@cat-factory/local-server 0.110.0 → 0.111.0

package/dist/vcsClientRouter.d.ts

@@ -0,0 +1,14 @@
+import type { GitHubClient } from '@cat-factory/kernel';
+/**
+ * A `GitHubClient` that forwards every call to `resolve()`'s answer at call time. When `resolve`
+ * answers undefined the deployment holds no credential, and every member is a function that
+ * REFUSES with {@link noVcsCredentialError} — the named, actionable cause — rather than resolving
+ * to `undefined` and surfacing as a type error deep in a gate probe.
+ *
+ * `has` reports the resolved client's own members, so the optional parts of the port
+ * (`listReposForToken`, `getRepoForToken`, `listSubIssues`) are advertised exactly as the backing
+ * client advertises them: the GitLab adapter omits them and callers that feature-test with `in`
+ * must keep seeing that.
+ */
+export declare function credentialRoutedGitHubClient(resolve: () => GitHubClient | undefined): GitHubClient;
+//# sourceMappingURL=vcsClientRouter.d.ts.map

package/dist/vcsClientRouter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vcsClientRouter.d.ts","sourceRoot":"","sources":["../src/vcsClientRouter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAmCvD;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,MAAM,YAAY,GAAG,SAAS,GACtC,YAAY,CAoBd"}

package/dist/vcsClientRouter.js

@@ -0,0 +1,65 @@
+import { noVcsCredentialError } from './github.js';
+// One `GitHubClient` whose backing client is chosen PER CALL from the deployment's current
+// source-control credential.
+//
+// Local mode is single-provider, but which provider that is stops being a boot-time fact once a
+// credential can be installed from the sign-in screen: a deployment that booted with nothing can
+// become a GitHub one or a GitLab one, and the layers above hold the client object they were
+// handed at build time. So the object has to be the stable one and the routing has to be inside
+// it.
+//
+// It is a `Proxy` rather than a hand-written delegate on purpose. `GitHubClient` is a 40-method
+// port that keeps growing, and a delegate that has to be edited for each addition fails SILENTLY
+// when it isn't: the method resolves on neither client and a caller gets `undefined is not a
+// function` on whichever path first uses it. Forwarding reflectively cannot drift.
+// (`ProviderRoutingGitHubClient` in @cat-factory/server IS that hand-written delegate, and its
+// routing key — an installation row's immutable stored provider — is a different question from
+// this one, so it is not the seam to reuse here.)
+/**
+ * Property names the no-client branch must answer `undefined` for rather than with a refusing
+ * function, because the LANGUAGE reads them as protocol rather than as a port method.
+ *
+ * `then` is the one that bites: an object with a callable `then` is a thenable, so `await client`
+ * or returning the client from an `async` function makes the promise machinery call it with
+ * `(resolve, reject)`. A function that ignores both and returns a rejected promise leaves the
+ * outer promise PENDING FOREVER and files an unhandled rejection, which is a strictly worse
+ * failure than the refusal it was trying to raise. `toJSON` is the same shape for a serializing
+ * logger, and a symbol key (`Symbol.toPrimitive`, `util.inspect.custom`) is never a port method.
+ */
+function isProtocolKey(property) {
+    return typeof property === 'symbol' || property === 'then' || property === 'toJSON';
+}
+/**
+ * A `GitHubClient` that forwards every call to `resolve()`'s answer at call time. When `resolve`
+ * answers undefined the deployment holds no credential, and every member is a function that
+ * REFUSES with {@link noVcsCredentialError} — the named, actionable cause — rather than resolving
+ * to `undefined` and surfacing as a type error deep in a gate probe.
+ *
+ * `has` reports the resolved client's own members, so the optional parts of the port
+ * (`listReposForToken`, `getRepoForToken`, `listSubIssues`) are advertised exactly as the backing
+ * client advertises them: the GitLab adapter omits them and callers that feature-test with `in`
+ * must keep seeing that.
+ */
+export function credentialRoutedGitHubClient(resolve) {
+    return new Proxy({}, {
+        get(_target, property) {
+            const client = resolve();
+            if (!client) {
+                if (isProtocolKey(property))
+                    return undefined;
+                // A REJECTED promise, not a synchronous throw: every member of the port is an async
+                // method, so callers hold the failure with `await` / `.catch`. Throwing synchronously
+                // would escape a `.catch()` chain and surface as an unhandled exception in whatever
+                // happened to call it first.
+                return () => Promise.reject(noVcsCredentialError());
+            }
+            const member = Reflect.get(client, property, client);
+            return typeof member === 'function' ? member.bind(client) : member;
+        },
+        has(_target, property) {
+            const client = resolve();
+            return client ? Reflect.has(client, property) : false;
+        },
+    });
+}
+//# sourceMappingURL=vcsClientRouter.js.map

package/dist/vcsClientRouter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vcsClientRouter.js","sourceRoot":"","sources":["../src/vcsClientRouter.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAElD,2FAA2F;AAC3F,6BAA6B;AAC7B,EAAE;AACF,gGAAgG;AAChG,iGAAiG;AACjG,6FAA6F;AAC7F,gGAAgG;AAChG,MAAM;AACN,EAAE;AACF,gGAAgG;AAChG,iGAAiG;AACjG,6FAA6F;AAC7F,mFAAmF;AACnF,+FAA+F;AAC/F,+FAA+F;AAC/F,kDAAkD;AAElD;;;;;;;;;;GAUG;AACH,SAAS,aAAa,CAAC,QAAyB;IAC9C,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,QAAQ,CAAA;AACrF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAAuC;IAEvC,OAAO,IAAI,KAAK,CAAC,EAAkB,EAAE;QACnC,GAAG,CAAC,OAAO,EAAE,QAAQ;YACnB,MAAM,MAAM,GAAG,OAAO,EAAE,CAAA;YACxB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,aAAa,CAAC,QAAQ,CAAC;oBAAE,OAAO,SAAS,CAAA;gBAC7C,oFAAoF;gBACpF,sFAAsF;gBACtF,oFAAoF;gBACpF,6BAA6B;gBAC7B,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAA;YACrD,CAAC;YACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAgB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;YAC9D,OAAO,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;QACpE,CAAC;QACD,GAAG,CAAC,OAAO,EAAE,QAAQ;YACnB,MAAM,MAAM,GAAG,OAAO,EAAE,CAAA;YACxB,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAgB,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACjE,CAAC;KACF,CAAC,CAAA;AACJ,CAAC"}

package/dist/vcsCredential.d.ts

@@ -0,0 +1,40 @@
+import type { LocalVcsSetup, VcsProvider } from '@cat-factory/kernel';
+import { type LocalVcsCredentialStore } from './sqlite/vcsCredentialStore.js';
+/** The source-control credential the local deployment operates with. */
+export interface LocalVcsCredential {
+    provider: VcsProvider;
+    token: string;
+    /** Where it came from — the sign-in screen labels a stored credential differently from `.env`. */
+    origin: 'env' | 'stored';
+}
+export interface LocalVcsCredentialSource extends LocalVcsSetup {
+    /** The credential to operate with right now, or undefined when the deployment has none. */
+    current(): LocalVcsCredential | undefined;
+    /** Run `fn` after an install changed the resolved credential. */
+    onChange(fn: (credential: LocalVcsCredential | undefined) => void): void;
+    /** Release the underlying store handle (boot never opened one ⇒ a no-op). */
+    close(): void;
+}
+/**
+ * Build the deployment's credential source from `env` (+ the sealed local store). `storeFactory`
+ * is injectable so tests drive an in-memory store without touching the developer's home
+ * directory; by default the store lives at `LOCAL_VCS_CREDENTIAL_DB` or
+ * `~/.cat-factory/vcs-credential.sqlite`.
+ */
+export declare function createLocalVcsCredentialSource(env: NodeJS.ProcessEnv, storeFactory?: () => LocalVcsCredentialStore): LocalVcsCredentialSource;
+/**
+ * The host a GitLab deployment clones/pushes against, derived from `GITLAB_API_BASE`'s host (a
+ * self-managed instance) or the public `gitlab.com`. Single source of truth for BOTH the clone URL
+ * the server builds (`resolveRepoOrigin`) and the harness host allow-list, so they can never
+ * disagree. Returns undefined unless the credential in use is a GitLab one.
+ */
+export declare function gitlabVcsHost(env: NodeJS.ProcessEnv, credential: LocalVcsCredential | undefined): string | undefined;
+/**
+ * The comma-separated host allow-list the harness container is given (`GITHUB_ALLOWED_HOSTS`).
+ * The harness rejects any clone/push host not on this list (default github.com), so a GitLab
+ * deployment must add its host or every clone is refused. Combines any operator-set
+ * `GITHUB_ALLOWED_HOSTS` with the host the CURRENT credential clones from. Returns undefined when
+ * neither applies (GitHub mode with no extra hosts ⇒ the harness keeps its github.com default).
+ */
+export declare function harnessAllowedHosts(env: NodeJS.ProcessEnv, credential: LocalVcsCredential | undefined): string | undefined;
+//# sourceMappingURL=vcsCredential.d.ts.map

package/dist/vcsCredential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vcsCredential.d.ts","sourceRoot":"","sources":["../src/vcsCredential.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAGrE,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,gCAAgC,CAAA;AAoBvC,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,WAAW,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;IACb,kGAAkG;IAClG,MAAM,EAAE,KAAK,GAAG,QAAQ,CAAA;CACzB;AAcD,MAAM,WAAW,wBAAyB,SAAQ,aAAa;IAC7D,2FAA2F;IAC3F,OAAO,IAAI,kBAAkB,GAAG,SAAS,CAAA;IACzC,iEAAiE;IACjE,QAAQ,CAAC,EAAE,EAAE,CAAC,UAAU,EAAE,kBAAkB,GAAG,SAAS,KAAK,IAAI,GAAG,IAAI,CAAA;IACxE,6EAA6E;IAC7E,KAAK,IAAI,IAAI,CAAA;CACd;AAyDD;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,YAAY,CAAC,EAAE,MAAM,uBAAuB,GAC3C,wBAAwB,CAyE1B;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,UAAU,EAAE,kBAAkB,GAAG,SAAS,GACzC,MAAM,GAAG,SAAS,CAWpB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,UAAU,EAAE,kBAAkB,GAAG,SAAS,GACzC,MAAM,GAAG,SAAS,CASpB"}

package/dist/vcsCredential.js

@@ -0,0 +1,168 @@
+import { ConflictError, UnavailableError } from '@cat-factory/kernel';
+import { localDbPath } from './sqlite/db.js';
+import { createLocalVcsCredentialStore, } from './sqlite/vcsCredentialStore.js';
+/** Every provider a local deployment can be given a token for. */
+const INSTALLABLE_PROVIDERS = ['github', 'gitlab'];
+/** The env variable holding each provider's PAT. */
+const PAT_ENV_VAR = {
+    github: 'GITHUB_PAT',
+    gitlab: 'GITLAB_PAT',
+};
+/** The env-configured credential, preferring GitHub — local mode operates on exactly one. */
+function envCredential(env) {
+    for (const provider of INSTALLABLE_PROVIDERS) {
+        const token = env[PAT_ENV_VAR[provider]]?.trim();
+        if (token)
+            return { provider, token, origin: 'env' };
+    }
+    return undefined;
+}
+/**
+ * Open the store lazily and remember the failure, so a broken/unwritable sqlite file costs one
+ * attempt rather than one per read, and so a deployment that never installs anything never
+ * creates the file at all.
+ */
+class LazyStore {
+    open;
+    store;
+    /** Set once the store may not be opened again: an open that failed, or a close. */
+    sealed = false;
+    constructor(open) {
+        this.open = open;
+    }
+    get() {
+        if (this.store || this.sealed)
+            return this.store;
+        try {
+            this.store = this.open();
+        }
+        catch {
+            // silent-catch-ok: an unopenable local store IS "the deployment has no stored credential",
+            // which the caller already renders (the sign-in screen offers to install one). The `.env`
+            // path is unaffected, so failing the boot over it would be strictly worse.
+            this.sealed = true;
+        }
+        return this.store;
+    }
+    /**
+     * Release the handle, permanently. `close()` is a shutdown (or a throwaway boot-time read), so a
+     * later `get()` must answer "no stored credential" rather than silently re-opening the file on a
+     * source its owner has already torn down.
+     */
+    close() {
+        this.store?.close();
+        this.store = undefined;
+        this.sealed = true;
+    }
+}
+/**
+ * Build the deployment's credential source from `env` (+ the sealed local store). `storeFactory`
+ * is injectable so tests drive an in-memory store without touching the developer's home
+ * directory; by default the store lives at `LOCAL_VCS_CREDENTIAL_DB` or
+ * `~/.cat-factory/vcs-credential.sqlite`.
+ */
+export function createLocalVcsCredentialSource(env, storeFactory) {
+    const masterKey = env.ENCRYPTION_KEY?.trim();
+    const lazy = storeFactory || masterKey
+        ? new LazyStore(storeFactory ??
+            (() => createLocalVcsCredentialStore(localDbPath(env.LOCAL_VCS_CREDENTIAL_DB, 'vcs-credential.sqlite'), masterKey)))
+        : undefined;
+    const listeners = [];
+    // The resolved credential is cached because it is read on hot paths (every dispatch, every
+    // gate probe, every clone-URL build) and a sqlite read + AES open per call would be waste. It
+    // is invalidated on install — the only thing that can change it — so the cache can never be
+    // the reason a freshly installed token is not seen.
+    let cached = null;
+    const resolve = () => {
+        if (cached !== null)
+            return cached;
+        const fromEnv = envCredential(env);
+        if (fromEnv) {
+            cached = fromEnv;
+            return cached;
+        }
+        const stored = lazy?.get()?.read();
+        cached = stored
+            ? { provider: stored.provider, token: stored.token, origin: 'stored' }
+            : undefined;
+        return cached;
+    };
+    const blockedReason = () => {
+        if (envCredential(env))
+            return 'env_configured';
+        if (!lazy)
+            return 'no_encryption_key';
+        return undefined;
+    };
+    return {
+        current: resolve,
+        // Open while `.env` names no PAT — INCLUDING when a credential is already stored. The stored
+        // one can expire or be revoked, and the sign-in screen is the only surface a locked-out
+        // developer can reach, so refusing to replace it would recreate the dead end this exists to
+        // remove. It grants nothing extra: anyone who can reach that screen can already sign in with
+        // the stored token in one click.
+        installable: () => (blockedReason() ? [] : [...INSTALLABLE_PROVIDERS]),
+        // Both refusals are unreachable through the sign-in screen, which offers the box only for a
+        // provider `installable()` names. They are the port's own guard for any other caller, and
+        // they refuse by STATUS CLASS with no `details.reason`: the generic 409 / 503 copy is exactly
+        // right for both (a credential already owned elsewhere; a capability the deployment has not
+        // configured), so neither earns a place in the closed reason vocabularies the SPA translates.
+        install: async (provider, token, options) => {
+            if (blockedReason() === 'env_configured') {
+                throw new ConflictError(`${PAT_ENV_VAR[provider]} is set in this deployment's environment, so that token is the one in use. Change it there.`);
+            }
+            const store = lazy?.get();
+            if (!store) {
+                throw new UnavailableError('This deployment cannot store a source-control token (no ENCRYPTION_KEY is configured).');
+            }
+            store.write({ provider, token, login: options?.login ?? null });
+            cached = null;
+            const next = resolve();
+            for (const listener of listeners)
+                listener(next);
+        },
+        onChange: (fn) => listeners.push(fn),
+        close: () => lazy?.close(),
+    };
+}
+/**
+ * The host a GitLab deployment clones/pushes against, derived from `GITLAB_API_BASE`'s host (a
+ * self-managed instance) or the public `gitlab.com`. Single source of truth for BOTH the clone URL
+ * the server builds (`resolveRepoOrigin`) and the harness host allow-list, so they can never
+ * disagree. Returns undefined unless the credential in use is a GitLab one.
+ */
+export function gitlabVcsHost(env, credential) {
+    if (credential?.provider !== 'gitlab')
+        return undefined;
+    const apiBase = env.GITLAB_API_BASE?.trim();
+    if (!apiBase)
+        return 'gitlab.com';
+    try {
+        return new URL(apiBase).host;
+    }
+    catch {
+        // silent-catch-ok: an unparseable API base is already reported where it is CONFIGURED; here
+        // the honest fallback is the public host, which is what an unset value means too.
+        return 'gitlab.com';
+    }
+}
+/**
+ * The comma-separated host allow-list the harness container is given (`GITHUB_ALLOWED_HOSTS`).
+ * The harness rejects any clone/push host not on this list (default github.com), so a GitLab
+ * deployment must add its host or every clone is refused. Combines any operator-set
+ * `GITHUB_ALLOWED_HOSTS` with the host the CURRENT credential clones from. Returns undefined when
+ * neither applies (GitHub mode with no extra hosts ⇒ the harness keeps its github.com default).
+ */
+export function harnessAllowedHosts(env, credential) {
+    const hosts = new Set();
+    for (const h of (env.GITHUB_ALLOWED_HOSTS ?? '').split(',')) {
+        const t = h.trim();
+        if (t)
+            hosts.add(t);
+    }
+    const gitlab = gitlabVcsHost(env, credential);
+    if (gitlab)
+        hosts.add(gitlab);
+    return hosts.size > 0 ? [...hosts].join(',') : undefined;
+}
+//# sourceMappingURL=vcsCredential.js.map

package/dist/vcsCredential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vcsCredential.js","sourceRoot":"","sources":["../src/vcsCredential.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAEL,6BAA6B,GAC9B,MAAM,gCAAgC,CAAA;AAiDvC,kEAAkE;AAClE,MAAM,qBAAqB,GAA2B,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;AAE1E,oDAAoD;AACpD,MAAM,WAAW,GAAgC;IAC/C,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;CACrB,CAAA;AAED,6FAA6F;AAC7F,SAAS,aAAa,CAAC,GAAsB;IAC3C,KAAK,MAAM,QAAQ,IAAI,qBAAqB,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;QAChD,IAAI,KAAK;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IACtD,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,SAAS;IAKgB,IAAI;IAJzB,KAAK,CAAqC;IAClD,mFAAmF;IAC3E,MAAM,GAAG,KAAK,CAAA;IAEtB,YAA6B,IAAmC;oBAAnC,IAAI;IAAkC,CAAC;IAEpE,GAAG;QACD,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,KAAK,CAAA;QAChD,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,2FAA2F;YAC3F,0FAA0F;YAC1F,2EAA2E;YAC3E,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;QACpB,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;IAED;;;;OAIG;IACH,KAAK;QACH,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAA;QACnB,IAAI,CAAC,KAAK,GAAG,SAAS,CAAA;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;IACpB,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAC5C,GAAsB,EACtB,YAA4C;IAE5C,MAAM,SAAS,GAAG,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAA;IAC5C,MAAM,IAAI,GACR,YAAY,IAAI,SAAS;QACvB,CAAC,CAAC,IAAI,SAAS,CACX,YAAY;YACV,CAAC,GAAG,EAAE,CACJ,6BAA6B,CAC3B,WAAW,CAAC,GAAG,CAAC,uBAAuB,EAAE,uBAAuB,CAAC,EACjE,SAAmB,CACpB,CAAC,CACP;QACH,CAAC,CAAC,SAAS,CAAA;IACf,MAAM,SAAS,GAA6D,EAAE,CAAA;IAC9E,2FAA2F;IAC3F,8FAA8F;IAC9F,4FAA4F;IAC5F,oDAAoD;IACpD,IAAI,MAAM,GAA0C,IAAI,CAAA;IAExD,MAAM,OAAO,GAAG,GAAmC,EAAE;QACnD,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,MAAM,CAAA;QAClC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,GAAG,OAAO,CAAA;YAChB,OAAO,MAAM,CAAA;QACf,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAA;QAClC,MAAM,GAAG,MAAM;YACb,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE;YACtE,CAAC,CAAC,SAAS,CAAA;QACb,OAAO,MAAM,CAAA;IACf,CAAC,CAAA;IAED,MAAM,aAAa,GAAG,GAAwC,EAAE;QAC9D,IAAI,aAAa,CAAC,GAAG,CAAC;YAAE,OAAO,gBAAgB,CAAA;QAC/C,IAAI,CAAC,IAAI;YAAE,OAAO,mBAAmB,CAAA;QACrC,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;IAED,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,6FAA6F;QAC7F,wFAAwF;QACxF,4FAA4F;QAC5F,6FAA6F;QAC7F,iCAAiC;QACjC,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,qBAAqB,CAAC,CAAC;QACtE,4FAA4F;QAC5F,0FAA0F;QAC1F,8FAA8F;QAC9F,4FAA4F;QAC5F,8FAA8F;QAC9F,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC1C,IAAI,aAAa,EAAE,KAAK,gBAAgB,EAAE,CAAC;gBACzC,MAAM,IAAI,aAAa,CACrB,GAAG,WAAW,CAAC,QAAQ,CAAC,6FAA6F,CACtH,CAAA;YACH,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,EAAE,GAAG,EAAE,CAAA;YACzB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,gBAAgB,CACxB,wFAAwF,CACzF,CAAA;YACH,CAAC;YACD,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC,CAAA;YAC/D,MAAM,GAAG,IAAI,CAAA;YACb,MAAM,IAAI,GAAG,OAAO,EAAE,CAAA;YACtB,KAAK,MAAM,QAAQ,IAAI,SAAS;gBAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;QAClD,CAAC;QACD,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE;KAC3B,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAsB,EACtB,UAA0C;IAE1C,IAAI,UAAU,EAAE,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IACvD,MAAM,OAAO,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAA;IAC3C,IAAI,CAAC,OAAO;QAAE,OAAO,YAAY,CAAA;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,4FAA4F;QAC5F,kFAAkF;QAClF,OAAO,YAAY,CAAA;IACrB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAsB,EACtB,UAA0C;IAE1C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;QAClB,IAAI,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IACrB,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IAC7C,IAAI,MAAM;QAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC7B,OAAO,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAC1D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/local-server",
-  "version": "0.110.0",
+  "version": "0.111.0",
   "description": "Local-mode runtime facade for the Agent Architecture Board: the @cat-factory/node-server stack with agent jobs run as local Docker/Podman containers and GitHub accessed via a personal access token — a developer can run the whole product on their own machine.",
   "repository": {
     "type": "git",
@@ -27,23 +27,23 @@
     "@hono/node-server": "^2.1.0",
     "drizzle-orm": "1.0.0-rc.4",
     "ws": "^8.21.2",
-    "@cat-factory/agents": "0.113.0",
-    "@cat-factory/contracts": "0.246.0",
     "@cat-factory/executor-harness": "1.92.2",
-    "@cat-factory/gitlab": "0.15.42",
-    "@cat-factory/integrations": "0.131.0",
-    "@cat-factory/kernel": "0.244.0",
-    "@cat-factory/node-server": "0.176.0",
-    "@cat-factory/orchestration": "0.213.0",
-    "@cat-factory/server": "0.223.0"
+    "@cat-factory/contracts": "0.248.0",
+    "@cat-factory/gitlab": "0.16.0",
+    "@cat-factory/integrations": "0.132.0",
+    "@cat-factory/agents": "0.114.1",
+    "@cat-factory/kernel": "0.246.0",
+    "@cat-factory/orchestration": "0.215.0",
+    "@cat-factory/node-server": "0.177.1",
+    "@cat-factory/server": "0.225.0"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",
     "@types/ws": "^8.18.1",
     "typescript": "7.0.2",
     "vitest": "^4.1.10",
-    "@cat-factory/conformance": "0.31.0",
-    "@cat-factory/gates": "0.9.6"
+    "@cat-factory/conformance": "0.31.2",
+    "@cat-factory/gates": "0.9.8"
   },
   "scripts": {
     "build": "tsc -b tsconfig.build.json",