@cat-factory/integrations 0.163.1 → 0.164.0

package/dist/modules/kubernetes/kubernetes-registry-auth.logic.js

@@ -0,0 +1,407 @@
+import { isLocalMachineHost } from '@cat-factory/kernel';
+import { resolveImageOverrides } from './kubernetes-deploy.logic.js';
+// Pure helpers for wiring a per-PR namespace's REGISTRY PULL CREDENTIAL on a throwaway
+// local cluster. No I/O — the provider does the apiserver writes.
+//
+// The problem these solve: a per-PR namespace is created by the platform seconds before the
+// manifests are applied, so a pull secret cannot be waiting in it, and the images a scaffolded
+// service builds are published to the VCS host's own registry (GHCR for GitHub, the GitLab
+// container registry for GitLab), which is PRIVATE until somebody makes it public. The pull then
+// 403s for the whole life of the environment and presents as a cluster that never becomes ready.
+//
+// The credential to fix it is already in hand: a provision resolves a short-lived git token to
+// clone the manifests repo, and that same token authenticates against the VCS host's registry.
+// So nothing new is configured, asked for, or stored. What is derived here is only whether the
+// token PLAUSIBLY covers the registry the image names, which is the one judgement that must not
+// be made by guessing.
+/**
+ * The apiserver's hostname, or null when the URL will not parse (a provision that is about to
+ * fail on its own terms, with a better message than anything derived here).
+ */
+export function apiServerHostname(config) {
+    try {
+        return new URL(config.apiServerUrl).hostname.toLowerCase();
+    }
+    catch {
+        // silent-catch-ok: the provision fails on the malformed URL a moment later. Reported by the
+        // caller as an unreadable apiserver rather than swallowed.
+        return null;
+    }
+}
+/**
+ * Whether this cluster is one running on the machine that is provisioning into it, which is what
+ * makes the automatic credential wiring appropriate.
+ *
+ * The test is the APISERVER HOST, and it is deliberately not the handler's declared engine. A
+ * public-API caller cannot pick between `local-k3s` and `remote-kubernetes` (the split is not a
+ * public fact, and every API-registered connection lands on the remote name), so gating on the
+ * engine would give two identically-configured clusters different behaviour depending on which
+ * door connected them, and would silently miss the acceptance suite entirely. The apiserver
+ * address is the same fact for both doors.
+ *
+ * `isLocalMachineHost` rather than a bare loopback test, because the two spellings a local
+ * cluster actually writes into a kubeconfig are k3d's wildcard `0.0.0.0` and Docker Desktop's
+ * `kubernetes.docker.internal`. Gating on loopback alone withheld the whole behaviour from the
+ * default setup of both, which is most of the population it exists for. Still not "private"
+ * (`isBlockedPrivateHost`): a shared staging cluster on 10.x is somebody else's machine however
+ * private its address, and its namespaces are not a place to put a developer's git token unasked.
+ * The residual case is a port-forward of a remote apiserver to localhost, which reads as local
+ * here; the cost is a short-lived token in a namespace this platform created, and it is named in
+ * the operator docs.
+ */
+export function isLocalThrowawayCluster(config) {
+    const host = apiServerHostname(config);
+    return host !== null && isLocalMachineHost(host);
+}
+/** Name of the pull Secret the provider materializes in the per-PR namespace. */
+export const REGISTRY_AUTH_SECRET_NAME = 'cat-factory-registry-auth';
+/**
+ * Field manager for the writes this module's resources go in under, DELIBERATELY distinct from
+ * the manifest apply's.
+ *
+ * Server-side apply treats every apply from one manager as that manager's complete desired
+ * state, so writing the Secret and the undeclared-account patches under the manifests' manager
+ * would have the next manifest apply declare them gone. A separate manager owns them outright.
+ *
+ * What this does NOT buy is co-ownership of a field the manifests also set: see
+ * {@link withPullSecretOnServiceAccounts} for why a DECLARED account's `imagePullSecrets` cannot
+ * be split across two managers at all.
+ */
+export const REGISTRY_AUTH_FIELD_MANAGER = 'cat-factory-registry-auth';
+/**
+ * How long the wired credential stays usable, stated because nothing renews it.
+ *
+ * The password is the provision's own short-lived git token (a GitHub App installation token
+ * lasts about an hour), and the Secret keeps whatever value it held at provision time. Every
+ * image pull inside that window succeeds; a pull AFTER it (a rollout, a scale-up, a pod
+ * rescheduled onto a node with no cached layer) re-enters `ImagePullBackOff` with no new
+ * provisioning-log entry to explain it, because nothing ran. Re-provisioning the environment
+ * mints a fresh token and rewrites the Secret.
+ *
+ * A renewing design would need something that outlives the provision (a controller in the
+ * cluster, or a sweep re-writing every live environment's Secret), which is a large amount of
+ * machinery for a throwaway local preview whose images are almost always pulled once at rollout.
+ * The honest half of the trade is that the window is NAMED: in the recorded step, and in the
+ * operator doc.
+ */
+export const REGISTRY_AUTH_CREDENTIAL_LIFETIME = 'about an hour, the git token being short-lived and nothing renewing it: a pull after that ' +
+    '(a rollout, a scale-up, a reschedule) needs the environment re-provisioned';
+/**
+ * The registry host an image reference pulls from, or null when it names none.
+ *
+ * A reference's first path segment is a registry only when it looks like a host (it carries a
+ * `.` or a `:`, or it is `localhost`); otherwise the reference is a Docker Hub short name and
+ * this answers null. Null is the honest answer rather than `docker.io`, because the caller's
+ * question is "is this a registry a VCS token could cover", and Docker Hub never is.
+ *
+ * An empty string answers null too. That is not a degenerate case: an unconfigured
+ * `imageTemplate` renders `{{image}}` as the empty string, which is exactly the manifest that
+ * used to reach a cluster and fail there.
+ */
+export function registryHostForImage(image) {
+    const ref = image?.trim();
+    if (!ref)
+        return null;
+    const slash = ref.indexOf('/');
+    if (slash === -1)
+        return null;
+    const head = ref.slice(0, slash);
+    if (head === 'localhost' || head.includes('.') || head.includes(':'))
+        return head;
+    return null;
+}
+/**
+ * The registry hosts a git credential for `cloneUrl` can be expected to authenticate against.
+ *
+ * The two hosted providers publish their registry on a DIFFERENT host from their git host, so
+ * those two are mapped explicitly. Any other host maps to ITSELF, which is the self-hosted
+ * GitLab shape (git and registry on one host). A host whose registry is neither is simply not
+ * matched, and an unmatched registry means the convenience does not apply: the failure direction
+ * is "no pull secret written", never "a credential sent somewhere it does not belong".
+ */
+export function registriesCoveredByCloneUrl(cloneUrl) {
+    let host;
+    try {
+        host = new URL(cloneUrl).hostname.toLowerCase();
+    }
+    catch {
+        // silent-catch-ok: an unparseable clone URL only costs the pull-secret convenience, and the
+        // provision goes on to fail (or succeed) on its own terms. There is nothing to report that
+        // the clone itself will not report better.
+        return [];
+    }
+    if (!host)
+        return [];
+    if (host === 'github.com')
+        return ['ghcr.io'];
+    if (host === 'gitlab.com')
+        return ['registry.gitlab.com'];
+    return [host];
+}
+/**
+ * Every image reference a provision could pull, across both render paths: the single rendered
+ * `{{image}}` the raw path substitutes, plus the `newName` of each structured image override a
+ * kustomize overlay carries. Both are collected unconditionally because a config may carry
+ * either or both, and a candidate that names no registry is dropped downstream anyway.
+ */
+export function registryAuthImageCandidates(config, vars) {
+    return [vars.image, ...resolveImageOverrides(config.images, vars).map((image) => image.newName)];
+}
+/**
+ * The distinct registries a provision's image references name, in first-seen order. An image
+ * that names none (a Docker Hub short name, an unset `{{image}}`) contributes nothing.
+ */
+export function registriesNamedByImages(images) {
+    const seen = new Map();
+    for (const image of images) {
+        const registry = registryHostForImage(image);
+        if (registry && !seen.has(registry.toLowerCase()))
+            seen.set(registry.toLowerCase(), registry);
+    }
+    return [...seen.values()];
+}
+/**
+ * Which of a provision's image references the git credential covers, as one credential per
+ * distinct registry, or the reason there is none.
+ *
+ * It takes the image refs as a LIST because the two render paths name their images differently:
+ * the raw path resolves one `{{image}}`, while a kustomize overlay carries a structured image
+ * override per container. Reducing them here keeps that difference out of the provider.
+ *
+ * The username is the repo owner when the provision knows one. GHCR and the GitLab registry both
+ * authenticate on the TOKEN and accept any non-empty username, so the owner is a readable
+ * default rather than a load-bearing value, and the fallback covers a provision that carries no
+ * repo context.
+ */
+export function resolveRegistryAuth(args) {
+    const registries = registriesNamedByImages(args.images);
+    if (registries.length === 0) {
+        return {
+            kind: 'no-registry-image',
+            images: args.images.filter((i) => !!i?.trim()),
+        };
+    }
+    if (!args.clone)
+        return { kind: 'no-clone-target', registries };
+    const token = args.clone.token;
+    if (!token)
+        return { kind: 'no-token', registries };
+    const covered = registriesCoveredByCloneUrl(args.clone.cloneUrl);
+    const username = args.repoOwner?.trim() || 'x-access-token';
+    const auths = registries
+        .filter((registry) => covered.includes(registry.toLowerCase()))
+        .map((registry) => ({ registry, username, password: token }));
+    if (auths.length === 0)
+        return { kind: 'registry-not-covered', registries, covered };
+    return { kind: 'wired', auths };
+}
+/** One line for the provisioning log explaining why nothing was attempted. */
+export function describeRegistryAuthSkip(skip) {
+    switch (skip.kind) {
+        case 'not-local-cluster':
+            return (`No registry credential wired: the apiserver ` +
+                `(${skip.apiServerHost ?? 'an unreadable URL'}) is not on this machine, and a git ` +
+                `credential is only placed into namespaces on a local throwaway cluster. A private ` +
+                `image needs a pull secret this deployment provides.`);
+        case 'namespace-not-derivable':
+            return (`No registry credential wired: this kustomize overlay declares its own namespace, ` +
+                `which is resolved when the overlay is built inside the deploy container, so there is ` +
+                `no namespace to place a pull secret in before dispatch. Set a namespace template on ` +
+                `the connection to get per-PR isolation and automatic registry credentials.`);
+        default:
+            return exhaustiveSkip(skip);
+    }
+}
+/**
+ * One line for the provisioning log describing the credential outcome.
+ *
+ * Every branch is spelled out rather than collapsed into "no credential wired", because the four
+ * causes need four different actions and only this log records which one happened: by the time
+ * an `ImagePullBackOff` is visible, nothing distinguishes a public image that never needed a
+ * credential from a private one whose credential was refused.
+ */
+export function describeRegistryAuthVerdict(verdict, report) {
+    switch (verdict.kind) {
+        case 'wired': {
+            const wired = report ?? {
+                auths: verdict.auths,
+                patchedAccounts: [],
+                declaredAccounts: [],
+                manifestsVisible: false,
+            };
+            const covered = wired.manifestsVisible
+                ? `${wired.patchedAccounts.length} service account(s) directly and ` +
+                    `${wired.declaredAccounts.length} declared by the manifests`
+                : `the default service account only (this render path builds its manifests inside the ` +
+                    `deploy container, so the accounts they declare are not visible here)`;
+            return (`Wired a ${wired.auths.map((a) => a.registry).join(', ')} pull credential ` +
+                `(user '${wired.auths[0].username}') into ${covered}. It lasts ` +
+                `${REGISTRY_AUTH_CREDENTIAL_LIFETIME}. A 403 before then means the git token lacks ` +
+                `package-read scope.`);
+        }
+        case 'no-registry-image':
+            return (`No registry credential wired: ` +
+                `${verdict.images.length > 0 ? `[${verdict.images.join(', ')}] names` : 'the manifests name'} ` +
+                `no registry host, so no credential could apply. An image pulled from Docker Hub or an ` +
+                `unqualified name is never covered by a git credential.`);
+        case 'no-clone-target':
+            return (`No registry credential wired for [${verdict.registries.join(', ')}]: this provision has ` +
+                `no clone target, so there is no git credential to derive one from (no VCS connection, ` +
+                `or a block-less manual provision). A private image will fail to pull.`);
+        case 'no-token':
+            return (`No registry credential wired for [${verdict.registries.join(', ')}]: the manifests repo ` +
+                `is cloned without a token, so none is available to reuse. That is expected for a public ` +
+                `manifests repo. A private image will fail to pull.`);
+        case 'registry-not-covered':
+            return (`No registry credential wired: the images pull from ` +
+                `[${verdict.registries.join(', ')}], and the git credential authenticates against ` +
+                `[${verdict.covered.join(', ') || 'no registry'}]. A private image will fail to pull.`);
+        default:
+            return exhaustiveVerdict(verdict);
+    }
+}
+/* c8 ignore start -- compile-time totality guards; unreachable while the unions are exhaustive. */
+function exhaustiveSkip(skip) {
+    return `No registry credential wired: ${JSON.stringify(skip)}`;
+}
+function exhaustiveVerdict(verdict) {
+    return `No registry credential wired: ${JSON.stringify(verdict)}`;
+}
+/* c8 ignore stop */
+/** The `.dockerconfigjson` payload a `kubernetes.io/dockerconfigjson` Secret carries. */
+export function dockerConfigJson(auths) {
+    const entries = auths.map((auth) => [
+        auth.registry,
+        {
+            username: auth.username,
+            password: auth.password,
+            auth: base64(`${auth.username}:${auth.password}`),
+        },
+    ]);
+    return JSON.stringify({ auths: Object.fromEntries(entries) });
+}
+/** The pull Secret to apply into the per-PR namespace. */
+export function buildPullSecret(namespace, auths) {
+    return {
+        apiVersion: 'v1',
+        kind: 'Secret',
+        metadata: { name: REGISTRY_AUTH_SECRET_NAME, namespace },
+        type: 'kubernetes.io/dockerconfigjson',
+        data: { '.dockerconfigjson': base64(dockerConfigJson(auths)) },
+    };
+}
+/**
+ * The ServiceAccount body that attaches the pull secret to an account the manifests do NOT
+ * declare. Applied under the dedicated field manager, carrying `imagePullSecrets` and nothing
+ * else, so whatever else the account has is owned by another manager and left alone.
+ *
+ * Only safe for an UNDECLARED account, which is why {@link serviceAccountsNeedingOwnPatch} picks
+ * the names: `imagePullSecrets` is an ATOMIC list, so the manager that applies it last owns the
+ * whole thing. Against an account the manifests also apply, this write is either erased by them
+ * or erases theirs, depending on the order. A declared account is served by
+ * {@link withPullSecretOnServiceAccounts} instead, which puts the entry into the manifests' own
+ * body so ONE manager declares the union.
+ */
+export function buildServiceAccountPullSecretPatch(name, namespace) {
+    return {
+        apiVersion: 'v1',
+        kind: 'ServiceAccount',
+        metadata: { name, namespace },
+        imagePullSecrets: [{ name: REGISTRY_AUTH_SECRET_NAME }],
+    };
+}
+/** The `imagePullSecrets` entries a ServiceAccount resource already declares, names only. */
+function declaredPullSecretNames(resource) {
+    const raw = resource.imagePullSecrets;
+    if (!Array.isArray(raw))
+        return [];
+    return raw
+        .map((entry) => entry?.name)
+        .filter((name) => typeof name === 'string' && name.trim().length > 0);
+}
+/**
+ * The manifests' own resources, with every ServiceAccount they declare carrying the pull secret
+ * alongside whatever it already declared.
+ *
+ * This exists because `ServiceAccount.imagePullSecrets` is an ATOMIC list in the OpenAPI schema:
+ * server-side apply gives ownership of the WHOLE list to one manager, so two managers cannot own
+ * disjoint entries of it the way they can own disjoint fields. A separate-manager patch beside
+ * the manifests' own apply is therefore not a merge, it is a race, and with `force=true` the
+ * later writer wins outright. Since the manifests are applied by this provider, the fix is to
+ * apply the UNION: the entry goes into their declared body and no second writer touches the
+ * field. Their own entries are preserved and never reordered, so a manifest that pins a pull
+ * secret keeps it first.
+ *
+ * A pod's pull secrets are resolved by the ServiceAccount admission controller when the pod is
+ * CREATED, which is the other half of why this shape is the correct one: patching the account
+ * after its Deployment applied would leave the pods already admitted without the secret.
+ */
+export function withPullSecretOnServiceAccounts(resources) {
+    return resources.map((resource) => {
+        if (resource.kind !== 'ServiceAccount')
+            return resource;
+        const existing = declaredPullSecretNames(resource);
+        if (existing.includes(REGISTRY_AUTH_SECRET_NAME))
+            return resource;
+        return {
+            ...resource,
+            imagePullSecrets: [
+                ...existing.map((name) => ({ name })),
+                { name: REGISTRY_AUTH_SECRET_NAME },
+            ],
+        };
+    });
+}
+/**
+ * The ServiceAccounts that need a patch of THIS provider's own: `default` plus every account a
+ * pod template NAMES, minus the ones the manifests declare themselves.
+ *
+ * The subtraction is the point. A declared account gets the secret through
+ * {@link withPullSecretOnServiceAccounts}, inside the manifests' own apply; patching it here as
+ * well would be the atomic-list race that function exists to avoid. What is left is exactly the
+ * set nothing else writes: `default`, which Kubernetes creates per namespace, and any account a
+ * workload names but never defines (a cluster-wide account, or a manifest that assumes one).
+ */
+export function serviceAccountsNeedingOwnPatch(resources) {
+    const declared = new Set();
+    const needed = new Set(['default']);
+    for (const resource of resources) {
+        if (resource.kind === 'ServiceAccount' && resource.metadata.name) {
+            declared.add(resource.metadata.name);
+        }
+        const referenced = podSpecServiceAccountName(resource);
+        if (referenced)
+            needed.add(referenced);
+    }
+    return [...needed].filter((name) => !declared.has(name));
+}
+/**
+ * The `serviceAccountName` a resource's pod template declares.
+ *
+ * Three nestings reach a pod spec and all three occur in ordinary manifests: a bare Pod's own
+ * `spec`, a workload's `spec.template.spec` (Deployment, StatefulSet, DaemonSet, Job), and a
+ * CronJob's `spec.jobTemplate.spec.template.spec`. Missing the last one left a CronJob naming an
+ * undeclared account with no pull secret, which is the failure mode that shows up hours later on
+ * the first schedule rather than at provision time. Unknown shapes answer null.
+ */
+function podSpecServiceAccountName(resource) {
+    const spec = resource.spec;
+    const name = spec?.jobTemplate?.spec?.template?.spec?.serviceAccountName ??
+        spec?.template?.spec?.serviceAccountName ??
+        spec?.serviceAccountName;
+    return typeof name === 'string' && name.trim() ? name.trim() : null;
+}
+/**
+ * Base64 of a string's UTF-8 bytes. `btoa` alone is wrong here: it encodes CODE UNITS, so any
+ * non-ASCII character in a repo owner would produce a payload the apiserver stores and the
+ * kubelet cannot parse. The bytes are accumulated in a loop rather than spread into
+ * `String.fromCharCode(...)`, which blows the call stack on a large enough input.
+ */
+function base64(value) {
+    const bytes = new TextEncoder().encode(value);
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary);
+}
+//# sourceMappingURL=kubernetes-registry-auth.logic.js.map

package/dist/modules/kubernetes/kubernetes-registry-auth.logic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubernetes-registry-auth.logic.js","sourceRoot":"","sources":["../../../src/modules/kubernetes/kubernetes-registry-auth.logic.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAGpE,uFAAuF;AACvF,kEAAkE;AAClE,EAAE;AACF,4FAA4F;AAC5F,+FAA+F;AAC/F,2FAA2F;AAC3F,iGAAiG;AACjG,iGAAiG;AACjG,EAAE;AACF,+FAA+F;AAC/F,+FAA+F;AAC/F,+FAA+F;AAC/F,gGAAgG;AAChG,uBAAuB;AAEvB;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAkC;IAClE,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,4FAA4F;QAC5F,2DAA2D;QAC3D,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAkC;IACxE,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAA;IACtC,OAAO,IAAI,KAAK,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAA;AAClD,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAA2B,CAAA;AAEpE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,2BAA2B,CAAA;AAEtE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAC5C,4FAA4F;IAC5F,4EAA4E,CAAA;AAU9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAyB;IAC5D,MAAM,GAAG,GAAG,KAAK,EAAE,IAAI,EAAE,CAAA;IACzB,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IAChC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACjF,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAgB;IAC1D,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,4FAA4F;QAC5F,2FAA2F;QAC3F,2CAA2C;QAC3C,OAAO,EAAE,CAAA;IACX,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAA;IACpB,IAAI,IAAI,KAAK,YAAY;QAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAC7C,IAAI,IAAI,KAAK,YAAY;QAAE,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACzD,OAAO,CAAC,IAAI,CAAC,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAiC,EACjC,IAA4B;IAE5B,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,qBAAqB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;AAClG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAA8B;IACpE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAA;IACtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;QAC5C,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,CAAA;IAC/F,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;AAC3B,CAAC;AAqBD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAInC;IACC,MAAM,UAAU,GAAG,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACvD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;SAC5D,CAAA;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAA;IAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAA;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,CAAA;IACnD,MAAM,OAAO,GAAG,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,gBAAgB,CAAA;IAC3D,MAAM,KAAK,GAAG,UAAU;SACrB,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;SAC9D,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;IAC/D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,UAAU,EAAE,OAAO,EAAE,CAAA;IACpF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;AACjC,CAAC;AAYD,8EAA8E;AAC9E,MAAM,UAAU,wBAAwB,CAAC,IAAsB;IAC7D,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,mBAAmB;YACtB,OAAO,CACL,8CAA8C;gBAC9C,IAAI,IAAI,CAAC,aAAa,IAAI,mBAAmB,sCAAsC;gBACnF,oFAAoF;gBACpF,qDAAqD,CACtD,CAAA;QACH,KAAK,yBAAyB;YAC5B,OAAO,CACL,mFAAmF;gBACnF,uFAAuF;gBACvF,sFAAsF;gBACtF,4EAA4E,CAC7E,CAAA;QACH;YACE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAA;IAC/B,CAAC;AACH,CAAC;AAaD;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAA4B,EAC5B,MAAgC;IAEhC,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,OAAO,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,MAAM,IAAI;gBACtB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,eAAe,EAAE,EAAE;gBACnB,gBAAgB,EAAE,EAAE;gBACpB,gBAAgB,EAAE,KAAK;aACxB,CAAA;YACD,MAAM,OAAO,GAAG,KAAK,CAAC,gBAAgB;gBACpC,CAAC,CAAC,GAAG,KAAK,CAAC,eAAe,CAAC,MAAM,mCAAmC;oBAClE,GAAG,KAAK,CAAC,gBAAgB,CAAC,MAAM,4BAA4B;gBAC9D,CAAC,CAAC,qFAAqF;oBACrF,sEAAsE,CAAA;YAC1E,OAAO,CACL,WAAW,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB;gBAC3E,UAAU,KAAK,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,QAAQ,WAAW,OAAO,aAAa;gBACjE,GAAG,iCAAiC,gDAAgD;gBACpF,qBAAqB,CACtB,CAAA;QACH,CAAC;QACD,KAAK,mBAAmB;YACtB,OAAO,CACL,gCAAgC;gBAChC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,GAAG;gBAC/F,wFAAwF;gBACxF,wDAAwD,CACzD,CAAA;QACH,KAAK,iBAAiB;YACpB,OAAO,CACL,qCAAqC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB;gBAC1F,wFAAwF;gBACxF,uEAAuE,CACxE,CAAA;QACH,KAAK,UAAU;YACb,OAAO,CACL,qCAAqC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB;gBAC1F,0FAA0F;gBAC1F,oDAAoD,CACrD,CAAA;QACH,KAAK,sBAAsB;YACzB,OAAO,CACL,qDAAqD;gBACrD,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,kDAAkD;gBACnF,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,uCAAuC,CACvF,CAAA;QACH;YACE,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAA;IACrC,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,SAAS,cAAc,CAAC,IAAW;IACjC,OAAO,iCAAiC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAA;AAChE,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAc;IACvC,OAAO,iCAAiC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAA;AACnE,CAAC;AACD,oBAAoB;AAEpB,yFAAyF;AACzF,MAAM,UAAU,gBAAgB,CAAC,KAAqB;IACpD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC,QAAQ;QACb;YACE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;SAClD;KACF,CAAC,CAAA;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;AAC/D,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,KAAqB;IACtE,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,SAAS,EAAE;QACxD,IAAI,EAAE,gCAAgC;QACtC,IAAI,EAAE,EAAE,mBAAmB,EAAE,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE;KAC/D,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kCAAkC,CAChD,IAAY,EACZ,SAAiB;IAEjB,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC7B,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;KACxD,CAAA;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAS,uBAAuB,CAAC,QAA4B;IAC3D,MAAM,GAAG,GAAI,QAA2C,CAAC,gBAAgB,CAAA;IACzE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAA;IAClC,OAAO,GAAG;SACP,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAE,KAAmC,EAAE,IAAI,CAAC;SAC1D,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AACzF,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,+BAA+B,CAC7C,SAA+B;IAE/B,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAChC,IAAI,QAAQ,CAAC,IAAI,KAAK,gBAAgB;YAAE,OAAO,QAAQ,CAAA;QACvD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAA;QAClD,IAAI,QAAQ,CAAC,QAAQ,CAAC,yBAAyB,CAAC;YAAE,OAAO,QAAQ,CAAA;QACjE,OAAO;YACL,GAAG,QAAQ;YACX,gBAAgB,EAAE;gBAChB,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrC,EAAE,IAAI,EAAE,yBAAyB,EAAE;aACpC;SACF,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,8BAA8B,CAAC,SAA+B;IAC5E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IAClC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,CAAC,SAAS,CAAC,CAAC,CAAA;IAC3C,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,IAAI,KAAK,gBAAgB,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACjE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QACtC,CAAC;QACD,MAAM,UAAU,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAA;QACtD,IAAI,UAAU;YAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IACxC,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;AAC1D,CAAC;AAUD;;;;;;;;GAQG;AACH,SAAS,yBAAyB,CAAC,QAA4B;IAC7D,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAgC,CAAA;IACtD,MAAM,IAAI,GACR,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,kBAAkB;QAC3D,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,kBAAkB;QACxC,IAAI,EAAE,kBAAkB,CAAA;IAC1B,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AACrE,CAAC;AAED;;;;;GAKG;AACH,SAAS,MAAM,CAAC,KAAa;IAC3B,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC7C,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IAC7D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAA;AACrB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/integrations",
-  "version": "0.163.1",
+  "version": "0.164.0",
   "description": "External-system integration domain logic for the Agent Architecture Board (GitHub, documents, tasks, environments, runners).",
   "repository": {
     "type": "git",
@@ -28,14 +28,14 @@
     "p-map": "^7.0.6",
     "undici": "^8.10.0",
     "yaml": "^2.9.0",
-    "@cat-factory/contracts": "0.315.0",
-    "@cat-factory/kernel": "0.303.0"
+    "@cat-factory/contracts": "0.316.0",
+    "@cat-factory/kernel": "0.304.0"
   },
   "devDependencies": {
     "typescript": "7.0.2",
     "valibot": "^1.4.2",
     "vitest": "^4.1.10",
-    "@cat-factory/caching": "0.20.24"
+    "@cat-factory/caching": "0.20.25"
   },
   "scripts": {
     "build": "tsc -b tsconfig.build.json",