@cat-factory/kernel 0.6.0

package/dist/ports/recurring-repositories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recurring-repositories.d.ts","sourceRoot":"","sources":["../../src/ports/recurring-repositories.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAQvE,gFAAgF;AAChF,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,gBAAgB,CAAA;CAC3B;AAED,MAAM,WAAW,0BAA0B;IACzC,sDAAsD;IACtD,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAA;IACtE,6DAA6D;IAC7D,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAA;IAClF,6DAA6D;IAC7D,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;IACtD;;;;OAIG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;IAC7D;;;;;OAKG;IACH,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;IACjE;;;;OAIG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;IAC7C,kDAAkD;IAClD,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACtE,iFAAiF;IACjF,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEtD,mCAAmC;IACnC,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/D,8DAA8D;IAC9D,SAAS,CACP,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,YAAY,GAAG,SAAS,GAAG,aAAa,CAAC,CAAC,GACrF,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB,oDAAoD;IACpD,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;IACzE,wFAAwF;IACxF,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACjD"}

package/dist/ports/recurring-repositories.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=recurring-repositories.js.map

package/dist/ports/recurring-repositories.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recurring-repositories.js","sourceRoot":"","sources":["../../src/ports/recurring-repositories.ts"],"names":[],"mappings":""}

package/dist/ports/release-health-repositories.d.ts

@@ -0,0 +1,42 @@
+/** A workspace's Datadog connection. Exactly one per workspace. */
+export interface DatadogConnectionRecord {
+    workspaceId: string;
+    /** Datadog site host, e.g. 'datadoghq.com' | 'datadoghq.eu' | 'us5.datadoghq.com'. */
+    site: string;
+    /** Datadog API key (DD-API-KEY). */
+    apiKey: string;
+    /** Datadog application key (DD-APPLICATION-KEY). */
+    appKey: string;
+    createdAt: number;
+    updatedAt: number;
+}
+export interface DatadogConnectionRepository {
+    get(workspaceId: string): Promise<DatadogConnectionRecord | null>;
+    upsert(record: DatadogConnectionRecord): Promise<void>;
+    delete(workspaceId: string): Promise<void>;
+}
+/**
+ * Per-repo/service release-health config: which Datadog monitors/SLOs map to a
+ * block (the service frame a run's repo target resolves to). Drives the gate's
+ * `probe` reads for that run.
+ */
+export interface ReleaseHealthConfigRecord {
+    workspaceId: string;
+    /** The service frame (or task) block these monitors/SLOs belong to. */
+    blockId: string;
+    /** Datadog monitor ids to watch. */
+    monitorIds: string[];
+    /** Datadog SLO ids to watch. */
+    sloIds: string[];
+    /** Optional env tag (e.g. 'prod') used when querying logs/errors. */
+    envTag: string | null;
+    createdAt: number;
+    updatedAt: number;
+}
+export interface ReleaseHealthConfigRepository {
+    getByBlock(workspaceId: string, blockId: string): Promise<ReleaseHealthConfigRecord | null>;
+    listByWorkspace(workspaceId: string): Promise<ReleaseHealthConfigRecord[]>;
+    upsert(record: ReleaseHealthConfigRecord): Promise<void>;
+    delete(workspaceId: string, blockId: string): Promise<void>;
+}
+//# sourceMappingURL=release-health-repositories.d.ts.map

package/dist/ports/release-health-repositories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-health-repositories.d.ts","sourceRoot":"","sources":["../../src/ports/release-health-repositories.ts"],"names":[],"mappings":"AAKA,mEAAmE;AACnE,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAA;IACnB,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAA;IACZ,oCAAoC;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,GAAG,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAA;IACjE,MAAM,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACtD,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3C;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,MAAM,CAAA;IACnB,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAA;IACf,oCAAoC;IACpC,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,gCAAgC;IAChC,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,qEAAqE;IACrE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,6BAA6B;IAC5C,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAA;IAC3F,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAAA;IAC1E,MAAM,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACxD,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC5D"}

package/dist/ports/release-health-repositories.js

@@ -0,0 +1,6 @@
+// Persistence ports for the Datadog post-release-health integration. Both mirror
+// across the D1 (Cloudflare) and Drizzle/Postgres (Node) facades (runtime parity is
+// mandatory). Credentials are sealed at rest by the facade's SecretCipher; the
+// records here carry plaintext only in memory.
+export {};
+//# sourceMappingURL=release-health-repositories.js.map

package/dist/ports/release-health-repositories.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-health-repositories.js","sourceRoot":"","sources":["../../src/ports/release-health-repositories.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,oFAAoF;AACpF,+EAA+E;AAC/E,+CAA+C"}

package/dist/ports/release-health.d.ts

@@ -0,0 +1,59 @@
+/** The state of a single monitored signal (a Datadog monitor or SLO). */
+export type ReleaseSignalState = 'ok' | 'warn' | 'alert' | 'no_data';
+/** Whether a {@link ReleaseSignal} is a Datadog monitor or an SLO. */
+export type ReleaseSignalKind = 'monitor' | 'slo';
+/** One configured monitor/SLO, flattened to its current state. */
+export interface ReleaseSignal {
+    kind: ReleaseSignalKind;
+    /** The Datadog monitor or SLO id. */
+    id: string;
+    name: string;
+    state: ReleaseSignalState;
+    /** Optional human detail (current value vs threshold, SLO budget burn, …). */
+    detail?: string;
+}
+/**
+ * The provider's verdict on the configured signals (independent of the gate's
+ * monitoring-window timing, which the engine layers on):
+ *  - `healthy`   — nothing alerting / no SLO breached.
+ *  - `pending`   — no verdict yet (e.g. `no_data` right after deploy).
+ *  - `regressed` — at least one monitor alerting or SLO breached.
+ */
+export type ReleaseHealthStatus = 'healthy' | 'pending' | 'regressed';
+export interface ReleaseHealthReport {
+    status: ReleaseHealthStatus;
+    signals: ReleaseSignal[];
+}
+/** A recent error group / log sample gathered for the on-call investigation. */
+export interface ReleaseErrorSample {
+    /** Error class / log group title. */
+    title: string;
+    /** Occurrences in the window, when known. */
+    count?: number;
+    /** Epoch ms of first occurrence in the window, when known. */
+    firstSeen?: number;
+    /** A representative message / sample line. */
+    sampleMessage?: string;
+    /** Deep link to the source (Datadog log view), when known. */
+    url?: string;
+}
+/** The investigation bundle handed to the on-call agent on a regression. */
+export interface ReleaseEvidence {
+    /** The signals that are alerting / breached. */
+    regressedSignals: ReleaseSignal[];
+    /** Recent error groups / log samples from the observability + error sources. */
+    errors: ReleaseErrorSample[];
+    /** Free-form notes (query windows used, services inspected). */
+    notes?: string;
+}
+export interface ReleaseHealthProvider {
+    /**
+     * Read the configured monitors/SLOs for the block's release since `since`
+     * (epoch ms of the release marker). The engine combines this verdict with the
+     * monitoring-window timing to decide pass / keep-polling / escalate.
+     */
+    probe(workspaceId: string, blockId: string, since: number): Promise<ReleaseHealthReport>;
+    /** Gather the investigation evidence bundle for the on-call agent. */
+    gatherEvidence(workspaceId: string, blockId: string, since: number): Promise<ReleaseEvidence>;
+}
+//# sourceMappingURL=release-health.d.ts.map

package/dist/ports/release-health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-health.d.ts","sourceRoot":"","sources":["../../src/ports/release-health.ts"],"names":[],"mappings":"AAOA,yEAAyE;AACzE,MAAM,MAAM,kBAAkB,GAAG,IAAI,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAA;AAEpE,sEAAsE;AACtE,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,KAAK,CAAA;AAEjD,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,iBAAiB,CAAA;IACvB,qCAAqC;IACrC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,kBAAkB,CAAA;IACzB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,CAAA;AAErE,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,mBAAmB,CAAA;IAC3B,OAAO,EAAE,aAAa,EAAE,CAAA;CACzB;AAED,gFAAgF;AAChF,MAAM,WAAW,kBAAkB;IACjC,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAA;IACb,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,8CAA8C;IAC9C,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC9B,gDAAgD;IAChD,gBAAgB,EAAE,aAAa,EAAE,CAAA;IACjC,gFAAgF;IAChF,MAAM,EAAE,kBAAkB,EAAE,CAAA;IAC5B,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;IACxF,sEAAsE;IACtE,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;CAC9F"}

package/dist/ports/release-health.js

@@ -0,0 +1,8 @@
+// Port for reading a deployed release's health from an observability provider
+// (today Datadog) for the post-release-health gate. Modelled on `CiStatusProvider`:
+// the gate polls `probe` between durable sleeps over a monitoring window and, on a
+// regression, escalates to the `on-call` agent — handing it the bundle from
+// `gatherEvidence`. Core stays free of Datadog specifics; the facade resolves the
+// block's release-health config (which monitors/SLOs to read) and credentials.
+export {};
+//# sourceMappingURL=release-health.js.map

package/dist/ports/release-health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-health.js","sourceRoot":"","sources":["../../src/ports/release-health.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,oFAAoF;AACpF,mFAAmF;AACnF,4EAA4E;AAC5E,kFAAkF;AAClF,+EAA+E"}

package/dist/ports/repo-bootstrapper.d.ts

@@ -0,0 +1,80 @@
+import type { BootstrapFailureKind, StepSubtasks } from '../domain/types.js';
+export interface BootstrapRepoRequest {
+    /** Workspace the run belongs to (resolves the GitHub installation to use). */
+    workspaceId: string;
+    /** Id of the bootstrap job this run records into (also keys the container job). */
+    jobId: string;
+    /** The base repository to clone from, or undefined to scaffold from scratch. */
+    referenceRepo?: {
+        owner: string;
+        name: string;
+    };
+    /** The repository to create and bootstrap into. */
+    target: {
+        name: string;
+        description: string;
+        private: boolean;
+    };
+    /** Effective bootstrapper instructions (reference defaults + per-run extras). */
+    instructions: string;
+}
+export interface BootstrapRepoOutcome {
+    /** Web URL of the created repository. */
+    repoUrl: string;
+    /** Owner the repo was created under. */
+    owner: string;
+    /** Name of the created repository. */
+    name: string;
+    /** Default branch the bootstrapped contents were pushed to. */
+    defaultBranch: string;
+}
+/** Addresses a dispatched bootstrap job for polling (the container is keyed by job id). */
+export interface BootstrapJobHandle {
+    workspaceId: string;
+    jobId: string;
+}
+/** A bootstrap job's current state, as the container reports it via the poll. */
+export interface BootstrapJobUpdate {
+    state: 'running' | 'done' | 'failed';
+    /** Present while running once the agent has touched its todo list. */
+    subtasks?: StepSubtasks;
+    /** Present when `state === 'done'`: where the bootstrapped repo landed. */
+    outcome?: BootstrapRepoOutcome;
+    /** Present when `state === 'failed'`: why the run faulted. */
+    error?: string;
+    /** Present when `state === 'failed'`: classification of the fault. */
+    failureKind?: BootstrapFailureKind;
+    /** Present when `state === 'failed'`: extended diagnostic detail, if any. */
+    detail?: string;
+}
+export interface RepoBootstrapper {
+    /**
+     * Whether the workspace is connected to GitHub (an active App installation
+     * exists). Checked before a run starts so an unconnected workspace fails fast
+     * with a clear error instead of recording a job that immediately fails.
+     */
+    isWorkspaceConnected(workspaceId: string): Promise<boolean>;
+    /**
+     * Pre-flight the target repo (exists, reachable, empty-or-boilerplate) and
+     * dispatch the bootstrap container. Returns once the job is accepted — the work
+     * continues in the container, polled via {@link pollBootstrap}. Throws on a
+     * pre-flight failure (e.g. the repo has real content) so the run fails fast.
+     * Idempotent per job id: a re-dispatch re-attaches rather than duplicating.
+     */
+    startBootstrap(request: BootstrapRepoRequest): Promise<BootstrapJobHandle>;
+    /** Poll a dispatched job for progress / its terminal outcome. */
+    pollBootstrap(handle: BootstrapJobHandle): Promise<BootstrapJobUpdate>;
+    /**
+     * Best-effort: stop and reclaim the per-run container for a job (e.g. after the
+     * run faulted), so a leaked instance doesn't idle until its sleep timer. Safe to
+     * call when the container is already gone — implementations swallow the error.
+     */
+    stopBootstrap(handle: BootstrapJobHandle): Promise<void>;
+    /**
+     * After a successful run: ensure the new repo is present in the local GitHub
+     * projection and link it to the board service frame `blockId`, so tasks dropped
+     * on that frame resolve to (and are implemented against) the bootstrapped repo.
+     */
+    linkRepoToBlock(workspaceId: string, outcome: BootstrapRepoOutcome, blockId: string): Promise<void>;
+}
+//# sourceMappingURL=repo-bootstrapper.d.ts.map

package/dist/ports/repo-bootstrapper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-bootstrapper.d.ts","sourceRoot":"","sources":["../../src/ports/repo-bootstrapper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAe5E,MAAM,WAAW,oBAAoB;IACnC,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAA;IACnB,mFAAmF;IACnF,KAAK,EAAE,MAAM,CAAA;IACb,gFAAgF;IAChF,aAAa,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/C,mDAAmD;IACnD,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAA;IAC/D,iFAAiF;IACjF,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAA;IACf,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAA;IACb,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,+DAA+D;IAC/D,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,iFAAiF;AACjF,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAA;IACpC,sEAAsE;IACtE,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,oBAAoB,CAAA;IAC9B,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,sEAAsE;IACtE,WAAW,CAAC,EAAE,oBAAoB,CAAA;IAClC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC3D;;;;;;OAMG;IACH,cAAc,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAC1E,iEAAiE;IACjE,aAAa,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IACtE;;;;OAIG;IACH,aAAa,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACxD;;;;OAIG;IACH,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,oBAAoB,EAC7B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAAA;CACjB"}

package/dist/ports/repo-bootstrapper.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=repo-bootstrapper.js.map

package/dist/ports/repo-bootstrapper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-bootstrapper.js","sourceRoot":"","sources":["../../src/ports/repo-bootstrapper.ts"],"names":[],"mappings":""}

package/dist/ports/repo-scanner.d.ts

@@ -0,0 +1,22 @@
+import type { BlueprintService, BlueprintSource } from '../domain/types.js';
+export interface ScanRepoRequest {
+    /** Workspace the scan belongs to (resolves the GitHub installation to use). */
+    workspaceId: string;
+    /** The repository to scan. */
+    repo: {
+        owner: string;
+        name: string;
+    };
+    /** Extra guidance for the scanner (focus areas, naming, granularity). */
+    instructions: string;
+}
+export interface ScannedBlueprint {
+    /** Whether an LLM produced the decomposition, or the deterministic heuristic. */
+    source: BlueprintSource;
+    /** The repository decomposed into one service frame with its modules. */
+    service: BlueprintService;
+}
+export interface RepoScanner {
+    scan(request: ScanRepoRequest): Promise<ScannedBlueprint>;
+}
+//# sourceMappingURL=repo-scanner.d.ts.map

package/dist/ports/repo-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-scanner.d.ts","sourceRoot":"","sources":["../../src/ports/repo-scanner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAQ3E,MAAM,WAAW,eAAe;IAC9B,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAA;IACnB,8BAA8B;IAC9B,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACrC,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,MAAM,EAAE,eAAe,CAAA;IACvB,yEAAyE;IACzE,OAAO,EAAE,gBAAgB,CAAA;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;CAC1D"}

package/dist/ports/repo-scanner.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=repo-scanner.js.map

package/dist/ports/repo-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-scanner.js","sourceRoot":"","sources":["../../src/ports/repo-scanner.ts"],"names":[],"mappings":""}

package/dist/ports/repositories.d.ts

@@ -0,0 +1,131 @@
+import type { AgentFailure, Block, ExecutionInstance, Pipeline, Workspace } from '../domain/types.js';
+/**
+ * The set of boards a signed-in user may see: those belonging to an account they
+ * are a member of, plus any legacy boards they personally own (account_id NULL,
+ * owner_user_id = them). `null` means "no scoping" — the auth-disabled / local-dev
+ * path, where every board is returned.
+ */
+export type WorkspaceVisibility = {
+    accountIds: string[];
+    ownerUserId: string;
+} | null;
+export interface WorkspaceRepository {
+    /**
+     * List boards visible to a user (see {@link WorkspaceVisibility}). A `null`
+     * scope means ownership is not being enforced (auth disabled) and ALL boards
+     * are returned.
+     */
+    listVisible(scope: WorkspaceVisibility): Promise<Workspace[]>;
+    get(id: string): Promise<Workspace | null>;
+    /**
+     * The owning user id for a board: a string when owned, `null` for a board with
+     * no owner, and `undefined` when the board does not exist.
+     */
+    ownerOf(id: string): Promise<string | null | undefined>;
+    /**
+     * The owning account id for a board: a string when account-scoped, `null` for a
+     * legacy/unscoped board, and `undefined` when the board does not exist. Used by
+     * the API's per-workspace authorization check.
+     */
+    accountOf(id: string): Promise<string | null | undefined>;
+    create(workspace: Workspace, ownerUserId: string | null, accountId: string | null): Promise<void>;
+    rename(id: string, name: string): Promise<void>;
+    /** Update a board's description (null clears it). */
+    setDescription(id: string, description: string | null): Promise<void>;
+    delete(id: string): Promise<void>;
+}
+/**
+ * Fields of a block that may be patched. Excludes `id`; the `parentId`/`position`
+ * structural move is just another patch, kept honest by the adapter.
+ */
+export type BlockPatch = Partial<Omit<Block, 'id'>>;
+export interface BlockRepository {
+    listByWorkspace(workspaceId: string): Promise<Block[]>;
+    /**
+     * Every block belonging to a service (its frame + modules + tasks), regardless of
+     * which workspace created them. Backs the board composition that renders a service
+     * mounted from another workspace in the same org. Returns the blocks whose
+     * `service_id` column matches (set at insert time when the service repos are wired).
+     */
+    listByService(serviceId: string): Promise<Block[]>;
+    /**
+     * Every block belonging to ANY of the given services, in a single (chunked) query — the
+     * batched form of {@link BlockRepository.listByService} used to compose a board from all the
+     * services it mounts without one round-trip per service. Empty input → empty result.
+     */
+    listByServices(serviceIds: string[]): Promise<Block[]>;
+    get(workspaceId: string, id: string): Promise<Block | null>;
+    /**
+     * Resolve a block by its (globally unique) id, regardless of which workspace homes it,
+     * returning the block plus its home `workspaceId` and its `serviceId` (or null). Backs
+     * the shared-board mutation path: a block belonging to a service mounted from another
+     * workspace is acted on at its home workspace (after the caller authorizes that the
+     * requester mounts the service). Returns null when no block has that id.
+     */
+    findById(blockId: string): Promise<{
+        workspaceId: string;
+        serviceId: string | null;
+        block: Block;
+    } | null>;
+    /**
+     * Insert a block. `serviceId` stamps the account-owned service the block belongs to
+     * (so it can be rendered on every workspace that mounts the service); omit/undefined
+     * for legacy, workspace-local blocks.
+     */
+    insert(workspaceId: string, block: Block, serviceId?: string | null): Promise<void>;
+    update(workspaceId: string, id: string, patch: BlockPatch): Promise<void>;
+    /**
+     * Re-stamp the `service_id` of one or more blocks. Used when a block is reparented into a
+     * different service's frame (`service_id` is not part of {@link BlockPatch}, since it is the
+     * physical scope key, not a domain field): the moved subtree must follow its new owning
+     * service so it renders on — and fans out to — the right boards.
+     */
+    setService(workspaceId: string, ids: string[], serviceId: string | null): Promise<void>;
+    deleteMany(workspaceId: string, ids: string[]): Promise<void>;
+}
+export interface PipelineRepository {
+    listByWorkspace(workspaceId: string): Promise<Pipeline[]>;
+    get(workspaceId: string, id: string): Promise<Pipeline | null>;
+    insert(workspaceId: string, pipeline: Pipeline): Promise<void>;
+    /** Overwrite an existing pipeline in place (preserving its catalog order). */
+    update(workspaceId: string, pipeline: Pipeline): Promise<void>;
+    delete(workspaceId: string, id: string): Promise<void>;
+}
+/** A lightweight reference to a run, used by the cron sweeper. */
+export interface RunRef {
+    workspaceId: string;
+    id: string;
+}
+export interface ExecutionRepository {
+    listByWorkspace(workspaceId: string): Promise<ExecutionInstance[]>;
+    /**
+     * Every execution belonging to a service, regardless of which workspace it ran under.
+     * Backs the board snapshot for a service mounted from another workspace in the same org,
+     * so its run progress/status renders identically on every board that mounts it (not just
+     * on its home workspace). Matches the `service_id` column stamped at insert time.
+     */
+    listByService(serviceId: string): Promise<ExecutionInstance[]>;
+    /**
+     * Every execution belonging to ANY of the given services, in a single (chunked) query — the
+     * batched form of {@link ExecutionRepository.listByService} used to compose a board's runs
+     * from all the services it mounts without one round-trip per mount. Empty input → empty.
+     */
+    listByServices(serviceIds: string[]): Promise<ExecutionInstance[]>;
+    get(workspaceId: string, id: string): Promise<ExecutionInstance | null>;
+    getByBlock(workspaceId: string, blockId: string): Promise<ExecutionInstance | null>;
+    upsert(workspaceId: string, execution: ExecutionInstance): Promise<void>;
+    deleteByBlock(workspaceId: string, blockId: string): Promise<void>;
+    /**
+     * Runs still marked `running` whose lease (`updated_at`) is older than the
+     * given epoch-ms cutoff — i.e. candidates the durable driver may have dropped.
+     * Spans all workspaces so a single cron pass can repair the whole system.
+     */
+    listStale(olderThanEpochMs: number): Promise<RunRef[]>;
+    /**
+     * Record a terminal agent failure: flip the run to `failed` and store the
+     * structured {@link AgentFailure} (its `message` mirrors the legacy one-line
+     * `error`). Surfaces the same failure banner + retry as a failed bootstrap.
+     */
+    markFailed(workspaceId: string, id: string, failure: AgentFailure): Promise<void>;
+}
+//# sourceMappingURL=repositories.d.ts.map

package/dist/ports/repositories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repositories.d.ts","sourceRoot":"","sources":["../../src/ports/repositories.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,KAAK,EACL,iBAAiB,EACjB,QAAQ,EACR,SAAS,EACV,MAAM,oBAAoB,CAAA;AAS3B;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAA;AAEtF,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,WAAW,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAA;IAC1C;;;OAGG;IACH,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAA;IACvD;;;;OAIG;IACH,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAA;IACzD,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjG,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/C,qDAAqD;IACrD,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrE,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClC;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;AAEnD,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;IACtD;;;;;OAKG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;IAClD;;;;OAIG;IACH,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;IACtD,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAA;IAC3D;;;;;;OAMG;IACH,QAAQ,CACN,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,KAAK,CAAA;KAAE,GAAG,IAAI,CAAC,CAAA;IAClF;;;;OAIG;IACH,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnF,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzE;;;;;OAKG;IACH,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvF,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D;AAED,MAAM,WAAW,kBAAkB;IACjC,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;IACzD,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAA;IAC9D,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9D,8EAA8E;IAC9E,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9D,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACvD;AAED,kEAAkE;AAClE,MAAM,WAAW,MAAM;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,EAAE,EAAE,MAAM,CAAA;CACX;AAED,MAAM,WAAW,mBAAmB;IAClC,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAA;IAClE;;;;;OAKG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAA;IAC9D;;;;OAIG;IACH,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAA;IAClE,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAA;IACvE,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAA;IACnF,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACxE,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClE;;;;OAIG;IACH,SAAS,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IACtD;;;;OAIG;IACH,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClF"}

package/dist/ports/repositories.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=repositories.js.map

package/dist/ports/repositories.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repositories.js","sourceRoot":"","sources":["../../src/ports/repositories.ts"],"names":[],"mappings":""}

package/dist/ports/requirement-review-repositories.d.ts

@@ -0,0 +1,16 @@
+import type { RequirementReview } from '../domain/types.js';
+export interface RequirementReviewRepository {
+    /** The current review for a block, or null if none has been run. */
+    getByBlock(workspaceId: string, blockId: string): Promise<RequirementReview | null>;
+    /** A review by its id, or null if it does not exist. */
+    get(workspaceId: string, id: string): Promise<RequirementReview | null>;
+    /**
+     * Create or replace a review. Replacing the block's prior review is the caller's
+     * responsibility (the service deletes it before inserting a fresh one), so a
+     * block never accumulates stale reviews.
+     */
+    upsert(workspaceId: string, review: RequirementReview): Promise<void>;
+    /** Drop any existing review(s) for a block (called before a fresh review run). */
+    deleteByBlock(workspaceId: string, blockId: string): Promise<void>;
+}
+//# sourceMappingURL=requirement-review-repositories.d.ts.map

package/dist/ports/requirement-review-repositories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requirement-review-repositories.d.ts","sourceRoot":"","sources":["../../src/ports/requirement-review-repositories.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAQ3D,MAAM,WAAW,2BAA2B;IAC1C,oEAAoE;IACpE,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAA;IACnF,wDAAwD;IACxD,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAA;IACvE;;;;OAIG;IACH,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrE,kFAAkF;IAClF,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACnE"}

package/dist/ports/requirement-review-repositories.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=requirement-review-repositories.js.map

package/dist/ports/requirement-review-repositories.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requirement-review-repositories.js","sourceRoot":"","sources":["../../src/ports/requirement-review-repositories.ts"],"names":[],"mappings":""}

package/dist/ports/runner-pool-provider.d.ts

@@ -0,0 +1,25 @@
+import type { RunnerPoolManifest } from '../domain/types.js';
+import type { SecretResolver } from './environment-provider.js';
+import type { RunnerJobView } from './runner-transport.js';
+export interface RunnerDispatchRequest {
+    manifest: RunnerPoolManifest;
+    /** The cat-factory job id (execution id) the pool is keyed on. */
+    jobId: string;
+    /** The harness job spec; available to templates as `{{input.job}}` (JSON). */
+    spec: Record<string, unknown>;
+    resolveSecret: SecretResolver;
+}
+export interface RunnerPollRequest {
+    manifest: RunnerPoolManifest;
+    jobId: string;
+    resolveSecret: SecretResolver;
+}
+export interface RunnerPoolProvider {
+    /** Start (or re-attach to) the job on the pool. Idempotent per `jobId`. */
+    dispatch(req: RunnerDispatchRequest): Promise<void>;
+    /** Read the job's current state, mapped onto the canonical view. */
+    poll(req: RunnerPollRequest): Promise<RunnerJobView>;
+    /** Free the job/runner (only when the manifest declares a `release` template). */
+    release(req: RunnerPollRequest): Promise<void>;
+}
+//# sourceMappingURL=runner-pool-provider.d.ts.map

package/dist/ports/runner-pool-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-pool-provider.d.ts","sourceRoot":"","sources":["../../src/ports/runner-pool-provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAS1D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAA;IACb,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7B,aAAa,EAAE,cAAc,CAAA;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,cAAc,CAAA;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnD,oEAAoE;IACpE,IAAI,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;IACpD,kFAAkF;IAClF,OAAO,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC/C"}

package/dist/ports/runner-pool-provider.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=runner-pool-provider.js.map

package/dist/ports/runner-pool-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-pool-provider.js","sourceRoot":"","sources":["../../src/ports/runner-pool-provider.ts"],"names":[],"mappings":""}

package/dist/ports/runner-pool-repositories.d.ts

@@ -0,0 +1,27 @@
+/**
+ * A workspace's binding to a self-hosted runner pool: the validated manifest and
+ * the encrypted per-tenant secret bundle (the scheduler-API credentials). The
+ * bundle is decrypted only in-memory, at call time, by the dispatch/poll path.
+ */
+export interface RunnerPoolConnectionRecord {
+    workspaceId: string;
+    providerId: string;
+    label: string;
+    baseUrl: string;
+    /** The validated manifest, serialized as JSON. */
+    manifestJson: string;
+    /** Ciphertext of the `{ key: value }` secret bundle (SecretCipher envelope). */
+    secretsCipher: string;
+    createdAt: number;
+    /** Set when the workspace unregisters (tombstone). */
+    deletedAt: number | null;
+}
+export interface RunnerPoolConnectionRepository {
+    /** The workspace's live connection, or null if not registered. */
+    getByWorkspace(workspaceId: string): Promise<RunnerPoolConnectionRecord | null>;
+    /** Create or replace the live connection for a workspace. */
+    upsert(record: RunnerPoolConnectionRecord): Promise<void>;
+    /** Tombstone the workspace's connection. */
+    softDelete(workspaceId: string, at: number): Promise<void>;
+}
+//# sourceMappingURL=runner-pool-repositories.d.ts.map

package/dist/ports/runner-pool-repositories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-pool-repositories.d.ts","sourceRoot":"","sources":["../../src/ports/runner-pool-repositories.ts"],"names":[],"mappings":"AAMA;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,kDAAkD;IAClD,YAAY,EAAE,MAAM,CAAA;IACpB,gFAAgF;IAChF,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,MAAM,CAAA;IACjB,sDAAsD;IACtD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,8BAA8B;IAC7C,kEAAkE;IAClE,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC,CAAA;IAC/E,6DAA6D;IAC7D,MAAM,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzD,4CAA4C;IAC5C,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3D"}

package/dist/ports/runner-pool-repositories.js

@@ -0,0 +1,7 @@
+// Persistence port for the self-hosted runner-pool integration. The worker
+// implements this against D1 (migration 0013); tests can supply an in-memory
+// fake. Rows are scoped by workspace, mirroring the environment-connection
+// repository. The management-API secret bundle is stored as opaque ciphertext
+// (see the SecretCipher port) — this record never holds plaintext secrets.
+export {};
+//# sourceMappingURL=runner-pool-repositories.js.map

package/dist/ports/runner-pool-repositories.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-pool-repositories.js","sourceRoot":"","sources":["../../src/ports/runner-pool-repositories.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,2EAA2E"}