@cat-factory/node-server 0.107.11 → 0.107.13

package/dist/container-account-deps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-account-deps.d.ts","sourceRoot":"","sources":["../src/container-account-deps.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,sBAAsB,EAMvB,MAAM,2BAA2B,CAAA;AAElC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAC1F,OAAO,EACL,KAAK,SAAS,EAKf,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,qBAAqB,EAA4B,MAAM,wBAAwB,CAAA;AAE7F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG/C,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AAE1E,KAAK,gBAAgB,GAAG,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAEpE,2EAA2E;AAC3E,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;IACtB,MAAM,EAAE,SAAS,CAAA;IACjB,EAAE,EAAE,SAAS,CAAA;IACb,KAAK,EAAE,gBAAgB,CAAA;IACvB,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,KAAK,CAAA;IACZ,2FAA2F;IAC3F,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,+FAA+F;IAC/F,2BAA2B,EAAE,gBAAgB,CAAC,6BAA6B,CAAC,CAAA;IAC5E,4BAA4B,CAAC,EAAE,qBAAqB,CAAA;IACpD,MAAM,CAAC,EAAE,SAAS,CAAA;CACnB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,oBAAoB;;;;;;EAoJ/D"}

package/dist/container-account-deps.js

@@ -0,0 +1,142 @@
+import { ACCOUNT_SETTINGS_CIPHER_INFO, AccountSettingsService, INCIDENT_ENRICHMENT_CIPHER_INFO, OBSERVABILITY_CIPHER_INFO, RegistryReleaseHealthProvider, WorkspaceIncidentEnrichmentProvider, defaultObservabilityRegistry, } from '@cat-factory/integrations';
+import { wireIncidentEnrichment, wireReleaseHealthProvider } from '@cat-factory/gates';
+import { WebCryptoSecretCipher, logger, makeResolveBinaryArtifactStore, } from '@cat-factory/server';
+import { S3BinaryBlobBackend } from '@cat-factory/provider-s3';
+import { FilesystemBinaryBlobBackend } from './storage/FilesystemBinaryBlobBackend.js';
+import { PostgresBinaryBlobBackend } from './storage/PostgresBinaryBlobBackend.js';
+/**
+ * The per-account settings + binary-artifact storage + observability/incident gate wiring of
+ * the Node composition root, lifted out of `buildNodeContainer` so that root stays within the
+ * file-size budget. Wires the release-health + incident-enrichment gate providers onto the
+ * app-owned `providerRegistry` (a side effect — call BEFORE `applyGateProviders`), and builds
+ * the per-account settings service + the content-storage blob backend factory it resolves the
+ * binary-artifact store from.
+ */
+export function buildNodeAccountDeps(input) {
+    const { env, config, db, repos, idGenerator, clock, providerRegistry, packageRegistrySecretCipher, contentStorageDefaultBackend, caches, } = input;
+    // Binary-artifact storage (UI screenshots + reference design images) for the
+    // visual-confirmation gate. The backend is configured PER ACCOUNT in the UI (no env vars):
+    // the metadata always lives in Postgres; the bytes go to the account's chosen blob backend
+    // (`fs` → the local filesystem; `db` → a Postgres `bytea` table; `s3` → an S3 bucket).
+    const contentStorageCapability = {
+        supportedBackends: ['off', 'fs', 's3', 'db'],
+        defaultBackend: contentStorageDefaultBackend ?? 'off',
+    };
+    const buildBlobBackend = (kind, opts) => {
+        switch (kind) {
+            case 'fs':
+                // NOTE: the filesystem backend is local-disk only. It is correct for the local facade
+                // and a single-instance Node deployment with a persistent volume, but NOT for a scaled
+                // (multi-replica) or ephemeral-disk deployment — bytes written on one replica are
+                // invisible to the others and lost on redeploy. Scaled deployments should pick `s3`.
+                return new FilesystemBinaryBlobBackend({ basePath: opts.fs?.basePath });
+            case 'db':
+                return new PostgresBinaryBlobBackend(db);
+            case 's3':
+                if (!opts.s3)
+                    return null;
+                // Omitting credentials is intentional: the S3 client then falls back to the ambient AWS
+                // credential chain (instance role / `AWS_*` env), which is the right behaviour for a
+                // deployment running on AWS with an attached role. The UI requires explicit keys, so this
+                // path is only reached by a config written through another channel.
+                return new S3BinaryBlobBackend({
+                    ...opts.s3,
+                    ...(opts.s3Credentials ? { credentials: opts.s3Credentials } : {}),
+                });
+            default:
+                // `r2`/`memory` are not served on Node/local — null ⇒ storage unavailable.
+                return null;
+        }
+    };
+    // Observability post-release-health: wire the gate + the release-health settings module
+    // when enabled (+ ENCRYPTION_KEY), mirroring the Worker's `selectReleaseHealthDeps`. Off →
+    // the `post-release-health` gate is a pass-through and the module isn't assembled.
+    const releaseHealthDeps = {};
+    if (config.releaseHealth.enabled && config.releaseHealth.encryptionKey) {
+        const observabilitySecretCipher = new WebCryptoSecretCipher({
+            masterKeyBase64: config.releaseHealth.encryptionKey,
+            info: OBSERVABILITY_CIPHER_INFO,
+        });
+        releaseHealthDeps.observabilityConnectionRepository = repos.observabilityConnectionRepository;
+        releaseHealthDeps.releaseHealthConfigRepository = repos.releaseHealthConfigRepository;
+        releaseHealthDeps.observabilitySecretCipher = observabilitySecretCipher;
+        // The post-release-health gate + on-call escalation now live in `@cat-factory/gates`; wire
+        // their providers into the gate suite. The observability repos/cipher above stay on
+        // CoreDependencies — they power the management API (ReleaseHealthService), not the gate.
+        wireReleaseHealthProvider(providerRegistry, new RegistryReleaseHealthProvider({
+            observabilityConnectionRepository: repos.observabilityConnectionRepository,
+            releaseHealthConfigRepository: repos.releaseHealthConfigRepository,
+            blockRepository: repos.blockRepository,
+            secretCipher: observabilitySecretCipher,
+            registry: defaultObservabilityRegistry,
+        }));
+    }
+    // Per-workspace incident-enrichment (PagerDuty + incident.io): credentials moved out of
+    // env into a sealed per-workspace row, resolved + decrypted at enrichment time. Wired
+    // whenever the shared ENCRYPTION_KEY is present (independent of the release-health gate).
+    const encryptionKey = env.ENCRYPTION_KEY?.trim();
+    // Per-workspace private package registries (npm private orgs, GitHub Packages): the
+    // management API over the same repo + cipher the dispatch resolver rides.
+    const packageRegistryDeps = packageRegistrySecretCipher
+        ? {
+            packageRegistryConnectionRepository: repos.packageRegistryConnectionRepository,
+            packageRegistrySecretCipher,
+        }
+        : {};
+    const incidentEnrichmentDeps = {};
+    if (encryptionKey) {
+        const incidentEnrichmentSecretCipher = new WebCryptoSecretCipher({
+            masterKeyBase64: encryptionKey,
+            info: INCIDENT_ENRICHMENT_CIPHER_INFO,
+        });
+        incidentEnrichmentDeps.incidentEnrichmentConnectionRepository =
+            repos.incidentEnrichmentConnectionRepository;
+        incidentEnrichmentDeps.incidentEnrichmentSecretCipher = incidentEnrichmentSecretCipher;
+        // The on-call enrichment provider now lives in `@cat-factory/gates`; wire the
+        // workspace-backed provider into the gate suite. The connection repo + cipher above
+        // stay on CoreDependencies to power the management API.
+        wireIncidentEnrichment(providerRegistry, new WorkspaceIncidentEnrichmentProvider({
+            incidentEnrichmentConnectionRepository: repos.incidentEnrichmentConnectionRepository,
+            secretCipher: incidentEnrichmentSecretCipher,
+        }));
+    }
+    // Per-account deployment settings (Slack OAuth + web-search keys + content-storage), built
+    // once so the service's short-TTL cache spans requests; the Slack OAuth + content-storage
+    // resolvers derive from it.
+    const accountSettings = encryptionKey
+        ? new AccountSettingsService({
+            accountSettingsRepository: repos.accountSettingsRepository,
+            secretCipher: new WebCryptoSecretCipher({
+                masterKeyBase64: encryptionKey,
+                info: ACCOUNT_SETTINGS_CIPHER_INFO,
+            }),
+            clock,
+            contentStorageCapability,
+            ...(caches ? { settingsCache: caches.accountSettings } : {}),
+        })
+        : undefined;
+    // Resolve the binary-artifact store for a workspace's account from its content-storage
+    // settings (the blob backend is per-account; the metadata is the shared Postgres store).
+    // Without `accountSettings` (no encryption key) there is no per-account override, so every
+    // workspace falls back to the runtime default — which on Node is `off`, so the resolver then
+    // returns null and the controllers 503 / the gate passes through. Caches per account, so a
+    // backend switch rebuilds and the many workspaces under one account share a store.
+    const resolveBinaryArtifactStore = makeResolveBinaryArtifactStore({
+        accountSettings,
+        accountOf: (workspaceId) => repos.workspaceRepository.accountOf(workspaceId),
+        metadata: repos.binaryArtifactMetadataStore,
+        idGenerator,
+        clock,
+        buildBlobBackend,
+        defaultBackend: contentStorageCapability.defaultBackend,
+        logger,
+    });
+    return {
+        releaseHealthDeps,
+        packageRegistryDeps,
+        incidentEnrichmentDeps,
+        accountSettings,
+        resolveBinaryArtifactStore,
+    };
+}
+//# sourceMappingURL=container-account-deps.js.map

package/dist/container-account-deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-account-deps.js","sourceRoot":"","sources":["../src/container-account-deps.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,+BAA+B,EAC/B,yBAAyB,EACzB,6BAA6B,EAC7B,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAA;AAGtF,OAAO,EAGL,qBAAqB,EACrB,MAAM,EACN,8BAA8B,GAC/B,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAE9D,OAAO,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAA;AACtF,OAAO,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAA;AAqBlF;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAA2B;IAC9D,MAAM,EACJ,GAAG,EACH,MAAM,EACN,EAAE,EACF,KAAK,EACL,WAAW,EACX,KAAK,EACL,gBAAgB,EAChB,2BAA2B,EAC3B,4BAA4B,EAC5B,MAAM,GACP,GAAG,KAAK,CAAA;IAET,6EAA6E;IAC7E,2FAA2F;IAC3F,2FAA2F;IAC3F,uFAAuF;IACvF,MAAM,wBAAwB,GAA6B;QACzD,iBAAiB,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAC5C,cAAc,EAAE,4BAA4B,IAAI,KAAK;KACtD,CAAA;IACD,MAAM,gBAAgB,GAAqB,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QACxD,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,IAAI;gBACP,sFAAsF;gBACtF,uFAAuF;gBACvF,kFAAkF;gBAClF,qFAAqF;gBACrF,OAAO,IAAI,2BAA2B,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;YACzE,KAAK,IAAI;gBACP,OAAO,IAAI,yBAAyB,CAAC,EAAE,CAAC,CAAA;YAC1C,KAAK,IAAI;gBACP,IAAI,CAAC,IAAI,CAAC,EAAE;oBAAE,OAAO,IAAI,CAAA;gBACzB,wFAAwF;gBACxF,qFAAqF;gBACrF,0FAA0F;gBAC1F,oEAAoE;gBACpE,OAAO,IAAI,mBAAmB,CAAC;oBAC7B,GAAG,IAAI,CAAC,EAAE;oBACV,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACnE,CAAC,CAAA;YACJ;gBACE,2EAA2E;gBAC3E,OAAO,IAAI,CAAA;QACf,CAAC;IACH,CAAC,CAAA;IAED,wFAAwF;IACxF,2FAA2F;IAC3F,mFAAmF;IACnF,MAAM,iBAAiB,GAA8B,EAAE,CAAA;IACvD,IAAI,MAAM,CAAC,aAAa,CAAC,OAAO,IAAI,MAAM,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;QACvE,MAAM,yBAAyB,GAAG,IAAI,qBAAqB,CAAC;YAC1D,eAAe,EAAE,MAAM,CAAC,aAAa,CAAC,aAAa;YACnD,IAAI,EAAE,yBAAyB;SAChC,CAAC,CAAA;QACF,iBAAiB,CAAC,iCAAiC,GAAG,KAAK,CAAC,iCAAiC,CAAA;QAC7F,iBAAiB,CAAC,6BAA6B,GAAG,KAAK,CAAC,6BAA6B,CAAA;QACrF,iBAAiB,CAAC,yBAAyB,GAAG,yBAAyB,CAAA;QACvE,2FAA2F;QAC3F,oFAAoF;QACpF,yFAAyF;QACzF,yBAAyB,CACvB,gBAAgB,EAChB,IAAI,6BAA6B,CAAC;YAChC,iCAAiC,EAAE,KAAK,CAAC,iCAAiC;YAC1E,6BAA6B,EAAE,KAAK,CAAC,6BAA6B;YAClE,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,YAAY,EAAE,yBAAyB;YACvC,QAAQ,EAAE,4BAA4B;SACvC,CAAC,CACH,CAAA;IACH,CAAC;IAED,wFAAwF;IACxF,sFAAsF;IACtF,0FAA0F;IAC1F,MAAM,aAAa,GAAG,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAA;IAChD,oFAAoF;IACpF,0EAA0E;IAC1E,MAAM,mBAAmB,GAA8B,2BAA2B;QAChF,CAAC,CAAC;YACE,mCAAmC,EAAE,KAAK,CAAC,mCAAmC;YAC9E,2BAA2B;SAC5B;QACH,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,sBAAsB,GAA8B,EAAE,CAAA;IAC5D,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,8BAA8B,GAAG,IAAI,qBAAqB,CAAC;YAC/D,eAAe,EAAE,aAAa;YAC9B,IAAI,EAAE,+BAA+B;SACtC,CAAC,CAAA;QACF,sBAAsB,CAAC,sCAAsC;YAC3D,KAAK,CAAC,sCAAsC,CAAA;QAC9C,sBAAsB,CAAC,8BAA8B,GAAG,8BAA8B,CAAA;QACtF,8EAA8E;QAC9E,oFAAoF;QACpF,wDAAwD;QACxD,sBAAsB,CACpB,gBAAgB,EAChB,IAAI,mCAAmC,CAAC;YACtC,sCAAsC,EAAE,KAAK,CAAC,sCAAsC;YACpF,YAAY,EAAE,8BAA8B;SAC7C,CAAC,CACH,CAAA;IACH,CAAC;IAED,2FAA2F;IAC3F,0FAA0F;IAC1F,4BAA4B;IAC5B,MAAM,eAAe,GAAG,aAAa;QACnC,CAAC,CAAC,IAAI,sBAAsB,CAAC;YACzB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;YAC1D,YAAY,EAAE,IAAI,qBAAqB,CAAC;gBACtC,eAAe,EAAE,aAAa;gBAC9B,IAAI,EAAE,4BAA4B;aACnC,CAAC;YACF,KAAK;YACL,wBAAwB;YACxB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC;QACJ,CAAC,CAAC,SAAS,CAAA;IAEb,uFAAuF;IACvF,yFAAyF;IACzF,2FAA2F;IAC3F,6FAA6F;IAC7F,2FAA2F;IAC3F,mFAAmF;IACnF,MAAM,0BAA0B,GAAG,8BAA8B,CAAC;QAChE,eAAe;QACf,SAAS,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC,WAAW,CAAC;QAC5E,QAAQ,EAAE,KAAK,CAAC,2BAA2B;QAC3C,WAAW;QACX,KAAK;QACL,gBAAgB;QAChB,cAAc,EAAE,wBAAwB,CAAC,cAAc;QACvD,MAAM;KACP,CAAC,CAAA;IAEF,OAAO;QACL,iBAAiB;QACjB,mBAAmB;QACnB,sBAAsB;QACtB,eAAe;QACf,0BAA0B;KAC3B,CAAA;AACH,CAAC"}

package/dist/container-github-deps.d.ts

@@ -0,0 +1,56 @@
+import { IssueWritebackService } from '@cat-factory/integrations';
+import type { AppCaches, BlockRepository, Clock, GitHubClient, GitHubInstallationRepository, IdGenerator, ProviderRegistry, RepoProjectionRepository, ResolveUserGitHubToken, TaskConnectionRepository, TrackerSettingsRepository } from '@cat-factory/kernel';
+import type { CoreDependencies } from '@cat-factory/orchestration';
+import { type AppConfig, type GitHubAppRegistry, type ResolveRepoTarget } from '@cat-factory/server';
+import { buildNodeGitHubIssueFiler } from './container-executor-deps.js';
+import type { DrizzleDb } from './db/client.js';
+/** The result shape of {@link selectNodeTasksDeps}: the module deps plus the raw connection repo. */
+export interface NodeTasksDeps {
+    deps: Partial<CoreDependencies>;
+    taskConnectionRepository?: TaskConnectionRepository;
+}
+/** Inputs {@link selectNodeGitHubDeps} needs from the composition root. */
+export interface NodeGitHubDepsInput {
+    config: AppConfig;
+    db: DrizzleDb;
+    /** Undefined in a standard build; the full-surface remote registry in mothership mode. */
+    remoteRepos: Record<string, unknown> | undefined;
+    /** Source one org/durable repo from the remote registry (mothership) else the Drizzle db. */
+    sourced: <T>(name: string, build: (d: DrizzleDb) => T) => T;
+    idGenerator: IdGenerator;
+    clock: Clock;
+    appRegistry: GitHubAppRegistry | undefined;
+    /** An injected client (the local facade's PAT-backed one) wins over the App-minted client. */
+    githubClientOverride?: GitHubClient;
+    resolveUserGitHubToken?: ResolveUserGitHubToken;
+    /** The GitLab-backed engine client, used as the gate/merge fallback when no GitHub App is set. */
+    gitlabEngineClient: GitHubClient | undefined;
+    providerRegistry: ProviderRegistry;
+    resolveRepoTarget: ResolveRepoTarget;
+    githubInstallationRepository: GitHubInstallationRepository;
+    repoProjectionRepository: RepoProjectionRepository;
+    blockRepository: BlockRepository;
+    trackerSettingsRepository: TrackerSettingsRepository;
+    caches?: AppCaches;
+}
+/** The GitHub-client-dependent wiring {@link selectNodeGitHubDeps} produces. */
+export interface NodeGitHubDeps {
+    /** The GitHub-issue-specific client (App or injected); NOT the GitLab fallback. */
+    githubClient: GitHubClient | undefined;
+    tasks: NodeTasksDeps;
+    fileGitHubIssue: ReturnType<typeof buildNodeGitHubIssueFiler>;
+    issueWritebackProvider: IssueWritebackService;
+    githubGateDeps: Partial<CoreDependencies>;
+    githubModuleDeps: Partial<CoreDependencies>;
+}
+/**
+ * The GitHub-client-dependent slice of the Node composition root, lifted out of
+ * `buildNodeContainer` so that root stays within the file-size budget (the same reason
+ * `container-executor-deps.ts` / `container-content-library-deps.ts` exist). Mirrors the
+ * Worker's `selectGitHubDeps`: build the engine's GitHub client, wire the CI / mergeability /
+ * review / doc-quality gate providers onto the app-owned `providerRegistry`, and assemble the
+ * GitHub gate + projection/sync module deps. As a side effect it registers the gate providers;
+ * call it at the point the region occupied so the ordering (before `applyGateProviders`) holds.
+ */
+export declare function selectNodeGitHubDeps(input: NodeGitHubDepsInput): NodeGitHubDeps;
+//# sourceMappingURL=container-github-deps.d.ts.map

package/dist/container-github-deps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-github-deps.d.ts","sourceRoot":"","sources":["../src/container-github-deps.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,qBAAqB,EAItB,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EACV,SAAS,EACT,eAAe,EACf,KAAK,EACL,YAAY,EACZ,4BAA4B,EAC5B,WAAW,EACX,gBAAgB,EAGhB,wBAAwB,EACxB,sBAAsB,EACtB,wBAAwB,EAExB,yBAAyB,EAC1B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAClE,OAAO,EACL,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EAcvB,MAAM,qBAAqB,CAAA;AAO5B,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAA;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AA2B/C,qGAAqG;AACrG,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAC/B,wBAAwB,CAAC,EAAE,wBAAwB,CAAA;CACpD;AA6CD,2EAA2E;AAC3E,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,SAAS,CAAA;IACjB,EAAE,EAAE,SAAS,CAAA;IACb,0FAA0F;IAC1F,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAA;IAChD,6FAA6F;IAC7F,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,SAAS,KAAK,CAAC,KAAK,CAAC,CAAA;IAC3D,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,KAAK,CAAA;IACZ,WAAW,EAAE,iBAAiB,GAAG,SAAS,CAAA;IAC1C,8FAA8F;IAC9F,oBAAoB,CAAC,EAAE,YAAY,CAAA;IACnC,sBAAsB,CAAC,EAAE,sBAAsB,CAAA;IAC/C,kGAAkG;IAClG,kBAAkB,EAAE,YAAY,GAAG,SAAS,CAAA;IAC5C,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,4BAA4B,EAAE,4BAA4B,CAAA;IAC1D,wBAAwB,EAAE,wBAAwB,CAAA;IAClD,eAAe,EAAE,eAAe,CAAA;IAChC,yBAAyB,EAAE,yBAAyB,CAAA;IACpD,MAAM,CAAC,EAAE,SAAS,CAAA;CACnB;AAED,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC7B,mFAAmF;IACnF,YAAY,EAAE,YAAY,GAAG,SAAS,CAAA;IACtC,KAAK,EAAE,aAAa,CAAA;IACpB,eAAe,EAAE,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAA;IAC7D,sBAAsB,EAAE,qBAAqB,CAAA;IAC7C,cAAc,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACzC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAA;CAC5C;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CAmS/E"}

package/dist/container-github-deps.js

@@ -0,0 +1,275 @@
+import { GitHubIssuesProvider, IssueWritebackService, JiraProvider, LinearTaskProvider, githubIssuesLogic, } from '@cat-factory/integrations';
+import { FetchGitHubClient, FetchGitHubProvisioningClient, GitHubBranchUpdater, GitHubCiStatusProvider, GitHubDocQualityProvider, GitHubMergeabilityProvider, GitHubPullRequestMerger, GitHubPullRequestReviewProvider, PatPreferringAppRegistry, WebCryptoSecretCipher, WebCryptoWebhookVerifier, makeResolveRepoFilesForCoords, makeResolveRunRepoContext, } from '@cat-factory/server';
+import { wireCiStatusProvider, wireDocQualityProvider, wireMergeabilityProvider, wirePullRequestReviewProvider, } from '@cat-factory/gates';
+import { buildNodeGitHubIssueFiler } from './container-executor-deps.js';
+import { DrizzleDocumentRepository } from './repositories/documents.js';
+import { DrizzleBranchProjectionRepository, DrizzleCheckRunProjectionRepository, DrizzleCommitProjectionRepository, DrizzleIssueProjectionRepository, DrizzlePullRequestProjectionRepository, } from './repositories/github.js';
+import { DrizzleTaskConnectionRepository, DrizzleTaskRepository, DrizzleTaskSourceSettingsRepository, } from './repositories/tasks.js';
+import { DrizzleUserRepoAccessRepository } from './repositories/userRepoAccess.js';
+// The engine's CI/mergeability gate reads never persist rate-limit snapshots (that is the
+// GitHub sync/webhook path's job), so the client backing them takes a no-op rate-limit store.
+class NoopRateLimitRepository {
+    record(_snapshot) {
+        return Promise.resolve();
+    }
+    deleteOlderThan(_epochMs) {
+        return Promise.resolve(0);
+    }
+}
+/**
+ * Wire the task-source integration for the Node facade (Jira + Linear always; GitHub Issues
+ * only when a GitHub client is available, since it reuses the workspace's App installation).
+ * Mirrors the Cloudflare facade's `config.github.enabled` gate (see CLAUDE.md parity rule).
+ * Whether a workspace OFFERS a source is the per-workspace toggle (task_source_settings), not
+ * a deployment env gate.
+ */
+function selectNodeTasksDeps(config, db, githubClient, installations) {
+    if (!config.tasks.enabled || !config.tasks.encryptionKey)
+        return { deps: {} };
+    // Jira and Linear are always registered (their credentials are per-workspace, entered in the UI).
+    const providers = [new JiraProvider(), new LinearTaskProvider()];
+    // GitHub Issues reuse the workspace's installed GitHub App, so this provider is
+    // wired whenever a GitHub client is available (the App is configured) — it has no
+    // credentials of its own and resolves the installation per issue.
+    if (githubClient) {
+        providers.push(new GitHubIssuesProvider({ githubClient, installations }));
+    }
+    const taskConnectionRepository = new DrizzleTaskConnectionRepository(db, 
+    // Source credentials are encrypted at rest under a tasks-scoped HKDF info (the
+    // same domain the Cloudflare facade uses), keyed by the shared ENCRYPTION_KEY.
+    new WebCryptoSecretCipher({
+        masterKeyBase64: config.tasks.encryptionKey,
+        info: 'cat-factory:tasks',
+    }));
+    return {
+        deps: {
+            taskSourceProviders: providers,
+            taskConnectionRepository,
+            taskSourceSettingsRepository: new DrizzleTaskSourceSettingsRepository(db),
+            taskRepository: new DrizzleTaskRepository(db),
+        },
+        taskConnectionRepository,
+    };
+}
+/**
+ * The GitHub-client-dependent slice of the Node composition root, lifted out of
+ * `buildNodeContainer` so that root stays within the file-size budget (the same reason
+ * `container-executor-deps.ts` / `container-content-library-deps.ts` exist). Mirrors the
+ * Worker's `selectGitHubDeps`: build the engine's GitHub client, wire the CI / mergeability /
+ * review / doc-quality gate providers onto the app-owned `providerRegistry`, and assemble the
+ * GitHub gate + projection/sync module deps. As a side effect it registers the gate providers;
+ * call it at the point the region occupied so the ordering (before `applyGateProviders`) holds.
+ */
+export function selectNodeGitHubDeps(input) {
+    const { config, db, remoteRepos, sourced, idGenerator, clock, appRegistry, githubClientOverride, resolveUserGitHubToken, gitlabEngineClient, providerRegistry, resolveRepoTarget, githubInstallationRepository, repoProjectionRepository, blockRepository, trackerSettingsRepository, caches, } = input;
+    // GitHub-issue tracker: file the tech-debt pipeline's issue through the workspace's
+    // own GitHub App installation (per-tenant), resolving the service's repo from the
+    // github_repos projection — the same per-tenant infra the container executor uses.
+    const fileGitHubIssue = buildNodeGitHubIssueFiler(config, appRegistry, resolveRepoTarget);
+    // The GitHub client backing the CI gate + merge / mergeability providers: an injected
+    // one wins (the local facade supplies a PAT-backed client), else — when the GitHub App
+    // is configured — one minted from the shared App registry, so a stock Node deployment
+    // with an App ALSO gates on real GitHub Actions CI and merges the PR for real (parity
+    // with the Worker). Undefined → these stay unwired and the gates pass through.
+    // Prefer the run initiator's per-user PAT (when stored) over the App token for the
+    // engine's CI gate + merge reads, so those are attributed to them too. The engine
+    // sets the initiator in ambient context around the gate-probe / merge boundaries.
+    const engineRegistry = appRegistry && resolveUserGitHubToken
+        ? new PatPreferringAppRegistry(appRegistry, resolveUserGitHubToken)
+        : appRegistry;
+    const githubClient = githubClientOverride ??
+        (engineRegistry
+            ? new FetchGitHubClient({
+                registry: engineRegistry,
+                rateLimitRepository: new NoopRateLimitRepository(),
+                idGenerator,
+                clock,
+                apiBase: config.github.apiBase,
+            })
+            : undefined);
+    // The client the engine's gate / merge / RepoFiles seams read through: the real GitHub client
+    // when present, else the GitLab-backed fallback so a GitLab-only deployment still gates on real
+    // CI and merges for real (the GitHub App wins when both are configured). Kept SEPARATE from
+    // `githubClient` on purpose — the GitHub-issue-specific consumers below (the GitHub Issues task
+    // source, issue writeback, the App projection module) must NOT be fed the GitLab client, or a
+    // GitLab-only deployment would offer a non-functional "GitHub Issues" source (it resolves the
+    // empty github_installations projection). Parity with the Worker, which keeps the App client
+    // distinct from its GitLab engine fallback.
+    const engineVcsClient = githubClient ?? gitlabEngineClient;
+    // Task-source integration (Jira + GitHub issues). Tenants connect their own Jira
+    // site through the UI (credentials stored per-workspace, encrypted at rest); the
+    // tracker resolves each workspace's own credentials from this same store. GitHub
+    // issues reuse the workspace's installed App, so they wire only when `githubClient`
+    // is available — kept here, after the client is built, for parity with the Worker.
+    const tasks = selectNodeTasksDeps(config, db, githubClient, githubInstallationRepository);
+    // Issue-tracker writeback (comment-on-PR-open + close-on-merge of a task's linked
+    // issue), gated per workspace + per task inside the provider. GitHub uses the same
+    // per-tenant client + installation lookup as the tracker/CI/merge providers; Jira
+    // reuses the workspace's encrypted connection. Wired whenever the tracker-settings
+    // repo exists (always on Node) so the engine can write back when a tracker is set.
+    const resolveWritebackIssue = githubClient
+        ? async (workspaceId, externalId) => {
+            const parsed = githubIssuesLogic.parseGitHubIssueExternalId(externalId);
+            if (!parsed)
+                return null;
+            const installation = await githubInstallationRepository.getByWorkspace(workspaceId);
+            if (!installation)
+                return null;
+            return { installationId: installation.installationId, parsed };
+        }
+        : undefined;
+    const issueWritebackProvider = new IssueWritebackService({
+        trackerSettingsRepository,
+        taskRepository: sourced('taskRepository', (d) => new DrizzleTaskRepository(d)),
+        fetchImpl: fetch,
+        ...(githubClient && resolveWritebackIssue
+            ? {
+                commentOnGitHubIssue: async (workspaceId, externalId, body) => {
+                    const target = await resolveWritebackIssue(workspaceId, externalId);
+                    if (!target)
+                        return;
+                    await githubClient.comment(target.installationId, { owner: target.parsed.owner, repo: target.parsed.repo }, target.parsed.number, body);
+                },
+                closeGitHubIssue: async (workspaceId, externalId) => {
+                    const target = await resolveWritebackIssue(workspaceId, externalId);
+                    if (!target)
+                        return;
+                    await githubClient.closeIssue(target.installationId, { owner: target.parsed.owner, repo: target.parsed.repo }, target.parsed.number);
+                },
+                labelGitHubIssue: async (workspaceId, externalId, label) => {
+                    const target = await resolveWritebackIssue(workspaceId, externalId);
+                    if (!target)
+                        return;
+                    await githubClient.applyIssueLabel?.(target.installationId, { owner: target.parsed.owner, repo: target.parsed.repo }, target.parsed.number, label);
+                },
+            }
+            : {}),
+        ...(tasks.taskConnectionRepository
+            ? {
+                resolveJiraConnection: async (workspaceId) => {
+                    const connection = await tasks.taskConnectionRepository.getByWorkspace(workspaceId, 'jira');
+                    const { baseUrl, accountEmail, apiToken } = connection?.credentials ?? {};
+                    if (!baseUrl || !accountEmail || !apiToken)
+                        return null;
+                    return { baseUrl, accountEmail, apiToken };
+                },
+                resolveLinearConnection: async (workspaceId) => {
+                    const connection = await tasks.taskConnectionRepository.getByWorkspace(workspaceId, 'linear');
+                    const { apiKey, token } = connection?.credentials ?? {};
+                    return apiKey || token ? { apiKey, token } : null;
+                },
+            }
+            : {}),
+    });
+    let githubGateDeps = {};
+    if (engineVcsClient) {
+        // The `ci` / `conflicts` gates now live in `@cat-factory/gates`; wire their providers into
+        // the gate suite instead of onto the engine's CoreDependencies (single-process startup, so
+        // the deployment-global handles are set once here). Parity with the Worker's selectGitHubDeps.
+        // These read through `engineVcsClient` (GitHub App or the GitLab fallback), so a GitLab-only
+        // deployment gates + merges for real too.
+        wireCiStatusProvider(providerRegistry, new GitHubCiStatusProvider({
+            githubClient: engineVcsClient,
+            resolveRepoTarget,
+            blockRepository,
+        }));
+        wireMergeabilityProvider(providerRegistry, new GitHubMergeabilityProvider({
+            githubClient: engineVcsClient,
+            resolveRepoTarget,
+            blockRepository,
+        }));
+        wirePullRequestReviewProvider(providerRegistry, new GitHubPullRequestReviewProvider({
+            githubClient: engineVcsClient,
+            resolveRepoTarget,
+            blockRepository,
+        }));
+        wireDocQualityProvider(providerRegistry, new GitHubDocQualityProvider({
+            githubClient: engineVcsClient,
+            resolveRepoTarget,
+            blockRepository,
+            // The gate resolves a workspace-linked template (WS1) for the block's kind, so it checks
+            // against the SAME sections the doc-writer followed. In db-less mothership mode the writer
+            // resolves the template through the RPC-proxied documents repo (getRoleLink is run-path
+            // allow-listed), so the gate MUST use that same repo — not `undefined` — or a doc written
+            // to the workspace template would be graded against the built-in skeleton (writer/gate drift).
+            documentRepository: db
+                ? new DrizzleDocumentRepository(db)
+                : remoteRepos?.documentRepository,
+        }));
+        githubGateDeps = {
+            // The engine binds a registered custom kind's pre/post-op hooks to a run's repo
+            // via this checkout-free RepoFiles resolver, composed from the same client +
+            // repo-target walk the gates/merger use — parity with the Worker. The `repoFiles`
+            // cache (slice 4) makes the post-op idempotency re-reads a read-through hit.
+            resolveRunRepoContext: makeResolveRunRepoContext(engineVcsClient, resolveRepoTarget, caches?.repoFiles),
+            // Block-less repo resolver for the environments module's on-demand repo
+            // validation / config bootstrap (operator names owner+repo).
+            resolveRepoFilesForCoords: makeResolveRepoFilesForCoords(engineVcsClient, githubInstallationRepository, repoProjectionRepository),
+            branchUpdater: new GitHubBranchUpdater({
+                githubClient: engineVcsClient,
+                resolveRepoTarget,
+                blockRepository,
+            }),
+            pullRequestMerger: new GitHubPullRequestMerger({
+                githubClient: engineVcsClient,
+                resolveRepoTarget,
+                blockRepository,
+            }),
+        };
+    }
+    // GitHub installation + projections + sync/webhook module: wired when the App is
+    // configured (a real githubClient), mirroring the Worker's selectGitHubDeps. This
+    // turns the GitHub read endpoints + the inline webhook/backfill sync on for Node —
+    // the sync engine (GitHubSyncService) is runtime-neutral, so populating the
+    // projection repos here makes the inline ingest actually persist (parity with the
+    // Worker, which fans the same sync through a queue/Workflow). `canCreateRepos` /
+    // `workflowsGranted` come from the App registry when present (advisory).
+    const githubModuleDeps = config.github.enabled && githubClient
+        ? {
+            githubClient,
+            githubInstallationRepository,
+            repoProjectionRepository,
+            // The five GitHub projection repos share one shape (remote in mothership mode, else
+            // Drizzle over `db`), routed through the shared `sourced` helper.
+            branchProjectionRepository: sourced('branchProjectionRepository', (d) => new DrizzleBranchProjectionRepository(d)),
+            pullRequestProjectionRepository: sourced('pullRequestProjectionRepository', (d) => new DrizzlePullRequestProjectionRepository(d)),
+            issueProjectionRepository: sourced('issueProjectionRepository', (d) => new DrizzleIssueProjectionRepository(d)),
+            commitProjectionRepository: sourced('commitProjectionRepository', (d) => new DrizzleCommitProjectionRepository(d)),
+            checkRunProjectionRepository: sourced('checkRunProjectionRepository', (d) => new DrizzleCheckRunProjectionRepository(d)),
+            // Per-user PAT-reachable repo projection (picker expansion + redaction); Postgres-only,
+            // so absent in a no-DB mothership node (the picker keeps its App-only behaviour there).
+            userRepoAccessRepository: db ? new DrizzleUserRepoAccessRepository(db) : undefined,
+            webhookVerifier: new WebCryptoWebhookVerifier(config.github.webhookSecret),
+            // Bound the initial backfill to the commit retention horizon (0 = full).
+            commitBackfillHorizonMs: config.retention.commitMs || undefined,
+            ...(appRegistry
+                ? {
+                    // Privileged App tier (ADR 0005): when configured, its client backs the
+                    // create-repo endpoint; `canCreateRepos` flags a connection whose
+                    // installation is owned by the privileged App. Absent → repo creation
+                    // stays the manual flow (parity with the Worker's selectGitHubDeps).
+                    repoProvisioningClient: config.github.privilegedApp
+                        ? new FetchGitHubProvisioningClient({
+                            registry: appRegistry,
+                            apiBase: config.github.apiBase,
+                        })
+                        : undefined,
+                    canCreateRepos: (installation) => appRegistry.canCreateRepos(installation),
+                    workflowsGranted: async (installation) => {
+                        const perms = await appRegistry.installationPermissions(installation.installationId);
+                        return perms.workflows === 'write';
+                    },
+                }
+                : {}),
+        }
+        : {};
+    return {
+        githubClient,
+        tasks,
+        fileGitHubIssue,
+        issueWritebackProvider,
+        githubGateDeps,
+        githubModuleDeps,
+    };
+}
+//# sourceMappingURL=container-github-deps.js.map

package/dist/container-github-deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-github-deps.js","sourceRoot":"","sources":["../src/container-github-deps.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,2BAA2B,CAAA;AAkBlC,OAAO,EAIL,iBAAiB,EACjB,6BAA6B,EAC7B,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,0BAA0B,EAC1B,uBAAuB,EACvB,+BAA+B,EAC/B,wBAAwB,EACxB,qBAAqB,EACrB,wBAAwB,EACxB,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAA;AAExE,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAA;AACvE,OAAO,EACL,iCAAiC,EACjC,mCAAmC,EACnC,iCAAiC,EACjC,gCAAgC,EAChC,sCAAsC,GACvC,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,+BAA+B,EAC/B,qBAAqB,EACrB,mCAAmC,GACpC,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAA;AAElF,0FAA0F;AAC1F,8FAA8F;AAC9F,MAAM,uBAAuB;IAC3B,MAAM,CAAC,SAA4B;QACjC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;IAC1B,CAAC;IACD,eAAe,CAAC,QAAgB;QAC9B,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC3B,CAAC;CACF;AAQD;;;;;;GAMG;AACH,SAAS,mBAAmB,CAC1B,MAAiB,EACjB,EAAa,EACb,YAAsC,EACtC,aAA2C;IAE3C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAA;IAC7E,kGAAkG;IAClG,MAAM,SAAS,GAAyB,CAAC,IAAI,YAAY,EAAE,EAAE,IAAI,kBAAkB,EAAE,CAAC,CAAA;IACtF,gFAAgF;IAChF,kFAAkF;IAClF,kEAAkE;IAClE,IAAI,YAAY,EAAE,CAAC;QACjB,SAAS,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,CAAC,CAAA;IAC3E,CAAC;IAED,MAAM,wBAAwB,GAAG,IAAI,+BAA+B,CAClE,EAAE;IACF,+EAA+E;IAC/E,+EAA+E;IAC/E,IAAI,qBAAqB,CAAC;QACxB,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa;QAC3C,IAAI,EAAE,mBAAmB;KAC1B,CAAC,CACH,CAAA;IACD,OAAO;QACL,IAAI,EAAE;YACJ,mBAAmB,EAAE,SAAS;YAC9B,wBAAwB;YACxB,4BAA4B,EAAE,IAAI,mCAAmC,CAAC,EAAE,CAAC;YACzE,cAAc,EAAE,IAAI,qBAAqB,CAAC,EAAE,CAAC;SAC9C;QACD,wBAAwB;KACzB,CAAA;AACH,CAAC;AAsCD;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAA0B;IAC7D,MAAM,EACJ,MAAM,EACN,EAAE,EACF,WAAW,EACX,OAAO,EACP,WAAW,EACX,KAAK,EACL,WAAW,EACX,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,4BAA4B,EAC5B,wBAAwB,EACxB,eAAe,EACf,yBAAyB,EACzB,MAAM,GACP,GAAG,KAAK,CAAA;IAET,oFAAoF;IACpF,kFAAkF;IAClF,mFAAmF;IACnF,MAAM,eAAe,GAAG,yBAAyB,CAAC,MAAM,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAA;IAEzF,sFAAsF;IACtF,uFAAuF;IACvF,sFAAsF;IACtF,sFAAsF;IACtF,+EAA+E;IAC/E,mFAAmF;IACnF,kFAAkF;IAClF,kFAAkF;IAClF,MAAM,cAAc,GAClB,WAAW,IAAI,sBAAsB;QACnC,CAAC,CAAC,IAAI,wBAAwB,CAAC,WAAW,EAAE,sBAAsB,CAAC;QACnE,CAAC,CAAC,WAAW,CAAA;IACjB,MAAM,YAAY,GAChB,oBAAoB;QACpB,CAAC,cAAc;YACb,CAAC,CAAC,IAAI,iBAAiB,CAAC;gBACpB,QAAQ,EAAE,cAAc;gBACxB,mBAAmB,EAAE,IAAI,uBAAuB,EAAE;gBAClD,WAAW;gBACX,KAAK;gBACL,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;aAC/B,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC,CAAA;IAEhB,8FAA8F;IAC9F,gGAAgG;IAChG,4FAA4F;IAC5F,gGAAgG;IAChG,8FAA8F;IAC9F,8FAA8F;IAC9F,6FAA6F;IAC7F,4CAA4C;IAC5C,MAAM,eAAe,GAA6B,YAAY,IAAI,kBAAkB,CAAA;IAEpF,iFAAiF;IACjF,iFAAiF;IACjF,iFAAiF;IACjF,oFAAoF;IACpF,mFAAmF;IACnF,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,4BAA4B,CAAC,CAAA;IAEzF,kFAAkF;IAClF,mFAAmF;IACnF,kFAAkF;IAClF,mFAAmF;IACnF,mFAAmF;IACnF,MAAM,qBAAqB,GAAG,YAAY;QACxC,CAAC,CAAC,KAAK,EAAE,WAAmB,EAAE,UAAkB,EAAE,EAAE;YAChD,MAAM,MAAM,GAAG,iBAAiB,CAAC,0BAA0B,CAAC,UAAU,CAAC,CAAA;YACvE,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAA;YACxB,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;YACnF,IAAI,CAAC,YAAY;gBAAE,OAAO,IAAI,CAAA;YAC9B,OAAO,EAAE,cAAc,EAAE,YAAY,CAAC,cAAc,EAAE,MAAM,EAAE,CAAA;QAChE,CAAC;QACH,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,sBAAsB,GAAG,IAAI,qBAAqB,CAAC;QACvD,yBAAyB;QACzB,cAAc,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC9E,SAAS,EAAE,KAAK;QAChB,GAAG,CAAC,YAAY,IAAI,qBAAqB;YACvC,CAAC,CAAC;gBACE,oBAAoB,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE;oBAC5D,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;oBACnE,IAAI,CAAC,MAAM;wBAAE,OAAM;oBACnB,MAAM,YAAY,CAAC,OAAO,CACxB,MAAM,CAAC,cAAc,EACrB,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EACxD,MAAM,CAAC,MAAM,CAAC,MAAM,EACpB,IAAI,CACL,CAAA;gBACH,CAAC;gBACD,gBAAgB,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE;oBAClD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;oBACnE,IAAI,CAAC,MAAM;wBAAE,OAAM;oBACnB,MAAM,YAAY,CAAC,UAAU,CAC3B,MAAM,CAAC,cAAc,EACrB,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EACxD,MAAM,CAAC,MAAM,CAAC,MAAM,CACrB,CAAA;gBACH,CAAC;gBACD,gBAAgB,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE;oBACzD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;oBACnE,IAAI,CAAC,MAAM;wBAAE,OAAM;oBACnB,MAAM,YAAY,CAAC,eAAe,EAAE,CAClC,MAAM,CAAC,cAAc,EACrB,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EACxD,MAAM,CAAC,MAAM,CAAC,MAAM,EACpB,KAAK,CACN,CAAA;gBACH,CAAC;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,wBAAwB;YAChC,CAAC,CAAC;gBACE,qBAAqB,EAAE,KAAK,EAAE,WAAmB,EAAE,EAAE;oBACnD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,wBAAyB,CAAC,cAAc,CACrE,WAAW,EACX,MAAM,CACP,CAAA;oBACD,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,UAAU,EAAE,WAAW,IAAI,EAAE,CAAA;oBACzE,IAAI,CAAC,OAAO,IAAI,CAAC,YAAY,IAAI,CAAC,QAAQ;wBAAE,OAAO,IAAI,CAAA;oBACvD,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAA;gBAC5C,CAAC;gBACD,uBAAuB,EAAE,KAAK,EAAE,WAAmB,EAAE,EAAE;oBACrD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,wBAAyB,CAAC,cAAc,CACrE,WAAW,EACX,QAAQ,CACT,CAAA;oBACD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,EAAE,WAAW,IAAI,EAAE,CAAA;oBACvD,OAAO,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;gBACnD,CAAC;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAA;IAEF,IAAI,cAAc,GAA8B,EAAE,CAAA;IAClD,IAAI,eAAe,EAAE,CAAC;QACpB,2FAA2F;QAC3F,2FAA2F;QAC3F,+FAA+F;QAC/F,6FAA6F;QAC7F,0CAA0C;QAC1C,oBAAoB,CAClB,gBAAgB,EAChB,IAAI,sBAAsB,CAAC;YACzB,YAAY,EAAE,eAAe;YAC7B,iBAAiB;YACjB,eAAe;SAChB,CAAC,CACH,CAAA;QACD,wBAAwB,CACtB,gBAAgB,EAChB,IAAI,0BAA0B,CAAC;YAC7B,YAAY,EAAE,eAAe;YAC7B,iBAAiB;YACjB,eAAe;SAChB,CAAC,CACH,CAAA;QACD,6BAA6B,CAC3B,gBAAgB,EAChB,IAAI,+BAA+B,CAAC;YAClC,YAAY,EAAE,eAAe;YAC7B,iBAAiB;YACjB,eAAe;SAChB,CAAC,CACH,CAAA;QACD,sBAAsB,CACpB,gBAAgB,EAChB,IAAI,wBAAwB,CAAC;YAC3B,YAAY,EAAE,eAAe;YAC7B,iBAAiB;YACjB,eAAe;YACf,yFAAyF;YACzF,2FAA2F;YAC3F,wFAAwF;YACxF,0FAA0F;YAC1F,+FAA+F;YAC/F,kBAAkB,EAAE,EAAE;gBACpB,CAAC,CAAC,IAAI,yBAAyB,CAAC,EAAE,CAAC;gBACnC,CAAC,CAAE,WAAW,EAAE,kBAA6D;SAChF,CAAC,CACH,CAAA;QACD,cAAc,GAAG;YACf,gFAAgF;YAChF,6EAA6E;YAC7E,kFAAkF;YAClF,6EAA6E;YAC7E,qBAAqB,EAAE,yBAAyB,CAC9C,eAAe,EACf,iBAAiB,EACjB,MAAM,EAAE,SAAS,CAClB;YACD,wEAAwE;YACxE,6DAA6D;YAC7D,yBAAyB,EAAE,6BAA6B,CACtD,eAAe,EACf,4BAA4B,EAC5B,wBAAwB,CACzB;YACD,aAAa,EAAE,IAAI,mBAAmB,CAAC;gBACrC,YAAY,EAAE,eAAe;gBAC7B,iBAAiB;gBACjB,eAAe;aAChB,CAAC;YACF,iBAAiB,EAAE,IAAI,uBAAuB,CAAC;gBAC7C,YAAY,EAAE,eAAe;gBAC7B,iBAAiB;gBACjB,eAAe;aAChB,CAAC;SACH,CAAA;IACH,CAAC;IAED,iFAAiF;IACjF,kFAAkF;IAClF,mFAAmF;IACnF,4EAA4E;IAC5E,kFAAkF;IAClF,iFAAiF;IACjF,yEAAyE;IACzE,MAAM,gBAAgB,GACpB,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,YAAY;QACnC,CAAC,CAAC;YACE,YAAY;YACZ,4BAA4B;YAC5B,wBAAwB;YACxB,oFAAoF;YACpF,kEAAkE;YAClE,0BAA0B,EAAE,OAAO,CACjC,4BAA4B,EAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,iCAAiC,CAAC,CAAC,CAAC,CAChD;YACD,+BAA+B,EAAE,OAAO,CACtC,iCAAiC,EACjC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,sCAAsC,CAAC,CAAC,CAAC,CACrD;YACD,yBAAyB,EAAE,OAAO,CAChC,2BAA2B,EAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,gCAAgC,CAAC,CAAC,CAAC,CAC/C;YACD,0BAA0B,EAAE,OAAO,CACjC,4BAA4B,EAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,iCAAiC,CAAC,CAAC,CAAC,CAChD;YACD,4BAA4B,EAAE,OAAO,CACnC,8BAA8B,EAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,mCAAmC,CAAC,CAAC,CAAC,CAClD;YACD,wFAAwF;YACxF,wFAAwF;YACxF,wBAAwB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,+BAA+B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;YAClF,eAAe,EAAE,IAAI,wBAAwB,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;YAC1E,yEAAyE;YACzE,uBAAuB,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,IAAI,SAAS;YAC/D,GAAG,CAAC,WAAW;gBACb,CAAC,CAAC;oBACE,wEAAwE;oBACxE,kEAAkE;oBAClE,sEAAsE;oBACtE,qEAAqE;oBACrE,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa;wBACjD,CAAC,CAAC,IAAI,6BAA6B,CAAC;4BAChC,QAAQ,EAAE,WAAW;4BACrB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;yBAC/B,CAAC;wBACJ,CAAC,CAAC,SAAS;oBACb,cAAc,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,WAAW,CAAC,cAAc,CAAC,YAAY,CAAC;oBAC1E,gBAAgB,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;wBACvC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,uBAAuB,CACrD,YAAY,CAAC,cAAc,CAC5B,CAAA;wBACD,OAAO,KAAK,CAAC,SAAS,KAAK,OAAO,CAAA;oBACpC,CAAC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;QACH,CAAC,CAAC,EAAE,CAAA;IAER,OAAO;QACL,YAAY;QACZ,KAAK;QACL,eAAe;QACf,sBAAsB;QACtB,cAAc;QACd,gBAAgB;KACjB,CAAA;AACH,CAAC"}

package/dist/container-model-deps.d.ts

@@ -0,0 +1,50 @@
+import { AiAgentExecutor, type AgentKindRegistry } from '@cat-factory/agents';
+import type { ApiKeyService, LocalModelEndpointService, UserSecretKindRegistry } from '@cat-factory/integrations';
+import type { AppCaches, LocalModelEndpointRepository, ModelProviderResolver, PersonalSubscriptionRepository, ProviderApiKeyRepository, ProviderSubscriptionTokenRepository, ResolveUserGitHubToken, SubscriptionActivationRepository, WorkspaceRepository } from '@cat-factory/kernel';
+import type { Clock, IdGenerator } from '@cat-factory/kernel';
+import { type AppConfig } from '@cat-factory/server';
+import type { ModelProviderResolverWrapDeps } from './container.js';
+import type { DrizzleDb } from './db/client.js';
+/** Inputs {@link buildNodeModelDeps} needs from the composition root. */
+export interface NodeModelDepsInput {
+    env: NodeJS.ProcessEnv;
+    config: AppConfig;
+    db: DrizzleDb;
+    workspaceRepository: WorkspaceRepository;
+    idGenerator: IdGenerator;
+    clock: Clock;
+    agentKindRegistry: AgentKindRegistry;
+    userSecretKindRegistry: UserSecretKindRegistry;
+    resolveWorkspaceModelDefault: (workspaceId: string, agentKind: string, modelPresetId?: string) => Promise<string | undefined>;
+    providerApiKeyRepository?: ProviderApiKeyRepository;
+    localModelEndpointRepository?: LocalModelEndpointRepository;
+    providerSubscriptionTokenRepository?: ProviderSubscriptionTokenRepository;
+    personalSubscriptionRepository?: PersonalSubscriptionRepository;
+    subscriptionActivationRepository?: SubscriptionActivationRepository;
+    wrapModelProviderResolver?: (inner: ModelProviderResolver, deps: ModelProviderResolverWrapDeps) => ModelProviderResolver;
+    cloudflareModelsEnabled?: boolean;
+    caches?: AppCaches;
+}
+/**
+ * The credential/token stores + the model-provisioning stack of the Node composition root,
+ * lifted out of `buildNodeContainer` so that root stays within the file-size budget (the same
+ * reason `container-executor-deps.ts` exists). Builds the direct-provider API-key pool, the
+ * public-API + local-model-endpoint + user-secret + OpenRouter-catalog + subscription +
+ * personal-subscription stores, then the trace sink, the (optionally facade-wrapped +
+ * vendor-limited) model-provider resolver, and the inline agent executor.
+ */
+export declare function buildNodeModelDeps(input: NodeModelDepsInput): {
+    apiKeys: ApiKeyService | undefined;
+    publicApiKeys: import("@cat-factory/integrations").PublicApiKeyService | undefined;
+    localModelEndpoints: LocalModelEndpointService | undefined;
+    userSecrets: import("@cat-factory/integrations").UserSecretService | undefined;
+    resolveUserGitHubToken: ResolveUserGitHubToken | undefined;
+    openRouterCatalog: import("@cat-factory/integrations").OpenRouterCatalogService | undefined;
+    subscriptions: import("@cat-factory/integrations").ProviderSubscriptionService | undefined;
+    personalSubscriptions: import("@cat-factory/integrations").PersonalSubscriptionService | undefined;
+    traceSink: import("@cat-factory/kernel").LlmTraceSink | undefined;
+    modelProviderResolver: ModelProviderResolver;
+    cloudflareModelsEnabled: boolean;
+    inline: AiAgentExecutor;
+};
+//# sourceMappingURL=container-model-deps.d.ts.map

package/dist/container-model-deps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-model-deps.d.ts","sourceRoot":"","sources":["../src/container-model-deps.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,KAAK,iBAAiB,EAGvB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EACV,aAAa,EACb,yBAAyB,EACzB,sBAAsB,EACvB,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EACV,SAAS,EACT,4BAA4B,EAC5B,qBAAqB,EACrB,8BAA8B,EAC9B,wBAAwB,EACxB,mCAAmC,EACnC,sBAAsB,EACtB,gCAAgC,EAChC,mBAAmB,EACpB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,EAAE,KAAK,SAAS,EAA2B,MAAM,qBAAqB,CAAA;AAE7E,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAsC/C,yEAAyE;AACzE,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;IACtB,MAAM,EAAE,SAAS,CAAA;IACjB,EAAE,EAAE,SAAS,CAAA;IACb,mBAAmB,EAAE,mBAAmB,CAAA;IACxC,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,KAAK,CAAA;IACZ,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,sBAAsB,EAAE,sBAAsB,CAAA;IAC9C,4BAA4B,EAAE,CAC5B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,KACnB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAChC,wBAAwB,CAAC,EAAE,wBAAwB,CAAA;IACnD,4BAA4B,CAAC,EAAE,4BAA4B,CAAA;IAC3D,mCAAmC,CAAC,EAAE,mCAAmC,CAAA;IACzE,8BAA8B,CAAC,EAAE,8BAA8B,CAAA;IAC/D,gCAAgC,CAAC,EAAE,gCAAgC,CAAA;IACnE,yBAAyB,CAAC,EAAE,CAC1B,KAAK,EAAE,qBAAqB,EAC5B,IAAI,EAAE,6BAA6B,KAChC,qBAAqB,CAAA;IAC1B,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC,MAAM,CAAC,EAAE,SAAS,CAAA;CACnB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,kBAAkB;;;;;;;;;;;;;EAiK3D"}