@cat-factory/node-server 0.107.10 → 0.107.12

package/dist/container-github-deps.js

@@ -0,0 +1,275 @@
+import { GitHubIssuesProvider, IssueWritebackService, JiraProvider, LinearTaskProvider, githubIssuesLogic, } from '@cat-factory/integrations';
+import { FetchGitHubClient, FetchGitHubProvisioningClient, GitHubBranchUpdater, GitHubCiStatusProvider, GitHubDocQualityProvider, GitHubMergeabilityProvider, GitHubPullRequestMerger, GitHubPullRequestReviewProvider, PatPreferringAppRegistry, WebCryptoSecretCipher, WebCryptoWebhookVerifier, makeResolveRepoFilesForCoords, makeResolveRunRepoContext, } from '@cat-factory/server';
+import { wireCiStatusProvider, wireDocQualityProvider, wireMergeabilityProvider, wirePullRequestReviewProvider, } from '@cat-factory/gates';
+import { buildNodeGitHubIssueFiler } from './container-executor-deps.js';
+import { DrizzleDocumentRepository } from './repositories/documents.js';
+import { DrizzleBranchProjectionRepository, DrizzleCheckRunProjectionRepository, DrizzleCommitProjectionRepository, DrizzleIssueProjectionRepository, DrizzlePullRequestProjectionRepository, } from './repositories/github.js';
+import { DrizzleTaskConnectionRepository, DrizzleTaskRepository, DrizzleTaskSourceSettingsRepository, } from './repositories/tasks.js';
+import { DrizzleUserRepoAccessRepository } from './repositories/userRepoAccess.js';
+// The engine's CI/mergeability gate reads never persist rate-limit snapshots (that is the
+// GitHub sync/webhook path's job), so the client backing them takes a no-op rate-limit store.
+class NoopRateLimitRepository {
+    record(_snapshot) {
+        return Promise.resolve();
+    }
+    deleteOlderThan(_epochMs) {
+        return Promise.resolve(0);
+    }
+}
+/**
+ * Wire the task-source integration for the Node facade (Jira + Linear always; GitHub Issues
+ * only when a GitHub client is available, since it reuses the workspace's App installation).
+ * Mirrors the Cloudflare facade's `config.github.enabled` gate (see CLAUDE.md parity rule).
+ * Whether a workspace OFFERS a source is the per-workspace toggle (task_source_settings), not
+ * a deployment env gate.
+ */
+function selectNodeTasksDeps(config, db, githubClient, installations) {
+    if (!config.tasks.enabled || !config.tasks.encryptionKey)
+        return { deps: {} };
+    // Jira and Linear are always registered (their credentials are per-workspace, entered in the UI).
+    const providers = [new JiraProvider(), new LinearTaskProvider()];
+    // GitHub Issues reuse the workspace's installed GitHub App, so this provider is
+    // wired whenever a GitHub client is available (the App is configured) — it has no
+    // credentials of its own and resolves the installation per issue.
+    if (githubClient) {
+        providers.push(new GitHubIssuesProvider({ githubClient, installations }));
+    }
+    const taskConnectionRepository = new DrizzleTaskConnectionRepository(db, 
+    // Source credentials are encrypted at rest under a tasks-scoped HKDF info (the
+    // same domain the Cloudflare facade uses), keyed by the shared ENCRYPTION_KEY.
+    new WebCryptoSecretCipher({
+        masterKeyBase64: config.tasks.encryptionKey,
+        info: 'cat-factory:tasks',
+    }));
+    return {
+        deps: {
+            taskSourceProviders: providers,
+            taskConnectionRepository,
+            taskSourceSettingsRepository: new DrizzleTaskSourceSettingsRepository(db),
+            taskRepository: new DrizzleTaskRepository(db),
+        },
+        taskConnectionRepository,
+    };
+}
+/**
+ * The GitHub-client-dependent slice of the Node composition root, lifted out of
+ * `buildNodeContainer` so that root stays within the file-size budget (the same reason
+ * `container-executor-deps.ts` / `container-content-library-deps.ts` exist). Mirrors the
+ * Worker's `selectGitHubDeps`: build the engine's GitHub client, wire the CI / mergeability /
+ * review / doc-quality gate providers onto the app-owned `providerRegistry`, and assemble the
+ * GitHub gate + projection/sync module deps. As a side effect it registers the gate providers;
+ * call it at the point the region occupied so the ordering (before `applyGateProviders`) holds.
+ */
+export function selectNodeGitHubDeps(input) {
+    const { config, db, remoteRepos, sourced, idGenerator, clock, appRegistry, githubClientOverride, resolveUserGitHubToken, gitlabEngineClient, providerRegistry, resolveRepoTarget, githubInstallationRepository, repoProjectionRepository, blockRepository, trackerSettingsRepository, caches, } = input;
+    // GitHub-issue tracker: file the tech-debt pipeline's issue through the workspace's
+    // own GitHub App installation (per-tenant), resolving the service's repo from the
+    // github_repos projection — the same per-tenant infra the container executor uses.
+    const fileGitHubIssue = buildNodeGitHubIssueFiler(config, appRegistry, resolveRepoTarget);
+    // The GitHub client backing the CI gate + merge / mergeability providers: an injected
+    // one wins (the local facade supplies a PAT-backed client), else — when the GitHub App
+    // is configured — one minted from the shared App registry, so a stock Node deployment
+    // with an App ALSO gates on real GitHub Actions CI and merges the PR for real (parity
+    // with the Worker). Undefined → these stay unwired and the gates pass through.
+    // Prefer the run initiator's per-user PAT (when stored) over the App token for the
+    // engine's CI gate + merge reads, so those are attributed to them too. The engine
+    // sets the initiator in ambient context around the gate-probe / merge boundaries.
+    const engineRegistry = appRegistry && resolveUserGitHubToken
+        ? new PatPreferringAppRegistry(appRegistry, resolveUserGitHubToken)
+        : appRegistry;
+    const githubClient = githubClientOverride ??
+        (engineRegistry
+            ? new FetchGitHubClient({
+                registry: engineRegistry,
+                rateLimitRepository: new NoopRateLimitRepository(),
+                idGenerator,
+                clock,
+                apiBase: config.github.apiBase,
+            })
+            : undefined);
+    // The client the engine's gate / merge / RepoFiles seams read through: the real GitHub client
+    // when present, else the GitLab-backed fallback so a GitLab-only deployment still gates on real
+    // CI and merges for real (the GitHub App wins when both are configured). Kept SEPARATE from
+    // `githubClient` on purpose — the GitHub-issue-specific consumers below (the GitHub Issues task
+    // source, issue writeback, the App projection module) must NOT be fed the GitLab client, or a
+    // GitLab-only deployment would offer a non-functional "GitHub Issues" source (it resolves the
+    // empty github_installations projection). Parity with the Worker, which keeps the App client
+    // distinct from its GitLab engine fallback.
+    const engineVcsClient = githubClient ?? gitlabEngineClient;
+    // Task-source integration (Jira + GitHub issues). Tenants connect their own Jira
+    // site through the UI (credentials stored per-workspace, encrypted at rest); the
+    // tracker resolves each workspace's own credentials from this same store. GitHub
+    // issues reuse the workspace's installed App, so they wire only when `githubClient`
+    // is available — kept here, after the client is built, for parity with the Worker.
+    const tasks = selectNodeTasksDeps(config, db, githubClient, githubInstallationRepository);
+    // Issue-tracker writeback (comment-on-PR-open + close-on-merge of a task's linked
+    // issue), gated per workspace + per task inside the provider. GitHub uses the same
+    // per-tenant client + installation lookup as the tracker/CI/merge providers; Jira
+    // reuses the workspace's encrypted connection. Wired whenever the tracker-settings
+    // repo exists (always on Node) so the engine can write back when a tracker is set.
+    const resolveWritebackIssue = githubClient
+        ? async (workspaceId, externalId) => {
+            const parsed = githubIssuesLogic.parseGitHubIssueExternalId(externalId);
+            if (!parsed)
+                return null;
+            const installation = await githubInstallationRepository.getByWorkspace(workspaceId);
+            if (!installation)
+                return null;
+            return { installationId: installation.installationId, parsed };
+        }
+        : undefined;
+    const issueWritebackProvider = new IssueWritebackService({
+        trackerSettingsRepository,
+        taskRepository: sourced('taskRepository', (d) => new DrizzleTaskRepository(d)),
+        fetchImpl: fetch,
+        ...(githubClient && resolveWritebackIssue
+            ? {
+                commentOnGitHubIssue: async (workspaceId, externalId, body) => {
+                    const target = await resolveWritebackIssue(workspaceId, externalId);
+                    if (!target)
+                        return;
+                    await githubClient.comment(target.installationId, { owner: target.parsed.owner, repo: target.parsed.repo }, target.parsed.number, body);
+                },
+                closeGitHubIssue: async (workspaceId, externalId) => {
+                    const target = await resolveWritebackIssue(workspaceId, externalId);
+                    if (!target)
+                        return;
+                    await githubClient.closeIssue(target.installationId, { owner: target.parsed.owner, repo: target.parsed.repo }, target.parsed.number);
+                },
+                labelGitHubIssue: async (workspaceId, externalId, label) => {
+                    const target = await resolveWritebackIssue(workspaceId, externalId);
+                    if (!target)
+                        return;
+                    await githubClient.applyIssueLabel?.(target.installationId, { owner: target.parsed.owner, repo: target.parsed.repo }, target.parsed.number, label);
+                },
+            }
+            : {}),
+        ...(tasks.taskConnectionRepository
+            ? {
+                resolveJiraConnection: async (workspaceId) => {
+                    const connection = await tasks.taskConnectionRepository.getByWorkspace(workspaceId, 'jira');
+                    const { baseUrl, accountEmail, apiToken } = connection?.credentials ?? {};
+                    if (!baseUrl || !accountEmail || !apiToken)
+                        return null;
+                    return { baseUrl, accountEmail, apiToken };
+                },
+                resolveLinearConnection: async (workspaceId) => {
+                    const connection = await tasks.taskConnectionRepository.getByWorkspace(workspaceId, 'linear');
+                    const { apiKey, token } = connection?.credentials ?? {};
+                    return apiKey || token ? { apiKey, token } : null;
+                },
+            }
+            : {}),
+    });
+    let githubGateDeps = {};
+    if (engineVcsClient) {
+        // The `ci` / `conflicts` gates now live in `@cat-factory/gates`; wire their providers into
+        // the gate suite instead of onto the engine's CoreDependencies (single-process startup, so
+        // the deployment-global handles are set once here). Parity with the Worker's selectGitHubDeps.
+        // These read through `engineVcsClient` (GitHub App or the GitLab fallback), so a GitLab-only
+        // deployment gates + merges for real too.
+        wireCiStatusProvider(providerRegistry, new GitHubCiStatusProvider({
+            githubClient: engineVcsClient,
+            resolveRepoTarget,
+            blockRepository,
+        }));
+        wireMergeabilityProvider(providerRegistry, new GitHubMergeabilityProvider({
+            githubClient: engineVcsClient,
+            resolveRepoTarget,
+            blockRepository,
+        }));
+        wirePullRequestReviewProvider(providerRegistry, new GitHubPullRequestReviewProvider({
+            githubClient: engineVcsClient,
+            resolveRepoTarget,
+            blockRepository,
+        }));
+        wireDocQualityProvider(providerRegistry, new GitHubDocQualityProvider({
+            githubClient: engineVcsClient,
+            resolveRepoTarget,
+            blockRepository,
+            // The gate resolves a workspace-linked template (WS1) for the block's kind, so it checks
+            // against the SAME sections the doc-writer followed. In db-less mothership mode the writer
+            // resolves the template through the RPC-proxied documents repo (getRoleLink is run-path
+            // allow-listed), so the gate MUST use that same repo — not `undefined` — or a doc written
+            // to the workspace template would be graded against the built-in skeleton (writer/gate drift).
+            documentRepository: db
+                ? new DrizzleDocumentRepository(db)
+                : remoteRepos?.documentRepository,
+        }));
+        githubGateDeps = {
+            // The engine binds a registered custom kind's pre/post-op hooks to a run's repo
+            // via this checkout-free RepoFiles resolver, composed from the same client +
+            // repo-target walk the gates/merger use — parity with the Worker. The `repoFiles`
+            // cache (slice 4) makes the post-op idempotency re-reads a read-through hit.
+            resolveRunRepoContext: makeResolveRunRepoContext(engineVcsClient, resolveRepoTarget, caches?.repoFiles),
+            // Block-less repo resolver for the environments module's on-demand repo
+            // validation / config bootstrap (operator names owner+repo).
+            resolveRepoFilesForCoords: makeResolveRepoFilesForCoords(engineVcsClient, githubInstallationRepository, repoProjectionRepository),
+            branchUpdater: new GitHubBranchUpdater({
+                githubClient: engineVcsClient,
+                resolveRepoTarget,
+                blockRepository,
+            }),
+            pullRequestMerger: new GitHubPullRequestMerger({
+                githubClient: engineVcsClient,
+                resolveRepoTarget,
+                blockRepository,
+            }),
+        };
+    }
+    // GitHub installation + projections + sync/webhook module: wired when the App is
+    // configured (a real githubClient), mirroring the Worker's selectGitHubDeps. This
+    // turns the GitHub read endpoints + the inline webhook/backfill sync on for Node —
+    // the sync engine (GitHubSyncService) is runtime-neutral, so populating the
+    // projection repos here makes the inline ingest actually persist (parity with the
+    // Worker, which fans the same sync through a queue/Workflow). `canCreateRepos` /
+    // `workflowsGranted` come from the App registry when present (advisory).
+    const githubModuleDeps = config.github.enabled && githubClient
+        ? {
+            githubClient,
+            githubInstallationRepository,
+            repoProjectionRepository,
+            // The five GitHub projection repos share one shape (remote in mothership mode, else
+            // Drizzle over `db`), routed through the shared `sourced` helper.
+            branchProjectionRepository: sourced('branchProjectionRepository', (d) => new DrizzleBranchProjectionRepository(d)),
+            pullRequestProjectionRepository: sourced('pullRequestProjectionRepository', (d) => new DrizzlePullRequestProjectionRepository(d)),
+            issueProjectionRepository: sourced('issueProjectionRepository', (d) => new DrizzleIssueProjectionRepository(d)),
+            commitProjectionRepository: sourced('commitProjectionRepository', (d) => new DrizzleCommitProjectionRepository(d)),
+            checkRunProjectionRepository: sourced('checkRunProjectionRepository', (d) => new DrizzleCheckRunProjectionRepository(d)),
+            // Per-user PAT-reachable repo projection (picker expansion + redaction); Postgres-only,
+            // so absent in a no-DB mothership node (the picker keeps its App-only behaviour there).
+            userRepoAccessRepository: db ? new DrizzleUserRepoAccessRepository(db) : undefined,
+            webhookVerifier: new WebCryptoWebhookVerifier(config.github.webhookSecret),
+            // Bound the initial backfill to the commit retention horizon (0 = full).
+            commitBackfillHorizonMs: config.retention.commitMs || undefined,
+            ...(appRegistry
+                ? {
+                    // Privileged App tier (ADR 0005): when configured, its client backs the
+                    // create-repo endpoint; `canCreateRepos` flags a connection whose
+                    // installation is owned by the privileged App. Absent → repo creation
+                    // stays the manual flow (parity with the Worker's selectGitHubDeps).
+                    repoProvisioningClient: config.github.privilegedApp
+                        ? new FetchGitHubProvisioningClient({
+                            registry: appRegistry,
+                            apiBase: config.github.apiBase,
+                        })
+                        : undefined,
+                    canCreateRepos: (installation) => appRegistry.canCreateRepos(installation),
+                    workflowsGranted: async (installation) => {
+                        const perms = await appRegistry.installationPermissions(installation.installationId);
+                        return perms.workflows === 'write';
+                    },
+                }
+                : {}),
+        }
+        : {};
+    return {
+        githubClient,
+        tasks,
+        fileGitHubIssue,
+        issueWritebackProvider,
+        githubGateDeps,
+        githubModuleDeps,
+    };
+}
+//# sourceMappingURL=container-github-deps.js.map

package/dist/container-github-deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-github-deps.js","sourceRoot":"","sources":["../src/container-github-deps.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,2BAA2B,CAAA;AAkBlC,OAAO,EAIL,iBAAiB,EACjB,6BAA6B,EAC7B,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,0BAA0B,EAC1B,uBAAuB,EACvB,+BAA+B,EAC/B,wBAAwB,EACxB,qBAAqB,EACrB,wBAAwB,EACxB,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAA;AAExE,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAA;AACvE,OAAO,EACL,iCAAiC,EACjC,mCAAmC,EACnC,iCAAiC,EACjC,gCAAgC,EAChC,sCAAsC,GACvC,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,+BAA+B,EAC/B,qBAAqB,EACrB,mCAAmC,GACpC,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAA;AAElF,0FAA0F;AAC1F,8FAA8F;AAC9F,MAAM,uBAAuB;IAC3B,MAAM,CAAC,SAA4B;QACjC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;IAC1B,CAAC;IACD,eAAe,CAAC,QAAgB;QAC9B,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC3B,CAAC;CACF;AAQD;;;;;;GAMG;AACH,SAAS,mBAAmB,CAC1B,MAAiB,EACjB,EAAa,EACb,YAAsC,EACtC,aAA2C;IAE3C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAA;IAC7E,kGAAkG;IAClG,MAAM,SAAS,GAAyB,CAAC,IAAI,YAAY,EAAE,EAAE,IAAI,kBAAkB,EAAE,CAAC,CAAA;IACtF,gFAAgF;IAChF,kFAAkF;IAClF,kEAAkE;IAClE,IAAI,YAAY,EAAE,CAAC;QACjB,SAAS,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,CAAC,CAAA;IAC3E,CAAC;IAED,MAAM,wBAAwB,GAAG,IAAI,+BAA+B,CAClE,EAAE;IACF,+EAA+E;IAC/E,+EAA+E;IAC/E,IAAI,qBAAqB,CAAC;QACxB,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa;QAC3C,IAAI,EAAE,mBAAmB;KAC1B,CAAC,CACH,CAAA;IACD,OAAO;QACL,IAAI,EAAE;YACJ,mBAAmB,EAAE,SAAS;YAC9B,wBAAwB;YACxB,4BAA4B,EAAE,IAAI,mCAAmC,CAAC,EAAE,CAAC;YACzE,cAAc,EAAE,IAAI,qBAAqB,CAAC,EAAE,CAAC;SAC9C;QACD,wBAAwB;KACzB,CAAA;AACH,CAAC;AAsCD;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAA0B;IAC7D,MAAM,EACJ,MAAM,EACN,EAAE,EACF,WAAW,EACX,OAAO,EACP,WAAW,EACX,KAAK,EACL,WAAW,EACX,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,4BAA4B,EAC5B,wBAAwB,EACxB,eAAe,EACf,yBAAyB,EACzB,MAAM,GACP,GAAG,KAAK,CAAA;IAET,oFAAoF;IACpF,kFAAkF;IAClF,mFAAmF;IACnF,MAAM,eAAe,GAAG,yBAAyB,CAAC,MAAM,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAA;IAEzF,sFAAsF;IACtF,uFAAuF;IACvF,sFAAsF;IACtF,sFAAsF;IACtF,+EAA+E;IAC/E,mFAAmF;IACnF,kFAAkF;IAClF,kFAAkF;IAClF,MAAM,cAAc,GAClB,WAAW,IAAI,sBAAsB;QACnC,CAAC,CAAC,IAAI,wBAAwB,CAAC,WAAW,EAAE,sBAAsB,CAAC;QACnE,CAAC,CAAC,WAAW,CAAA;IACjB,MAAM,YAAY,GAChB,oBAAoB;QACpB,CAAC,cAAc;YACb,CAAC,CAAC,IAAI,iBAAiB,CAAC;gBACpB,QAAQ,EAAE,cAAc;gBACxB,mBAAmB,EAAE,IAAI,uBAAuB,EAAE;gBAClD,WAAW;gBACX,KAAK;gBACL,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;aAC/B,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC,CAAA;IAEhB,8FAA8F;IAC9F,gGAAgG;IAChG,4FAA4F;IAC5F,gGAAgG;IAChG,8FAA8F;IAC9F,8FAA8F;IAC9F,6FAA6F;IAC7F,4CAA4C;IAC5C,MAAM,eAAe,GAA6B,YAAY,IAAI,kBAAkB,CAAA;IAEpF,iFAAiF;IACjF,iFAAiF;IACjF,iFAAiF;IACjF,oFAAoF;IACpF,mFAAmF;IACnF,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,4BAA4B,CAAC,CAAA;IAEzF,kFAAkF;IAClF,mFAAmF;IACnF,kFAAkF;IAClF,mFAAmF;IACnF,mFAAmF;IACnF,MAAM,qBAAqB,GAAG,YAAY;QACxC,CAAC,CAAC,KAAK,EAAE,WAAmB,EAAE,UAAkB,EAAE,EAAE;YAChD,MAAM,MAAM,GAAG,iBAAiB,CAAC,0BAA0B,CAAC,UAAU,CAAC,CAAA;YACvE,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAA;YACxB,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;YACnF,IAAI,CAAC,YAAY;gBAAE,OAAO,IAAI,CAAA;YAC9B,OAAO,EAAE,cAAc,EAAE,YAAY,CAAC,cAAc,EAAE,MAAM,EAAE,CAAA;QAChE,CAAC;QACH,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,sBAAsB,GAAG,IAAI,qBAAqB,CAAC;QACvD,yBAAyB;QACzB,cAAc,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC9E,SAAS,EAAE,KAAK;QAChB,GAAG,CAAC,YAAY,IAAI,qBAAqB;YACvC,CAAC,CAAC;gBACE,oBAAoB,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE;oBAC5D,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;oBACnE,IAAI,CAAC,MAAM;wBAAE,OAAM;oBACnB,MAAM,YAAY,CAAC,OAAO,CACxB,MAAM,CAAC,cAAc,EACrB,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EACxD,MAAM,CAAC,MAAM,CAAC,MAAM,EACpB,IAAI,CACL,CAAA;gBACH,CAAC;gBACD,gBAAgB,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE;oBAClD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;oBACnE,IAAI,CAAC,MAAM;wBAAE,OAAM;oBACnB,MAAM,YAAY,CAAC,UAAU,CAC3B,MAAM,CAAC,cAAc,EACrB,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EACxD,MAAM,CAAC,MAAM,CAAC,MAAM,CACrB,CAAA;gBACH,CAAC;gBACD,gBAAgB,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE;oBACzD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;oBACnE,IAAI,CAAC,MAAM;wBAAE,OAAM;oBACnB,MAAM,YAAY,CAAC,eAAe,EAAE,CAClC,MAAM,CAAC,cAAc,EACrB,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EACxD,MAAM,CAAC,MAAM,CAAC,MAAM,EACpB,KAAK,CACN,CAAA;gBACH,CAAC;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,wBAAwB;YAChC,CAAC,CAAC;gBACE,qBAAqB,EAAE,KAAK,EAAE,WAAmB,EAAE,EAAE;oBACnD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,wBAAyB,CAAC,cAAc,CACrE,WAAW,EACX,MAAM,CACP,CAAA;oBACD,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,UAAU,EAAE,WAAW,IAAI,EAAE,CAAA;oBACzE,IAAI,CAAC,OAAO,IAAI,CAAC,YAAY,IAAI,CAAC,QAAQ;wBAAE,OAAO,IAAI,CAAA;oBACvD,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAA;gBAC5C,CAAC;gBACD,uBAAuB,EAAE,KAAK,EAAE,WAAmB,EAAE,EAAE;oBACrD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,wBAAyB,CAAC,cAAc,CACrE,WAAW,EACX,QAAQ,CACT,CAAA;oBACD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,EAAE,WAAW,IAAI,EAAE,CAAA;oBACvD,OAAO,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;gBACnD,CAAC;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAA;IAEF,IAAI,cAAc,GAA8B,EAAE,CAAA;IAClD,IAAI,eAAe,EAAE,CAAC;QACpB,2FAA2F;QAC3F,2FAA2F;QAC3F,+FAA+F;QAC/F,6FAA6F;QAC7F,0CAA0C;QAC1C,oBAAoB,CAClB,gBAAgB,EAChB,IAAI,sBAAsB,CAAC;YACzB,YAAY,EAAE,eAAe;YAC7B,iBAAiB;YACjB,eAAe;SAChB,CAAC,CACH,CAAA;QACD,wBAAwB,CACtB,gBAAgB,EAChB,IAAI,0BAA0B,CAAC;YAC7B,YAAY,EAAE,eAAe;YAC7B,iBAAiB;YACjB,eAAe;SAChB,CAAC,CACH,CAAA;QACD,6BAA6B,CAC3B,gBAAgB,EAChB,IAAI,+BAA+B,CAAC;YAClC,YAAY,EAAE,eAAe;YAC7B,iBAAiB;YACjB,eAAe;SAChB,CAAC,CACH,CAAA;QACD,sBAAsB,CACpB,gBAAgB,EAChB,IAAI,wBAAwB,CAAC;YAC3B,YAAY,EAAE,eAAe;YAC7B,iBAAiB;YACjB,eAAe;YACf,yFAAyF;YACzF,2FAA2F;YAC3F,wFAAwF;YACxF,0FAA0F;YAC1F,+FAA+F;YAC/F,kBAAkB,EAAE,EAAE;gBACpB,CAAC,CAAC,IAAI,yBAAyB,CAAC,EAAE,CAAC;gBACnC,CAAC,CAAE,WAAW,EAAE,kBAA6D;SAChF,CAAC,CACH,CAAA;QACD,cAAc,GAAG;YACf,gFAAgF;YAChF,6EAA6E;YAC7E,kFAAkF;YAClF,6EAA6E;YAC7E,qBAAqB,EAAE,yBAAyB,CAC9C,eAAe,EACf,iBAAiB,EACjB,MAAM,EAAE,SAAS,CAClB;YACD,wEAAwE;YACxE,6DAA6D;YAC7D,yBAAyB,EAAE,6BAA6B,CACtD,eAAe,EACf,4BAA4B,EAC5B,wBAAwB,CACzB;YACD,aAAa,EAAE,IAAI,mBAAmB,CAAC;gBACrC,YAAY,EAAE,eAAe;gBAC7B,iBAAiB;gBACjB,eAAe;aAChB,CAAC;YACF,iBAAiB,EAAE,IAAI,uBAAuB,CAAC;gBAC7C,YAAY,EAAE,eAAe;gBAC7B,iBAAiB;gBACjB,eAAe;aAChB,CAAC;SACH,CAAA;IACH,CAAC;IAED,iFAAiF;IACjF,kFAAkF;IAClF,mFAAmF;IACnF,4EAA4E;IAC5E,kFAAkF;IAClF,iFAAiF;IACjF,yEAAyE;IACzE,MAAM,gBAAgB,GACpB,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,YAAY;QACnC,CAAC,CAAC;YACE,YAAY;YACZ,4BAA4B;YAC5B,wBAAwB;YACxB,oFAAoF;YACpF,kEAAkE;YAClE,0BAA0B,EAAE,OAAO,CACjC,4BAA4B,EAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,iCAAiC,CAAC,CAAC,CAAC,CAChD;YACD,+BAA+B,EAAE,OAAO,CACtC,iCAAiC,EACjC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,sCAAsC,CAAC,CAAC,CAAC,CACrD;YACD,yBAAyB,EAAE,OAAO,CAChC,2BAA2B,EAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,gCAAgC,CAAC,CAAC,CAAC,CAC/C;YACD,0BAA0B,EAAE,OAAO,CACjC,4BAA4B,EAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,iCAAiC,CAAC,CAAC,CAAC,CAChD;YACD,4BAA4B,EAAE,OAAO,CACnC,8BAA8B,EAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,mCAAmC,CAAC,CAAC,CAAC,CAClD;YACD,wFAAwF;YACxF,wFAAwF;YACxF,wBAAwB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,+BAA+B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;YAClF,eAAe,EAAE,IAAI,wBAAwB,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;YAC1E,yEAAyE;YACzE,uBAAuB,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,IAAI,SAAS;YAC/D,GAAG,CAAC,WAAW;gBACb,CAAC,CAAC;oBACE,wEAAwE;oBACxE,kEAAkE;oBAClE,sEAAsE;oBACtE,qEAAqE;oBACrE,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa;wBACjD,CAAC,CAAC,IAAI,6BAA6B,CAAC;4BAChC,QAAQ,EAAE,WAAW;4BACrB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;yBAC/B,CAAC;wBACJ,CAAC,CAAC,SAAS;oBACb,cAAc,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,WAAW,CAAC,cAAc,CAAC,YAAY,CAAC;oBAC1E,gBAAgB,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;wBACvC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,uBAAuB,CACrD,YAAY,CAAC,cAAc,CAC5B,CAAA;wBACD,OAAO,KAAK,CAAC,SAAS,KAAK,OAAO,CAAA;oBACpC,CAAC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;QACH,CAAC,CAAC,EAAE,CAAA;IAER,OAAO;QACL,YAAY;QACZ,KAAK;QACL,eAAe;QACf,sBAAsB;QACtB,cAAc;QACd,gBAAgB;KACjB,CAAA;AACH,CAAC"}

package/dist/container-model-deps.d.ts

@@ -0,0 +1,50 @@
+import { AiAgentExecutor, type AgentKindRegistry } from '@cat-factory/agents';
+import type { ApiKeyService, LocalModelEndpointService, UserSecretKindRegistry } from '@cat-factory/integrations';
+import type { AppCaches, LocalModelEndpointRepository, ModelProviderResolver, PersonalSubscriptionRepository, ProviderApiKeyRepository, ProviderSubscriptionTokenRepository, ResolveUserGitHubToken, SubscriptionActivationRepository, WorkspaceRepository } from '@cat-factory/kernel';
+import type { Clock, IdGenerator } from '@cat-factory/kernel';
+import { type AppConfig } from '@cat-factory/server';
+import type { ModelProviderResolverWrapDeps } from './container.js';
+import type { DrizzleDb } from './db/client.js';
+/** Inputs {@link buildNodeModelDeps} needs from the composition root. */
+export interface NodeModelDepsInput {
+    env: NodeJS.ProcessEnv;
+    config: AppConfig;
+    db: DrizzleDb;
+    workspaceRepository: WorkspaceRepository;
+    idGenerator: IdGenerator;
+    clock: Clock;
+    agentKindRegistry: AgentKindRegistry;
+    userSecretKindRegistry: UserSecretKindRegistry;
+    resolveWorkspaceModelDefault: (workspaceId: string, agentKind: string, modelPresetId?: string) => Promise<string | undefined>;
+    providerApiKeyRepository?: ProviderApiKeyRepository;
+    localModelEndpointRepository?: LocalModelEndpointRepository;
+    providerSubscriptionTokenRepository?: ProviderSubscriptionTokenRepository;
+    personalSubscriptionRepository?: PersonalSubscriptionRepository;
+    subscriptionActivationRepository?: SubscriptionActivationRepository;
+    wrapModelProviderResolver?: (inner: ModelProviderResolver, deps: ModelProviderResolverWrapDeps) => ModelProviderResolver;
+    cloudflareModelsEnabled?: boolean;
+    caches?: AppCaches;
+}
+/**
+ * The credential/token stores + the model-provisioning stack of the Node composition root,
+ * lifted out of `buildNodeContainer` so that root stays within the file-size budget (the same
+ * reason `container-executor-deps.ts` exists). Builds the direct-provider API-key pool, the
+ * public-API + local-model-endpoint + user-secret + OpenRouter-catalog + subscription +
+ * personal-subscription stores, then the trace sink, the (optionally facade-wrapped +
+ * vendor-limited) model-provider resolver, and the inline agent executor.
+ */
+export declare function buildNodeModelDeps(input: NodeModelDepsInput): {
+    apiKeys: ApiKeyService | undefined;
+    publicApiKeys: import("@cat-factory/integrations").PublicApiKeyService | undefined;
+    localModelEndpoints: LocalModelEndpointService | undefined;
+    userSecrets: import("@cat-factory/integrations").UserSecretService | undefined;
+    resolveUserGitHubToken: ResolveUserGitHubToken | undefined;
+    openRouterCatalog: import("@cat-factory/integrations").OpenRouterCatalogService | undefined;
+    subscriptions: import("@cat-factory/integrations").ProviderSubscriptionService | undefined;
+    personalSubscriptions: import("@cat-factory/integrations").PersonalSubscriptionService | undefined;
+    traceSink: import("@cat-factory/kernel").LlmTraceSink | undefined;
+    modelProviderResolver: ModelProviderResolver;
+    cloudflareModelsEnabled: boolean;
+    inline: AiAgentExecutor;
+};
+//# sourceMappingURL=container-model-deps.d.ts.map

package/dist/container-model-deps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-model-deps.d.ts","sourceRoot":"","sources":["../src/container-model-deps.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,KAAK,iBAAiB,EAGvB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EACV,aAAa,EACb,yBAAyB,EACzB,sBAAsB,EACvB,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EACV,SAAS,EACT,4BAA4B,EAC5B,qBAAqB,EACrB,8BAA8B,EAC9B,wBAAwB,EACxB,mCAAmC,EACnC,sBAAsB,EACtB,gCAAgC,EAChC,mBAAmB,EACpB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,EAAE,KAAK,SAAS,EAA2B,MAAM,qBAAqB,CAAA;AAE7E,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAsC/C,yEAAyE;AACzE,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;IACtB,MAAM,EAAE,SAAS,CAAA;IACjB,EAAE,EAAE,SAAS,CAAA;IACb,mBAAmB,EAAE,mBAAmB,CAAA;IACxC,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,KAAK,CAAA;IACZ,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,sBAAsB,EAAE,sBAAsB,CAAA;IAC9C,4BAA4B,EAAE,CAC5B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,KACnB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAChC,wBAAwB,CAAC,EAAE,wBAAwB,CAAA;IACnD,4BAA4B,CAAC,EAAE,4BAA4B,CAAA;IAC3D,mCAAmC,CAAC,EAAE,mCAAmC,CAAA;IACzE,8BAA8B,CAAC,EAAE,8BAA8B,CAAA;IAC/D,gCAAgC,CAAC,EAAE,gCAAgC,CAAA;IACnE,yBAAyB,CAAC,EAAE,CAC1B,KAAK,EAAE,qBAAqB,EAC5B,IAAI,EAAE,6BAA6B,KAChC,qBAAqB,CAAA;IAC1B,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC,MAAM,CAAC,EAAE,SAAS,CAAA;CACnB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,kBAAkB;;;;;;;;;;;;;EAiK3D"}

package/dist/container-model-deps.js

@@ -0,0 +1,127 @@
+import { AiAgentExecutor, inlineWebSearchOptionsFromEnv, vendorConcurrencyLimiterFromEnv, } from '@cat-factory/agents';
+import { wrapResolverWithLimiter } from '@cat-factory/server';
+import { buildTraceSink } from './container-executor-deps.js';
+import { createNodeModelProviderResolver } from './modelProvider.js';
+import { buildNodeApiKeyService, buildNodeLocalModelEndpointService, buildNodeOpenRouterCatalogService, buildNodePersonalSubscriptionService, buildNodePublicApiKeyService, buildNodeSubscriptionService, buildNodeUserSecretService, } from './wireCredentialServices.js';
+/**
+ * The Node model-provider RESOLVER (instrumented when Langfuse is on), shared per
+ * `(env, db)`. Builds a per-scope provider from the DB-backed API-key pool plus opt-in
+ * Cloudflare-REST / Bedrock registries. Mirrors the Worker's buildModelProviderResolver.
+ */
+const modelResolverCache = new WeakMap();
+function buildModelProviderResolver(env, db, apiKeys, localModelEndpoints, 
+// The shared inline instrument (one trace sink for the proxied path, the core AND the
+// inline calls) so the OTel SDK exporter isn't rebuilt per wiring site.
+instrument) {
+    // The cache keys on the db handle (one resolver per Drizzle client). Mothership mode has no
+    // db, so skip the cache entirely (WeakMap keys must be objects) and build a fresh resolver —
+    // a mothership node builds one container, so there is nothing to share it with anyway.
+    if (!db)
+        return createNodeModelProviderResolver(env, apiKeys, localModelEndpoints, instrument);
+    const cached = modelResolverCache.get(db);
+    if (cached)
+        return cached;
+    const resolver = createNodeModelProviderResolver(env, apiKeys, localModelEndpoints, instrument);
+    modelResolverCache.set(db, resolver);
+    return resolver;
+}
+/**
+ * The credential/token stores + the model-provisioning stack of the Node composition root,
+ * lifted out of `buildNodeContainer` so that root stays within the file-size budget (the same
+ * reason `container-executor-deps.ts` exists). Builds the direct-provider API-key pool, the
+ * public-API + local-model-endpoint + user-secret + OpenRouter-catalog + subscription +
+ * personal-subscription stores, then the trace sink, the (optionally facade-wrapped +
+ * vendor-limited) model-provider resolver, and the inline agent executor.
+ */
+export function buildNodeModelDeps(input) {
+    const { env, config, db, workspaceRepository, idGenerator, clock, agentKindRegistry, userSecretKindRegistry, resolveWorkspaceModelDefault, providerApiKeyRepository, localModelEndpointRepository, providerSubscriptionTokenRepository, personalSubscriptionRepository, subscriptionActivationRepository, wrapModelProviderResolver, cloudflareModelsEnabled: cloudflareModelsEnabledOverride, caches, } = input;
+    // The direct-provider API-key pool + the per-scope model-provider resolver, shared by
+    // the inline executor, the inline modules (planner/reviewer/fragment selector), the
+    // API-key controller, and the LLM proxy key lease.
+    const apiKeys = buildNodeApiKeyService(env, db, workspaceRepository, idGenerator, clock, providerApiKeyRepository);
+    // The inbound public-API key store — drives the public `/api/v1` surface's authentication.
+    const publicApiKeys = buildNodePublicApiKeyService(env, db, idGenerator, clock);
+    // The per-user locally-run model endpoints store (Ollama / LM Studio / …), shared by
+    // the local-runner controller, the per-user model catalog, the inline model provider,
+    // and the LLM proxy.
+    const localModelEndpoints = buildNodeLocalModelEndpointService(env, db, clock, localModelEndpointRepository);
+    // The per-user generic secret store (a GitHub PAT today), shared by the user-secret
+    // controller and the run-initiator PAT resolver below.
+    const userSecrets = buildNodeUserSecretService(env, db, clock, userSecretKindRegistry, caches?.viewerRepos);
+    // Resolve the run initiator's stored GitHub PAT (when set) — preferred over the
+    // App/env token by the container push-token mint + the engine GitHub client.
+    const resolveUserGitHubToken = userSecrets
+        ? (userId) => userSecrets.resolve(userId, 'github_pat')
+        : undefined;
+    // The per-workspace OpenRouter dynamic-catalog store — shared by the catalog controller,
+    // the per-workspace model catalog's dynamic OpenRouter entries, and the spend overlay.
+    const openRouterCatalog = buildNodeOpenRouterCatalogService(env, db, clock, apiKeys, config.spend.currency);
+    // The subscription-token pool (Claude Code / Codex credentials), shared by the
+    // container executor (lease + usage feedback) and the vendor-credential controller.
+    // Built HERE (before the model-provider wrap below) so its lease closures can be handed
+    // to `wrapModelProviderResolver` — the local facade's inline-harness wrap serves an
+    // inline subscription ref through a warm container on a LEASED credential, so it needs the
+    // same lease seams the container executor uses (built once, shared by both).
+    const subscriptions = buildNodeSubscriptionService(env, db, workspaceRepository, idGenerator, clock, providerSubscriptionTokenRepository);
+    // The per-user individual-usage subscription store (Claude), shared by the
+    // container executor's personal lease, the personal-subscription controller, and the
+    // inline-harness wrap's per-run personal lease.
+    const personalSubscriptions = buildNodePersonalSubscriptionService(env, db, idGenerator, clock, personalSubscriptionRepository, subscriptionActivationRepository);
+    // The ONE external trace sink for this container (memoised per config): the core, the
+    // container executor AND the inline model-provider instrumentation all share this single
+    // instance, so the OTel SDK exporter's batch processors/timers exist exactly once (and its
+    // shutdown is wired below). Its `recordPrompts` matches the proxied path's gating.
+    const traceSink = buildTraceSink(config);
+    const baseModelProviderResolver = buildModelProviderResolver(env, db, apiKeys, localModelEndpoints, traceSink ? { traceSink, recordPrompts: config.observability.recordPrompts } : undefined);
+    const wrappedModelProviderResolver = wrapModelProviderResolver
+        ? wrapModelProviderResolver(baseModelProviderResolver, {
+            ...(personalSubscriptions
+                ? {
+                    leasePersonalSubscriptionToken: (executionId, userId, vendor) => personalSubscriptions.leaseForRun(executionId, userId, vendor),
+                }
+                : {}),
+            ...(subscriptions
+                ? {
+                    leaseSubscriptionToken: (workspaceId, vendor) => subscriptions.leaseToken(workspaceId, vendor),
+                }
+                : {}),
+        })
+        : baseModelProviderResolver;
+    // Cap concurrent inline calls to a subscription vendor, OUTERMOST so it sits outside the
+    // local facade's subscription-inline harness wrap above (and therefore sees the un-degraded
+    // subscription ref). One limiter per container = per process for a stock node, per tenant in
+    // mothership mode; a pass-through when nothing is capped. Symmetric with the Worker's wrap in
+    // `buildModelProviderResolver` (see "Keep the runtimes symmetric").
+    const modelProviderResolver = wrapResolverWithLimiter(wrappedModelProviderResolver, vendorConcurrencyLimiterFromEnv((key) => env[key]));
+    // Cloudflare Workers AI is opt-in on Node: enabled when the REST creds are present.
+    const cloudflareModelsEnabled = cloudflareModelsEnabledOverride ?? !!(env.CLOUDFLARE_ACCOUNT_ID && env.CLOUDFLARE_API_TOKEN);
+    const inline = new AiAgentExecutor({
+        modelProviderResolver,
+        agentRouting: config.agents.routing,
+        resolveBlockModel: config.agents.resolveBlockModel,
+        resolveWorkspaceModelDefault,
+        // In local mode this keeps an ambient-eligible subscription harness ref so the inline
+        // design/research kinds run on the developer's Claude Code / Codex CLI; undefined on
+        // stock Node (no inline harness), where such a ref degrades to the routing default.
+        ...(config.agents.inlineHarnessRef ? { runsInline: config.agents.inlineHarnessRef } : {}),
+        // Opt-in provider web search for the inline design/research kinds (no-op unless
+        // INLINE_WEB_SEARCH_ENABLED and an Anthropic/OpenAI model).
+        webSearch: inlineWebSearchOptionsFromEnv(env),
+        agentKindRegistry,
+    });
+    return {
+        apiKeys,
+        publicApiKeys,
+        localModelEndpoints,
+        userSecrets,
+        resolveUserGitHubToken,
+        openRouterCatalog,
+        subscriptions,
+        personalSubscriptions,
+        traceSink,
+        modelProviderResolver,
+        cloudflareModelsEnabled,
+        inline,
+    };
+}
+//# sourceMappingURL=container-model-deps.js.map

package/dist/container-model-deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-model-deps.js","sourceRoot":"","sources":["../src/container-model-deps.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EAEf,6BAA6B,EAC7B,+BAA+B,GAChC,MAAM,qBAAqB,CAAA;AAkB5B,OAAO,EAAkB,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAG7D,OAAO,EAAyB,+BAA+B,EAAE,MAAM,oBAAoB,CAAA;AAC3F,OAAO,EACL,sBAAsB,EACtB,kCAAkC,EAClC,iCAAiC,EACjC,oCAAoC,EACpC,4BAA4B,EAC5B,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,6BAA6B,CAAA;AAEpC;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,IAAI,OAAO,EAAoC,CAAA;AAC1E,SAAS,0BAA0B,CACjC,GAAsB,EACtB,EAAyB,EACzB,OAAkC,EAClC,mBAA0D;AAC1D,sFAAsF;AACtF,wEAAwE;AACxE,UAAwC;IAExC,4FAA4F;IAC5F,6FAA6F;IAC7F,uFAAuF;IACvF,IAAI,CAAC,EAAE;QAAE,OAAO,+BAA+B,CAAC,GAAG,EAAE,OAAO,EAAE,mBAAmB,EAAE,UAAU,CAAC,CAAA;IAC9F,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACzC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IACzB,MAAM,QAAQ,GAAG,+BAA+B,CAAC,GAAG,EAAE,OAAO,EAAE,mBAAmB,EAAE,UAAU,CAAC,CAAA;IAC/F,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;IACpC,OAAO,QAAQ,CAAA;AACjB,CAAC;AA8BD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IAC1D,MAAM,EACJ,GAAG,EACH,MAAM,EACN,EAAE,EACF,mBAAmB,EACnB,WAAW,EACX,KAAK,EACL,iBAAiB,EACjB,sBAAsB,EACtB,4BAA4B,EAC5B,wBAAwB,EACxB,4BAA4B,EAC5B,mCAAmC,EACnC,8BAA8B,EAC9B,gCAAgC,EAChC,yBAAyB,EACzB,uBAAuB,EAAE,+BAA+B,EACxD,MAAM,GACP,GAAG,KAAK,CAAA;IAET,sFAAsF;IACtF,oFAAoF;IACpF,mDAAmD;IACnD,MAAM,OAAO,GAAG,sBAAsB,CACpC,GAAG,EACH,EAAE,EACF,mBAAmB,EACnB,WAAW,EACX,KAAK,EACL,wBAAwB,CACzB,CAAA;IACD,2FAA2F;IAC3F,MAAM,aAAa,GAAG,4BAA4B,CAAC,GAAG,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,CAAA;IAC/E,qFAAqF;IACrF,sFAAsF;IACtF,qBAAqB;IACrB,MAAM,mBAAmB,GAAG,kCAAkC,CAC5D,GAAG,EACH,EAAE,EACF,KAAK,EACL,4BAA4B,CAC7B,CAAA;IACD,oFAAoF;IACpF,uDAAuD;IACvD,MAAM,WAAW,GAAG,0BAA0B,CAC5C,GAAG,EACH,EAAE,EACF,KAAK,EACL,sBAAsB,EACtB,MAAM,EAAE,WAAW,CACpB,CAAA;IACD,gFAAgF;IAChF,6EAA6E;IAC7E,MAAM,sBAAsB,GAAuC,WAAW;QAC5E,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC;QACvD,CAAC,CAAC,SAAS,CAAA;IACb,yFAAyF;IACzF,uFAAuF;IACvF,MAAM,iBAAiB,GAAG,iCAAiC,CACzD,GAAG,EACH,EAAE,EACF,KAAK,EACL,OAAO,EACP,MAAM,CAAC,KAAK,CAAC,QAAQ,CACtB,CAAA;IACD,+EAA+E;IAC/E,oFAAoF;IACpF,wFAAwF;IACxF,oFAAoF;IACpF,2FAA2F;IAC3F,6EAA6E;IAC7E,MAAM,aAAa,GAAG,4BAA4B,CAChD,GAAG,EACH,EAAE,EACF,mBAAmB,EACnB,WAAW,EACX,KAAK,EACL,mCAAmC,CACpC,CAAA;IACD,2EAA2E;IAC3E,qFAAqF;IACrF,gDAAgD;IAChD,MAAM,qBAAqB,GAAG,oCAAoC,CAChE,GAAG,EACH,EAAE,EACF,WAAW,EACX,KAAK,EACL,8BAA8B,EAC9B,gCAAgC,CACjC,CAAA;IACD,sFAAsF;IACtF,yFAAyF;IACzF,2FAA2F;IAC3F,mFAAmF;IACnF,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;IACxC,MAAM,yBAAyB,GAAG,0BAA0B,CAC1D,GAAG,EACH,EAAE,EACF,OAAO,EACP,mBAAmB,EACnB,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS,CACzF,CAAA;IACD,MAAM,4BAA4B,GAAG,yBAAyB;QAC5D,CAAC,CAAC,yBAAyB,CAAC,yBAAyB,EAAE;YACnD,GAAG,CAAC,qBAAqB;gBACvB,CAAC,CAAC;oBACE,8BAA8B,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAC9D,qBAAqB,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC;iBACjE;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,aAAa;gBACf,CAAC,CAAC;oBACE,sBAAsB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAC9C,aAAa,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC;iBAChD;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACJ,CAAC,CAAC,yBAAyB,CAAA;IAC7B,yFAAyF;IACzF,4FAA4F;IAC5F,6FAA6F;IAC7F,8FAA8F;IAC9F,oEAAoE;IACpE,MAAM,qBAAqB,GAAG,uBAAuB,CACnD,4BAA4B,EAC5B,+BAA+B,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CACnD,CAAA;IACD,oFAAoF;IACpF,MAAM,uBAAuB,GAC3B,+BAA+B,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,qBAAqB,IAAI,GAAG,CAAC,oBAAoB,CAAC,CAAA;IAE9F,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,qBAAqB;QACrB,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;QACnC,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,iBAAiB;QAClD,4BAA4B;QAC5B,sFAAsF;QACtF,qFAAqF;QACrF,oFAAoF;QACpF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,gFAAgF;QAChF,4DAA4D;QAC5D,SAAS,EAAE,6BAA6B,CAAC,GAAG,CAAC;QAC7C,iBAAiB;KAClB,CAAC,CAAA;IAEF,OAAO;QACL,OAAO;QACP,aAAa;QACb,mBAAmB;QACnB,WAAW;QACX,sBAAsB;QACtB,iBAAiB;QACjB,aAAa;QACb,qBAAqB;QACrB,SAAS;QACT,qBAAqB;QACrB,uBAAuB;QACvB,MAAM;KACP,CAAA;AACH,CAAC"}

package/dist/container-realtime-deps.d.ts

@@ -0,0 +1,34 @@
+import { type AgentKindRegistry } from '@cat-factory/agents';
+import { type AgentExecutor, type ModelProviderResolver, type NotificationChannel } from '@cat-factory/kernel';
+import type { CoreDependencies } from '@cat-factory/orchestration';
+import { type AppConfig, type CompositeAgentExecutor, FanOutEventPublisher } from '@cat-factory/server';
+import type { DrizzleDb } from './db/client.js';
+import { type LocalEventSink } from './realtime.js';
+import type { createDrizzleRepositories } from './repositories/drizzle.js';
+type NodeRepositories = ReturnType<typeof createDrizzleRepositories>;
+/** Inputs {@link buildNodeRealtimeDeps} needs from the composition root. */
+export interface NodeRealtimeDepsInput {
+    env: NodeJS.ProcessEnv;
+    config: AppConfig;
+    repos: NodeRepositories;
+    sourced: <T>(name: string, build: (d: DrizzleDb) => T) => T;
+    realtimeSink?: LocalEventSink;
+    standardAgentExecutor: CompositeAgentExecutor;
+    modelProviderResolver: ModelProviderResolver;
+    resolveWorkspaceModelDefault: (workspaceId: string, agentKind: string, modelPresetId?: string) => Promise<string | undefined>;
+    agentKindRegistry: AgentKindRegistry;
+}
+/**
+ * The real-time event-publisher + notification-channel + optional consensus wrap of the Node
+ * composition root, lifted out of `buildNodeContainer` so that root stays within the file-size
+ * budget. Builds the Slack deps, the fan-out event publisher (when a realtime hub is wired),
+ * the (optionally consensus-wrapped) agent executor, and the composite notification channel.
+ */
+export declare function buildNodeRealtimeDeps(input: NodeRealtimeDepsInput): {
+    slackDeps: Partial<CoreDependencies>;
+    executionEventPublisher: FanOutEventPublisher | undefined;
+    agentExecutor: AgentExecutor;
+    notificationChannel: NotificationChannel | undefined;
+};
+export {};
+//# sourceMappingURL=container-realtime-deps.d.ts.map

package/dist/container-realtime-deps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-realtime-deps.d.ts","sourceRoot":"","sources":["../src/container-realtime-deps.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAG5D,OAAO,EACL,KAAK,aAAa,EAElB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACzB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAClE,OAAO,EACL,KAAK,SAAS,EACd,KAAK,sBAAsB,EAC3B,oBAAoB,EAIrB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,EAAE,KAAK,cAAc,EAAsB,MAAM,eAAe,CAAA;AACvE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AAO1E,KAAK,gBAAgB,GAAG,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAsEpE,4EAA4E;AAC5E,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;IACtB,MAAM,EAAE,SAAS,CAAA;IACjB,KAAK,EAAE,gBAAgB,CAAA;IACvB,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,SAAS,KAAK,CAAC,KAAK,CAAC,CAAA;IAC3D,YAAY,CAAC,EAAE,cAAc,CAAA;IAC7B,qBAAqB,EAAE,sBAAsB,CAAA;IAC7C,qBAAqB,EAAE,qBAAqB,CAAA;IAC5C,4BAA4B,EAAE,CAC5B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,KACnB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAChC,iBAAiB,EAAE,iBAAiB,CAAA;CACrC;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,qBAAqB;;;;;EA2DjE"}