM,GAA6B;YACvC,MAAM;YACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC;YACjE,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY;YACZ,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;YAC5B,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,GAAG;YACrC,SAAS,EAAE,GAAG;SACf,CAAA;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC3D,wEAAwE;QACxE,OAAO,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC7B,CAAC;IAED,+CAA+C;IAC/C,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,QAAqB;QAChD,MAAM,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACvE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CACnB,MAAc;QAEd,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QAC5E,OAAO,CACL,IAAI;aACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;YACnC,sFAAsF;YACtF,qFAAqF;YACrF,oFAAoF;YACpF,iDAAiD;aAChD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;aACrD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAC5E,CAAA;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,QAAgB;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,iBAAiB,CAC3E,MAAM,EACN,QAAuB,CACxB,CAAA;QACD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY;YAChC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;YAC3D,CAAC,CAAC,IAAI,CAAA;QACR,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,CAAA;IACvE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QAC5E,MAAM,GAAG,GAA4B,EAAE,CAAA;QACvC,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY;gBAChC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;gBAC3D,CAAC,CAAC,IAAI,CAAA;YACR,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;QAC1E,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED;;;;;OAKG;IACH,WAAW,CAAC,MAAc,EAAE,IAAiB;QAC3C,OAAO,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IACjF,CAAC;IAED;;;;;OAKG;IACH,WAAW,CACT,OAAe,EACf,MAAoB;QAEpB,OAAO,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IAC1D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,KAAkC;QACrD,uFAAuF;QACvF,qFAAqF;QACrF,qFAAqF;QACrF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAC3E,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;YAC1B,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO;gBAC/B,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;aACrC,CAAA;QACH,CAAC;QACD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAA;QACxB,IAAI,CAAC;YACH,MAAM,OAAO,GAA2B,EAAE,CAAA;YAC1C,IAAI,KAAK,CAAC,MAAM;gBAAE,OAAO,CAAC,aAAa,GAAG,UAAU,KAAK,CAAC,MAAM,EAAE,CAAA;YAClE,8EAA8E;YAC9E,gEAAgE;YAChE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACvF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,wBAAwB,GAAG,CAAC,MAAM,EAAE,EAAE,CAAA;YACtF,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkC,CAAA;YAChE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBACrC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBAC3D,CAAC,CAAC,EAAE,CAAA;YACN,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,CAAA;QACtE,CAAC;IACH,CAAC;CACF;AAED,SAAS,MAAM,CACb,MAAgC,EAChC,gBAA6C;IAE7C,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,SAAS,EAAE,MAAM,CAAC,YAAY,KAAK,IAAI;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,gBAAgB;QAChB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAA;AACH,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AAClE,CAAC"}
+{"version":3,"file":"LocalModelEndpointService.js","sourceRoot":"","sources":["../../../src/modules/providers/LocalModelEndpointService.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAStE,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,EACL,gBAAgB,EAGhB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,oBAAoB,CAAA;AAE3B,uFAAuF;AACvF,yFAAyF;AACzF,oFAAoF;AACpF,kFAAkF;AAClF,kEAAkE;AAClE,EAAE;AACF,yFAAyF;AACzF,0FAA0F;AAC1F,yFAAyF;AACzF,kEAAkE;AAElE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,mCAAmC,CAAA;AAyBpF,MAAM,OAAO,yBAAyB;IAIP,IAAI;IAHjC,+EAA+E;IAC9D,SAAS,CAAsB;IAEhD,YAA6B,IAA2C;oBAA3C,IAAI;QAC/B,IAAI,CAAC,SAAS,GAAG,EAAE,eAAe,EAAE,IAAI,CAAC,oBAAoB,IAAI,KAAK,EAAE,CAAA;IAC1E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,IAAI,CAAC,MAAc;QACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QAC5E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAClE,CAAC;IAED,qFAAqF;IAC7E,aAAa,CAAC,OAAe;QACnC,OAAO,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,IAAI,IAAI,CAAA;IACvE,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,KAAoC;QAC/D,qFAAqF;QACrF,sFAAsF;QACtF,oFAAoF;QACpF,iEAAiE;QACjE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QACrE,IAAI,QAAQ;YAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QACtF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,iBAAiB,CAC7E,MAAM,EACN,KAAK,CAAC,QAAQ,CACf,CAAA;QACD,8EAA8E;QAC9E,MAAM,YAAY,GAChB,KAAK,CAAC,MAAM,KAAK,SAAS;YACxB,CAAC,CAAC,CAAC,QAAQ,EAAE,YAAY,IAAI,IAAI,CAAC;YAClC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;gBACvB,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;gBACpD,CAAC,CAAC,IAAI,CAAA;QACZ,MAAM,MAAM,GAA6B;YACvC,MAAM;YACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC;YACjE,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY;YACZ,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;YAC5B,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,GAAG;YACrC,SAAS,EAAE,GAAG;SACf,CAAA;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC3D,wEAAwE;QACxE,OAAO,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC7B,CAAC;IAED,+CAA+C;IAC/C,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,QAAqB;QAChD,MAAM,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACvE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CACnB,MAAc;QAEd,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QAC5E,OAAO,CACL,IAAI;aACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;YACnC,sFAAsF;YACtF,qFAAqF;YACrF,oFAAoF;YACpF,iDAAiD;aAChD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;aACrD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAC5E,CAAA;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,QAAgB;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,iBAAiB,CAC3E,MAAM,EACN,QAAuB,CACxB,CAAA;QACD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY;YAChC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;YAC3D,CAAC,CAAC,IAAI,CAAA;QACR,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,CAAA;IACvE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QAC5E,MAAM,GAAG,GAA4B,EAAE,CAAA;QACvC,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY;gBAChC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;gBAC3D,CAAC,CAAC,IAAI,CAAA;YACR,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;QAC1E,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED;;;;;OAKG;IACH,WAAW,CAAC,MAAc,EAAE,IAAiB;QAC3C,OAAO,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IACjF,CAAC;IAED;;;;;OAKG;IACH,WAAW,CACT,OAAe,EACf,MAAoB;QAEpB,OAAO,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IAC1D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,KAAkC;QACrD,uFAAuF;QACvF,qFAAqF;QACrF,qFAAqF;QACrF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAC3E,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;YAC1B,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO;gBAC/B,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;aACrC,CAAA;QACH,CAAC;QACD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAA;QACxB,IAAI,CAAC;YACH,MAAM,OAAO,GAA2B,EAAE,CAAA;YAC1C,IAAI,KAAK,CAAC,MAAM;gBAAE,OAAO,CAAC,aAAa,GAAG,UAAU,KAAK,CAAC,MAAM,EAAE,CAAA;YAClE,8EAA8E;YAC9E,gEAAgE;YAChE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACvF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,wBAAwB,GAAG,CAAC,MAAM,EAAE,EAAE,CAAA;YACtF,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkC,CAAA;YAChE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBACrC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBAC3D,CAAC,CAAC,EAAE,CAAA;YACN,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,CAAA;QACtE,CAAC;IACH,CAAC;CACF;AAED,SAAS,MAAM,CACb,MAAgC,EAChC,gBAA6C;IAE7C,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,SAAS,EAAE,MAAM,CAAC,YAAY,KAAK,IAAI;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,gBAAgB;QAChB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAA;AACH,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AAClE,CAAC"}

package/dist/modules/providers/PersonalSubscriptionService.d.ts

@@ -14,6 +14,13 @@ import type { PersonalSubscriptionStatus, StorePersonalSubscriptionInput } from
 export declare const DEFAULT_ACTIVATION_TTL_MS: number;
 /** Surface "renew your subscription" once it expires within this horizon (~7 days). */
 export declare const DEFAULT_RENEW_WARNING_MS: number;
+/**
+ * HKDF domain tag for the SYSTEM layer sealing a personal subscription (the password-derived
+ * layer is separate, keyed by `PersonalSecretCipher`). Both facades build their
+ * `WebCryptoSecretCipher` from this constant: the tag derives the key, so a facade spelling it
+ * differently seals credentials its sibling cannot unseal.
+ */
+export declare const PERSONAL_SUBSCRIPTIONS_CIPHER_INFO = "cat-factory:personal-subscriptions";
 export interface PersonalSubscriptionServiceDependencies {
     personalSubscriptionRepository: PersonalSubscriptionRepository;
     subscriptionActivationRepository: SubscriptionActivationRepository;

package/dist/modules/providers/PersonalSubscriptionService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PersonalSubscriptionService.d.ts","sourceRoot":"","sources":["../../../src/modules/providers/PersonalSubscriptionService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EACL,WAAW,EACX,oBAAoB,EACpB,0BAA0B,EAC1B,8BAA8B,EAC9B,YAAY,EAEZ,gCAAgC,EAChC,kBAAkB,EACnB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EACV,0BAA0B,EAC1B,8BAA8B,EAC/B,MAAM,wBAAwB,CAAA;AAa/B;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,QAAsB,CAAA;AAC5D,uFAAuF;AACvF,eAAO,MAAM,wBAAwB,QAA0B,CAAA;AAE/D,MAAM,WAAW,uCAAuC;IACtD,8BAA8B,EAAE,8BAA8B,CAAA;IAC9D,gCAAgC,EAAE,gCAAgC,CAAA;IAClE,gFAAgF;IAChF,YAAY,EAAE,YAAY,CAAA;IAC1B,uEAAuE;IACvE,cAAc,EAAE,oBAAoB,CAAA;IACpC,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,KAAK,CAAA;IACZ,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,6EAA6E;AAC7E,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,kBAAkB,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;CACf;AAED,qBAAa,2BAA2B;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,uCAAuC,EAAI;IAE9E,OAAO,KAAK,eAAe,GAE1B;IACD,OAAO,KAAK,cAAc,GAEzB;IAED,OAAO,CAAC,gBAAgB;IASxB,wFAAwF;IAClF,KAAK,CACT,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,0BAA0B,CAAC,CAwBrC;IAED;;;;;;;;OAQG;YACW,0BAA0B;IAsBxC,kFAAkF;IAC5E,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,EAAE,CAAC,CAIhE;IAED,sEAAsE;IAChE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAEtE;IAED,0DAA0D;IACpD,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtE;IAED;;;;OAIG;IACG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiC1F;IAED;;;;;OAKG;IACG,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,kBAAkB,EAC1B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAef;IAED;;;;OAIG;IACG,WAAW,CACf,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,mBAAmB,CAAC,CAgB9B;IAED,2EAA2E;IACrE,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,OAAO,CAAC,CASlB;IAED,iFAAiF;IAC3E,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjD;IAED,sFAAsF;IAChF,uBAAuB,IAAI,OAAO,CAAC,MAAM,CAAC,CAE/C;IAED,4FAA4F;IACtF,qBAAqB,IAAI,OAAO,CAAC,0BAA0B,EAAE,CAAC,CAGnE;IAED,OAAO,CAAC,QAAQ;CAiBjB"}
+{"version":3,"file":"PersonalSubscriptionService.d.ts","sourceRoot":"","sources":["../../../src/modules/providers/PersonalSubscriptionService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EACL,WAAW,EACX,oBAAoB,EACpB,0BAA0B,EAC1B,8BAA8B,EAC9B,YAAY,EAEZ,gCAAgC,EAChC,kBAAkB,EACnB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EACV,0BAA0B,EAC1B,8BAA8B,EAC/B,MAAM,wBAAwB,CAAA;AAa/B;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,QAAsB,CAAA;AAC5D,uFAAuF;AACvF,eAAO,MAAM,wBAAwB,QAA0B,CAAA;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,kCAAkC,uCAAuC,CAAA;AAEtF,MAAM,WAAW,uCAAuC;IACtD,8BAA8B,EAAE,8BAA8B,CAAA;IAC9D,gCAAgC,EAAE,gCAAgC,CAAA;IAClE,gFAAgF;IAChF,YAAY,EAAE,YAAY,CAAA;IAC1B,uEAAuE;IACvE,cAAc,EAAE,oBAAoB,CAAA;IACpC,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,KAAK,CAAA;IACZ,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,6EAA6E;AAC7E,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,kBAAkB,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;CACf;AAED,qBAAa,2BAA2B;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,uCAAuC,EAAI;IAE9E,OAAO,KAAK,eAAe,GAE1B;IACD,OAAO,KAAK,cAAc,GAEzB;IAED,OAAO,CAAC,gBAAgB;IASxB,wFAAwF;IAClF,KAAK,CACT,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,0BAA0B,CAAC,CAwBrC;IAED;;;;;;;;OAQG;YACW,0BAA0B;IAsBxC,kFAAkF;IAC5E,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,EAAE,CAAC,CAIhE;IAED,sEAAsE;IAChE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAEtE;IAED,0DAA0D;IACpD,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtE;IAED;;;;OAIG;IACG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiC1F;IAED;;;;;OAKG;IACG,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,kBAAkB,EAC1B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAef;IAED;;;;OAIG;IACG,WAAW,CACf,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,mBAAmB,CAAC,CAgB9B;IAED,2EAA2E;IACrE,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,OAAO,CAAC,CASlB;IAED,iFAAiF;IAC3E,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjD;IAED,sFAAsF;IAChF,uBAAuB,IAAI,OAAO,CAAC,MAAM,CAAC,CAE/C;IAED,4FAA4F;IACtF,qBAAqB,IAAI,OAAO,CAAC,0BAA0B,EAAE,CAAC,CAGnE;IAED,OAAO,CAAC,QAAQ;CAiBjB"}

package/dist/modules/providers/PersonalSubscriptionService.js

@@ -23,6 +23,13 @@ import { CredentialRequiredError, isIndividualVendor, ValidationError } from '@c
 export const DEFAULT_ACTIVATION_TTL_MS = 12 * 60 * 60 * 1000;
 /** Surface "renew your subscription" once it expires within this horizon (~7 days). */
 export const DEFAULT_RENEW_WARNING_MS = 7 * 24 * 60 * 60 * 1000;
+/**
+ * HKDF domain tag for the SYSTEM layer sealing a personal subscription (the password-derived
+ * layer is separate, keyed by `PersonalSecretCipher`). Both facades build their
+ * `WebCryptoSecretCipher` from this constant: the tag derives the key, so a facade spelling it
+ * differently seals credentials its sibling cannot unseal.
+ */
+export const PERSONAL_SUBSCRIPTIONS_CIPHER_INFO = 'cat-factory:personal-subscriptions';
 export class PersonalSubscriptionService {
     deps;
     constructor(deps) {

package/dist/modules/providers/PersonalSubscriptionService.js.map

@@ -1 +1 @@
-{"version":3,"file":"PersonalSubscriptionService.js","sourceRoot":"","sources":["../../../src/modules/providers/PersonalSubscriptionService.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAMlG,8EAA8E;AAC9E,kFAAkF;AAClF,8EAA8E;AAC9E,kFAAkF;AAClF,iFAAiF;AACjF,kFAAkF;AAClF,+EAA+E;AAC/E,kFAAkF;AAClF,EAAE;AACF,6EAA6E;AAE7E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAC5D,uFAAuF;AACvF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAqB/D,MAAM,OAAO,2BAA2B;IACT,IAAI;IAAjC,YAA6B,IAA6C;oBAA7C,IAAI;IAA4C,CAAC;IAE9E,IAAY,eAAe;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,yBAAyB,CAAA;IAC/D,CAAC;IACD,IAAY,cAAc;QACxB,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAAA;IAC7D,CAAC;IAEO,gBAAgB,CAAC,MAA0B;QACjD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,uBAAuB,CAC/B,WAAW,MAAM,uFAAuF,EACxG,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,CACtC,CAAA;QACH,CAAC;IACH,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,KAAK,CACT,MAAc,EACd,KAAqC;QAErC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACnC,MAAM,IAAI,CAAC,0BAA0B,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC3E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC/E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,eAAe,CAC7E,MAAM,EACN,KAAK,CAAC,MAAM,CACb,CAAA;QACD,MAAM,MAAM,GAA+B;YACzC,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;YACtD,MAAM;YACN,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,WAAW;YACX,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,GAAG;YACrC,SAAS,EAAE,GAAG;YACd,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,IAAI;YACxC,SAAS,EAAE,IAAI;SAChB,CAAA;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC7D,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACnC,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,0BAA0B,CACtC,MAAc,EACd,MAA0B,EAC1B,QAAgB;QAEhB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CACpF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAC1E,CAAA;QACD,IAAI,CAAC,KAAK;YAAE,OAAM;QAClB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QACtE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,eAAe,CACvB,qFAAqF;gBACnF,kFAAkF;gBAClF,wEAAwE,CAC3E,CAAA;QACH,CAAC;IACH,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,IAAI,CAAC,MAAc;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QAC9E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IAC/C,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,MAA0B;QAClD,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,IAAI,CAAA;IAClG,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,MAA0B;QACrD,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;IAClG,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,MAA0B,EAAE,QAAgB;QACvE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC7F,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,uBAAuB,CAC/B,eAAe,MAAM,2CAA2C,EAChE,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,CACtC,CAAA;QACH,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;YACzD,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,MAAM,mEAAmE,EACjF,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAC3C,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QACvE,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,qFAAqF;YACrF,oFAAoF;YACpF,uFAAuF;YACvF,uFAAuF;YACvF,uFAAuF;YACvF,kFAAkF;YAClF,qFAAqF;YACrF,8DAA8D;YAC9D,MAAM,IAAI,uBAAuB,CAC/B,0DAA0D,MAAM,iBAAiB;gBAC/E,qDAAqD,EACvD,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,CACrC,CAAA;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAClB,WAAmB,EACnB,MAAc,EACd,MAA0B,EAC1B,QAAgB;QAEhB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC/D,MAAM,MAAM,GAAiC;YAC3C,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;YACrC,WAAW;YACX,MAAM;YACN,MAAM;YACN,WAAW;YACX,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,eAAe;SACtC,CAAA;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC/D,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;IAC9E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CACf,WAAmB,EACnB,MAAc,EACd,MAA0B;QAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,GAAG,CACrE,WAAW,EACX,MAAM,EACN,MAAM,EACN,GAAG,CACJ,CAAA;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,uBAAuB,CAC/B,0BAA0B,MAAM,2DAA2D,EAC3F,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CACxC,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;QAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;IAC3B,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,aAAa,CACjB,WAAmB,EACnB,MAAc,EACd,MAA0B;QAE1B,OAAO,CACL,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,GAAG,CACnD,WAAW,EACX,MAAM,EACN,MAAM,EACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CACtB,CAAC,KAAK,IAAI,CACZ,CAAA;IACH,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,QAAQ,CAAC,WAAmB;QAChC,MAAM,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;IACjF,CAAC;IAED,sFAAsF;IACtF,KAAK,CAAC,uBAAuB;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;IACxF,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,qBAAqB;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,OAAO,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,CAAA;IAC9F,CAAC;IAEO,QAAQ,CAAC,MAAkC,EAAE,GAAW;QAC9D,MAAM,aAAa,GACjB,MAAM,CAAC,SAAS,KAAK,IAAI;YACvB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAA;QAClE,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,aAAa;YACb,OAAO,EAAE,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;YAC7D,SAAS,EAAE,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG,GAAG,IAAI,CAAC,cAAc;SACtF,CAAA;IACH,CAAC;CACF"}
+{"version":3,"file":"PersonalSubscriptionService.js","sourceRoot":"","sources":["../../../src/modules/providers/PersonalSubscriptionService.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAMlG,8EAA8E;AAC9E,kFAAkF;AAClF,8EAA8E;AAC9E,kFAAkF;AAClF,iFAAiF;AACjF,kFAAkF;AAClF,+EAA+E;AAC/E,kFAAkF;AAClF,EAAE;AACF,6EAA6E;AAE7E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAC5D,uFAAuF;AACvF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAE/D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,oCAAoC,CAAA;AAqBtF,MAAM,OAAO,2BAA2B;IACT,IAAI;IAAjC,YAA6B,IAA6C;oBAA7C,IAAI;IAA4C,CAAC;IAE9E,IAAY,eAAe;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,yBAAyB,CAAA;IAC/D,CAAC;IACD,IAAY,cAAc;QACxB,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAAA;IAC7D,CAAC;IAEO,gBAAgB,CAAC,MAA0B;QACjD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,uBAAuB,CAC/B,WAAW,MAAM,uFAAuF,EACxG,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,CACtC,CAAA;QACH,CAAC;IACH,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,KAAK,CACT,MAAc,EACd,KAAqC;QAErC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACnC,MAAM,IAAI,CAAC,0BAA0B,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC3E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC/E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,eAAe,CAC7E,MAAM,EACN,KAAK,CAAC,MAAM,CACb,CAAA;QACD,MAAM,MAAM,GAA+B;YACzC,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;YACtD,MAAM;YACN,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,WAAW;YACX,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,GAAG;YACrC,SAAS,EAAE,GAAG;YACd,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,IAAI;YACxC,SAAS,EAAE,IAAI;SAChB,CAAA;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC7D,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACnC,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,0BAA0B,CACtC,MAAc,EACd,MAA0B,EAC1B,QAAgB;QAEhB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CACpF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAC1E,CAAA;QACD,IAAI,CAAC,KAAK;YAAE,OAAM;QAClB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QACtE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,eAAe,CACvB,qFAAqF;gBACnF,kFAAkF;gBAClF,wEAAwE,CAC3E,CAAA;QACH,CAAC;IACH,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,IAAI,CAAC,MAAc;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QAC9E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IAC/C,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,MAA0B;QAClD,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,IAAI,CAAA;IAClG,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,MAA0B;QACrD,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;IAClG,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,MAA0B,EAAE,QAAgB;QACvE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC7F,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,uBAAuB,CAC/B,eAAe,MAAM,2CAA2C,EAChE,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,CACtC,CAAA;QACH,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;YACzD,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,MAAM,mEAAmE,EACjF,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAC3C,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QACvE,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,qFAAqF;YACrF,oFAAoF;YACpF,uFAAuF;YACvF,uFAAuF;YACvF,uFAAuF;YACvF,kFAAkF;YAClF,qFAAqF;YACrF,8DAA8D;YAC9D,MAAM,IAAI,uBAAuB,CAC/B,0DAA0D,MAAM,iBAAiB;gBAC/E,qDAAqD,EACvD,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,CACrC,CAAA;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAClB,WAAmB,EACnB,MAAc,EACd,MAA0B,EAC1B,QAAgB;QAEhB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC/D,MAAM,MAAM,GAAiC;YAC3C,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;YACrC,WAAW;YACX,MAAM;YACN,MAAM;YACN,WAAW;YACX,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,eAAe;SACtC,CAAA;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC/D,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;IAC9E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CACf,WAAmB,EACnB,MAAc,EACd,MAA0B;QAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,GAAG,CACrE,WAAW,EACX,MAAM,EACN,MAAM,EACN,GAAG,CACJ,CAAA;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,uBAAuB,CAC/B,0BAA0B,MAAM,2DAA2D,EAC3F,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CACxC,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;QAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;IAC3B,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,aAAa,CACjB,WAAmB,EACnB,MAAc,EACd,MAA0B;QAE1B,OAAO,CACL,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,GAAG,CACnD,WAAW,EACX,MAAM,EACN,MAAM,EACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CACtB,CAAC,KAAK,IAAI,CACZ,CAAA;IACH,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,QAAQ,CAAC,WAAmB;QAChC,MAAM,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;IACjF,CAAC;IAED,sFAAsF;IACtF,KAAK,CAAC,uBAAuB;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;IACxF,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,qBAAqB;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,OAAO,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,CAAA;IAC9F,CAAC;IAEO,QAAQ,CAAC,MAAkC,EAAE,GAAW;QAC9D,MAAM,aAAa,GACjB,MAAM,CAAC,SAAS,KAAK,IAAI;YACvB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAA;QAClE,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,aAAa;YACb,OAAO,EAAE,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;YAC7D,SAAS,EAAE,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG,GAAG,IAAI,CAAC,cAAc;SACtF,CAAA;IACH,CAAC;CACF"}

package/dist/modules/providers/ProviderSubscriptionService.d.ts

@@ -1,5 +1,12 @@
 import type { Clock, IdGenerator, ProviderSubscriptionTokenRepository, SecretCipher, SubscriptionVendor } from '@cat-factory/kernel';
 import type { WorkspaceRepository } from '@cat-factory/kernel';
+/**
+ * HKDF domain tag separating the sealed subscription tokens from every other cipher (mirrors
+ * {@link TEST_SECRETS_CIPHER_INFO} et al). Both facades build their `WebCryptoSecretCipher` from
+ * this constant: the tag derives the key, so a facade spelling it differently seals credentials
+ * its sibling cannot unseal.
+ */
+export declare const PROVIDER_SUBSCRIPTIONS_CIPHER_INFO = "cat-factory:provider-subscriptions";
 export interface ProviderSubscriptionServiceDependencies {
     providerSubscriptionTokenRepository: ProviderSubscriptionTokenRepository;
     workspaceRepository: WorkspaceRepository;

package/dist/modules/providers/ProviderSubscriptionService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProviderSubscriptionService.d.ts","sourceRoot":"","sources":["../../../src/modules/providers/ProviderSubscriptionService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EACL,WAAW,EAEX,mCAAmC,EACnC,YAAY,EACZ,kBAAkB,EACnB,MAAM,qBAAqB,CAAA;AAI5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAyB9D,MAAM,WAAW,uCAAuC;IACtD,mCAAmC,EAAE,mCAAmC,CAAA;IACxE,mBAAmB,EAAE,mBAAmB,CAAA;IACxC,YAAY,EAAE,YAAY,CAAA;IAC1B,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,KAAK,CAAA;IACZ,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,2DAA2D;AAC3D,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,kBAAkB,CAAA;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,yFAAyF;AACzF,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,kBAAkB,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;CACf;AAED,qBAAa,2BAA2B;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,uCAAuC,EAAI;IAE9E,OAAO,KAAK,QAAQ,GAEnB;IAED;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAStB,wDAAwD;IAClD,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE;QAAE,MAAM,EAAE,kBAAkB,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAClE,OAAO,CAAC,uBAAuB,CAAC,CAiClC;IAED,sFAAsF;IAChF,UAAU,CACd,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,kBAAkB,GAC1B,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAQpC;IAED;;;;OAIG;IACG,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAShF;IAED;;;;;OAKG;IACG,WAAW,CACf,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAChD,OAAO,CAAC,uBAAuB,CAAC,CAgBlC;IAED,oCAAoC;IAC9B,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMhE;IAED;;;;;;;;;;;;OAYG;IACG,UAAU,CACd,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,uBAAuB,CAAC,CAmBlC;IAED,oFAAoF;IAC9E,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GACnD,OAAO,CAAC,IAAI,CAAC,CAQf;CACF"}
+{"version":3,"file":"ProviderSubscriptionService.d.ts","sourceRoot":"","sources":["../../../src/modules/providers/ProviderSubscriptionService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EACL,WAAW,EAEX,mCAAmC,EACnC,YAAY,EACZ,kBAAkB,EACnB,MAAM,qBAAqB,CAAA;AAI5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAyB9D;;;;;GAKG;AACH,eAAO,MAAM,kCAAkC,uCAAuC,CAAA;AAEtF,MAAM,WAAW,uCAAuC;IACtD,mCAAmC,EAAE,mCAAmC,CAAA;IACxE,mBAAmB,EAAE,mBAAmB,CAAA;IACxC,YAAY,EAAE,YAAY,CAAA;IAC1B,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,KAAK,CAAA;IACZ,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,2DAA2D;AAC3D,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,kBAAkB,CAAA;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,yFAAyF;AACzF,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,kBAAkB,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;CACf;AAED,qBAAa,2BAA2B;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,uCAAuC,EAAI;IAE9E,OAAO,KAAK,QAAQ,GAEnB;IAED;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAStB,wDAAwD;IAClD,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE;QAAE,MAAM,EAAE,kBAAkB,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAClE,OAAO,CAAC,uBAAuB,CAAC,CAiClC;IAED,sFAAsF;IAChF,UAAU,CACd,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,kBAAkB,GAC1B,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAQpC;IAED;;;;OAIG;IACG,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAShF;IAED;;;;;OAKG;IACG,WAAW,CACf,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAChD,OAAO,CAAC,uBAAuB,CAAC,CAgBlC;IAED,oCAAoC;IAC9B,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMhE;IAED;;;;;;;;;;;;OAYG;IACG,UAAU,CACd,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,uBAAuB,CAAC,CAmBlC;IAED,oFAAoF;IAC9E,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GACnD,OAAO,CAAC,IAAI,CAAC,CAQf;CACF"}

package/dist/modules/providers/ProviderSubscriptionService.js

@@ -13,6 +13,19 @@ const ALL_VENDORS = Object.keys(SUBSCRIPTION_VENDORS).filter((v) => !isIndividua
 // usable while bounding accidental/abusive unbounded growth (every lease lists the
 // whole live pool, so an unbounded pool would also bloat that read).
 const MAX_TOKENS_PER_VENDOR = 25;
+// ProviderSubscriptionService: owns a workspace's pool of subscription
+// credentials per vendor. Tokens are stored *encrypted* (the raw secret is the
+// CLAUDE_CODE_OAUTH_TOKEN string for `claude` or the full auth.json blob for
+// `codex`); only metadata + rolling-window usage is exposed back to clients.
+// Leasing is usage-aware (see providers.logic): least-loaded token wins, with
+// round-robin by lastUsedAt as the tiebreaker. Mirrors RunnerPoolConnectionService.
+/**
+ * HKDF domain tag separating the sealed subscription tokens from every other cipher (mirrors
+ * {@link TEST_SECRETS_CIPHER_INFO} et al). Both facades build their `WebCryptoSecretCipher` from
+ * this constant: the tag derives the key, so a facade spelling it differently seals credentials
+ * its sibling cannot unseal.
+ */
+export const PROVIDER_SUBSCRIPTIONS_CIPHER_INFO = 'cat-factory:provider-subscriptions';
 export class ProviderSubscriptionService {
     deps;
     constructor(deps) {