@cat-factory/local-server 0.7.2 → 0.7.3

package/dist/github.js

@@ -0,0 +1,174 @@
+import { randomUUID } from 'node:crypto';
+import { FetchGitHubClient } from '@cat-factory/server';
+// PAT-backed GitHub access for local mode. The shared FetchGitHubClient normally mints
+// per-installation tokens via the GitHub App registry; here we feed it a static-token
+// source returning the developer's PAT, so the CI gate + merge / mergeability
+// providers (wired in container.ts from this client) hit real GitHub with the PAT.
+//
+// The app-JWT paths (installation discovery / listing) are never reached in local
+// mode — those are the GitHub-App connect flow, which local mode replaces with the
+// linkRepo helper — so they throw rather than pretend to work.
+// The scopes a local-mode PAT needs. Agent containers clone/push branches and open PRs
+// (`repo`, which also covers reading the PR head's Actions check runs for the CI gate and
+// merging the PR), and the coder/ci-fixer may touch `.github/workflows/*` files (`workflow`).
+const LOCAL_PAT_SCOPES = ['repo', 'workflow'];
+/**
+ * A GitHub "new personal access token (classic)" URL with the scopes local mode needs
+ * pre-selected, so a developer without a PAT can click straight through to create one.
+ * Classic tokens are used (not fine-grained) because only the classic form accepts the
+ * `scopes` query param for pre-selection.
+ */
+export function githubPatCreationUrl() {
+    const params = new URLSearchParams({
+        description: 'cat-factory local mode',
+        scopes: LOCAL_PAT_SCOPES.join(','),
+    });
+    return `https://github.com/settings/tokens/new?${params.toString()}`;
+}
+/** An {@link AppTokenSource} that returns a fixed PAT for every installation call. */
+export class StaticTokenAppRegistry {
+    token;
+    defaultAppId = '';
+    constructor(token) {
+        this.token = token;
+    }
+    apps() {
+        return [{ appId: '' }];
+    }
+    authForApp() {
+        return {
+            appJwt: () => Promise.reject(new Error('GitHub App JWT is not available in local (PAT) mode')),
+        };
+    }
+    installationToken() {
+        return Promise.resolve(this.token);
+    }
+}
+/** Rate-limit accounting is best-effort telemetry the local facade simply drops. */
+class NoopRateLimitRepository {
+    record(_snapshot) {
+        return Promise.resolve();
+    }
+    deleteOlderThan(_epochMs) {
+        return Promise.resolve(0);
+    }
+}
+const localIdGenerator = {
+    next: (prefix) => (prefix ? `${prefix}_${randomUUID()}` : randomUUID()),
+};
+const localClock = { now: () => Date.now() };
+const PER_PAGE = 100;
+const MAX_PAGES = 20;
+/** Parse the `rel="next"` URL out of a GitHub `Link` response header, if present. */
+function nextLink(header) {
+    if (!header)
+        return null;
+    for (const part of header.split(',')) {
+        const m = part.match(/<([^>]+)>\s*;\s*rel="next"/);
+        if (m)
+            return m[1] ?? null;
+    }
+    return null;
+}
+function toRepoProjection(p, installationId, syncedAt) {
+    return {
+        githubId: p.id,
+        installationId,
+        owner: p.owner?.login ?? '',
+        name: p.name,
+        defaultBranch: p.default_branch ?? null,
+        private: p.private ?? false,
+        blockId: null,
+        syncedAt,
+    };
+}
+function patHeaders(pat) {
+    return {
+        authorization: `Bearer ${pat}`,
+        accept: 'application/vnd.github+json',
+        'x-github-api-version': '2022-11-28',
+        'user-agent': 'cat-factory',
+    };
+}
+/**
+ * A {@link FetchGitHubClient} that lists repos a PAT can access via `/user/repos`, the
+ * personal-token analogue of the App-only `/installation/repositories` the base client
+ * uses (which 403s for a PAT). The board's "Add from existing repo" picker, the
+ * link-a-repo flow and the monorepo browser all enumerate repos through
+ * `listInstallationRepos`, so overriding this one method makes them work under a PAT.
+ * Every other call (repo/branch/PR/issue reads, merges) already works with the PAT via
+ * the installation-token paths, so they fall through to the base implementation.
+ */
+class PatGitHubClient extends FetchGitHubClient {
+    pat;
+    apiBase;
+    clock;
+    constructor(deps, pat, apiBase, clock) {
+        super(deps);
+        this.pat = pat;
+        this.apiBase = apiBase;
+        this.clock = clock;
+    }
+    async listInstallationRepos(installationId) {
+        const syncedAt = this.clock.now();
+        const items = [];
+        let url = `${this.apiBase}/user/repos?per_page=${PER_PAGE}&sort=full_name&affiliation=owner,collaborator,organization_member`;
+        for (let page = 0; url && page < MAX_PAGES; page++) {
+            const res = await fetch(url, { headers: patHeaders(this.pat) });
+            if (!res.ok) {
+                const text = await res.text().catch(() => '');
+                throw new Error(`GitHub /user/repos failed (HTTP ${res.status}): ${text.slice(0, 200)}`);
+            }
+            const payload = (await res.json());
+            for (const repo of payload)
+                items.push(toRepoProjection(repo, installationId, syncedAt));
+            url = nextLink(res.headers.get('link'));
+        }
+        return { items };
+    }
+}
+/**
+ * Read the PAT's own account (`GET /user`) so a synthetic installation can be attributed
+ * to it in the connect UI. Best-effort: a failed/forbidden call falls back to an empty
+ * login (the link flow only needs the installation row to exist, not its account label).
+ */
+export async function fetchPatAccount(env) {
+    const fallback = { accountId: null, accountLogin: '', targetType: 'User' };
+    const pat = env.GITHUB_PAT?.trim();
+    if (!pat)
+        return fallback;
+    const apiBase = (env.GITHUB_API_BASE?.trim() || 'https://api.github.com').replace(/\/+$/, '');
+    try {
+        const res = await fetch(`${apiBase}/user`, { headers: patHeaders(pat) });
+        if (!res.ok)
+            return fallback;
+        const user = (await res.json());
+        return {
+            accountId: user.id != null ? String(user.id) : null,
+            accountLogin: user.login ?? '',
+            targetType: user.type === 'Organization' ? 'Organization' : 'User',
+        };
+    }
+    catch {
+        return fallback;
+    }
+}
+/**
+ * Build a {@link GitHubClient} that authenticates with the PAT, for the CI / merge /
+ * mergeability gates AND the repo-link / board "add from repo" flows. Returns undefined
+ * when no PAT is configured (the gates then pass through, like the Node default).
+ */
+export function createLocalGitHubClient(env) {
+    const pat = env.GITHUB_PAT?.trim();
+    if (!pat)
+        return undefined;
+    const apiBase = env.GITHUB_API_BASE?.trim() || 'https://api.github.com';
+    return new PatGitHubClient({
+        registry: new StaticTokenAppRegistry(pat),
+        rateLimitRepository: new NoopRateLimitRepository(),
+        idGenerator: localIdGenerator,
+        clock: localClock,
+        apiBase,
+    }, pat, apiBase, localClock);
+}
+//# sourceMappingURL=github.js.map

package/dist/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../src/github.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAUxC,OAAO,EAAuB,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAG5E,uFAAuF;AACvF,sFAAsF;AACtF,8EAA8E;AAC9E,mFAAmF;AACnF,EAAE;AACF,kFAAkF;AAClF,mFAAmF;AACnF,+DAA+D;AAE/D,uFAAuF;AACvF,0FAA0F;AAC1F,8FAA8F;AAC9F,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,UAAU,CAAU,CAAA;AAEtD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,WAAW,EAAE,wBAAwB;QACrC,MAAM,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;KACnC,CAAC,CAAA;IACF,OAAO,0CAA0C,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;AACtE,CAAC;AAED,sFAAsF;AACtF,MAAM,OAAO,sBAAsB;IAEJ,KAAK;IADzB,YAAY,GAAG,EAAE,CAAA;IAC1B,YAA6B,KAAa;qBAAb,KAAK;IAAW,CAAC;IAE9C,IAAI;QACF,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAA;IACxB,CAAC;IAED,UAAU;QACR,OAAO;YACL,MAAM,EAAE,GAAG,EAAE,CACX,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;SACnF,CAAA;IACH,CAAC;IAED,iBAAiB;QACf,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpC,CAAC;CACF;AAED,oFAAoF;AACpF,MAAM,uBAAuB;IAC3B,MAAM,CAAC,SAA4B;QACjC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;IAC1B,CAAC;IACD,eAAe,CAAC,QAAgB;QAC9B,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC3B,CAAC;CACF;AAED,MAAM,gBAAgB,GAAgB;IACpC,IAAI,EAAE,CAAC,MAAe,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;CACjF,CAAA;AAED,MAAM,UAAU,GAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAA;AAEnD,MAAM,QAAQ,GAAG,GAAG,CAAA;AACpB,MAAM,SAAS,GAAG,EAAE,CAAA;AAEpB,qFAAqF;AACrF,SAAS,QAAQ,CAAC,MAAqB;IACrC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAA;QAClD,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;IAC5B,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAWD,SAAS,gBAAgB,CAAC,CAAa,EAAE,cAAsB,EAAE,QAAgB;IAC/E,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,EAAE;QACd,cAAc;QACd,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,aAAa,EAAE,CAAC,CAAC,cAAc,IAAI,IAAI;QACvC,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,KAAK;QAC3B,OAAO,EAAE,IAAI;QACb,QAAQ;KACT,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO;QACL,aAAa,EAAE,UAAU,GAAG,EAAE;QAC9B,MAAM,EAAE,6BAA6B;QACrC,sBAAsB,EAAE,YAAY;QACpC,YAAY,EAAE,aAAa;KAC5B,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,eAAgB,SAAQ,iBAAiB;IAG1B,GAAG;IACH,OAAO;IACP,KAAK;IAJxB,YACE,IAAwD,EACvC,GAAW,EACX,OAAe,EACf,KAAY;QAE7B,KAAK,CAAC,IAAI,CAAC,CAAA;mBAJM,GAAG;uBACH,OAAO;qBACP,KAAK;IAGxB,CAAC;IAEQ,KAAK,CAAC,qBAAqB,CAAC,cAAsB;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,KAAK,GAAiB,EAAE,CAAA;QAC9B,IAAI,GAAG,GACL,GAAG,IAAI,CAAC,OAAO,wBAAwB,QAAQ,oEAAoE,CAAA;QACrH,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,GAAG,IAAI,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;YACnD,MAAM,GAAG,GAAa,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACzE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;gBAC7C,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;YAC1F,CAAC;YACD,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiB,CAAA;YAClD,KAAK,MAAM,IAAI,IAAI,OAAO;gBAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAA;YACxF,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;QACzC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,CAAA;IAClB,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAsB;IAC1D,MAAM,QAAQ,GAAe,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IACtF,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAA;IAClC,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAA;IACzB,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,wBAAwB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAC7F,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,OAAO,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACxE,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmD,CAAA;QACjF,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;YACnD,YAAY,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;YAC9B,UAAU,EAAE,IAAI,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM;SACnE,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAA;IACjB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAsB;IAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAA;IAClC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAA;IAC1B,MAAM,OAAO,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,wBAAwB,CAAA;IACvE,OAAO,IAAI,eAAe,CACxB;QACE,QAAQ,EAAE,IAAI,sBAAsB,CAAC,GAAG,CAAC;QACzC,mBAAmB,EAAE,IAAI,uBAAuB,EAAE;QAClD,WAAW,EAAE,gBAAgB;QAC7B,KAAK,EAAE,UAAU;QACjB,OAAO;KACR,EACD,GAAG,EACH,OAAO,EACP,UAAU,CACX,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+export { startLocal } from './server.js';
+export { buildLocalContainer } from './container.js';
+export { loadLocalConfig, applyLocalDefaults } from './config.js';
+export { LocalContainerRunnerTransport, createLocalContainerTransportFromEnv, type LocalContainerRunnerTransportOptions, } from './LocalContainerRunnerTransport.js';
+export { type ContainerRuntimeAdapter, type ContainerExec, type RuntimeId, createRuntimeAdapter, resolveRuntimeId, runtimeProfile, resolveHostAlias, DockerRuntimeAdapter, AppleContainerRuntimeAdapter, } from './runtimes/index.js';
+export { linkRepo, type LinkRepoOptions, type LinkedRepo } from './linkRepo.js';
+export { createLocalGitHubClient, StaticTokenAppRegistry } from './github.js';
+export { registerAgentKind, registerAgentKinds, clearRegisteredAgentKinds, type AgentKindDefinition, } from '@cat-factory/agents';
+export { registerPipeline, registerPipelines, clearRegisteredPipelines } from '@cat-factory/kernel';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,EACL,6BAA6B,EAC7B,oCAAoC,EACpC,KAAK,oCAAoC,GAC1C,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,qBAAqB,CAAA;AAI5B,OAAO,EAAE,QAAQ,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAA;AAE/E,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAI7E,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/index.js

@@ -0,0 +1,23 @@
+// @cat-factory/local-server — the local-mode runtime facade. It is the Node.js
+// facade (@cat-factory/node-server: shared Hono app + Drizzle/Postgres + pg-boss)
+// with two differentiators so a developer can run the whole product on their own
+// machine: agent jobs run as per-run local containers (Docker/Podman/OrbStack/Colima/
+// Apple `container`, selected by LOCAL_CONTAINER_RUNTIME), and GitHub is
+// reached via a personal access token (no GitHub App). `startLocal()` boots the
+// service; `buildLocalContainer()` is the composition root.
+export { startLocal } from './server.js';
+export { buildLocalContainer } from './container.js';
+export { loadLocalConfig, applyLocalDefaults } from './config.js';
+export { LocalContainerRunnerTransport, createLocalContainerTransportFromEnv, } from './LocalContainerRunnerTransport.js';
+export { createRuntimeAdapter, resolveRuntimeId, runtimeProfile, resolveHostAlias, DockerRuntimeAdapter, AppleContainerRuntimeAdapter, } from './runtimes/index.js';
+// Seed the github_installations/github_repos projection so container agent steps can
+// resolve a target repo in local mode (no GitHub App connect flow). Also a CLI:
+// `node dist/link-repo.js <workspaceId> <frameBlockId> <owner/repo>`.
+export { linkRepo } from './linkRepo.js';
+// PAT-backed GitHub access for the CI gate + merge / mergeability providers.
+export { createLocalGitHubClient, StaticTokenAppRegistry } from './github.js';
+// Installation-level extension points, re-exported for parity with the Node facade so
+// a local deployment can register custom agent kinds / pipelines before `startLocal()`.
+export { registerAgentKind, registerAgentKinds, clearRegisteredAgentKinds, } from '@cat-factory/agents';
+export { registerPipeline, registerPipelines, clearRegisteredPipelines } from '@cat-factory/kernel';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,kFAAkF;AAClF,iFAAiF;AACjF,sFAAsF;AACtF,yEAAyE;AACzE,gFAAgF;AAChF,4DAA4D;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,EACL,6BAA6B,EAC7B,oCAAoC,GAErC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAIL,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,qBAAqB,CAAA;AAC5B,qFAAqF;AACrF,gFAAgF;AAChF,sEAAsE;AACtE,OAAO,EAAE,QAAQ,EAAyC,MAAM,eAAe,CAAA;AAC/E,6EAA6E;AAC7E,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAE7E,sFAAsF;AACtF,wFAAwF;AACxF,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,GAE1B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/installations.d.ts

@@ -0,0 +1,31 @@
+import type { GitHubInstallation, GitHubInstallationRepository } from '@cat-factory/kernel';
+/** A stable, positive, safe-integer installation id derived from the workspace id. */
+export declare function syntheticInstallationId(workspaceId: string): number;
+/** The PAT account a synthetic installation is attributed to (shown in the connect UI). */
+export interface PatAccount {
+    accountId: string | null;
+    accountLogin: string;
+    targetType: 'Organization' | 'User';
+}
+/**
+ * Wraps a real {@link GitHubInstallationRepository} so that, in local PAT mode, a
+ * workspace's installation is conjured on first read instead of requiring a connect flow.
+ * Every method delegates to the inner repository; only {@link getByWorkspace} adds the
+ * lazy provision (and only when no live row exists — a CLI-seeded or already-provisioned
+ * row is returned untouched). The provisioned row carries the synthetic id, so a repo
+ * later linked via the CLI lands under the same installation.
+ */
+export declare class AutoProvisioningInstallationRepository implements GitHubInstallationRepository {
+    private readonly inner;
+    private readonly resolveAccount;
+    private readonly now;
+    constructor(inner: GitHubInstallationRepository, resolveAccount: () => Promise<PatAccount>, now?: () => number);
+    getByWorkspace(workspaceId: string): Promise<GitHubInstallation | null>;
+    getByInstallationId(installationId: number): Promise<GitHubInstallation | null>;
+    listWorkspacesForInstallation(installationId: number): Promise<string[]>;
+    listActive(): Promise<GitHubInstallation[]>;
+    upsert(installation: GitHubInstallation): Promise<void>;
+    updateCachedToken(installationId: number, token: string, expiresAt: number): Promise<void>;
+    softDelete(installationId: number, at: number): Promise<void>;
+}
+//# sourceMappingURL=installations.d.ts.map

package/dist/installations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installations.d.ts","sourceRoot":"","sources":["../src/installations.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAA;AAa3F,sFAAsF;AACtF,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAMnE;AAED,2FAA2F;AAC3F,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,cAAc,GAAG,MAAM,CAAA;CACpC;AAED;;;;;;;GAOG;AACH,qBAAa,sCAAuC,YAAW,4BAA4B;IAEvF,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,GAAG;IAHtB,YACmB,KAAK,EAAE,4BAA4B,EACnC,cAAc,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,EACzC,GAAG,GAAE,MAAM,MAAyB,EACnD;IAEE,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAkB5E;IAED,mBAAmB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAE9E;IAED,6BAA6B,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAEvE;IAED,UAAU,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAE1C;IAED,MAAM,CAAC,YAAY,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtD;IAED,iBAAiB,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzF;IAED,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5D;CACF"}

package/dist/installations.js

@@ -0,0 +1,76 @@
+import { createHash } from 'node:crypto';
+// Local mode has no GitHub-App connect flow: a single developer runs the whole product
+// against one PAT. So instead of binding a real App installation, every workspace is
+// implicitly "connected" to the PAT. This module supplies the two pieces that makes the
+// shared GitHub integration work that way:
+//   - `syntheticInstallationId`: a stable per-workspace id (the projection rows the CLI
+//     `linkRepo` helper and the in-UI link flow both write key off it, so they agree);
+//   - `AutoProvisioningInstallationRepository`: a decorator that lazily materialises that
+//     synthetic `github_installations` row the first time a workspace's installation is
+//     read, so `getConnection` reports connected and the sync service has an
+//     installation id to list/link repos under — no manual connect step.
+/** A stable, positive, safe-integer installation id derived from the workspace id. */
+export function syntheticInstallationId(workspaceId) {
+    // 48 bits keeps it well inside Number.MAX_SAFE_INTEGER and the bigint column; the value
+    // is per-workspace (the table's workspace_id is unique) so two workspaces never collide,
+    // and re-provisioning a workspace reuses the same id (upsert, not a new row).
+    const hex = createHash('sha1').update(workspaceId).digest('hex').slice(0, 12);
+    return Number.parseInt(hex, 16);
+}
+/**
+ * Wraps a real {@link GitHubInstallationRepository} so that, in local PAT mode, a
+ * workspace's installation is conjured on first read instead of requiring a connect flow.
+ * Every method delegates to the inner repository; only {@link getByWorkspace} adds the
+ * lazy provision (and only when no live row exists — a CLI-seeded or already-provisioned
+ * row is returned untouched). The provisioned row carries the synthetic id, so a repo
+ * later linked via the CLI lands under the same installation.
+ */
+export class AutoProvisioningInstallationRepository {
+    inner;
+    resolveAccount;
+    now;
+    constructor(inner, resolveAccount, now = () => Date.now()) {
+        this.inner = inner;
+        this.resolveAccount = resolveAccount;
+        this.now = now;
+    }
+    async getByWorkspace(workspaceId) {
+        const existing = await this.inner.getByWorkspace(workspaceId);
+        if (existing && !existing.deletedAt)
+            return existing;
+        const account = await this.resolveAccount();
+        const installation = {
+            installationId: syntheticInstallationId(workspaceId),
+            workspaceId,
+            accountId: account.accountId,
+            accountLogin: account.accountLogin,
+            targetType: account.targetType,
+            appId: null,
+            cachedToken: null,
+            tokenExpiresAt: null,
+            createdAt: this.now(),
+            deletedAt: null,
+        };
+        await this.inner.upsert(installation);
+        return installation;
+    }
+    getByInstallationId(installationId) {
+        return this.inner.getByInstallationId(installationId);
+    }
+    listWorkspacesForInstallation(installationId) {
+        return this.inner.listWorkspacesForInstallation(installationId);
+    }
+    listActive() {
+        return this.inner.listActive();
+    }
+    upsert(installation) {
+        return this.inner.upsert(installation);
+    }
+    updateCachedToken(installationId, token, expiresAt) {
+        return this.inner.updateCachedToken(installationId, token, expiresAt);
+    }
+    softDelete(installationId, at) {
+        return this.inner.softDelete(installationId, at);
+    }
+}
+//# sourceMappingURL=installations.js.map

package/dist/installations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installations.js","sourceRoot":"","sources":["../src/installations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGxC,uFAAuF;AACvF,qFAAqF;AACrF,wFAAwF;AACxF,2CAA2C;AAC3C,wFAAwF;AACxF,uFAAuF;AACvF,0FAA0F;AAC1F,wFAAwF;AACxF,6EAA6E;AAC7E,yEAAyE;AAEzE,sFAAsF;AACtF,MAAM,UAAU,uBAAuB,CAAC,WAAmB;IACzD,wFAAwF;IACxF,yFAAyF;IACzF,8EAA8E;IAC9E,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC7E,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;AACjC,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,OAAO,sCAAsC;IAE9B,KAAK;IACL,cAAc;IACd,GAAG;IAHtB,YACmB,KAAmC,EACnC,cAAyC,EACzC,GAAG,GAAiB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;qBAFpC,KAAK;8BACL,cAAc;mBACd,GAAG;IACnB,CAAC;IAEJ,KAAK,CAAC,cAAc,CAAC,WAAmB;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QAC7D,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,SAAS;YAAE,OAAO,QAAQ,CAAA;QACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAA;QAC3C,MAAM,YAAY,GAAuB;YACvC,cAAc,EAAE,uBAAuB,CAAC,WAAW,CAAC;YACpD,WAAW;YACX,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,KAAK,EAAE,IAAI;YACX,WAAW,EAAE,IAAI;YACjB,cAAc,EAAE,IAAI;YACpB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,SAAS,EAAE,IAAI;SAChB,CAAA;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;QACrC,OAAO,YAAY,CAAA;IACrB,CAAC;IAED,mBAAmB,CAAC,cAAsB;QACxC,OAAO,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAA;IACvD,CAAC;IAED,6BAA6B,CAAC,cAAsB;QAClD,OAAO,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,cAAc,CAAC,CAAA;IACjE,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAA;IAChC,CAAC;IAED,MAAM,CAAC,YAAgC;QACrC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IACxC,CAAC;IAED,iBAAiB,CAAC,cAAsB,EAAE,KAAa,EAAE,SAAiB;QACxE,OAAO,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,cAAc,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;IACvE,CAAC;IAED,UAAU,CAAC,cAAsB,EAAE,EAAU;QAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,cAAc,EAAE,EAAE,CAAC,CAAA;IAClD,CAAC;CACF"}

package/dist/link-repo.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=link-repo.d.ts.map

package/dist/link-repo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-repo.d.ts","sourceRoot":"","sources":["../src/link-repo.ts"],"names":[],"mappings":""}

package/dist/link-repo.js

@@ -0,0 +1,21 @@
+import { linkRepo } from './linkRepo.js';
+// Small CLI to link a real GitHub repo to a board service frame in local mode:
+//   node dist/link-repo.js <workspaceId> <frameBlockId> <owner/repo>
+// Reads GITHUB_PAT + DATABASE_URL from the environment (load a .env via Node's
+// `--env-file-if-exists`). Seeds the github_installations + github_repos rows the
+// container executor resolves a run's target repo from.
+const [workspaceId, frameBlockId, repo] = process.argv.slice(2);
+if (!workspaceId || !frameBlockId || !repo) {
+    console.error('usage: link-repo <workspaceId> <frameBlockId> <owner/repo>');
+    process.exit(2);
+}
+linkRepo({ workspaceId, frameBlockId, repo })
+    .then((r) => {
+    console.log(`linked ${r.owner}/${r.name} (#${r.githubId}) → frame ${frameBlockId} ` +
+        `[default branch: ${r.defaultBranch}, installation ${r.installationId}]`);
+})
+    .catch((err) => {
+    console.error('link failed:', err instanceof Error ? err.message : String(err));
+    process.exit(1);
+});
+//# sourceMappingURL=link-repo.js.map

package/dist/link-repo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-repo.js","sourceRoot":"","sources":["../src/link-repo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,+EAA+E;AAC/E,qEAAqE;AACrE,+EAA+E;AAC/E,kFAAkF;AAClF,wDAAwD;AACxD,MAAM,CAAC,WAAW,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAE/D,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,EAAE,CAAC;IAC3C,OAAO,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAA;IAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC;AAED,QAAQ,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;KAC1C,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;IACV,OAAO,CAAC,GAAG,CACT,UAAU,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,QAAQ,aAAa,YAAY,GAAG;QACrE,oBAAoB,CAAC,CAAC,aAAa,kBAAkB,CAAC,CAAC,cAAc,GAAG,CAC3E,CAAA;AACH,CAAC,CAAC;KACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IACtB,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;IAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}

package/dist/linkRepo.d.ts

@@ -0,0 +1,31 @@
+import { type DrizzleDb } from '@cat-factory/node-server';
+export interface LinkRepoOptions {
+    /** The board workspace id. */
+    workspaceId: string;
+    /** The service-frame block id tasks will sit under (the repo links to this). */
+    frameBlockId: string;
+    /** The repository, as `owner/name`. */
+    repo: string;
+    /** Pre-built Drizzle client; else one is opened from {@link databaseUrl}. */
+    db?: DrizzleDb;
+    /** `DATABASE_URL`; required when {@link db} is not supplied. */
+    databaseUrl?: string;
+    /** The PAT; defaults to `env.GITHUB_PAT`. */
+    pat?: string;
+    /** GitHub API base; defaults to `env.GITHUB_API_BASE` or api.github.com. */
+    apiBase?: string;
+    /** Environment source for the PAT / API base defaults. */
+    env?: NodeJS.ProcessEnv;
+    /** Injectable fetch (tests). */
+    fetchImpl?: typeof fetch;
+}
+export interface LinkedRepo {
+    owner: string;
+    name: string;
+    githubId: number;
+    installationId: number;
+    defaultBranch: string;
+    private: boolean;
+}
+export declare function linkRepo(options: LinkRepoOptions): Promise<LinkedRepo>;
+//# sourceMappingURL=linkRepo.d.ts.map

package/dist/linkRepo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"linkRepo.d.ts","sourceRoot":"","sources":["../src/linkRepo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAA0B,MAAM,0BAA0B,CAAA;AAkBjF,MAAM,WAAW,eAAe;IAC9B,8BAA8B;IAC9B,WAAW,EAAE,MAAM,CAAA;IACnB,gFAAgF;IAChF,YAAY,EAAE,MAAM,CAAA;IACpB,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAA;IACZ,6EAA6E;IAC7E,EAAE,CAAC,EAAE,SAAS,CAAA;IACd,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,6CAA6C;IAC7C,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IACvB,gCAAgC;IAChC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,CAAA;IACrB,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAgH5E"}

package/dist/linkRepo.js

@@ -0,0 +1,113 @@
+import { createDbClient, schema } from '@cat-factory/node-server';
+import { and, eq, ne } from 'drizzle-orm';
+import { syntheticInstallationId } from './installations.js';
+// Link a real GitHub repo to a board service frame for LOCAL mode. Container agent
+// steps resolve which repo to operate on from the `github_repos` /
+// `github_installations` projection (`buildResolveRepoTarget`). The cloud facades
+// populate those rows from the GitHub App connect/sync flow; local mode has no App, so
+// this helper seeds them directly from the repo's public metadata read with the PAT:
+//   - a synthetic per-workspace `github_installations` row (the executor's PAT token
+//     source ignores the installation id, but `resolveRepoTarget` requires a row to
+//     exist + reads its id back), and
+//   - a `github_repos` row linked to the frame via `block_id` (the legacy projection
+//     link `resolveRepoTarget` walks the block ancestry to find).
+// Idempotent: re-linking the same repo/frame updates the rows in place.
+const GITHUB_API_BASE = 'https://api.github.com';
+export async function linkRepo(options) {
+    const env = options.env ?? process.env;
+    const pat = options.pat ?? env.GITHUB_PAT?.trim();
+    if (!pat)
+        throw new Error('A GitHub PAT is required (set GITHUB_PAT or pass options.pat)');
+    const apiBase = (options.apiBase ?? env.GITHUB_API_BASE?.trim() ?? GITHUB_API_BASE).replace(/\/+$/, '');
+    const slash = options.repo.indexOf('/');
+    if (slash <= 0 || slash === options.repo.length - 1) {
+        throw new Error(`Invalid repo '${options.repo}' — expected 'owner/name'`);
+    }
+    const owner = options.repo.slice(0, slash);
+    const name = options.repo.slice(slash + 1);
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const res = await fetchImpl(`${apiBase}/repos/${owner}/${name}`, {
+        headers: {
+            authorization: `Bearer ${pat}`,
+            accept: 'application/vnd.github+json',
+            'user-agent': 'cat-factory',
+        },
+    });
+    if (!res.ok) {
+        const text = await res.text().catch(() => '');
+        throw new Error(`GitHub repo lookup failed (HTTP ${res.status}): ${text.slice(0, 200)}`);
+    }
+    const meta = (await res.json());
+    const installationId = syntheticInstallationId(options.workspaceId);
+    const defaultBranch = meta.default_branch ?? 'main';
+    const now = Date.now();
+    let db = options.db;
+    let close;
+    if (!db) {
+        const url = options.databaseUrl ?? env.DATABASE_URL;
+        if (!url)
+            throw new Error('DATABASE_URL is required to link a repo (or pass options.db)');
+        const client = createDbClient(url);
+        db = client.db;
+        close = () => client.pool.end();
+    }
+    try {
+        const installationValues = {
+            installation_id: installationId,
+            workspace_id: options.workspaceId,
+            account_id: meta.owner?.id != null ? String(meta.owner.id) : null,
+            account_login: meta.owner?.login ?? owner,
+            target_type: meta.owner?.type === 'Organization' ? 'Organization' : 'User',
+            app_id: null,
+            cached_token: null,
+            token_expires_at: null,
+            created_at: now,
+            deleted_at: null,
+        };
+        // `github_installations` has a partial UNIQUE index on (workspace_id) WHERE
+        // deleted_at IS NULL, so a pre-existing live row for this workspace under a DIFFERENT
+        // id (e.g. from a real GitHub-App connect) would collide with our synthetic-id
+        // insert — and the upsert below keys on installation_id, not workspace_id, so it
+        // wouldn't catch it. Clear any such row first so re-linking is robust.
+        await db
+            .delete(schema.githubInstallations)
+            .where(and(eq(schema.githubInstallations.workspace_id, options.workspaceId), ne(schema.githubInstallations.installation_id, installationId)));
+        await db.insert(schema.githubInstallations).values(installationValues).onConflictDoUpdate({
+            target: schema.githubInstallations.installation_id,
+            set: installationValues,
+        });
+        const repoValues = {
+            workspace_id: options.workspaceId,
+            github_id: meta.id,
+            installation_id: installationId,
+            owner,
+            name,
+            default_branch: defaultBranch,
+            private: meta.private ? 1 : 0,
+            block_id: options.frameBlockId,
+            is_monorepo: 0,
+            etag: null,
+            synced_at: now,
+            deleted_at: null,
+        };
+        await db
+            .insert(schema.githubRepos)
+            .values(repoValues)
+            .onConflictDoUpdate({
+            target: [schema.githubRepos.workspace_id, schema.githubRepos.github_id],
+            set: repoValues,
+        });
+    }
+    finally {
+        await close?.();
+    }
+    return {
+        owner,
+        name,
+        githubId: meta.id,
+        installationId,
+        defaultBranch,
+        private: Boolean(meta.private),
+    };
+}
+//# sourceMappingURL=linkRepo.js.map

package/dist/linkRepo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linkRepo.js","sourceRoot":"","sources":["../src/linkRepo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,cAAc,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAA;AACjF,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AAE5D,mFAAmF;AACnF,mEAAmE;AACnE,kFAAkF;AAClF,uFAAuF;AACvF,qFAAqF;AACrF,qFAAqF;AACrF,oFAAoF;AACpF,sCAAsC;AACtC,qFAAqF;AACrF,kEAAkE;AAClE,wEAAwE;AAExE,MAAM,eAAe,GAAG,wBAAwB,CAAA;AAgChD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAwB;IACrD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAA;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAA;IACjD,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;IAC1F,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,CAAC,OAAO,CACzF,MAAM,EACN,EAAE,CACH,CAAA;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,iBAAiB,OAAO,CAAC,IAAI,2BAA2B,CAAC,CAAA;IAC3E,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;IAE1C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAA;IAC5C,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,UAAU,KAAK,IAAI,IAAI,EAAE,EAAE;QAC/D,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,GAAG,EAAE;YAC9B,MAAM,EAAE,6BAA6B;YACrC,YAAY,EAAE,aAAa;SAC5B;KACF,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;QAC7C,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;IAC1F,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAK7B,CAAA;IAED,MAAM,cAAc,GAAG,uBAAuB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IACnE,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,IAAI,MAAM,CAAA;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAEtB,IAAI,EAAE,GAAG,OAAO,CAAC,EAAE,CAAA;IACnB,IAAI,KAAwC,CAAA;IAC5C,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC,YAAY,CAAA;QACnD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;QACzF,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;QAClC,EAAE,GAAG,MAAM,CAAC,EAAE,CAAA;QACd,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAA;IACjC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,kBAAkB,GAAG;YACzB,eAAe,EAAE,cAAc;YAC/B,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;YACjE,aAAa,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,IAAI,KAAK;YACzC,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM;YAC1E,MAAM,EAAE,IAAI;YACZ,YAAY,EAAE,IAAI;YAClB,gBAAgB,EAAE,IAAI;YACtB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,IAAI;SACjB,CAAA;QACD,4EAA4E;QAC5E,sFAAsF;QACtF,+EAA+E;QAC/E,iFAAiF;QACjF,uEAAuE;QACvE,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC;aAClC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,YAAY,EAAE,OAAO,CAAC,WAAW,CAAC,EAChE,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,eAAe,EAAE,cAAc,CAAC,CAC/D,CACF,CAAA;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,kBAAkB,CAAC;YACxF,MAAM,EAAE,MAAM,CAAC,mBAAmB,CAAC,eAAe;YAClD,GAAG,EAAE,kBAAkB;SACxB,CAAC,CAAA;QAEF,MAAM,UAAU,GAAG;YACjB,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,SAAS,EAAE,IAAI,CAAC,EAAE;YAClB,eAAe,EAAE,cAAc;YAC/B,KAAK;YACL,IAAI;YACJ,cAAc,EAAE,aAAa;YAC7B,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7B,QAAQ,EAAE,OAAO,CAAC,YAAY;YAC9B,WAAW,EAAE,CAAC;YACd,IAAI,EAAE,IAAI;YACV,SAAS,EAAE,GAAG;YACd,UAAU,EAAE,IAAI;SACjB,CAAA;QACD,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;aAC1B,MAAM,CAAC,UAAU,CAAC;aAClB,kBAAkB,CAAC;YAClB,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC;YACvE,GAAG,EAAE,UAAU;SAChB,CAAC,CAAA;IACN,CAAC;YAAS,CAAC;QACT,MAAM,KAAK,EAAE,EAAE,CAAA;IACjB,CAAC;IAED,OAAO;QACL,KAAK;QACL,IAAI;QACJ,QAAQ,EAAE,IAAI,CAAC,EAAE;QACjB,cAAc;QACd,aAAa;QACb,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;KAC/B,CAAA;AACH,CAAC"}

package/dist/main.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":""}

package/dist/main.js

@@ -0,0 +1,10 @@
+import { logger } from '@cat-factory/server';
+import { startLocal } from './server.js';
+// Default entrypoint: `pnpm build` then `node dist/main.js`. Requires DATABASE_URL
+// (the local Postgres) and LOCAL_HARNESS_IMAGE (the executor-harness image run per
+// job). Set PORT to override the listen port (PUBLIC_URL defaults from it).
+startLocal().catch((err) => {
+    logger.error({ err: err instanceof Error ? err.message : String(err) }, 'failed to start');
+    process.exit(1);
+});
+//# sourceMappingURL=main.js.map

package/dist/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,mFAAmF;AACnF,mFAAmF;AACnF,4EAA4E;AAC5E,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAClC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAA;IAC1F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}

package/dist/runtimes/appleContainerRuntime.d.ts

@@ -0,0 +1,21 @@
+import { type ContainerEndpoint, type ContainerExec, type ContainerRuntimeAdapter, type RunContainerSpec } from './containerRuntime.js';
+export declare class AppleContainerRuntimeAdapter implements ContainerRuntimeAdapter {
+    readonly id: 'apple';
+    readonly binary: string;
+    readonly hostAlias: string;
+    readonly capabilities: {
+        localDind: boolean;
+    };
+    constructor(options: {
+        binary?: string;
+        hostAlias: string;
+    });
+    run(exec: ContainerExec, spec: RunContainerSpec): Promise<string>;
+    find(exec: ContainerExec, runId: string): Promise<string | undefined>;
+    endpoint(exec: ContainerExec, containerId: string): Promise<ContainerEndpoint | undefined>;
+    isRunning(exec: ContainerExec, containerId: string): Promise<boolean>;
+    remove(exec: ContainerExec, containerId: string): Promise<void>;
+    removeRun(exec: ContainerExec, runId: string): Promise<void>;
+    reapExited(exec: ContainerExec): Promise<number>;
+}
+//# sourceMappingURL=appleContainerRuntime.d.ts.map

package/dist/runtimes/appleContainerRuntime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appleContainerRuntime.d.ts","sourceRoot":"","sources":["../../src/runtimes/appleContainerRuntime.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,uBAAuB,EAE5B,KAAK,gBAAgB,EACtB,MAAM,uBAAuB,CAAA;AA0H9B,qBAAa,4BAA6B,YAAW,uBAAuB;IAC1E,QAAQ,CAAC,EAAE,EAAG,OAAO,CAAS;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,YAAY;QAAK,SAAS;MAAS;IAE5C,YAAY,OAAO,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAG1D;IAEK,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAqBtE;IAEK,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAQ1E;IAEK,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAI/F;IAEK,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAM1E;IAEK,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpE;IAEK,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjE;IAEK,UAAU,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAYrD;CACF"}