npm - @cat-factory/integrations - Versions diffs - 0.94.1 → 0.95.0 - Mend

@cat-factory/integrations 0.94.1 → 0.95.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (37) hide show

package/dist/index.d.ts CHANGED Viewed

@@ -90,6 +90,12 @@ export { PreflightService, preflightBlockingFailures, formatPreflightFailure, }
 export { ProvisioningLogRecorder, ProvisioningLogService, PROVISIONING_LOG_MAX_LIMIT, type ProvisioningLogEvent, type ProvisioningLogRecorderDependencies, type ProvisioningLogServiceDependencies, } from './modules/provisioning-logs/ProvisioningLogService.js';
 export { LoggingRunnerTransport, type LoggingRunnerTransportOptions, } from './modules/provisioning-logs/LoggingRunnerTransport.js';
 export { redactSecrets } from './modules/provisioning-logs/redact.js';
+export { WebhookNotificationChannel, type WebhookNotificationChannelDependencies, } from './modules/notificationWebhook/WebhookNotificationChannel.js';
+export { NotificationWebhookService, type NotificationWebhookServiceDependencies, } from './modules/notificationWebhook/NotificationWebhookService.js';
+export { WEBHOOK_SIGNATURE_HEADERS, signWebhookDelivery, } from './modules/notificationWebhook/webhookSignature.js';
+export { NOTIFICATION_WEBHOOK_CIPHER_INFO, buildNotificationWebhookSupport, type NotificationWebhookSupportDependencies, } from './modules/notificationWebhook/support.js';
+export { assertSafeNotificationWebhookUrl } from './modules/notificationWebhook/webhookUrl.js';
+export { assertSafePublicUrl, type PublicUrlGuardOptions } from './modules/shared/url-guard.js';
 export { SlackNotificationChannel, type SlackNotificationChannelDependencies, } from './modules/slack/SlackNotificationChannel.js';
 export { SlackConnectionService, type SlackConnectionServiceDependencies, } from './modules/slack/SlackConnectionService.js';
 export { SlackSettingsService, type SlackSettingsServiceDependencies, } from './modules/slack/SlackSettingsService.js';

package/dist/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,yBAAyB,EACzB,KAAK,qCAAqC,GAC3C,MAAM,+CAA+C,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,KAAK,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AACjG,OAAO,EACL,iBAAiB,EACjB,KAAK,6BAA6B,GACnC,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAE,KAAK,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AACpG,OAAO,EACL,uBAAuB,EACvB,KAAK,mCAAmC,GACzC,MAAM,0CAA0C,CAAA;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAA;AAClF,OAAO,KAAK,gBAAgB,MAAM,sCAAsC,CAAA;AACxE,OAAO,EACL,uBAAuB,EACvB,KAAK,mCAAmC,EACxC,KAAK,gBAAgB,EACrB,KAAK,eAAe,GACrB,MAAM,6CAA6C,CAAA;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAA;AAEtE,OAAO,EACL,yBAAyB,EACzB,KAAK,qCAAqC,GAC3C,MAAM,kDAAkD,CAAA;AACzD,OAAO,EACL,8BAA8B,EAC9B,KAAK,0CAA0C,GAChD,MAAM,uDAAuD,CAAA;AAC9D,OAAO,EACL,qBAAqB,EACrB,KAAK,iCAAiC,EACtC,gBAAgB,GACjB,MAAM,8CAA8C,CAAA;AACrD,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,GACxC,MAAM,+CAA+C,CAAA;AACtD,OAAO,EACL,mBAAmB,EACnB,KAAK,+BAA+B,EACpC,KAAK,WAAW,GACjB,MAAM,4CAA4C,CAAA;AACnD,OAAO,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAA;AAClF,OAAO,KAAK,cAAc,MAAM,wCAAwC,CAAA;AACxE,OAAO,KAAK,eAAe,MAAM,yCAAyC,CAAA;AAC1E,OAAO,KAAK,WAAW,MAAM,qCAAqC,CAAA;AAClE,OAAO,KAAK,eAAe,MAAM,0CAA0C,CAAA;AAC3E,OAAO,KAAK,UAAU,MAAM,oCAAoC,CAAA;AAChE,OAAO,KAAK,WAAW,MAAM,qCAAqC,CAAA;AAClE,OAAO,KAAK,WAAW,MAAM,qCAAqC,CAAA;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAA;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAA;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAA;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAA;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAA;AAEvE,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,IAAI,sBAAsB,GACzC,MAAM,6BAA6B,CAAA;AAGpC,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAA;AAClG,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAA;AAC9E,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAA;AACnF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AACtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAA;AACtF,OAAO,KAAK,eAAe,MAAM,0CAA0C,CAAA;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAA;AAGjF,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,yBAAyB,EACzB,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,eAAe,GACrB,MAAM,mCAAmC,CAAA;AAE1C,OAAO,EACL,qBAAqB,EACrB,KAAK,iCAAiC,GACvC,MAAM,0CAA0C,CAAA;AACjD,OAAO,EACL,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,YAAY,GACb,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,eAAe,EACf,KAAK,2BAA2B,GACjC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,gBAAgB,EAChB,KAAK,4BAA4B,EACjC,KAAK,gBAAgB,EACrB,KAAK,eAAe,GACrB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,qBAAqB,EACrB,KAAK,eAAe,EACpB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AACvC,OAAO,KAAK,UAAU,MAAM,gCAAgC,CAAA;AAC5D,OAAO,KAAK,SAAS,MAAM,+BAA+B,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAC/D,OAAO,KAAK,gBAAgB,MAAM,iCAAiC,CAAA;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAA;AAC1E,OAAO,EACL,oBAAoB,EACpB,KAAK,gCAAgC,EACrC,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,SAAS,GACf,MAAM,2CAA2C,CAAA;AAClD,OAAO,KAAK,eAAe,MAAM,wCAAwC,CAAA;AACzE,OAAO,KAAK,kBAAkB,MAAM,2CAA2C,CAAA;AAC/E,OAAO,KAAK,iBAAiB,MAAM,0CAA0C,CAAA;AAC7E,OAAO,KAAK,oBAAoB,MAAM,6CAA6C,CAAA;AACnF,OAAO,EAAE,iBAAiB,EAAE,KAAK,mBAAmB,EAAE,MAAM,sCAAsC,CAAA;AAClG,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,KAAK,iCAAiC,GACvC,MAAM,8CAA8C,CAAA;AACrD,OAAO,EACL,yBAAyB,EACzB,KAAK,uBAAuB,GAC7B,MAAM,0CAA0C,CAAA;AACjD,OAAO,KAAK,iBAAiB,MAAM,wCAAwC,CAAA;AAC3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAA;AACjF,OAAO,EACL,oBAAoB,EACpB,KAAK,gCAAgC,GACtC,MAAM,yCAAyC,CAAA;AAGhD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAA;AAE5E,OAAO,EACL,4BAA4B,EAC5B,KAAK,wCAAwC,EAC7C,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,GAC1B,MAAM,wDAAwD,CAAA;AAI/D,YAAY,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAA;AAM5F,OAAO,EACL,0BAA0B,EAC1B,iCAAiC,EACjC,0BAA0B,EAC1B,4BAA4B,EAC5B,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,+BAA+B,GACrC,MAAM,gDAAgD,CAAA;AACvD,OAAO,EACL,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,GAC5B,MAAM,+CAA+C,CAAA;AACtD,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,KAAK,4BAA4B,GAClC,MAAM,iDAAiD,CAAA;AACxD,OAAO,EACL,6BAA6B,EAC7B,KAAK,yCAAyC,GAC/C,MAAM,yDAAyD,CAAA;AAChE,OAAO,EACL,KAAK,eAAe,EACpB,8BAA8B,EAC9B,KAAK,0CAA0C,EAC/C,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,0DAA0D,CAAA;AACjE,OAAO,EACL,0BAA0B,EAC1B,KAAK,sCAAsC,GAC5C,MAAM,sDAAsD,CAAA;AAC7D,OAAO,KAAK,iBAAiB,MAAM,8CAA8C,CAAA;AAGjF,OAAO,EACL,KAAK,aAAa,EAClB,qBAAqB,EACrB,cAAc,EACd,SAAS,GACV,MAAM,gCAAgC,CAAA;AAGvC,OAAO,EACL,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,mDAAmD,CAAA;AAC1D,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,8CAA8C,CAAA;AAErD,OAAO,EACL,2BAA2B,EAC3B,KAAK,uCAAuC,EAC5C,KAAK,qBAAqB,GAC3B,MAAM,kDAAkD,CAAA;AACzD,OAAO,KAAK,YAAY,MAAM,oCAAoC,CAAA;AAMlE,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,sCAAsC,CAAA;AAG7C,OAAO,EAAE,uBAAuB,EAAE,KAAK,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AAIjG,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,6BAA6B,GACnC,MAAM,6CAA6C,CAAA;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAA;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,mDAAmD,CAAA;AAC7F,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,6BAA6B,EAC7B,KAAK,oCAAoC,GAC1C,MAAM,uDAAuD,CAAA;AAC9D,OAAO,KAAK,eAAe,MAAM,0CAA0C,CAAA;AAC3E,OAAO,KAAK,0BAA0B,MAAM,sDAAsD,CAAA;AAOlG,OAAO,EACL,0BAA0B,EAC1B,KAAK,iCAAiC,GACvC,MAAM,iDAAiD,CAAA;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAA;AAC5F,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,GAC9B,MAAM,gDAAgD,CAAA;AACvD,OAAO,KAAK,uBAAuB,MAAM,gDAAgD,CAAA;AAEzF,OAAO,EACL,kBAAkB,EAClB,KAAK,8BAA8B,GACpC,MAAM,6CAA6C,CAAA;AAEpD,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,yCAAyC,CAAA;AAGhD,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,oBAAoB,EACzB,KAAK,mCAAmC,EACxC,KAAK,kCAAkC,GACxC,MAAM,uDAAuD,CAAA;AAC9D,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,uDAAuD,CAAA;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAA;~~AAKrE~~,OAAO,EACL,wBAAwB,EACxB,KAAK,oCAAoC,GAC1C,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,GACxC,MAAM,2CAA2C,CAAA;AAClD,OAAO,EACL,oBAAoB,EACpB,KAAK,gCAAgC,GACtC,MAAM,yCAAyC,CAAA;AAChD,OAAO,EACL,yBAAyB,EACzB,KAAK,qCAAqC,GAC3C,MAAM,8CAA8C,CAAA;AACrD,OAAO,EACL,cAAc,EACd,aAAa,EACb,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,gBAAgB,GACtB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,UAAU,MAAM,gCAAgC,CAAA;AAC5D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,YAAY,GACb,MAAM,gCAAgC,CAAA;AACvC,OAAO,EACL,2BAA2B,EAC3B,KAAK,uCAAuC,EAC5C,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,GAC7B,MAAM,oDAAoD,CAAA;AAC3D,OAAO,EACL,aAAa,EACb,KAAK,yBAAyB,EAC9B,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,aAAa,GACnB,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,KAAK,+BAA+B,EACpC,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,GACxB,MAAM,4CAA4C,CAAA;AACnD,OAAO,EACL,2BAA2B,EAC3B,KAAK,uCAAuC,EAC5C,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,oDAAoD,CAAA;AAC3D,OAAO,EACL,yBAAyB,EACzB,KAAK,qCAAqC,EAC1C,KAAK,qBAAqB,GAC3B,MAAM,kDAAkD,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAA;AAC5F,OAAO,EACL,iBAAiB,EACjB,KAAK,6BAA6B,GACnC,MAAM,0CAA0C,CAAA;AACjD,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,uBAAuB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,GACzB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,wBAAwB,EACxB,KAAK,oCAAoC,EACzC,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,iDAAiD,CAAA;AACxD,OAAO,KAAK,cAAc,MAAM,wCAAwC,CAAA;AACxE,OAAO,EACL,uBAAuB,EACvB,WAAW,EACX,WAAW,EACX,KAAK,kBAAkB,GACxB,MAAM,wCAAwC,CAAA;AAM/C,OAAO,EACL,6BAA6B,EAC7B,KAAK,yCAAyC,EAC9C,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,GACjC,MAAM,0DAA0D,CAAA;AACjE,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,2BAA2B,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,kDAAkD,CAAA;AACzD,OAAO,EACL,aAAa,EACb,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,GAC1B,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,oBAAoB,EACpB,cAAc,GACf,MAAM,oCAAoC,CAAA;AAM3C,OAAO,EACL,iCAAiC,EACjC,KAAK,6CAA6C,EAClD,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,iCAAiC,GACvC,MAAM,kEAAkE,CAAA;AACzE,OAAO,EAAE,gCAAgC,EAAE,MAAM,yCAAyC,CAAA;AAC1F,OAAO,EACL,2BAA2B,EAC3B,KAAK,kCAAkC,GACxC,MAAM,oDAAoD,CAAA;AAC3D,OAAO,EACL,4BAA4B,EAC5B,KAAK,mCAAmC,GACzC,MAAM,sDAAsD,CAAA;AAC7D,OAAO,EACL,mCAAmC,EACnC,+BAA+B,EAC/B,KAAK,+CAA+C,GACrD,MAAM,qEAAqE,CAAA;AAC5E,OAAO,EACL,sBAAsB,EACtB,4BAA4B,EAC5B,KAAK,kCAAkC,EACvC,KAAK,uBAAuB,GAC7B,MAAM,qDAAqD,CAAA;AAC5D,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,KAAK,8BAA8B,GACpC,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,oBAAoB,EACpB,KAAK,gCAAgC,GACtC,MAAM,iDAAiD,CAAA;AAExD,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,YAAY,GAClB,MAAM,6BAA6B,CAAA;AACpC,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,EACvC,KAAK,eAAe,GACrB,MAAM,2CAA2C,CAAA"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,yBAAyB,EACzB,KAAK,qCAAqC,GAC3C,MAAM,+CAA+C,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,KAAK,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AACjG,OAAO,EACL,iBAAiB,EACjB,KAAK,6BAA6B,GACnC,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAE,KAAK,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AACpG,OAAO,EACL,uBAAuB,EACvB,KAAK,mCAAmC,GACzC,MAAM,0CAA0C,CAAA;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAA;AAClF,OAAO,KAAK,gBAAgB,MAAM,sCAAsC,CAAA;AACxE,OAAO,EACL,uBAAuB,EACvB,KAAK,mCAAmC,EACxC,KAAK,gBAAgB,EACrB,KAAK,eAAe,GACrB,MAAM,6CAA6C,CAAA;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAA;AAEtE,OAAO,EACL,yBAAyB,EACzB,KAAK,qCAAqC,GAC3C,MAAM,kDAAkD,CAAA;AACzD,OAAO,EACL,8BAA8B,EAC9B,KAAK,0CAA0C,GAChD,MAAM,uDAAuD,CAAA;AAC9D,OAAO,EACL,qBAAqB,EACrB,KAAK,iCAAiC,EACtC,gBAAgB,GACjB,MAAM,8CAA8C,CAAA;AACrD,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,GACxC,MAAM,+CAA+C,CAAA;AACtD,OAAO,EACL,mBAAmB,EACnB,KAAK,+BAA+B,EACpC,KAAK,WAAW,GACjB,MAAM,4CAA4C,CAAA;AACnD,OAAO,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAA;AAClF,OAAO,KAAK,cAAc,MAAM,wCAAwC,CAAA;AACxE,OAAO,KAAK,eAAe,MAAM,yCAAyC,CAAA;AAC1E,OAAO,KAAK,WAAW,MAAM,qCAAqC,CAAA;AAClE,OAAO,KAAK,eAAe,MAAM,0CAA0C,CAAA;AAC3E,OAAO,KAAK,UAAU,MAAM,oCAAoC,CAAA;AAChE,OAAO,KAAK,WAAW,MAAM,qCAAqC,CAAA;AAClE,OAAO,KAAK,WAAW,MAAM,qCAAqC,CAAA;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAA;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAA;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAA;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAA;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAA;AAEvE,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,IAAI,sBAAsB,GACzC,MAAM,6BAA6B,CAAA;AAGpC,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAA;AAClG,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAA;AAC9E,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAA;AACnF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AACtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAA;AACtF,OAAO,KAAK,eAAe,MAAM,0CAA0C,CAAA;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAA;AAGjF,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,yBAAyB,EACzB,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,eAAe,GACrB,MAAM,mCAAmC,CAAA;AAE1C,OAAO,EACL,qBAAqB,EACrB,KAAK,iCAAiC,GACvC,MAAM,0CAA0C,CAAA;AACjD,OAAO,EACL,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,YAAY,GACb,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,eAAe,EACf,KAAK,2BAA2B,GACjC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,gBAAgB,EAChB,KAAK,4BAA4B,EACjC,KAAK,gBAAgB,EACrB,KAAK,eAAe,GACrB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,qBAAqB,EACrB,KAAK,eAAe,EACpB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AACvC,OAAO,KAAK,UAAU,MAAM,gCAAgC,CAAA;AAC5D,OAAO,KAAK,SAAS,MAAM,+BAA+B,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAC/D,OAAO,KAAK,gBAAgB,MAAM,iCAAiC,CAAA;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAA;AAC1E,OAAO,EACL,oBAAoB,EACpB,KAAK,gCAAgC,EACrC,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,SAAS,GACf,MAAM,2CAA2C,CAAA;AAClD,OAAO,KAAK,eAAe,MAAM,wCAAwC,CAAA;AACzE,OAAO,KAAK,kBAAkB,MAAM,2CAA2C,CAAA;AAC/E,OAAO,KAAK,iBAAiB,MAAM,0CAA0C,CAAA;AAC7E,OAAO,KAAK,oBAAoB,MAAM,6CAA6C,CAAA;AACnF,OAAO,EAAE,iBAAiB,EAAE,KAAK,mBAAmB,EAAE,MAAM,sCAAsC,CAAA;AAClG,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,KAAK,iCAAiC,GACvC,MAAM,8CAA8C,CAAA;AACrD,OAAO,EACL,yBAAyB,EACzB,KAAK,uBAAuB,GAC7B,MAAM,0CAA0C,CAAA;AACjD,OAAO,KAAK,iBAAiB,MAAM,wCAAwC,CAAA;AAC3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAA;AACjF,OAAO,EACL,oBAAoB,EACpB,KAAK,gCAAgC,GACtC,MAAM,yCAAyC,CAAA;AAGhD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAA;AAE5E,OAAO,EACL,4BAA4B,EAC5B,KAAK,wCAAwC,EAC7C,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,GAC1B,MAAM,wDAAwD,CAAA;AAI/D,YAAY,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAA;AAM5F,OAAO,EACL,0BAA0B,EAC1B,iCAAiC,EACjC,0BAA0B,EAC1B,4BAA4B,EAC5B,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,+BAA+B,GACrC,MAAM,gDAAgD,CAAA;AACvD,OAAO,EACL,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,GAC5B,MAAM,+CAA+C,CAAA;AACtD,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,KAAK,4BAA4B,GAClC,MAAM,iDAAiD,CAAA;AACxD,OAAO,EACL,6BAA6B,EAC7B,KAAK,yCAAyC,GAC/C,MAAM,yDAAyD,CAAA;AAChE,OAAO,EACL,KAAK,eAAe,EACpB,8BAA8B,EAC9B,KAAK,0CAA0C,EAC/C,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,0DAA0D,CAAA;AACjE,OAAO,EACL,0BAA0B,EAC1B,KAAK,sCAAsC,GAC5C,MAAM,sDAAsD,CAAA;AAC7D,OAAO,KAAK,iBAAiB,MAAM,8CAA8C,CAAA;AAGjF,OAAO,EACL,KAAK,aAAa,EAClB,qBAAqB,EACrB,cAAc,EACd,SAAS,GACV,MAAM,gCAAgC,CAAA;AAGvC,OAAO,EACL,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,mDAAmD,CAAA;AAC1D,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,8CAA8C,CAAA;AAErD,OAAO,EACL,2BAA2B,EAC3B,KAAK,uCAAuC,EAC5C,KAAK,qBAAqB,GAC3B,MAAM,kDAAkD,CAAA;AACzD,OAAO,KAAK,YAAY,MAAM,oCAAoC,CAAA;AAMlE,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,sCAAsC,CAAA;AAG7C,OAAO,EAAE,uBAAuB,EAAE,KAAK,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AAIjG,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,6BAA6B,GACnC,MAAM,6CAA6C,CAAA;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAA;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,mDAAmD,CAAA;AAC7F,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,6BAA6B,EAC7B,KAAK,oCAAoC,GAC1C,MAAM,uDAAuD,CAAA;AAC9D,OAAO,KAAK,eAAe,MAAM,0CAA0C,CAAA;AAC3E,OAAO,KAAK,0BAA0B,MAAM,sDAAsD,CAAA;AAOlG,OAAO,EACL,0BAA0B,EAC1B,KAAK,iCAAiC,GACvC,MAAM,iDAAiD,CAAA;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAA;AAC5F,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,GAC9B,MAAM,gDAAgD,CAAA;AACvD,OAAO,KAAK,uBAAuB,MAAM,gDAAgD,CAAA;AAEzF,OAAO,EACL,kBAAkB,EAClB,KAAK,8BAA8B,GACpC,MAAM,6CAA6C,CAAA;AAEpD,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,yCAAyC,CAAA;AAGhD,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,oBAAoB,EACzB,KAAK,mCAAmC,EACxC,KAAK,kCAAkC,GACxC,MAAM,uDAAuD,CAAA;AAC9D,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,uDAAuD,CAAA;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAA;AAMrE,OAAO,EACL,0BAA0B,EAC1B,KAAK,sCAAsC,GAC5C,MAAM,6DAA6D,CAAA;AACpE,OAAO,EACL,0BAA0B,EAC1B,KAAK,sCAAsC,GAC5C,MAAM,6DAA6D,CAAA;AACpE,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,mDAAmD,CAAA;AAC1D,OAAO,EACL,gCAAgC,EAChC,+BAA+B,EAC/B,KAAK,sCAAsC,GAC5C,MAAM,0CAA0C,CAAA;AACjD,OAAO,EAAE,gCAAgC,EAAE,MAAM,6CAA6C,CAAA;AAK9F,OAAO,EAAE,mBAAmB,EAAE,KAAK,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAK/F,OAAO,EACL,wBAAwB,EACxB,KAAK,oCAAoC,GAC1C,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,GACxC,MAAM,2CAA2C,CAAA;AAClD,OAAO,EACL,oBAAoB,EACpB,KAAK,gCAAgC,GACtC,MAAM,yCAAyC,CAAA;AAChD,OAAO,EACL,yBAAyB,EACzB,KAAK,qCAAqC,GAC3C,MAAM,8CAA8C,CAAA;AACrD,OAAO,EACL,cAAc,EACd,aAAa,EACb,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,gBAAgB,GACtB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,UAAU,MAAM,gCAAgC,CAAA;AAC5D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,YAAY,GACb,MAAM,gCAAgC,CAAA;AACvC,OAAO,EACL,2BAA2B,EAC3B,KAAK,uCAAuC,EAC5C,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,GAC7B,MAAM,oDAAoD,CAAA;AAC3D,OAAO,EACL,aAAa,EACb,KAAK,yBAAyB,EAC9B,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,aAAa,GACnB,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,KAAK,+BAA+B,EACpC,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,GACxB,MAAM,4CAA4C,CAAA;AACnD,OAAO,EACL,2BAA2B,EAC3B,KAAK,uCAAuC,EAC5C,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,oDAAoD,CAAA;AAC3D,OAAO,EACL,yBAAyB,EACzB,KAAK,qCAAqC,EAC1C,KAAK,qBAAqB,GAC3B,MAAM,kDAAkD,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAA;AAC5F,OAAO,EACL,iBAAiB,EACjB,KAAK,6BAA6B,GACnC,MAAM,0CAA0C,CAAA;AACjD,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,uBAAuB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,GACzB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,wBAAwB,EACxB,KAAK,oCAAoC,EACzC,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,iDAAiD,CAAA;AACxD,OAAO,KAAK,cAAc,MAAM,wCAAwC,CAAA;AACxE,OAAO,EACL,uBAAuB,EACvB,WAAW,EACX,WAAW,EACX,KAAK,kBAAkB,GACxB,MAAM,wCAAwC,CAAA;AAM/C,OAAO,EACL,6BAA6B,EAC7B,KAAK,yCAAyC,EAC9C,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,GACjC,MAAM,0DAA0D,CAAA;AACjE,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,2BAA2B,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,kDAAkD,CAAA;AACzD,OAAO,EACL,aAAa,EACb,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,GAC1B,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,oBAAoB,EACpB,cAAc,GACf,MAAM,oCAAoC,CAAA;AAM3C,OAAO,EACL,iCAAiC,EACjC,KAAK,6CAA6C,EAClD,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,iCAAiC,GACvC,MAAM,kEAAkE,CAAA;AACzE,OAAO,EAAE,gCAAgC,EAAE,MAAM,yCAAyC,CAAA;AAC1F,OAAO,EACL,2BAA2B,EAC3B,KAAK,kCAAkC,GACxC,MAAM,oDAAoD,CAAA;AAC3D,OAAO,EACL,4BAA4B,EAC5B,KAAK,mCAAmC,GACzC,MAAM,sDAAsD,CAAA;AAC7D,OAAO,EACL,mCAAmC,EACnC,+BAA+B,EAC/B,KAAK,+CAA+C,GACrD,MAAM,qEAAqE,CAAA;AAC5E,OAAO,EACL,sBAAsB,EACtB,4BAA4B,EAC5B,KAAK,kCAAkC,EACvC,KAAK,uBAAuB,GAC7B,MAAM,qDAAqD,CAAA;AAC5D,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,KAAK,8BAA8B,GACpC,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,oBAAoB,EACpB,KAAK,gCAAgC,GACtC,MAAM,iDAAiD,CAAA;AAExD,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,YAAY,GAClB,MAAM,6BAA6B,CAAA;AACpC,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,EACvC,KAAK,eAAe,GACrB,MAAM,2CAA2C,CAAA"}

package/dist/index.js CHANGED Viewed

@@ -126,6 +126,19 @@ export { PreflightService, preflightBlockingFailures, formatPreflightFailure, }
 export { ProvisioningLogRecorder, ProvisioningLogService, PROVISIONING_LOG_MAX_LIMIT, } from './modules/provisioning-logs/ProvisioningLogService.js';
 export { LoggingRunnerTransport, } from './modules/provisioning-logs/LoggingRunnerTransport.js';
 export { redactSecrets } from './modules/provisioning-logs/redact.js';
+// Notification webhook: an outbound HTTP delivery transport for the existing notification
+// mechanism (`WebhookNotificationChannel` implements the same `NotificationChannel` port),
+// plus the per-workspace endpoint management service. This is how a HEADLESS integration —
+// which has no in-app inbox and no browser WebSocket — learns that a run parked.
+export { WebhookNotificationChannel, } from './modules/notificationWebhook/WebhookNotificationChannel.js';
+export { NotificationWebhookService, } from './modules/notificationWebhook/NotificationWebhookService.js';
+export { WEBHOOK_SIGNATURE_HEADERS, signWebhookDelivery, } from './modules/notificationWebhook/webhookSignature.js';
+export { NOTIFICATION_WEBHOOK_CIPHER_INFO, buildNotificationWebhookSupport, } from './modules/notificationWebhook/support.js';
+export { assertSafeNotificationWebhookUrl } from './modules/notificationWebhook/webhookUrl.js';
+// The provider-neutral SSRF host/scheme guard behind every operator-supplied-URL integration
+// (environments, runner pools, notification webhooks). One implementation, so a bypass found in
+// any of them is fixed for all of them; each caller supplies only its wording + its own policy.
+export { assertSafePublicUrl } from './modules/shared/url-guard.js';
 // Slack: an additional delivery transport for the existing notification mechanism
 // (the `SlackNotificationChannel` implements the same `NotificationChannel` port),
 // plus the per-account connection / per-workspace routing / member-mapping services.

package/dist/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAE3D,OAAO,EACL,yBAAyB,GAE1B,MAAM,+CAA+C,CAAA;AACtD,OAAO,EAAE,aAAa,EAAkC,MAAM,mCAAmC,CAAA;AACjG,OAAO,EACL,iBAAiB,GAElB,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAmC,MAAM,oCAAoC,CAAA;AACpG,OAAO,EACL,uBAAuB,GAExB,MAAM,0CAA0C,CAAA;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAA;AAClF,OAAO,KAAK,gBAAgB,MAAM,sCAAsC,CAAA;AACxE,OAAO,EACL,uBAAuB,GAIxB,MAAM,6CAA6C,CAAA;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAA;AAEtE,OAAO,EACL,yBAAyB,GAE1B,MAAM,kDAAkD,CAAA;AACzD,OAAO,EACL,8BAA8B,GAE/B,MAAM,uDAAuD,CAAA;AAC9D,OAAO,EACL,qBAAqB,EAErB,gBAAgB,GACjB,MAAM,8CAA8C,CAAA;AACrD,OAAO,EACL,sBAAsB,GAEvB,MAAM,+CAA+C,CAAA;AACtD,OAAO,EACL,mBAAmB,GAGpB,MAAM,4CAA4C,CAAA;AACnD,OAAO,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAA;AAClF,OAAO,KAAK,cAAc,MAAM,wCAAwC,CAAA;AACxE,OAAO,KAAK,eAAe,MAAM,yCAAyC,CAAA;AAC1E,OAAO,KAAK,WAAW,MAAM,qCAAqC,CAAA;AAClE,OAAO,KAAK,eAAe,MAAM,0CAA0C,CAAA;AAC3E,OAAO,KAAK,UAAU,MAAM,oCAAoC,CAAA;AAChE,OAAO,KAAK,WAAW,MAAM,qCAAqC,CAAA;AAClE,OAAO,KAAK,WAAW,MAAM,qCAAqC,CAAA;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAA;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAA;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAA;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAA;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAA;AACvE,+EAA+E;AAC/E,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,IAAI,sBAAsB,GACzC,MAAM,6BAA6B,CAAA;AACpC,iFAAiF;AACjF,8EAA8E;AAC9E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAA;AAClG,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAA;AAC9E,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAA;AACnF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AACtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAA;AACtF,OAAO,KAAK,eAAe,MAAM,0CAA0C,CAAA;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAA;AACjF,8EAA8E;AAC9E,iFAAiF;AACjF,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,yBAAyB,EACzB,gBAAgB,GAGjB,MAAM,mCAAmC,CAAA;AAE1C,OAAO,EACL,qBAAqB,GAEtB,MAAM,0CAA0C,CAAA;AACjD,OAAO,EACL,iBAAiB,EAEjB,YAAY,GACb,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,eAAe,GAEhB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,gBAAgB,GAIjB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,qBAAqB,EAErB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AACvC,OAAO,KAAK,UAAU,MAAM,gCAAgC,CAAA;AAC5D,OAAO,KAAK,SAAS,MAAM,+BAA+B,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAC/D,OAAO,KAAK,gBAAgB,MAAM,iCAAiC,CAAA;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAA;AAC1E,OAAO,EACL,oBAAoB,GAKrB,MAAM,2CAA2C,CAAA;AAClD,OAAO,KAAK,eAAe,MAAM,wCAAwC,CAAA;AACzE,OAAO,KAAK,kBAAkB,MAAM,2CAA2C,CAAA;AAC/E,OAAO,KAAK,iBAAiB,MAAM,0CAA0C,CAAA;AAC7E,OAAO,KAAK,oBAAoB,MAAM,6CAA6C,CAAA;AACnF,OAAO,EAAE,iBAAiB,EAA4B,MAAM,sCAAsC,CAAA;AAClG,OAAO,EACL,yBAAyB,EACzB,qBAAqB,GAEtB,MAAM,8CAA8C,CAAA;AACrD,OAAO,EACL,yBAAyB,GAE1B,MAAM,0CAA0C,CAAA;AACjD,OAAO,KAAK,iBAAiB,MAAM,wCAAwC,CAAA;AAC3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAA;AACjF,OAAO,EACL,oBAAoB,GAErB,MAAM,yCAAyC,CAAA;AAChD,mFAAmF;AACnF,yFAAyF;AACzF,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAA;AAE5E,OAAO,EACL,4BAA4B,GAO7B,MAAM,wDAAwD,CAAA;AAK/D,gFAAgF;AAChF,2FAA2F;AAC3F,qFAAqF;AACrF,sFAAsF;AACtF,qFAAqF;AACrF,OAAO,EACL,0BAA0B,EAC1B,iCAAiC,EACjC,0BAA0B,EAC1B,4BAA4B,GAI7B,MAAM,gDAAgD,CAAA;AACvD,OAAO,EACL,mBAAmB,GAGpB,MAAM,+CAA+C,CAAA;AACtD,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAE7B,MAAM,iDAAiD,CAAA;AACxD,OAAO,EACL,6BAA6B,GAE9B,MAAM,yDAAyD,CAAA;AAChE,OAAO,EAEL,8BAA8B,GAK/B,MAAM,0DAA0D,CAAA;AACjE,OAAO,EACL,0BAA0B,GAE3B,MAAM,sDAAsD,CAAA;AAC7D,OAAO,KAAK,iBAAiB,MAAM,8CAA8C,CAAA;AACjF,yFAAyF;AACzF,+EAA+E;AAC/E,OAAO,EAEL,qBAAqB,EACrB,cAAc,EACd,SAAS,GACV,MAAM,gCAAgC,CAAA;AACvC,mFAAmF;AACnF,6EAA6E;AAC7E,OAAO,EACL,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,mDAAmD,CAAA;AAC1D,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,8CAA8C,CAAA;AAErD,OAAO,EACL,2BAA2B,GAG5B,MAAM,kDAAkD,CAAA;AACzD,OAAO,KAAK,YAAY,MAAM,oCAAoC,CAAA;AAClE,mFAAmF;AACnF,0FAA0F;AAC1F,gFAAgF;AAChF,sFAAsF;AACtF,qFAAqF;AACrF,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,qBAAqB,EACrB,uBAAuB,GAGxB,MAAM,sCAAsC,CAAA;AAC7C,4FAA4F;AAC5F,iGAAiG;AACjG,OAAO,EAAE,uBAAuB,EAA0B,MAAM,iCAAiC,CAAA;AACjG,wEAAwE;AACxE,iFAAiF;AACjF,uFAAuF;AACvF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,GAEnB,MAAM,6CAA6C,CAAA;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAA;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,mDAAmD,CAAA;AAC7F,OAAO,EACL,mBAAmB,GAGpB,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,6BAA6B,GAE9B,MAAM,uDAAuD,CAAA;AAC9D,OAAO,KAAK,eAAe,MAAM,0CAA0C,CAAA;AAC3E,OAAO,KAAK,0BAA0B,MAAM,sDAAsD,CAAA;AAClG,4FAA4F;AAC5F,6FAA6F;AAC7F,4FAA4F;AAC5F,2FAA2F;AAC3F,gGAAgG;AAChG,qDAAqD;AACrD,OAAO,EACL,0BAA0B,GAE3B,MAAM,iDAAiD,CAAA;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAA;AAC5F,OAAO,EAIN,MAAM,gDAAgD,CAAA;AACvD,OAAO,KAAK,uBAAuB,MAAM,gDAAgD,CAAA;AACzF,qGAAqG;AACrG,OAAO,EACL,kBAAkB,GAEnB,MAAM,6CAA6C,CAAA;AACpD,+FAA+F;AAC/F,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,yCAAyC,CAAA;AAChD,mFAAmF;AACnF,qFAAqF;AACrF,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,0BAA0B,GAI3B,MAAM,uDAAuD,CAAA;AAC9D,OAAO,EACL,sBAAsB,GAEvB,MAAM,uDAAuD,CAAA;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAA;AAErE,kFAAkF;AAClF,mFAAmF;AACnF,qFAAqF;AACrF,OAAO,EACL,wBAAwB,GAEzB,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,sBAAsB,GAEvB,MAAM,2CAA2C,CAAA;AAClD,OAAO,EACL,oBAAoB,GAErB,MAAM,yCAAyC,CAAA;AAChD,OAAO,EACL,yBAAyB,GAE1B,MAAM,8CAA8C,CAAA;AACrD,OAAO,EACL,cAAc,EACd,aAAa,GAId,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,UAAU,MAAM,gCAAgC,CAAA;AAC5D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,YAAY,GACb,MAAM,gCAAgC,CAAA;AACvC,OAAO,EACL,2BAA2B,GAI5B,MAAM,oDAAoD,CAAA;AAC3D,OAAO,EACL,aAAa,GAKd,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,mBAAmB,EACnB,cAAc,GAIf,MAAM,4CAA4C,CAAA;AACnD,OAAO,EACL,2BAA2B,EAG3B,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,oDAAoD,CAAA;AAC3D,OAAO,EACL,yBAAyB,GAG1B,MAAM,kDAAkD,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAA;AAC5F,OAAO,EACL,iBAAiB,GAElB,MAAM,0CAA0C,CAAA;AACjD,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,uBAAuB,GAGxB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,wBAAwB,EAExB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,iDAAiD,CAAA;AACxD,OAAO,KAAK,cAAc,MAAM,wCAAwC,CAAA;AACxE,OAAO,EACL,uBAAuB,EACvB,WAAW,EACX,WAAW,GAEZ,MAAM,wCAAwC,CAAA;AAE/C,uFAAuF;AACvF,0FAA0F;AAC1F,yFAAyF;AACzF,uDAAuD;AACvD,OAAO,EACL,6BAA6B,GAI9B,MAAM,0DAA0D,CAAA;AACjE,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,2BAA2B,GAE5B,MAAM,kDAAkD,CAAA;AACzD,OAAO,EACL,aAAa,GAGd,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,oBAAoB,EACpB,cAAc,GACf,MAAM,oCAAoC,CAAA;AAE3C,sFAAsF;AACtF,uFAAuF;AACvF,wFAAwF;AACxF,kDAAkD;AAClD,OAAO,EACL,iCAAiC,GAKlC,MAAM,kEAAkE,CAAA;AACzE,OAAO,EAAE,gCAAgC,EAAE,MAAM,yCAAyC,CAAA;AAC1F,OAAO,EACL,2BAA2B,GAE5B,MAAM,oDAAoD,CAAA;AAC3D,OAAO,EACL,4BAA4B,GAE7B,MAAM,sDAAsD,CAAA;AAC7D,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAEhC,MAAM,qEAAqE,CAAA;AAC5E,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAG7B,MAAM,qDAAqD,CAAA;AAC5D,OAAO,EACL,kBAAkB,EAClB,wBAAwB,GAEzB,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,oBAAoB,GAErB,MAAM,iDAAiD,CAAA;AAExD,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,GAIlB,MAAM,6BAA6B,CAAA;AACpC,OAAO,EACL,sBAAsB,GAGvB,MAAM,2CAA2C,CAAA"}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAE3D,OAAO,EACL,yBAAyB,GAE1B,MAAM,+CAA+C,CAAA;AACtD,OAAO,EAAE,aAAa,EAAkC,MAAM,mCAAmC,CAAA;AACjG,OAAO,EACL,iBAAiB,GAElB,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAmC,MAAM,oCAAoC,CAAA;AACpG,OAAO,EACL,uBAAuB,GAExB,MAAM,0CAA0C,CAAA;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAA;AAClF,OAAO,KAAK,gBAAgB,MAAM,sCAAsC,CAAA;AACxE,OAAO,EACL,uBAAuB,GAIxB,MAAM,6CAA6C,CAAA;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAA;AAEtE,OAAO,EACL,yBAAyB,GAE1B,MAAM,kDAAkD,CAAA;AACzD,OAAO,EACL,8BAA8B,GAE/B,MAAM,uDAAuD,CAAA;AAC9D,OAAO,EACL,qBAAqB,EAErB,gBAAgB,GACjB,MAAM,8CAA8C,CAAA;AACrD,OAAO,EACL,sBAAsB,GAEvB,MAAM,+CAA+C,CAAA;AACtD,OAAO,EACL,mBAAmB,GAGpB,MAAM,4CAA4C,CAAA;AACnD,OAAO,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAA;AAClF,OAAO,KAAK,cAAc,MAAM,wCAAwC,CAAA;AACxE,OAAO,KAAK,eAAe,MAAM,yCAAyC,CAAA;AAC1E,OAAO,KAAK,WAAW,MAAM,qCAAqC,CAAA;AAClE,OAAO,KAAK,eAAe,MAAM,0CAA0C,CAAA;AAC3E,OAAO,KAAK,UAAU,MAAM,oCAAoC,CAAA;AAChE,OAAO,KAAK,WAAW,MAAM,qCAAqC,CAAA;AAClE,OAAO,KAAK,WAAW,MAAM,qCAAqC,CAAA;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAA;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAA;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAA;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAA;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAA;AACvE,+EAA+E;AAC/E,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,IAAI,sBAAsB,GACzC,MAAM,6BAA6B,CAAA;AACpC,iFAAiF;AACjF,8EAA8E;AAC9E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAA;AAClG,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAA;AAC9E,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAA;AACnF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AACtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAA;AACtF,OAAO,KAAK,eAAe,MAAM,0CAA0C,CAAA;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAA;AACjF,8EAA8E;AAC9E,iFAAiF;AACjF,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,yBAAyB,EACzB,gBAAgB,GAGjB,MAAM,mCAAmC,CAAA;AAE1C,OAAO,EACL,qBAAqB,GAEtB,MAAM,0CAA0C,CAAA;AACjD,OAAO,EACL,iBAAiB,EAEjB,YAAY,GACb,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,eAAe,GAEhB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,gBAAgB,GAIjB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,qBAAqB,EAErB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AACvC,OAAO,KAAK,UAAU,MAAM,gCAAgC,CAAA;AAC5D,OAAO,KAAK,SAAS,MAAM,+BAA+B,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAC/D,OAAO,KAAK,gBAAgB,MAAM,iCAAiC,CAAA;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAA;AAC1E,OAAO,EACL,oBAAoB,GAKrB,MAAM,2CAA2C,CAAA;AAClD,OAAO,KAAK,eAAe,MAAM,wCAAwC,CAAA;AACzE,OAAO,KAAK,kBAAkB,MAAM,2CAA2C,CAAA;AAC/E,OAAO,KAAK,iBAAiB,MAAM,0CAA0C,CAAA;AAC7E,OAAO,KAAK,oBAAoB,MAAM,6CAA6C,CAAA;AACnF,OAAO,EAAE,iBAAiB,EAA4B,MAAM,sCAAsC,CAAA;AAClG,OAAO,EACL,yBAAyB,EACzB,qBAAqB,GAEtB,MAAM,8CAA8C,CAAA;AACrD,OAAO,EACL,yBAAyB,GAE1B,MAAM,0CAA0C,CAAA;AACjD,OAAO,KAAK,iBAAiB,MAAM,wCAAwC,CAAA;AAC3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAA;AACjF,OAAO,EACL,oBAAoB,GAErB,MAAM,yCAAyC,CAAA;AAChD,mFAAmF;AACnF,yFAAyF;AACzF,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAA;AAE5E,OAAO,EACL,4BAA4B,GAO7B,MAAM,wDAAwD,CAAA;AAK/D,gFAAgF;AAChF,2FAA2F;AAC3F,qFAAqF;AACrF,sFAAsF;AACtF,qFAAqF;AACrF,OAAO,EACL,0BAA0B,EAC1B,iCAAiC,EACjC,0BAA0B,EAC1B,4BAA4B,GAI7B,MAAM,gDAAgD,CAAA;AACvD,OAAO,EACL,mBAAmB,GAGpB,MAAM,+CAA+C,CAAA;AACtD,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAE7B,MAAM,iDAAiD,CAAA;AACxD,OAAO,EACL,6BAA6B,GAE9B,MAAM,yDAAyD,CAAA;AAChE,OAAO,EAEL,8BAA8B,GAK/B,MAAM,0DAA0D,CAAA;AACjE,OAAO,EACL,0BAA0B,GAE3B,MAAM,sDAAsD,CAAA;AAC7D,OAAO,KAAK,iBAAiB,MAAM,8CAA8C,CAAA;AACjF,yFAAyF;AACzF,+EAA+E;AAC/E,OAAO,EAEL,qBAAqB,EACrB,cAAc,EACd,SAAS,GACV,MAAM,gCAAgC,CAAA;AACvC,mFAAmF;AACnF,6EAA6E;AAC7E,OAAO,EACL,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,mDAAmD,CAAA;AAC1D,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,8CAA8C,CAAA;AAErD,OAAO,EACL,2BAA2B,GAG5B,MAAM,kDAAkD,CAAA;AACzD,OAAO,KAAK,YAAY,MAAM,oCAAoC,CAAA;AAClE,mFAAmF;AACnF,0FAA0F;AAC1F,gFAAgF;AAChF,sFAAsF;AACtF,qFAAqF;AACrF,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,qBAAqB,EACrB,uBAAuB,GAGxB,MAAM,sCAAsC,CAAA;AAC7C,4FAA4F;AAC5F,iGAAiG;AACjG,OAAO,EAAE,uBAAuB,EAA0B,MAAM,iCAAiC,CAAA;AACjG,wEAAwE;AACxE,iFAAiF;AACjF,uFAAuF;AACvF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,GAEnB,MAAM,6CAA6C,CAAA;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAA;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,mDAAmD,CAAA;AAC7F,OAAO,EACL,mBAAmB,GAGpB,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,6BAA6B,GAE9B,MAAM,uDAAuD,CAAA;AAC9D,OAAO,KAAK,eAAe,MAAM,0CAA0C,CAAA;AAC3E,OAAO,KAAK,0BAA0B,MAAM,sDAAsD,CAAA;AAClG,4FAA4F;AAC5F,6FAA6F;AAC7F,4FAA4F;AAC5F,2FAA2F;AAC3F,gGAAgG;AAChG,qDAAqD;AACrD,OAAO,EACL,0BAA0B,GAE3B,MAAM,iDAAiD,CAAA;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAA;AAC5F,OAAO,EAIN,MAAM,gDAAgD,CAAA;AACvD,OAAO,KAAK,uBAAuB,MAAM,gDAAgD,CAAA;AACzF,qGAAqG;AACrG,OAAO,EACL,kBAAkB,GAEnB,MAAM,6CAA6C,CAAA;AACpD,+FAA+F;AAC/F,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,yCAAyC,CAAA;AAChD,mFAAmF;AACnF,qFAAqF;AACrF,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,0BAA0B,GAI3B,MAAM,uDAAuD,CAAA;AAC9D,OAAO,EACL,sBAAsB,GAEvB,MAAM,uDAAuD,CAAA;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAA;AAErE,0FAA0F;AAC1F,2FAA2F;AAC3F,2FAA2F;AAC3F,iFAAiF;AACjF,OAAO,EACL,0BAA0B,GAE3B,MAAM,6DAA6D,CAAA;AACpE,OAAO,EACL,0BAA0B,GAE3B,MAAM,6DAA6D,CAAA;AACpE,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,mDAAmD,CAAA;AAC1D,OAAO,EACL,gCAAgC,EAChC,+BAA+B,GAEhC,MAAM,0CAA0C,CAAA;AACjD,OAAO,EAAE,gCAAgC,EAAE,MAAM,6CAA6C,CAAA;AAE9F,6FAA6F;AAC7F,gGAAgG;AAChG,gGAAgG;AAChG,OAAO,EAAE,mBAAmB,EAA8B,MAAM,+BAA+B,CAAA;AAE/F,kFAAkF;AAClF,mFAAmF;AACnF,qFAAqF;AACrF,OAAO,EACL,wBAAwB,GAEzB,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,sBAAsB,GAEvB,MAAM,2CAA2C,CAAA;AAClD,OAAO,EACL,oBAAoB,GAErB,MAAM,yCAAyC,CAAA;AAChD,OAAO,EACL,yBAAyB,GAE1B,MAAM,8CAA8C,CAAA;AACrD,OAAO,EACL,cAAc,EACd,aAAa,GAId,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,UAAU,MAAM,gCAAgC,CAAA;AAC5D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,YAAY,GACb,MAAM,gCAAgC,CAAA;AACvC,OAAO,EACL,2BAA2B,GAI5B,MAAM,oDAAoD,CAAA;AAC3D,OAAO,EACL,aAAa,GAKd,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,mBAAmB,EACnB,cAAc,GAIf,MAAM,4CAA4C,CAAA;AACnD,OAAO,EACL,2BAA2B,EAG3B,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,oDAAoD,CAAA;AAC3D,OAAO,EACL,yBAAyB,GAG1B,MAAM,kDAAkD,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAA;AAC5F,OAAO,EACL,iBAAiB,GAElB,MAAM,0CAA0C,CAAA;AACjD,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,uBAAuB,GAGxB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,wBAAwB,EAExB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,iDAAiD,CAAA;AACxD,OAAO,KAAK,cAAc,MAAM,wCAAwC,CAAA;AACxE,OAAO,EACL,uBAAuB,EACvB,WAAW,EACX,WAAW,GAEZ,MAAM,wCAAwC,CAAA;AAE/C,uFAAuF;AACvF,0FAA0F;AAC1F,yFAAyF;AACzF,uDAAuD;AACvD,OAAO,EACL,6BAA6B,GAI9B,MAAM,0DAA0D,CAAA;AACjE,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,2BAA2B,GAE5B,MAAM,kDAAkD,CAAA;AACzD,OAAO,EACL,aAAa,GAGd,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,oBAAoB,EACpB,cAAc,GACf,MAAM,oCAAoC,CAAA;AAE3C,sFAAsF;AACtF,uFAAuF;AACvF,wFAAwF;AACxF,kDAAkD;AAClD,OAAO,EACL,iCAAiC,GAKlC,MAAM,kEAAkE,CAAA;AACzE,OAAO,EAAE,gCAAgC,EAAE,MAAM,yCAAyC,CAAA;AAC1F,OAAO,EACL,2BAA2B,GAE5B,MAAM,oDAAoD,CAAA;AAC3D,OAAO,EACL,4BAA4B,GAE7B,MAAM,sDAAsD,CAAA;AAC7D,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAEhC,MAAM,qEAAqE,CAAA;AAC5E,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAG7B,MAAM,qDAAqD,CAAA;AAC5D,OAAO,EACL,kBAAkB,EAClB,wBAAwB,GAEzB,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,oBAAoB,GAErB,MAAM,iDAAiD,CAAA;AAExD,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,GAIlB,MAAM,6BAA6B,CAAA;AACpC,OAAO,EACL,sBAAsB,GAGvB,MAAM,2CAA2C,CAAA"}

package/dist/modules/environments/environments.logic.d.ts CHANGED Viewed

@@ -34,8 +34,12 @@ export declare function shouldTeardownSuperseded(prior: EnvironmentIdentity, nex
  * (STRICT_URL_SAFETY_POLICY) requires `https` and rejects internal/private hosts; a
  * trusted operator-installed adapter can pass a widened policy to permit specific
  * schemes/hosts (e.g. an internal env platform on a private/VPN host). Embedded
- * credentials are forbidden regardless of policy. Parsed by hand (no `URL` global) so
- * this stays in the platform-agnostic core.
+ * credentials are forbidden regardless of policy.
+ *
+ * The environment-labelled face of the SHARED {@link assertSafePublicUrl} guard, which the
+ * runner-pool and notification-webhook integrations also front with their own wording. Only the
+ * message differs — the host/scheme rules are one implementation, so an SSRF bypass is fixed once
+ * rather than per integration.
  */
 export declare function assertSafeEnvironmentUrl(url: string, label?: string, policy?: UrlSafetyPolicy): void;
 /** Validate every URL a manifest will fetch (defence against SSRF). */

package/dist/modules/environments/environments.logic.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"environments.logic.d.ts","sourceRoot":"","sources":["../../../src/modules/environments/environments.logic.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;~~AAe7E~~,+DAA+D;AAC/D,eAAO,MAAM,mBAAmB,aAAa,CAAA;AAC7C,uFAAuF;AACvF,eAAO,MAAM,sBAAsB,gBAAgB,CAAA;AAEnD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED,mGAAmG;AACnG,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,qGAAqG;IACrG,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,mBAAmB,GAAG,IAAI,GAC/B,OAAO,CAOT;~~AAeD;;;;;;;GAOG~~;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,EACX,KAAK,SAAQ,EACb,MAAM,GAAE,eAA0C,GACjD,IAAI,~~CAyBN~~;AAED,uEAAuE;AACvE,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,mBAAmB,EAC7B,MAAM,EAAE,eAAe,GACtB,IAAI,CAKN;AAED,oEAAoE;AACpE,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,MAAM,EAAE,CAe5E;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAC1C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAQpC;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAEhF;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,mBAAmB,EAAE,EAC7B,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,GAC3B,MAAM,EAAE,CAKV;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,MAAM,GAAE,eAA0C,EAClD,SAAS,SAAS,GACjB,OAAO,CAAC,oBAAoB,CAAC,CAqB/B;AAED,yEAAyE;AACzE,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAClC;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,MAAM,CAWvF;AAED,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CASlE;AAED,uEAAuE;AACvE,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOzF;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,SAAS,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,iBAAiB,CAAA;CAAE,EAAE,GAAG,SAAS,EAChE,QAAQ,EAAE,iBAAiB,GAC1B,iBAAiB,CAMnB;AAED,sFAAsF;AACtF,wBAAgB,cAAc,CAC5B,MAAM,EAAE,iBAAiB,EACzB,MAAM,CAAC,EAAE,uBAAuB,GAAG,IAAI,GACtC,iBAAiB,CAkBnB;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAU7D"}
1	+ {"version":3,"file":"environments.logic.d.ts","sourceRoot":"","sources":["../../../src/modules/environments/environments.logic.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAW7E,+DAA+D;AAC/D,eAAO,MAAM,mBAAmB,aAAa,CAAA;AAC7C,uFAAuF;AACvF,eAAO,MAAM,sBAAsB,gBAAgB,CAAA;AAEnD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED,mGAAmG;AACnG,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,qGAAqG;IACrG,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,mBAAmB,GAAG,IAAI,GAC/B,OAAO,CAOT;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,EACX,KAAK,SAAQ,EACb,MAAM,GAAE,eAA0C,GACjD,IAAI,CAEN;AAED,uEAAuE;AACvE,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,mBAAmB,EAC7B,MAAM,EAAE,eAAe,GACtB,IAAI,CAKN;AAED,oEAAoE;AACpE,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,MAAM,EAAE,CAe5E;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAC1C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAQpC;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAEhF;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,mBAAmB,EAAE,EAC7B,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,GAC3B,MAAM,EAAE,CAKV;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,MAAM,GAAE,eAA0C,EAClD,SAAS,SAAS,GACjB,OAAO,CAAC,oBAAoB,CAAC,CAqB/B;AAED,yEAAyE;AACzE,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAClC;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,MAAM,CAWvF;AAED,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CASlE;AAED,uEAAuE;AACvE,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOzF;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,SAAS,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,iBAAiB,CAAA;CAAE,EAAE,GAAG,SAAS,EAChE,QAAQ,EAAE,iBAAiB,GAC1B,iBAAiB,CAMnB;AAED,sFAAsF;AACtF,wBAAgB,cAAc,CAC5B,MAAM,EAAE,iBAAiB,EACzB,MAAM,CAAC,EAAE,uBAAuB,GAAG,IAAI,GACtC,iBAAiB,CAkBnB;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAU7D"}

package/dist/modules/environments/environments.logic.js CHANGED Viewed

@@ -1,5 +1,6 @@
-import { getErrorMessage, isBlockedPrivateHost, STRICT_URL_SAFETY_POLICY, ValidationError, } from '@cat-factory/kernel';
+import { getErrorMessage, STRICT_URL_SAFETY_POLICY } from '@cat-factory/kernel';
 import { safeFetch } from '../shared/safe-fetch.js';
+import { assertSafePublicUrl } from '../shared/url-guard.js';
 // Pure helpers for the ephemeral-environment integration: SSRF validation of the
 // URLs we fetch/expose, `{{var}}` interpolation over a bounded scope, dot-path
 // extraction from an arbitrary self-rolled response, status mapping and expiry
@@ -41,54 +42,20 @@ export function shouldTeardownSuperseded(prior, next) {
         return true;
     return false;
 }
-/**
- * Whether `host` is exempt from the private/internal-host block under `policy`.
- * An allow-list entry matches the hostname case-insensitively, either exactly or as a
- * dot suffix when it begins with `.` (`.internal` matches `a.b.internal`).
- */
-function hostExempt(host, policy) {
-    const h = host.toLowerCase().replace(/^\[|\]$/g, '');
-    return policy.allowHosts.some((entry) => {
-        const e = entry.toLowerCase();
-        return e.startsWith('.') ? h === e.slice(1) || h.endsWith(e) : h === e;
-    });
-}
 /**
  * Validate a URL before it is stored, fetched, or exposed. The default policy
  * (STRICT_URL_SAFETY_POLICY) requires `https` and rejects internal/private hosts; a
  * trusted operator-installed adapter can pass a widened policy to permit specific
  * schemes/hosts (e.g. an internal env platform on a private/VPN host). Embedded
- * credentials are forbidden regardless of policy. Parsed by hand (no `URL` global) so
- * this stays in the platform-agnostic core.
+ * credentials are forbidden regardless of policy.
+ *
+ * The environment-labelled face of the SHARED {@link assertSafePublicUrl} guard, which the
+ * runner-pool and notification-webhook integrations also front with their own wording. Only the
+ * message differs — the host/scheme rules are one implementation, so an SSRF bypass is fixed once
+ * rather than per integration.
  */
 export function assertSafeEnvironmentUrl(url, label = 'URL', policy = STRICT_URL_SAFETY_POLICY) {
-    const invalid = () => new ValidationError(`Environment ${label} is not a valid URL: '${url}'`);
-    const match = url.match(/^([a-zA-Z][a-zA-Z0-9+.-]*):\/\/([^/?#]*)/);
-    if (!match)
-        throw invalid();
-    if (!policy.schemes.includes(match[1].toLowerCase())) {
-        const allowed = policy.schemes.join('/') || '(none)';
-        throw new ValidationError(`Environment ${label} must use ${allowed}`);
-    }
-    const authority = match[2];
-    if (authority.includes('@')) {
-        throw new ValidationError(`Environment ${label} must not contain credentials`);
-    }
-    let host;
-    if (authority.startsWith('[')) {
-        const end = authority.indexOf(']');
-        if (end === -1)
-            throw invalid();
-        host = authority.slice(1, end);
-    }
-    else {
-        host = authority.split(':')[0];
-    }
-    if (host === '')
-        throw invalid();
-    if (!hostExempt(host, policy) && isBlockedPrivateHost(host)) {
-        throw new ValidationError(`Environment ${label} must be a public host`);
-    }
+    assertSafePublicUrl(url, { subject: 'Environment', label, policy });
 }
 /** Validate every URL a manifest will fetch (defence against SSRF). */
 export function assertManifestUrlsSafe(manifest, policy) {

package/dist/modules/environments/environments.logic.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"environments.logic.js","sourceRoot":"","sources":["../../../src/modules/environments/environments.logic.ts"],"names":[],"mappings":"AASA,OAAO,~~EACL~~,eAAe,~~EACf~~,~~oBAAoB,EACpB,~~wBAAwB,~~EACxB~~,~~eAAe,GAChB,~~MAAM,qBAAqB,CAAA;~~AAC5B~~,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;~~AAEnD~~,iFAAiF;AACjF,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,0CAA0C;AAE1C,+DAA+D;AAC/D,MAAM,CAAC,MAAM,mBAAmB,GAAG,UAAU,CAAA;AAC7C,uFAAuF;AACvF,MAAM,CAAC,MAAM,sBAAsB,GAAG,aAAa,CAAA;AAEnD;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,OAAO,SAAS,KAAK,mBAAmB,CAAA;AAC1C,CAAC;AAUD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAA0B,EAC1B,IAAgC;IAEhC,IAAI,CAAC,KAAK,CAAC,UAAU;QAAE,OAAO,KAAK,CAAA;IACnC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9B,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAA;IAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAC7C,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QAAE,OAAO,IAAI,CAAA;IAChF,OAAO,KAAK,CAAA;AACd,CAAC;AAED~~;;;;GAIG~~;AACH,~~SAAS,UAAU,CAAC,IAAY,EAAE,MAAuB;IACvD,~~MAAM,~~CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,~~UAAU,EAAE,EAAE,CAAC,CAAA;IACpD,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QACtC,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;QAC7B,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IACxE,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAW,EACX,KAAK,GAAG,KAAK,EACb,MAAM,GAAoB,wBAAwB;IAElD,~~MAAM~~,~~OAAO~~,GAAG,~~GAAG,~~EAAE,~~CAAC,IAAI,eAAe,CAAC,eAAe,KAAK,yBAAyB,GAAG,GAAG,CAAC,CAAA;IAC9F,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAA;IACnE,IAAI,CAAC,KAAK;QAAE,MAAM,OAAO,~~EAAE,~~CAAA;IAE3B,IAAI,CAAC,MAAM,CAAC,~~OAAO,~~CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,~~EAAE,~~CAAC,EAAE,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAA;QACpD,MAAM,IAAI,eAAe,CAAC,eAAe,KAAK,~~aAAa,~~OAAO,~~EAAE,~~CAAC,CAAA;IACvE,CAAC;IACD,MAAM,SAAS,GAAG,~~KAAK,~~CAAC,CAAC,CAAE,CAAA;IAC3B,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,~~EAAE,~~CAAC;QAC5B,~~MAAM,~~IAAI,eAAe,CAAC,eAAe,KAAK,+BAA+B,CAAC,CAAA;IAChF,CAAC;IACD,IAAI,IAAY,CAAA;IAChB,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,~~EAAE,CAAC~~;QAC9B~~,~~MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,~~CAAA;~~QAClC~~,~~IAAI,GAAG,KAAK,~~CAAC~~,CAAC~~;YAAE,MAAM,OAAO,EAAE,CAAA;QAC/B,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAChC,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAA;IACjC,CAAC;IACD,IAAI,IAAI,KAAK,EAAE;QAAE,MAAM,OAAO,EAAE,CAAA;IAChC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,eAAe,CAAC,eAAe,KAAK,wBAAwB,CAAC,CAAA;IACzE,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,sBAAsB,CACpC,QAA6B,EAC7B,MAAuB;IAEvB,wBAAwB,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;IAC9D,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,2BAA2B,EAAE,CAAC;QACvD,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAA;IAC7E,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,oBAAoB,CAAC,QAA6B;IAChE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;IAC1B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,MAAM;YACT,OAAO,EAAE,CAAA;QACX,KAAK,SAAS,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QAC7B,KAAK,OAAO;YACV,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAA;QACjE,KAAK,2BAA2B;YAC9B,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAA;QACrE,KAAK,gBAAgB;YACnB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IACnD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAA2C;IAE3C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC7B,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;QACrC,CAAC;QACD,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;KACpE,CAAC,CACH,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAc;IACvD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;AAC/E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAA6B,EAC7B,UAA4B;IAE5B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAA;IACnC,OAAO,MAAM;SACV,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;SACpF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAe,EACf,OAA+B,EAC/B,MAAM,GAAoB,wBAAwB,EAClD,SAAS,GAAG,MAAM;IAElB,IAAI,CAAC;QACH,iFAAiF;QACjF,gFAAgF;QAChF,MAAM,GAAG,GAAG,MAAM,SAAS,CACzB,OAAO,EACP;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE;YACnD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,EACtD,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,GAAG,OAAO,UAAU,MAAM,GAAG,CAAC,CAC9D,CAAA;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,8BAA8B,GAAG,CAAC,MAAM,GAAG,EAAE,CAAA;QAC5E,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAA;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,CAAA;IACrD,CAAC;AACH,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,KAAyB;IAC7E,OAAO,QAAQ,CAAC,OAAO,CAAC,iCAAiC,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE;QAClF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,OAAO,EAAE,CAAA;QACzB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;QAC/B,MAAM,GAAG,GAAG,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;QAC3F,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAA;QACnB,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;QACtB,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAA;IACzC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,IAAa,EAAE,IAAY;IACvD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAA;IAC3B,IAAI,OAAO,GAAY,IAAI,CAAA;IAC3B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAC/D,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QACjD,OAAO,GAAI,OAAmC,CAAC,OAAO,CAAC,CAAA;IACzD,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,aAAa,CAAC,IAAa,EAAE,IAAwB;IACnE,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAA;IAC3B,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACvC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IACjF,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CACvB,GAAuB,EACvB,SAAgE,EAChE,QAA2B;IAE3B,IAAI,GAAG,KAAK,SAAS,IAAI,SAAS,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;QAC7E,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC,EAAE,CAAA;IACxB,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,cAAc,CAC5B,MAAyB,EACzB,MAAuC;IAEvC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,aAAa,EAAE,MAAM,CAAC,aAAmD;QACzE,MAAM,EAAE,MAAM,CAAC,MAAqC;KACrD,CAAA;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACrE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;QAC5B,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAA;IAC1C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}
1	+ {"version":3,"file":"environments.logic.js","sourceRoot":"","sources":["../../../src/modules/environments/environments.logic.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AAE5D,iFAAiF;AACjF,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,0CAA0C;AAE1C,+DAA+D;AAC/D,MAAM,CAAC,MAAM,mBAAmB,GAAG,UAAU,CAAA;AAC7C,uFAAuF;AACvF,MAAM,CAAC,MAAM,sBAAsB,GAAG,aAAa,CAAA;AAEnD;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,OAAO,SAAS,KAAK,mBAAmB,CAAA;AAC1C,CAAC;AAUD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAA0B,EAC1B,IAAgC;IAEhC,IAAI,CAAC,KAAK,CAAC,UAAU;QAAE,OAAO,KAAK,CAAA;IACnC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9B,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAA;IAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAC7C,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QAAE,OAAO,IAAI,CAAA;IAChF,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAW,EACX,KAAK,GAAG,KAAK,EACb,MAAM,GAAoB,wBAAwB;IAElD,mBAAmB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;AACrE,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,sBAAsB,CACpC,QAA6B,EAC7B,MAAuB;IAEvB,wBAAwB,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;IAC9D,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,2BAA2B,EAAE,CAAC;QACvD,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAA;IAC7E,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,oBAAoB,CAAC,QAA6B;IAChE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;IAC1B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,MAAM;YACT,OAAO,EAAE,CAAA;QACX,KAAK,SAAS,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QAC7B,KAAK,OAAO;YACV,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAA;QACjE,KAAK,2BAA2B;YAC9B,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAA;QACrE,KAAK,gBAAgB;YACnB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IACnD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAA2C;IAE3C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC7B,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;QACrC,CAAC;QACD,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;KACpE,CAAC,CACH,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAc;IACvD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;AAC/E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAA6B,EAC7B,UAA4B;IAE5B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAA;IACnC,OAAO,MAAM;SACV,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;SACpF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAe,EACf,OAA+B,EAC/B,MAAM,GAAoB,wBAAwB,EAClD,SAAS,GAAG,MAAM;IAElB,IAAI,CAAC;QACH,iFAAiF;QACjF,gFAAgF;QAChF,MAAM,GAAG,GAAG,MAAM,SAAS,CACzB,OAAO,EACP;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE;YACnD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,EACtD,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,GAAG,OAAO,UAAU,MAAM,GAAG,CAAC,CAC9D,CAAA;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,8BAA8B,GAAG,CAAC,MAAM,GAAG,EAAE,CAAA;QAC5E,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAA;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,CAAA;IACrD,CAAC;AACH,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,KAAyB;IAC7E,OAAO,QAAQ,CAAC,OAAO,CAAC,iCAAiC,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE;QAClF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,OAAO,EAAE,CAAA;QACzB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;QAC/B,MAAM,GAAG,GAAG,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;QAC3F,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAA;QACnB,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;QACtB,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAA;IACzC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,IAAa,EAAE,IAAY;IACvD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAA;IAC3B,IAAI,OAAO,GAAY,IAAI,CAAA;IAC3B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAC/D,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QACjD,OAAO,GAAI,OAAmC,CAAC,OAAO,CAAC,CAAA;IACzD,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,aAAa,CAAC,IAAa,EAAE,IAAwB;IACnE,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAA;IAC3B,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACvC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IACjF,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CACvB,GAAuB,EACvB,SAAgE,EAChE,QAA2B;IAE3B,IAAI,GAAG,KAAK,SAAS,IAAI,SAAS,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;QAC7E,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC,EAAE,CAAA;IACxB,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,cAAc,CAC5B,MAAyB,EACzB,MAAuC;IAEvC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,aAAa,EAAE,MAAM,CAAC,aAAmD;QACzE,MAAM,EAAE,MAAM,CAAC,MAAqC;KACrD,CAAA;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACrE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;QAC5B,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAA;IAC1C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/modules/notificationWebhook/NotificationWebhookService.d.ts ADDED Viewed

@@ -0,0 +1,25 @@
+import type { NotificationWebhook, PutNotificationWebhookInput } from '@cat-factory/contracts';
+import type { Clock, NotificationWebhookRepository, SecretCipher, UrlSafetyPolicy } from '@cat-factory/kernel';
+export interface NotificationWebhookServiceDependencies {
+    notificationWebhookRepository: NotificationWebhookRepository;
+    secretCipher: SecretCipher;
+    clock: Clock;
+    /**
+     * The deployment's widened endpoint guard, when configured. Absent ⇒ strict public-https. The
+     * SAME policy the delivery channel re-applies per redirect hop — they come from one builder for
+     * exactly this reason, so an endpoint can never be accepted at write time by a rule the delivery
+     * path would then reject (or, far worse, the reverse).
+     */
+    urlSafetyPolicy?: UrlSafetyPolicy;
+}
+export declare class NotificationWebhookService {
+    private readonly deps;
+    constructor(deps: NotificationWebhookServiceDependencies);
+    /** The workspace's webhook as exposed to clients, or null when none is registered. */
+    get(workspaceId: string): Promise<NotificationWebhook | null>;
+    /** Register or update the workspace's webhook. */
+    put(workspaceId: string, input: PutNotificationWebhookInput): Promise<NotificationWebhook>;
+    /** Remove the workspace's webhook. Idempotent. */
+    remove(workspaceId: string): Promise<void>;
+}
+//# sourceMappingURL=NotificationWebhookService.d.ts.map

package/dist/modules/notificationWebhook/NotificationWebhookService.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"NotificationWebhookService.d.ts","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/NotificationWebhookService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAA;AAC9F,OAAO,KAAK,EACV,KAAK,EAEL,6BAA6B,EAC7B,YAAY,EACZ,eAAe,EAChB,MAAM,qBAAqB,CAAA;AAc5B,MAAM,WAAW,sCAAsC;IACrD,6BAA6B,EAAE,6BAA6B,CAAA;IAC5D,YAAY,EAAE,YAAY,CAAA;IAC1B,KAAK,EAAE,KAAK,CAAA;IACZ;;;;;OAKG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;CAClC;AAED,qBAAa,0BAA0B;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,sCAAsC,EAAI;IAE7E,sFAAsF;IAChF,GAAG,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAGlE;IAED,kDAAkD;IAC5C,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAoB/F;IAED,kDAAkD;IAC5C,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;CACF"}

package/dist/modules/notificationWebhook/NotificationWebhookService.js ADDED Viewed

@@ -0,0 +1,49 @@
+import { assertSafeNotificationWebhookUrl } from './webhookUrl.js';
+export class NotificationWebhookService {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** The workspace's webhook as exposed to clients, or null when none is registered. */
+    async get(workspaceId) {
+        const record = await this.deps.notificationWebhookRepository.get(workspaceId);
+        return record ? toWire(record) : null;
+    }
+    /** Register or update the workspace's webhook. */
+    async put(workspaceId, input) {
+        // Reject a private/internal/metadata endpoint HERE, where an operator sees the error, rather
+        // than leaving it to fail per-delivery later. The wire schema's `https://` prefix check is the
+        // friendly first pass; this is the guard that actually holds (and the same one the delivery
+        // path re-runs on every redirect hop).
+        assertSafeNotificationWebhookUrl(input.url, this.deps.urlSafetyPolicy);
+        const existing = await this.deps.notificationWebhookRepository.get(workspaceId);
+        const record = {
+            workspaceId,
+            url: input.url,
+            types: input.types ?? existing?.types ?? [],
+            enabled: input.enabled ?? existing?.enabled ?? true,
+            // Omitted `secret` keeps the stored one; a supplied one rotates it.
+            secretSealed: input.secret
+                ? await this.deps.secretCipher.encrypt(input.secret)
+                : (existing?.secretSealed ?? null),
+            updatedAt: this.deps.clock.now(),
+        };
+        await this.deps.notificationWebhookRepository.put(record);
+        return toWire(record);
+    }
+    /** Remove the workspace's webhook. Idempotent. */
+    async remove(workspaceId) {
+        await this.deps.notificationWebhookRepository.delete(workspaceId);
+    }
+}
+/** Project the persisted record onto the wire shape — the sealed secret becomes a boolean. */
+function toWire(record) {
+    return {
+        url: record.url,
+        types: record.types,
+        enabled: record.enabled,
+        hasSecret: record.secretSealed != null,
+        updatedAt: record.updatedAt,
+    };
+}
+//# sourceMappingURL=NotificationWebhookService.js.map

package/dist/modules/notificationWebhook/NotificationWebhookService.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"NotificationWebhookService.js","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/NotificationWebhookService.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,gCAAgC,EAAE,MAAM,iBAAiB,CAAA;AA0BlE,MAAM,OAAO,0BAA0B;IACR,IAAI;IAAjC,YAA6B,IAA4C;oBAA5C,IAAI;IAA2C,CAAC;IAE7E,sFAAsF;IACtF,KAAK,CAAC,GAAG,CAAC,WAAmB;QAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC7E,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACvC,CAAC;IAED,kDAAkD;IAClD,KAAK,CAAC,GAAG,CAAC,WAAmB,EAAE,KAAkC;QAC/D,6FAA6F;QAC7F,+FAA+F;QAC/F,4FAA4F;QAC5F,uCAAuC;QACvC,gCAAgC,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QACtE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC/E,MAAM,MAAM,GAA8B;YACxC,WAAW;YACX,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC3C,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,QAAQ,EAAE,OAAO,IAAI,IAAI;YACnD,oEAAoE;YACpE,YAAY,EAAE,KAAK,CAAC,MAAM;gBACxB,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;gBACpD,CAAC,CAAC,CAAC,QAAQ,EAAE,YAAY,IAAI,IAAI,CAAC;YACpC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SACjC,CAAA;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACzD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC;IAED,kDAAkD;IAClD,KAAK,CAAC,MAAM,CAAC,WAAmB;QAC9B,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IACnE,CAAC;CACF;AAED,8FAA8F;AAC9F,SAAS,MAAM,CAAC,MAAiC;IAC/C,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,SAAS,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;QACtC,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAA;AACH,CAAC"}

package/dist/modules/notificationWebhook/WebhookNotificationChannel.d.ts ADDED Viewed

@@ -0,0 +1,39 @@
+import type { Clock, Notification, NotificationChannel, NotificationWebhookRepository, SecretCipher, UrlSafetyPolicy } from '@cat-factory/kernel';
+import { WEBHOOK_SIGNATURE_HEADERS } from './webhookSignature.js';
+export interface WebhookNotificationChannelDependencies {
+    notificationWebhookRepository: NotificationWebhookRepository;
+    secretCipher: SecretCipher;
+    clock: Clock;
+    /** HTTP transport (each runtime exposes a global `fetch`); injectable for tests. */
+    fetchImpl?: typeof fetch;
+    /** Sleep between retries; injectable so tests don't spend real wall-clock on backoff. */
+    sleep?: (ms: number) => Promise<void>;
+    /**
+     * The deployment's widened URL guard for webhook endpoints, when one is configured
+     * (`NOTIFICATION_WEBHOOK_ALLOW_URL_HOSTS` / `_ALLOW_HTTP_URLS`). Absent ⇒ the strict
+     * public-https default: no private/internal hosts, no cloud-metadata endpoint. Resolved from the
+     * webhook's OWN config slice, so widening it cannot widen the runner-pool or environment guard.
+     */
+    urlSafetyPolicy?: UrlSafetyPolicy;
+    /**
+     * Optional observability hook invoked when a delivery ultimately fails. Delivery is best-effort
+     * (a receiver outage must never break the notification lifecycle), but a swallowed failure
+     * should still be diagnosable — the facades wire this to their structured logger, so a broken
+     * endpoint surfaces instead of vanishing. Mirrors `SlackNotificationChannel.onError`.
+     */
+    onError?: (error: unknown, context: {
+        workspaceId: string;
+        notificationId: string;
+        type: string;
+    }) => void;
+}
+export declare class WebhookNotificationChannel implements NotificationChannel {
+    private readonly deps;
+    private readonly fetchImpl;
+    private readonly sleep;
+    constructor(deps: WebhookNotificationChannelDependencies);
+    deliver(workspaceId: string, notification: Notification): Promise<void>;
+    private post;
+}
+export { WEBHOOK_SIGNATURE_HEADERS };
+//# sourceMappingURL=WebhookNotificationChannel.d.ts.map

package/dist/modules/notificationWebhook/WebhookNotificationChannel.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"WebhookNotificationChannel.d.ts","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/WebhookNotificationChannel.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,KAAK,EACL,YAAY,EACZ,mBAAmB,EAGnB,6BAA6B,EAC7B,YAAY,EACZ,eAAe,EAChB,MAAM,qBAAqB,CAAA;AAI5B,OAAO,EAAuB,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAqCtF,MAAM,WAAW,sCAAsC;IACrD,6BAA6B,EAAE,6BAA6B,CAAA;IAC5D,YAAY,EAAE,YAAY,CAAA;IAC1B,KAAK,EAAE,KAAK,CAAA;IACZ,oFAAoF;IACpF,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,yFAAyF;IACzF,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CACR,KAAK,EAAE,OAAO,EACd,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KACnE,IAAI,CAAA;CACV;AAED,qBAAa,0BAA2B,YAAW,mBAAmB;IAIxD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAc;IACxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+B;IAErD,YAA6B,IAAI,EAAE,sCAAsC,EAGxE;IAEK,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAa5E;YAEa,IAAI;CA8EnB;AAmBD,OAAO,EAAE,yBAAyB,EAAE,CAAA"}

package/dist/modules/notificationWebhook/WebhookNotificationChannel.js ADDED Viewed

@@ -0,0 +1,154 @@
+import { DEFAULT_NOTIFICATION_WEBHOOK_TYPES, } from '@cat-factory/contracts';
+import { ValidationError } from '@cat-factory/kernel';
+import { DEFAULT_MAX_REDIRECTS, safeFetch } from '../shared/safe-fetch.js';
+import { assertSafeNotificationWebhookUrl } from './webhookUrl.js';
+import { signWebhookDelivery, WEBHOOK_SIGNATURE_HEADERS } from './webhookSignature.js';
+// WebhookNotificationChannel: an outbound HTTP delivery transport for the existing notification
+// mechanism. It implements the same `NotificationChannel` port as the in-app and Slack channels
+// and is composed alongside them via `CompositeNotificationChannel` — so the engine call sites
+// that raise notifications are untouched.
+//
+// This is the channel a HEADLESS integration needs. A public-API caller has no in-app inbox to
+// watch and no browser to hold a WebSocket open, so without a push it can only learn that its run
+// parked by polling. That matters most for the clarification loop: a parked run waits for a human
+// INDEFINITELY, so "the caller will notice eventually" is not a design (see
+// `docs/initiatives/headless-clarification-loop.md`, D3).
+//
+// Runtime-neutral (fetch + decrypt + one DB read), so it lives here in @cat-factory/integrations
+// and serves BOTH runtime facades unchanged.
+/** How many attempts one delivery gets, and how long to wait between them (exponential). */
+const MAX_ATTEMPTS = 3;
+const BASE_RETRY_MS = 250;
+/** Give up on a single HTTP attempt after this long, so a black-holing endpoint can't hang us. */
+const REQUEST_TIMEOUT_MS = 5000;
+/**
+ * The ceiling on ONE delivery across all of its attempts. This is the number that matters, and it
+ * is not the per-attempt timeout multiplied out: `NotificationService.raise` AWAITS the channel
+ * fan-out, so every millisecond spent here is latency added to the engine step that raises the
+ * notification — the very step that parks a run. Three 5s attempts plus backoff would let a dead
+ * receiver add ~15.8s to a park, which the in-app and Slack channels never do.
+ *
+ * So the retry budget is a WALL-CLOCK deadline, not an attempt count: attempts stop as soon as the
+ * remaining budget is gone, and each attempt's own timeout is clamped to what is left. Delivery is
+ * best-effort by contract, so a receiver too slow to answer inside the budget is treated exactly
+ * like one that failed — logged through `onError`, never propagated.
+ */
+const TOTAL_DELIVERY_BUDGET_MS = 6000;
+export class WebhookNotificationChannel {
+    deps;
+    fetchImpl;
+    sleep;
+    constructor(deps) {
+        this.deps = deps;
+        this.fetchImpl = deps.fetchImpl ?? ((...args) => globalThis.fetch(...args));
+        this.sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    }
+    async deliver(workspaceId, notification) {
+        try {
+            await this.post(workspaceId, notification);
+        }
+        catch (error) {
+            // Best-effort: never let a receiver outage/misconfig break the notification lifecycle
+            // (CompositeNotificationChannel also isolates us, belt-and-braces). Surface it through the
+            // optional observability hook so the failure is diagnosable instead of silently dropped.
+            this.deps.onError?.(error, {
+                workspaceId,
+                notificationId: notification.id,
+                type: notification.type,
+            });
+        }
+    }
+    async post(workspaceId, notification) {
+        const webhook = await this.deps.notificationWebhookRepository.get(workspaceId);
+        if (!webhook || !webhook.enabled)
+            return;
+        if (!deliversType(webhook, notification.type))
+            return;
+        const body = {
+            // Stable per notification-and-status: a retried attempt repeats it, so a receiver dedupes on
+            // it. The status suffix keeps the delivery of a RESOLVED card (channels are re-delivered on
+            // resolve) distinct from the original open one, which is a genuinely different event.
+            deliveryId: `${notification.id}-${notification.status}`,
+            sentAt: this.deps.clock.now(),
+            workspaceId,
+            runId: notification.executionId,
+            taskId: notification.blockId,
+            notification,
+        };
+        const payload = JSON.stringify(body);
+        const headers = {
+            'content-type': 'application/json',
+            'user-agent': 'cat-factory',
+        };
+        if (webhook.secretSealed) {
+            const secret = await this.deps.secretCipher.decrypt(webhook.secretSealed);
+            Object.assign(headers, await signWebhookDelivery(secret, payload, body.sentAt));
+        }
+        // The endpoint is operator-supplied, and the body we are about to POST carries the workspace's
+        // work descriptions signed with a deployment secret. So the URL is re-validated on EVERY
+        // redirect hop through the shared SSRF seam: `startsWith('https://')` at registration only ever
+        // vouched for the FIRST url, and a receiver is free to 302 that to the cloud-metadata endpoint.
+        // `safeFetch` also strips the body and credential headers on a cross-origin hop, so a permitted
+        // host cannot bounce the delivery to a different one.
+        const assertSafe = (u) => assertSafeNotificationWebhookUrl(u, this.deps.urlSafetyPolicy);
+        const deadline = this.deps.clock.now() + TOTAL_DELIVERY_BUDGET_MS;
+        let lastError;
+        for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
+            if (attempt > 0) {
+                // Only back off if there is budget left to use afterwards — sleeping into the deadline
+                // would burn the caller's latency and then not even attempt the retry it paid for.
+                const backoff = BASE_RETRY_MS * 2 ** (attempt - 1);
+                if (this.deps.clock.now() + backoff >= deadline)
+                    break;
+                await this.sleep(backoff);
+            }
+            // Clamp this attempt to whatever is left, so the TOTAL is bounded rather than the per-attempt
+            // timeout multiplied by the attempt count.
+            const remaining = deadline - this.deps.clock.now();
+            if (remaining <= 0)
+                break;
+            try {
+                const response = await safeFetch(webhook.url, {
+                    method: 'POST',
+                    headers,
+                    body: payload,
+                    signal: AbortSignal.timeout(Math.min(REQUEST_TIMEOUT_MS, remaining)),
+                }, assertSafe, makeWebhookError, DEFAULT_MAX_REDIRECTS, this.fetchImpl);
+                if (response.ok)
+                    return;
+                // A 4xx is the receiver saying "this request is wrong" — a bad secret, a rejected shape, a
+                // revoked endpoint. Retrying cannot fix it and only multiplies the load, so give up now
+                // and let the error hook report it. 5xx / network faults are transient: those retry.
+                lastError = new Error(`Webhook endpoint responded ${response.status}`);
+                if (response.status >= 400 && response.status < 500)
+                    break;
+            }
+            catch (error) {
+                // A blocked hop (`assertSafe` threw) is a CONFIGURATION fault, not a transient one:
+                // retrying re-walks the same redirect chain to the same rejected target. Give up and let
+                // the operator see it, exactly as with a 4xx.
+                lastError = error;
+                if (error instanceof ValidationError)
+                    break;
+            }
+        }
+        throw lastError ?? new Error('Webhook delivery failed');
+    }
+}
+/** Builds the redirect/size errors `safeFetch` raises, carrying its status for the log line. */
+function makeWebhookError(status, message) {
+    return new Error(`Webhook delivery failed (${status}): ${message}`);
+}
+/**
+ * Whether a webhook delivers this notification type. An EMPTY filter means the defaults (the
+ * parking + actionable-tail types), NOT everything — registering an endpoint should not silently
+ * fire-hose every operator card at an integration that only wanted to hear about parked decisions.
+ */
+function deliversType(webhook, type) {
+    const types = webhook.types.length
+        ? webhook.types
+        : DEFAULT_NOTIFICATION_WEBHOOK_TYPES;
+    return types.includes(type);
+}
+export { WEBHOOK_SIGNATURE_HEADERS };
+//# sourceMappingURL=WebhookNotificationChannel.js.map

package/dist/modules/notificationWebhook/WebhookNotificationChannel.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"WebhookNotificationChannel.js","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/WebhookNotificationChannel.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kCAAkC,GAEnC,MAAM,wBAAwB,CAAA;AAW/B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAC1E,OAAO,EAAE,gCAAgC,EAAE,MAAM,iBAAiB,CAAA;AAClE,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAEtF,gGAAgG;AAChG,gGAAgG;AAChG,+FAA+F;AAC/F,0CAA0C;AAC1C,EAAE;AACF,+FAA+F;AAC/F,kGAAkG;AAClG,kGAAkG;AAClG,4EAA4E;AAC5E,0DAA0D;AAC1D,EAAE;AACF,iGAAiG;AACjG,6CAA6C;AAE7C,4FAA4F;AAC5F,MAAM,YAAY,GAAG,CAAC,CAAA;AACtB,MAAM,aAAa,GAAG,GAAG,CAAA;AAEzB,kGAAkG;AAClG,MAAM,kBAAkB,GAAG,IAAI,CAAA;AAE/B;;;;;;;;;;;GAWG;AACH,MAAM,wBAAwB,GAAG,IAAI,CAAA;AA6BrC,MAAM,OAAO,0BAA0B;IAIR,IAAI;IAHhB,SAAS,CAAc;IACvB,KAAK,CAA+B;IAErD,YAA6B,IAA4C;oBAA5C,IAAI;QAC/B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAA;QAC3E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;IACxF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,WAAmB,EAAE,YAA0B;QAC3D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sFAAsF;YACtF,2FAA2F;YAC3F,yFAAyF;YACzF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE;gBACzB,WAAW;gBACX,cAAc,EAAE,YAAY,CAAC,EAAE;gBAC/B,IAAI,EAAE,YAAY,CAAC,IAAI;aACxB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,WAAmB,EAAE,YAA0B;QAChE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC9E,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,OAAM;QACxC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC;YAAE,OAAM;QAErD,MAAM,IAAI,GAAgC;YACxC,6FAA6F;YAC7F,4FAA4F;YAC5F,sFAAsF;YACtF,UAAU,EAAE,GAAG,YAAY,CAAC,EAAE,IAAI,YAAY,CAAC,MAAM,EAAE;YACvD,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC7B,WAAW;YACX,KAAK,EAAE,YAAY,CAAC,WAAW;YAC/B,MAAM,EAAE,YAAY,CAAC,OAAO;YAC5B,YAAY;SACb,CAAA;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACpC,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,YAAY,EAAE,aAAa;SAC5B,CAAA;QACD,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;YACzE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;QACjF,CAAC;QAED,+FAA+F;QAC/F,yFAAyF;QACzF,gGAAgG;QAChG,gGAAgG;QAChG,gGAAgG;QAChG,sDAAsD;QACtD,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,gCAAgC,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QAEhG,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,wBAAwB,CAAA;QACjE,IAAI,SAAkB,CAAA;QACtB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,YAAY,EAAE,OAAO,EAAE,EAAE,CAAC;YACxD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAChB,uFAAuF;gBACvF,mFAAmF;gBACnF,MAAM,OAAO,GAAG,aAAa,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAA;gBAClD,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,OAAO,IAAI,QAAQ;oBAAE,MAAK;gBACtD,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAC3B,CAAC;YACD,8FAA8F;YAC9F,2CAA2C;YAC3C,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;YAClD,IAAI,SAAS,IAAI,CAAC;gBAAE,MAAK;YACzB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,OAAO,CAAC,GAAG,EACX;oBACE,MAAM,EAAE,MAAM;oBACd,OAAO;oBACP,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;iBACrE,EACD,UAAU,EACV,gBAAgB,EAChB,qBAAqB,EACrB,IAAI,CAAC,SAAS,CACf,CAAA;gBACD,IAAI,QAAQ,CAAC,EAAE;oBAAE,OAAM;gBACvB,2FAA2F;gBAC3F,wFAAwF;gBACxF,qFAAqF;gBACrF,SAAS,GAAG,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;gBACtE,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG;oBAAE,MAAK;YAC5D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,oFAAoF;gBACpF,yFAAyF;gBACzF,8CAA8C;gBAC9C,SAAS,GAAG,KAAK,CAAA;gBACjB,IAAI,KAAK,YAAY,eAAe;oBAAE,MAAK;YAC7C,CAAC;QACH,CAAC;QACD,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;IACzD,CAAC;CACF;AAED,gGAAgG;AAChG,SAAS,gBAAgB,CAAC,MAAc,EAAE,OAAe;IACvD,OAAO,IAAI,KAAK,CAAC,4BAA4B,MAAM,MAAM,OAAO,EAAE,CAAC,CAAA;AACrE,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,OAAkC,EAAE,IAAsB;IAC9E,MAAM,KAAK,GAAgC,OAAO,CAAC,KAAK,CAAC,MAAM;QAC7D,CAAC,CAAC,OAAO,CAAC,KAAK;QACf,CAAC,CAAC,kCAAkC,CAAA;IACtC,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AAC7B,CAAC;AAED,OAAO,EAAE,yBAAyB,EAAE,CAAA"}

package/dist/modules/notificationWebhook/support.d.ts ADDED Viewed

@@ -0,0 +1,42 @@
+import type { Clock, NotificationWebhookRepository, SecretCipher, UrlSafetyPolicy } from '@cat-factory/kernel';
+import { NotificationWebhookService } from './NotificationWebhookService.js';
+import { WebhookNotificationChannel } from './WebhookNotificationChannel.js';
+/**
+ * HKDF `info` tag the notification-webhook signing secret is sealed under, so it is
+ * cryptographically isolated from every other sealed credential class (Slack tokens, tracker
+ * credentials, package-registry auth) even though they share the deployment master key.
+ */
+export declare const NOTIFICATION_WEBHOOK_CIPHER_INFO = "cat-factory:notification-webhook";
+export interface NotificationWebhookSupportDependencies {
+    notificationWebhookRepository: NotificationWebhookRepository;
+    secretCipher: SecretCipher;
+    clock: Clock;
+    /**
+     * The deployment's widened endpoint guard (its own `NOTIFICATION_WEBHOOK_ALLOW_*` slice), or
+     * absent for the strict public-https default. Handed to BOTH halves from here, so the rule that
+     * admits an endpoint at registration is by construction the rule the delivery path enforces.
+     */
+    urlSafetyPolicy?: UrlSafetyPolicy;
+    fetchImpl?: typeof fetch;
+    /** Structured-logger hook for a delivery that ultimately failed (best-effort ≠ invisible). */
+    onError?: (error: unknown, context: {
+        workspaceId: string;
+        notificationId: string;
+        type: string;
+    }) => void;
+}
+/**
+ * Build BOTH halves of the notification-webhook feature from one dependency set: the management
+ * service (behind the workspace controller) and the delivery channel (composed into the facade's
+ * `CompositeNotificationChannel`).
+ *
+ * They exist as one builder because they MUST read the same rows through the same cipher —
+ * a facade that wired the service against one repository and the channel against another would
+ * present a webhook as configured while delivering nothing, and each facade wiring them
+ * separately is exactly how that drift happens. Both runtimes call this with their own repo.
+ */
+export declare function buildNotificationWebhookSupport(deps: NotificationWebhookSupportDependencies): {
+    service: NotificationWebhookService;
+    channel: WebhookNotificationChannel;
+};
+//# sourceMappingURL=support.d.ts.map

package/dist/modules/notificationWebhook/support.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"support.d.ts","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/support.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EACL,6BAA6B,EAC7B,YAAY,EACZ,eAAe,EAChB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAA;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAA;AAE5E;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,qCAAqC,CAAA;AAElF,MAAM,WAAW,sCAAsC;IACrD,6BAA6B,EAAE,6BAA6B,CAAA;IAC5D,YAAY,EAAE,YAAY,CAAA;IAC1B,KAAK,EAAE,KAAK,CAAA;IACZ;;;;OAIG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,CACR,KAAK,EAAE,OAAO,EACd,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KACnE,IAAI,CAAA;CACV;AAED;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,sCAAsC,GAAG;IAC7F,OAAO,EAAE,0BAA0B,CAAA;IACnC,OAAO,EAAE,0BAA0B,CAAA;CACpC,CAiBA"}

package/dist/modules/notificationWebhook/support.js ADDED Viewed

@@ -0,0 +1,37 @@
+import { NotificationWebhookService } from './NotificationWebhookService.js';
+import { WebhookNotificationChannel } from './WebhookNotificationChannel.js';
+/**
+ * HKDF `info` tag the notification-webhook signing secret is sealed under, so it is
+ * cryptographically isolated from every other sealed credential class (Slack tokens, tracker
+ * credentials, package-registry auth) even though they share the deployment master key.
+ */
+export const NOTIFICATION_WEBHOOK_CIPHER_INFO = 'cat-factory:notification-webhook';
+/**
+ * Build BOTH halves of the notification-webhook feature from one dependency set: the management
+ * service (behind the workspace controller) and the delivery channel (composed into the facade's
+ * `CompositeNotificationChannel`).
+ *
+ * They exist as one builder because they MUST read the same rows through the same cipher —
+ * a facade that wired the service against one repository and the channel against another would
+ * present a webhook as configured while delivering nothing, and each facade wiring them
+ * separately is exactly how that drift happens. Both runtimes call this with their own repo.
+ */
+export function buildNotificationWebhookSupport(deps) {
+    return {
+        service: new NotificationWebhookService({
+            notificationWebhookRepository: deps.notificationWebhookRepository,
+            secretCipher: deps.secretCipher,
+            clock: deps.clock,
+            urlSafetyPolicy: deps.urlSafetyPolicy,
+        }),
+        channel: new WebhookNotificationChannel({
+            notificationWebhookRepository: deps.notificationWebhookRepository,
+            secretCipher: deps.secretCipher,
+            clock: deps.clock,
+            urlSafetyPolicy: deps.urlSafetyPolicy,
+            fetchImpl: deps.fetchImpl,
+            onError: deps.onError,
+        }),
+    };
+}
+//# sourceMappingURL=support.js.map

package/dist/modules/notificationWebhook/support.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"support.js","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/support.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAA;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAA;AAE5E;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,kCAAkC,CAAA;AAoBlF;;;;;;;;;GASG;AACH,MAAM,UAAU,+BAA+B,CAAC,IAA4C;IAI1F,OAAO;QACL,OAAO,EAAE,IAAI,0BAA0B,CAAC;YACtC,6BAA6B,EAAE,IAAI,CAAC,6BAA6B;YACjE,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,eAAe,EAAE,IAAI,CAAC,eAAe;SACtC,CAAC;QACF,OAAO,EAAE,IAAI,0BAA0B,CAAC;YACtC,6BAA6B,EAAE,IAAI,CAAC,6BAA6B;YACjE,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;KACH,CAAA;AACH,CAAC"}

package/dist/modules/notificationWebhook/webhookSignature.d.ts ADDED Viewed

@@ -0,0 +1,17 @@
+/** Header names a receiver reads to verify a delivery. */
+export declare const WEBHOOK_SIGNATURE_HEADERS: {
+    /** Epoch-ms the delivery was produced; part of the signed string (replay window). */
+    readonly timestamp: 'x-cat-factory-timestamp';
+    /** `v1=<hex HMAC-SHA256>` over `<timestamp>.<body>`. */
+    readonly signature: 'x-cat-factory-signature';
+};
+/**
+ * Sign a delivery body, returning the headers to send with it.
+ *
+ * The signed string is `<timestamp>.<body>`, NOT the body alone: binding the timestamp INTO the
+ * MAC is what makes the timestamp header trustworthy, so a receiver can reject a replayed delivery
+ * by rejecting an old timestamp. Signing the body alone would leave the timestamp freely rewritable
+ * by anyone replaying the capture, making the whole replay window decorative.
+ */
+export declare function signWebhookDelivery(secret: string, body: string, timestamp: number): Promise<Record<string, string>>;
+//# sourceMappingURL=webhookSignature.d.ts.map

package/dist/modules/notificationWebhook/webhookSignature.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"webhookSignature.d.ts","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/webhookSignature.ts"],"names":[],"mappings":"AAWA,0DAA0D;AAC1D,eAAO,MAAM,yBAAyB;IACpC,qFAAqF;aACrF,SAAS,EAAE,yBAAyB;IACpC,wDAAwD;aACxD,SAAS,EAAE,yBAAyB;CAC5B,CAAA;AAKV;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAiBjC"}

package/dist/modules/notificationWebhook/webhookSignature.js ADDED Viewed

@@ -0,0 +1,42 @@
+// Detached HMAC signature over an outbound webhook body — the proof a receiver uses to decide that
+// a delivery really came from this deployment and was not replayed or tampered with.
+//
+// NOTE on why this is not the server's `HmacSigner` (`@cat-factory/server` `auth/signing.ts`):
+// that primitive mints self-contained TOKENS (`base64url(payload).base64url(mac)`) whose payload
+// travels inside the signed string, and it is audience-keyed for the session/OAuth/container/ws
+// token classes. A webhook needs the opposite shape — a signature DETACHED from a body the
+// receiver already has — and, decisively, `@cat-factory/server` sits ABOVE this package in the
+// layering, so importing it here would invert the dependency. The construction below is the plain
+// Web Crypto HMAC-SHA256 both use underneath, so it runs unchanged on workerd and Node.
+/** Header names a receiver reads to verify a delivery. */
+export const WEBHOOK_SIGNATURE_HEADERS = {
+    /** Epoch-ms the delivery was produced; part of the signed string (replay window). */
+    timestamp: 'x-cat-factory-timestamp',
+    /** `v1=<hex HMAC-SHA256>` over `<timestamp>.<body>`. */
+    signature: 'x-cat-factory-signature',
+};
+/** The signature scheme version, so the format can change without silently breaking receivers. */
+const SCHEME = 'v1';
+/**
+ * Sign a delivery body, returning the headers to send with it.
+ *
+ * The signed string is `<timestamp>.<body>`, NOT the body alone: binding the timestamp INTO the
+ * MAC is what makes the timestamp header trustworthy, so a receiver can reject a replayed delivery
+ * by rejecting an old timestamp. Signing the body alone would leave the timestamp freely rewritable
+ * by anyone replaying the capture, making the whole replay window decorative.
+ */
+export async function signWebhookDelivery(secret, body, timestamp) {
+    const key = await crypto.subtle.importKey('raw', new TextEncoder().encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const mac = await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(`${timestamp}.${body}`));
+    return {
+        [WEBHOOK_SIGNATURE_HEADERS.timestamp]: String(timestamp),
+        [WEBHOOK_SIGNATURE_HEADERS.signature]: `${SCHEME}=${toHex(new Uint8Array(mac))}`,
+    };
+}
+function toHex(bytes) {
+    let out = '';
+    for (const b of bytes)
+        out += b.toString(16).padStart(2, '0');
+    return out;
+}
+//# sourceMappingURL=webhookSignature.js.map

package/dist/modules/notificationWebhook/webhookSignature.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"webhookSignature.js","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/webhookSignature.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,qFAAqF;AACrF,EAAE;AACF,+FAA+F;AAC/F,iGAAiG;AACjG,gGAAgG;AAChG,2FAA2F;AAC3F,+FAA+F;AAC/F,kGAAkG;AAClG,wFAAwF;AAExF,0DAA0D;AAC1D,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,qFAAqF;IACrF,SAAS,EAAE,yBAAyB;IACpC,wDAAwD;IACxD,SAAS,EAAE,yBAAyB;CAC5B,CAAA;AAEV,kGAAkG;AAClG,MAAM,MAAM,GAAG,IAAI,CAAA;AAEnB;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,IAAY,EACZ,SAAiB;IAEjB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAA;IACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAClC,MAAM,EACN,GAAG,EACH,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,IAAI,EAAE,CAAC,CACjD,CAAA;IACD,OAAO;QACL,CAAC,yBAAyB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC;QACxD,CAAC,yBAAyB,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE;KACjF,CAAA;AACH,CAAC;AAED,SAAS,KAAK,CAAC,KAAiB;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC7D,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/modules/notificationWebhook/webhookUrl.d.ts ADDED Viewed

@@ -0,0 +1,9 @@
+import type { UrlSafetyPolicy } from '@cat-factory/kernel';
+/**
+ * Validate a notification-webhook endpoint. Strict by default — `https` only, no private/internal
+ * or cloud-metadata host — widened only by the deployment's own
+ * `NOTIFICATION_WEBHOOK_ALLOW_URL_HOSTS` / `_ALLOW_HTTP_URLS` slice, which a developer running a
+ * receiver on `localhost` genuinely needs. Throws `ValidationError` (a 400 at the controller).
+ */
+export declare function assertSafeNotificationWebhookUrl(url: string, policy?: UrlSafetyPolicy): void;
+//# sourceMappingURL=webhookUrl.d.ts.map

package/dist/modules/notificationWebhook/webhookUrl.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"webhookUrl.d.ts","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/webhookUrl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAe1D;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,eAAe,GAAG,IAAI,CAM5F"}

package/dist/modules/notificationWebhook/webhookUrl.js ADDED Viewed

@@ -0,0 +1,26 @@
+import { assertSafePublicUrl } from '../shared/url-guard.js';
+// The notification-webhook face of the shared SSRF guard. Applied in BOTH places a URL can enter
+// the system, which is the point:
+//
+//  - the WRITE boundary (`NotificationWebhookService.put`), so a private/internal endpoint is
+//    rejected with a clear message when an operator registers it, not silently at 3am;
+//  - every REDIRECT hop of a delivery (`WebhookNotificationChannel` via `safeFetch`), because the
+//    write-time check only ever vouched for the FIRST URL and a receiver is free to 302 the
+//    delivery — body, signature headers and all — at an internal target.
+//
+// The contract schema's `https://` prefix check is kept as well: it is the friendly wire-level
+// message, whereas this is the guard that actually holds.
+/**
+ * Validate a notification-webhook endpoint. Strict by default — `https` only, no private/internal
+ * or cloud-metadata host — widened only by the deployment's own
+ * `NOTIFICATION_WEBHOOK_ALLOW_URL_HOSTS` / `_ALLOW_HTTP_URLS` slice, which a developer running a
+ * receiver on `localhost` genuinely needs. Throws `ValidationError` (a 400 at the controller).
+ */
+export function assertSafeNotificationWebhookUrl(url, policy) {
+    assertSafePublicUrl(url, {
+        subject: 'Notification webhook',
+        label: 'endpoint',
+        ...(policy ? { policy } : {}),
+    });
+}
+//# sourceMappingURL=webhookUrl.js.map

package/dist/modules/notificationWebhook/webhookUrl.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"webhookUrl.js","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/webhookUrl.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AAE5D,iGAAiG;AACjG,kCAAkC;AAClC,EAAE;AACF,8FAA8F;AAC9F,uFAAuF;AACvF,kGAAkG;AAClG,4FAA4F;AAC5F,yEAAyE;AACzE,EAAE;AACF,+FAA+F;AAC/F,0DAA0D;AAE1D;;;;;GAKG;AACH,MAAM,UAAU,gCAAgC,CAAC,GAAW,EAAE,MAAwB;IACpF,mBAAmB,CAAC,GAAG,EAAE;QACvB,OAAO,EAAE,sBAAsB;QAC/B,KAAK,EAAE,UAAU;QACjB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAC,CAAA;AACJ,CAAC"}

package/dist/modules/publicApi/PublicApiKeyService.d.ts CHANGED Viewed

@@ -16,13 +16,16 @@ export interface PublicApiKeyAuth {
     keyId: string;
     accountId: string;
     workspaceId: string;
-    /** What this key may do (read ⊂ write ⊂ admin) — the public surface gates each route on it. */
+    /**
+     * What this key may do (read ⊂ write ⊂ decide ⊂ admin) — the public surface gates each
+     * route on it.
+     */
     scope: PublicApiScope;
 }
 /**
  * Whether a key that HOLDS `have` satisfies an endpoint that NEEDS `need`. The ladder is
- * inclusive — an `admin` key satisfies a `write` or `read` requirement — so this is a simple
- * rank comparison, the single source of truth for every `/api/v1` scope gate.
+ * inclusive — an `admin` key satisfies a `decide`, `write` or `read` requirement — so this is
+ * a simple rank comparison, the single source of truth for every `/api/v1` scope gate.
  */
 export declare function scopeSatisfies(have: PublicApiScope, need: PublicApiScope): boolean;
 /** The result of issuing a key: the stored record + the one-time raw secret to hand back. */

package/dist/modules/publicApi/PublicApiKeyService.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"PublicApiKeyService.d.ts","sourceRoot":"","sources":["../../../src/modules/publicApi/PublicApiKeyService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EACL,WAAW,EACX,kBAAkB,EAClB,sBAAsB,EACvB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAA;AA0B/E,MAAM,WAAW,+BAA+B;IAC9C,UAAU,EAAE,sBAAsB,CAAA;IAClC;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,KAAK,CAAA;CACb;AAED,iEAAiE;AACjE,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB~~,+FAA+F~~;~~IAC/F~~,KAAK,EAAE,cAAc,CAAA;CACtB;~~AAKD~~;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAElF;AAED,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,kBAAkB,CAAA;IAC1B,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAA;CACf;AAED,qBAAa,mBAAmB;IAGlB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,OAAO,CAAC,cAAc,CAAC,CAAoB;IAE3C,YAA6B,IAAI,EAAE,+BAA+B,EAAI;IAEtE;;;OAGG;IACG,KAAK,CACT,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAClF,KAAK,EAAE,MAAM,EACb,KAAK,GAAE,cAAwB,GAC9B,OAAO,CAAC,kBAAkB,CAAC,CA8B7B;IAED,qEAAqE;IAC/D,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAE7D;IAED,yDAAyD;IACnD,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3D;IAED;;;;;OAKG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAmB/E;IAED;;;;;OAKG;IACG,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAG9C;IAED,OAAO,CAAC,OAAO;YAaD,IAAI;CAQnB"}
1	+ {"version":3,"file":"PublicApiKeyService.d.ts","sourceRoot":"","sources":["../../../src/modules/publicApi/PublicApiKeyService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EACL,WAAW,EACX,kBAAkB,EAClB,sBAAsB,EACvB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAA;AA0B/E,MAAM,WAAW,+BAA+B;IAC9C,UAAU,EAAE,sBAAsB,CAAA;IAClC;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,KAAK,CAAA;CACb;AAED,iEAAiE;AACjE,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,KAAK,EAAE,cAAc,CAAA;CACtB;AAYD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAElF;AAED,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,kBAAkB,CAAA;IAC1B,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAA;CACf;AAED,qBAAa,mBAAmB;IAGlB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,OAAO,CAAC,cAAc,CAAC,CAAoB;IAE3C,YAA6B,IAAI,EAAE,+BAA+B,EAAI;IAEtE;;;OAGG;IACG,KAAK,CACT,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAClF,KAAK,EAAE,MAAM,EACb,KAAK,GAAE,cAAwB,GAC9B,OAAO,CAAC,kBAAkB,CAAC,CA8B7B;IAED,qEAAqE;IAC/D,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAE7D;IAED,yDAAyD;IACnD,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3D;IAED;;;;;OAKG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAmB/E;IAED;;;;;OAKG;IACG,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAG9C;IAED,OAAO,CAAC,OAAO;YAaD,IAAI;CAQnB"}

package/dist/modules/publicApi/PublicApiKeyService.js CHANGED Viewed

@@ -22,12 +22,17 @@ const MAX_KEYS_PER_WORKSPACE = 50;
  * collapses that write amplification.
  */
 const LAST_USED_STAMP_THROTTLE_MS = 60_000;
-/** The scope ladder as a rank, so a `have ≥ need` check is one comparison. */
-const SCOPE_RANK = { read: 0, write: 1, admin: 2 };
+/**
+ * The scope ladder as a rank, so a `have ≥ need` check is one comparison. DERIVED from the
+ * contract's `PUBLIC_API_SCOPES` array order rather than hand-listed, so inserting a rung
+ * (as `decide` was, between `write` and `admin`) cannot leave the wire vocabulary and the
+ * server-side check disagreeing about the ladder.
+ */
+const SCOPE_RANK = Object.fromEntries(PUBLIC_API_SCOPES.map((scope, rank) => [scope, rank]));
 /**
  * Whether a key that HOLDS `have` satisfies an endpoint that NEEDS `need`. The ladder is
- * inclusive — an `admin` key satisfies a `write` or `read` requirement — so this is a simple
- * rank comparison, the single source of truth for every `/api/v1` scope gate.
+ * inclusive — an `admin` key satisfies a `decide`, `write` or `read` requirement — so this is
+ * a simple rank comparison, the single source of truth for every `/api/v1` scope gate.
  */
 export function scopeSatisfies(have, need) {
     return SCOPE_RANK[have] >= SCOPE_RANK[need];

package/dist/modules/publicApi/PublicApiKeyService.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"PublicApiKeyService.js","sourceRoot":"","sources":["../../../src/modules/publicApi/PublicApiKeyService.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAuB,MAAM,wBAAwB,CAAA;AAE/E,wFAAwF;AACxF,0FAA0F;AAC1F,uFAAuF;AACvF,sFAAsF;AACtF,2FAA2F;AAC3F,4FAA4F;AAC5F,EAAE;AACF,0FAA0F;AAC1F,6FAA6F;AAE7F,8CAA8C;AAC9C,MAAM,cAAc,GAAG,UAAU,CAAA;AACjC,qDAAqD;AACrD,MAAM,YAAY,GAAG,EAAE,CAAA;AACvB,kFAAkF;AAClF,MAAM,sBAAsB,GAAG,EAAE,CAAA;AACjC;;;;;GAKG;AACH,MAAM,2BAA2B,GAAG,MAAM,CAAA;~~AAuB1C,8EAA8E~~;~~AAC9E~~,MAAM,UAAU,GAAmC,~~EAAE~~,~~IAAI~~,~~EAAE~~,CAAC,~~EAAE~~,KAAK,EAAE,~~CAAC~~,EAAE,KAAK,EAAE,CAAC,~~EAAE~~,CAAA;~~AAElF~~;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAoB,EAAE,IAAoB;IACvE,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAA;AAC7C,CAAC;AASD,MAAM,OAAO,mBAAmB;IAGD,IAAI;IAFzB,cAAc,CAAqB;IAE3C,YAA6B,IAAqC;oBAArC,IAAI;IAAoC,CAAC;IAEtE;;;OAGG;IACH,KAAK,CAAC,KAAK,CACT,KAAkF,EAClF,KAAa,EACb,KAAK,GAAmB,OAAO;QAE/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QAC1E,IAAI,IAAI,CAAC,MAAM,IAAI,sBAAsB,EAAE,CAAC;YAC1C,MAAM,IAAI,aAAa,CACrB,6CAA6C,sBAAsB,oBAAoB;gBACrF,oCAAoC,CACvC,CAAA;QACH,CAAC;QACD,sFAAsF;QACtF,0FAA0F;QAC1F,6CAA6C;QAC7C,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,aAAa,CAAC,iCAAiC,KAAK,EAAE,CAAC,CAAA;QACnE,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,YAAY,CAAC,CAAA;QACtC,MAAM,MAAM,GAAuB;YACjC,EAAE;YACF,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,KAAK;YACL,KAAK;YACL,UAAU,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YACnC,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;YAC9C,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAChC,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI;SAChB,CAAA;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACtC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,cAAc,GAAG,EAAE,IAAI,MAAM,EAAE,EAAE,CAAA;IAC/D,CAAC;IAED,qEAAqE;IACrE,KAAK,CAAC,IAAI,CAAC,WAAmB;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,WAAW,CAAC,CAAA;IAC1D,CAAC;IAED,yDAAyD;IACzD,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,EAAU;QAC1C,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;IAC3E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,MAA0B;QAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;QAClC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC/D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QACrD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAChD,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAA;QAClE,8FAA8F;QAC9F,gGAAgG;QAChG,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,GAAG,MAAM,CAAC,UAAU,IAAI,2BAA2B,EAAE,CAAC;YACzF,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;QACrD,CAAC;QACD,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,EAAE;YAChB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAA;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QACxD,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,CAAA;IACrD,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAC3C,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAC1C,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,MAAc;QAC/B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAClC,MAAM,EACN,MAAM,IAAI,CAAC,OAAO,EAAE,EACpB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CACjC,CAAA;QACD,OAAO,KAAK,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IACnC,CAAC;CACF;AAED,qFAAqF;AACrF,SAAS,WAAW,CAAC,GAAuB;IAC1C,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAA;IACxD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAChC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;IAClC,OAAO,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AACnD,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC7D,CAAC;AAED,SAAS,KAAK,CAAC,KAAiB;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC7D,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,0FAA0F;AAC1F,SAAS,kBAAkB,CAAC,CAAS,EAAE,CAAS;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACvC,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAC5E,OAAO,IAAI,KAAK,CAAC,CAAA;AACnB,CAAC"}
1	+ {"version":3,"file":"PublicApiKeyService.js","sourceRoot":"","sources":["../../../src/modules/publicApi/PublicApiKeyService.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAuB,MAAM,wBAAwB,CAAA;AAE/E,wFAAwF;AACxF,0FAA0F;AAC1F,uFAAuF;AACvF,sFAAsF;AACtF,2FAA2F;AAC3F,4FAA4F;AAC5F,EAAE;AACF,0FAA0F;AAC1F,6FAA6F;AAE7F,8CAA8C;AAC9C,MAAM,cAAc,GAAG,UAAU,CAAA;AACjC,qDAAqD;AACrD,MAAM,YAAY,GAAG,EAAE,CAAA;AACvB,kFAAkF;AAClF,MAAM,sBAAsB,GAAG,EAAE,CAAA;AACjC;;;;;GAKG;AACH,MAAM,2BAA2B,GAAG,MAAM,CAAA;AA0B1C;;;;;GAKG;AACH,MAAM,UAAU,GAAmC,MAAM,CAAC,WAAW,CACnE,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CACpB,CAAA;AAEnC;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAoB,EAAE,IAAoB;IACvE,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAA;AAC7C,CAAC;AASD,MAAM,OAAO,mBAAmB;IAGD,IAAI;IAFzB,cAAc,CAAqB;IAE3C,YAA6B,IAAqC;oBAArC,IAAI;IAAoC,CAAC;IAEtE;;;OAGG;IACH,KAAK,CAAC,KAAK,CACT,KAAkF,EAClF,KAAa,EACb,KAAK,GAAmB,OAAO;QAE/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QAC1E,IAAI,IAAI,CAAC,MAAM,IAAI,sBAAsB,EAAE,CAAC;YAC1C,MAAM,IAAI,aAAa,CACrB,6CAA6C,sBAAsB,oBAAoB;gBACrF,oCAAoC,CACvC,CAAA;QACH,CAAC;QACD,sFAAsF;QACtF,0FAA0F;QAC1F,6CAA6C;QAC7C,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,aAAa,CAAC,iCAAiC,KAAK,EAAE,CAAC,CAAA;QACnE,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,YAAY,CAAC,CAAA;QACtC,MAAM,MAAM,GAAuB;YACjC,EAAE;YACF,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,KAAK;YACL,KAAK;YACL,UAAU,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YACnC,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;YAC9C,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAChC,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI;SAChB,CAAA;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACtC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,cAAc,GAAG,EAAE,IAAI,MAAM,EAAE,EAAE,CAAA;IAC/D,CAAC;IAED,qEAAqE;IACrE,KAAK,CAAC,IAAI,CAAC,WAAmB;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,WAAW,CAAC,CAAA;IAC1D,CAAC;IAED,yDAAyD;IACzD,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,EAAU;QAC1C,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;IAC3E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,MAA0B;QAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;QAClC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC/D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QACrD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAChD,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAA;QAClE,8FAA8F;QAC9F,gGAAgG;QAChG,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,GAAG,MAAM,CAAC,UAAU,IAAI,2BAA2B,EAAE,CAAC;YACzF,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;QACrD,CAAC;QACD,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,EAAE;YAChB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAA;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QACxD,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,CAAA;IACrD,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAC3C,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAC1C,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,MAAc;QAC/B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAClC,MAAM,EACN,MAAM,IAAI,CAAC,OAAO,EAAE,EACpB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CACjC,CAAA;QACD,OAAO,KAAK,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IACnC,CAAC;CACF;AAED,qFAAqF;AACrF,SAAS,WAAW,CAAC,GAAuB;IAC1C,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAA;IACxD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAChC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;IAClC,OAAO,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AACnD,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC7D,CAAC;AAED,SAAS,KAAK,CAAC,KAAiB;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC7D,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,0FAA0F;AAC1F,SAAS,kBAAkB,CAAC,CAAS,EAAE,CAAS;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACvC,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAC5E,OAAO,IAAI,KAAK,CAAC,CAAA;AACnB,CAAC"}

package/dist/modules/shared/url-guard.d.ts ADDED Viewed

@@ -0,0 +1,24 @@
+import type { UrlSafetyPolicy } from '@cat-factory/kernel';
+/** Per-call wording + policy for {@link assertSafePublicUrl}. */
+export interface PublicUrlGuardOptions {
+    /** What owns the URL, capitalised for the message ('Environment', 'Notification webhook'). */
+    subject: string;
+    /** Which URL of that subject ('base URL', 'endpoint', 'OAuth token URL'). */
+    label?: string;
+    /**
+     * The widened policy, when the deployment configured one. Defaults to
+     * {@link STRICT_URL_SAFETY_POLICY} — `https` only, no private/internal hosts.
+     */
+    policy?: UrlSafetyPolicy;
+}
+/**
+ * Validate a URL before it is stored or fetched. The default policy requires `https` and rejects
+ * internal/private hosts (loopback, RFC1918, the link-local range including the 169.254.169.254
+ * cloud-metadata endpoint); a trusted operator-installed integration can pass a widened policy to
+ * permit specific schemes/hosts. Embedded credentials are forbidden regardless of policy.
+ *
+ * Parsed by hand (no `URL` global) so this stays in the platform-agnostic core and behaves
+ * identically on workerd and Node.
+ */
+export declare function assertSafePublicUrl(url: string, options: PublicUrlGuardOptions): void;
+//# sourceMappingURL=url-guard.d.ts.map

package/dist/modules/shared/url-guard.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"url-guard.d.ts","sourceRoot":"","sources":["../../../src/modules/shared/url-guard.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAa1D,iEAAiE;AACjE,MAAM,WAAW,qBAAqB;IACpC,8FAA8F;IAC9F,OAAO,EAAE,MAAM,CAAA;IACf,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,eAAe,CAAA;CACzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,IAAI,CA0BrF"}

package/dist/modules/shared/url-guard.js ADDED Viewed

@@ -0,0 +1,53 @@
+import { isBlockedPrivateHost, STRICT_URL_SAFETY_POLICY, ValidationError, } from '@cat-factory/kernel';
+/**
+ * Validate a URL before it is stored or fetched. The default policy requires `https` and rejects
+ * internal/private hosts (loopback, RFC1918, the link-local range including the 169.254.169.254
+ * cloud-metadata endpoint); a trusted operator-installed integration can pass a widened policy to
+ * permit specific schemes/hosts. Embedded credentials are forbidden regardless of policy.
+ *
+ * Parsed by hand (no `URL` global) so this stays in the platform-agnostic core and behaves
+ * identically on workerd and Node.
+ */
+export function assertSafePublicUrl(url, options) {
+    const { subject, label = 'URL', policy = STRICT_URL_SAFETY_POLICY } = options;
+    const invalid = () => new ValidationError(`${subject} ${label} is not a valid URL: '${url}'`);
+    const match = url.match(/^([a-zA-Z][a-zA-Z0-9+.-]*):\/\/([^/?#]*)/);
+    if (!match)
+        throw invalid();
+    if (!policy.schemes.includes(match[1].toLowerCase())) {
+        const allowed = policy.schemes.join('/') || '(none)';
+        throw new ValidationError(`${subject} ${label} must use ${allowed}`);
+    }
+    const authority = match[2];
+    if (authority.includes('@')) {
+        throw new ValidationError(`${subject} ${label} must not contain credentials`);
+    }
+    let host;
+    if (authority.startsWith('[')) {
+        const end = authority.indexOf(']');
+        if (end === -1)
+            throw invalid();
+        host = authority.slice(1, end);
+    }
+    else {
+        host = authority.split(':')[0];
+    }
+    if (host === '')
+        throw invalid();
+    if (!hostExempt(host, policy) && isBlockedPrivateHost(host)) {
+        throw new ValidationError(`${subject} ${label} must be a public host`);
+    }
+}
+/**
+ * Whether `host` is exempt from the private/internal-host block under `policy`.
+ * An allow-list entry matches the hostname case-insensitively, either exactly or as a
+ * dot suffix when it begins with `.` (`.internal` matches `a.b.internal`).
+ */
+function hostExempt(host, policy) {
+    const h = host.toLowerCase().replace(/^\[|\]$/g, '');
+    return policy.allowHosts.some((entry) => {
+        const e = entry.toLowerCase();
+        return e.startsWith('.') ? h === e.slice(1) || h.endsWith(e) : h === e;
+    });
+}
+//# sourceMappingURL=url-guard.js.map

package/dist/modules/shared/url-guard.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"url-guard.js","sourceRoot":"","sources":["../../../src/modules/shared/url-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,eAAe,GAChB,MAAM,qBAAqB,CAAA;AA2B5B;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,OAA8B;IAC7E,MAAM,EAAE,OAAO,EAAE,KAAK,GAAG,KAAK,EAAE,MAAM,GAAG,wBAAwB,EAAE,GAAG,OAAO,CAAA;IAC7E,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,eAAe,CAAC,GAAG,OAAO,IAAI,KAAK,yBAAyB,GAAG,GAAG,CAAC,CAAA;IAC7F,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAA;IACnE,IAAI,CAAC,KAAK;QAAE,MAAM,OAAO,EAAE,CAAA;IAE3B,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAA;QACpD,MAAM,IAAI,eAAe,CAAC,GAAG,OAAO,IAAI,KAAK,aAAa,OAAO,EAAE,CAAC,CAAA;IACtE,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;IAC3B,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,eAAe,CAAC,GAAG,OAAO,IAAI,KAAK,+BAA+B,CAAC,CAAA;IAC/E,CAAC;IACD,IAAI,IAAY,CAAA;IAChB,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,MAAM,OAAO,EAAE,CAAA;QAC/B,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAChC,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAA;IACjC,CAAC;IACD,IAAI,IAAI,KAAK,EAAE;QAAE,MAAM,OAAO,EAAE,CAAA;IAChC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,eAAe,CAAC,GAAG,OAAO,IAAI,KAAK,wBAAwB,CAAC,CAAA;IACxE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,IAAY,EAAE,MAAuB;IACvD,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IACpD,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QACtC,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;QAC7B,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IACxE,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/integrations",
-  "version": "0.94.1",
+  "version": "0.95.0",
   "description": "External-system integration domain logic for the Agent Architecture Board (GitHub, documents, tasks, environments, runners).",
   "repository": {
     "type": "git",
@@ -27,15 +27,15 @@
     "ai": "^7.0.35",
     "p-map": "^7.0.6",
     "yaml": "^2.9.0",
-    "@cat-factory/contracts": "0.162.0",
-    "@cat-factory/kernel": "0.156.0"
+    "@cat-factory/contracts": "0.163.0",
+    "@cat-factory/kernel": "0.157.0"
   },
   "devDependencies": {
     "typescript": "7.0.2",
     "undici": "^8.8.0",
     "valibot": "^1.4.2",
     "vitest": "^4.1.10",
-    "@cat-factory/caching": "0.10.37"
+    "@cat-factory/caching": "0.10.38"
   },
   "scripts": {
     "build": "tsc -b tsconfig.build.json",