@cat-factory/server 0.111.0 → 0.112.1

package/dist/crypto/WebCryptoPersonalSecretCipher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"WebCryptoPersonalSecretCipher.d.ts","sourceRoot":"","sources":["../../src/crypto/WebCryptoPersonalSecretCipher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAyB/D,qBAAa,6BAA8B,YAAW,oBAAoB;IAClE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAU/D;IAEK,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgB9D;CACF"}
+{"version":3,"file":"WebCryptoPersonalSecretCipher.d.ts","sourceRoot":"","sources":["../../src/crypto/WebCryptoPersonalSecretCipher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAyB/D,qBAAa,6BAA8B,YAAW,oBAAoB;IAClE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAU/D;IAEK,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAmD9D;CACF"}

package/dist/crypto/WebCryptoPersonalSecretCipher.js

@@ -28,19 +28,48 @@ export class WebCryptoPersonalSecretCipher {
         return [VERSION, base64url(salt), base64url(iv), base64url(new Uint8Array(sealed))].join('.');
     }
     async open(envelope, password) {
-        const parts = envelope.split('.');
-        if (parts.length !== 4 || parts[0] !== VERSION) {
-            throw new Error('Invalid personal secret envelope');
+        // Parse the `pv1.` envelope up front. A wrong structure OR an undecodable segment
+        // (base64url that `atob` rejects — a mid-envelope corruption) both mean the stored
+        // value is malformed: the ciphertext never even reaches the decrypt, so this is NOT a
+        // wrong password — the column is truncated/corrupted, or was written by a different
+        // scheme/version. Both funnel through one actionable message (original kept as `cause`).
+        let salt;
+        let iv;
+        let ciphertext;
+        try {
+            const parts = envelope.split('.');
+            if (parts.length !== 4 || parts[0] !== VERSION) {
+                throw new Error(`unexpected envelope structure (${parts.length} segments)`);
+            }
+            salt = base64urlToBytes(parts[1]);
+            iv = base64urlToBytes(parts[2]);
+            ciphertext = base64urlToBytes(parts[3]);
+        }
+        catch (e) {
+            throw new Error('The stored personal subscription credential is not a valid encryption envelope: ' +
+                'it is truncated or corrupted, or was written by a different scheme/version. ' +
+                'Remove and re-add the subscription to re-seal it.', { cause: e });
         }
-        const salt = base64urlToBytes(parts[1]);
-        const iv = base64urlToBytes(parts[2]);
-        const ciphertext = base64urlToBytes(parts[3]);
         const key = await deriveKey(password, salt);
-        // A wrong password fails the GCM auth tag and throws here.
-        const plain = await crypto.subtle.decrypt({ name: 'AES-GCM', iv }, key, ciphertext);
+        let plain;
+        try {
+            plain = await crypto.subtle.decrypt({ name: 'AES-GCM', iv }, key, ciphertext);
+        }
+        catch (e) {
+            // AES-GCM authentication failed. For this password-derived layer that almost
+            // always means the WRONG PASSWORD: the key is derived from the personal password,
+            // so a mismatch can't reproduce the auth tag. The raw failure is the opaque Web
+            // Crypto DOMException ("operation-specific reason"); rethrow an actionable message
+            // (original kept as `cause`). The service maps this to a `wrong_password` 428.
+            throw new Error('The personal password does not match the one this subscription was sealed under — ' +
+                're-enter it, or remove and re-add the subscription.', { cause: e });
+        }
         const text = new TextDecoder().decode(plain);
         if (!text.startsWith(MAGIC)) {
-            throw new Error('Personal secret failed integrity check');
+            // GCM verified but the sealed magic prefix is absent — the stored value is corrupted
+            // or was sealed by a different scheme, not a simple wrong password.
+            throw new Error('This personal subscription credential failed its integrity check — the stored value ' +
+                'is corrupted or was sealed by a different scheme. Remove and re-add the subscription.');
         }
         return text.slice(MAGIC.length);
     }

package/dist/crypto/WebCryptoPersonalSecretCipher.js.map

@@ -1 +1 @@
-{"version":3,"file":"WebCryptoPersonalSecretCipher.js","sourceRoot":"","sources":["../../src/crypto/WebCryptoPersonalSecretCipher.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAE3D,mFAAmF;AACnF,iFAAiF;AACjF,qFAAqF;AACrF,kFAAkF;AAClF,qFAAqF;AACrF,sFAAsF;AACtF,mBAAmB;AACnB,EAAE;AACF,wGAAwG;AACxG,EAAE;AACF,oFAAoF;AACpF,mFAAmF;AACnF,8EAA8E;AAE9E,MAAM,OAAO,GAAG,KAAK,CAAA;AACrB,MAAM,UAAU,GAAG,EAAE,CAAA;AACrB,MAAM,QAAQ,GAAG,EAAE,CAAA;AACnB,uFAAuF;AACvF,sDAAsD;AACtD,MAAM,iBAAiB,GAAG,OAAO,CAAA;AACjC,MAAM,KAAK,GAAG,UAAU,CAAA;AAExB,MAAM,OAAO,6BAA6B;IACxC,KAAK,CAAC,IAAI,CAAC,SAAiB,EAAE,QAAgB;QAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAA;QAC/D,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC3D,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QAC3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACxC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EACvB,GAAG,EACH,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,GAAG,SAAS,CAAC,CAC5C,CAAA;QACD,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC/F,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,QAAgB;QAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;QACrD,CAAC;QACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAE,CAA4B,CAAA;QACnE,MAAM,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAE,CAA4B,CAAA;QACjE,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAE,CAA4B,CAAA;QACzE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QAC3C,2DAA2D;QAC3D,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,CAAA;QACnF,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC5C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;QAC3D,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACjC,CAAC;CACF;AAED,KAAK,UAAU,SAAS,CAAC,QAAgB,EAAE,IAAgB;IACzD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC3C,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAA4B,EAC7D,QAAQ,EACR,KAAK,EACL,CAAC,WAAW,CAAC,CACd,CAAA;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,IAA+B;QACrC,UAAU,EAAE,iBAAiB;KAC9B,EACD,OAAO,EACP,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAA;AACH,CAAC"}
+{"version":3,"file":"WebCryptoPersonalSecretCipher.js","sourceRoot":"","sources":["../../src/crypto/WebCryptoPersonalSecretCipher.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAE3D,mFAAmF;AACnF,iFAAiF;AACjF,qFAAqF;AACrF,kFAAkF;AAClF,qFAAqF;AACrF,sFAAsF;AACtF,mBAAmB;AACnB,EAAE;AACF,wGAAwG;AACxG,EAAE;AACF,oFAAoF;AACpF,mFAAmF;AACnF,8EAA8E;AAE9E,MAAM,OAAO,GAAG,KAAK,CAAA;AACrB,MAAM,UAAU,GAAG,EAAE,CAAA;AACrB,MAAM,QAAQ,GAAG,EAAE,CAAA;AACnB,uFAAuF;AACvF,sDAAsD;AACtD,MAAM,iBAAiB,GAAG,OAAO,CAAA;AACjC,MAAM,KAAK,GAAG,UAAU,CAAA;AAExB,MAAM,OAAO,6BAA6B;IACxC,KAAK,CAAC,IAAI,CAAC,SAAiB,EAAE,QAAgB;QAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAA;QAC/D,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC3D,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QAC3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACxC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EACvB,GAAG,EACH,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,GAAG,SAAS,CAAC,CAC5C,CAAA;QACD,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC/F,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,QAAgB;QAC3C,kFAAkF;QAClF,mFAAmF;QACnF,sFAAsF;QACtF,oFAAoF;QACpF,yFAAyF;QACzF,IAAI,IAA6B,CAAA;QACjC,IAAI,EAA2B,CAAA;QAC/B,IAAI,UAAmC,CAAA;QACvC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,kCAAkC,KAAK,CAAC,MAAM,YAAY,CAAC,CAAA;YAC7E,CAAC;YACD,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAE,CAA4B,CAAA;YAC7D,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAE,CAA4B,CAAA;YAC3D,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAE,CAA4B,CAAA;QACrE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,kFAAkF;gBAChF,8EAA8E;gBAC9E,mDAAmD,EACrD,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAA;QACH,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QAC3C,IAAI,KAAkB,CAAA;QACtB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,CAAA;QAC/E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,6EAA6E;YAC7E,kFAAkF;YAClF,gFAAgF;YAChF,mFAAmF;YACnF,+EAA+E;YAC/E,MAAM,IAAI,KAAK,CACb,oFAAoF;gBAClF,qDAAqD,EACvD,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAA;QACH,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC5C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,qFAAqF;YACrF,oEAAoE;YACpE,MAAM,IAAI,KAAK,CACb,sFAAsF;gBACpF,uFAAuF,CAC1F,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACjC,CAAC;CACF;AAED,KAAK,UAAU,SAAS,CAAC,QAAgB,EAAE,IAAgB;IACzD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC3C,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAA4B,EAC7D,QAAQ,EACR,KAAK,EACL,CAAC,WAAW,CAAC,CACd,CAAA;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,IAA+B;QACrC,UAAU,EAAE,iBAAiB;KAC9B,EACD,OAAO,EACP,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAA;AACH,CAAC"}

package/dist/crypto/WebCryptoSecretCipher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"WebCryptoSecretCipher.d.ts","sourceRoot":"","sources":["../../src/crypto/WebCryptoSecretCipher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAmBvD,MAAM,WAAW,4BAA4B;IAC3C,4DAA4D;IAC5D,eAAe,EAAE,MAAM,CAAA;IACvB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,qBAAa,qBAAsB,YAAW,YAAY;IAGxD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IACnD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyB;IAC9C,OAAO,CAAC,cAAc,CAAC,CAAoB;IAE3C,YAAY,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,4BAA4B,EAMlE;IAEK,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAUhD;IAEK,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA2B/C;IAED,OAAO,CAAC,OAAO;YASD,SAAS;CASxB"}
+{"version":3,"file":"WebCryptoSecretCipher.d.ts","sourceRoot":"","sources":["../../src/crypto/WebCryptoSecretCipher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAmBvD,MAAM,WAAW,4BAA4B;IAC3C,4DAA4D;IAC5D,eAAe,EAAE,MAAM,CAAA;IACvB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,qBAAa,qBAAsB,YAAW,YAAY;IAGxD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IACnD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyB;IAC9C,OAAO,CAAC,cAAc,CAAC,CAAoB;IAE3C,YAAY,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,4BAA4B,EAMlE;IAEK,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAUhD;IAEK,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA8C/C;IAED,OAAO,CAAC,OAAO;YASD,SAAS;CASxB"}

package/dist/crypto/WebCryptoSecretCipher.js

@@ -34,13 +34,30 @@ export class WebCryptoSecretCipher {
         return [VERSION, base64url(salt), base64url(iv), base64url(new Uint8Array(sealed))].join('.');
     }
     async decrypt(envelope) {
-        const parts = envelope.split('.');
-        if (parts.length !== 4 || parts[0] !== VERSION) {
-            throw new Error('Invalid secret envelope');
+        // Parse the `v1.` envelope up front. A wrong structure OR an undecodable segment
+        // (base64url that `atob` rejects — a mid-envelope corruption) both mean the ciphertext
+        // never reaches decryption, so this is a corruption/format problem, not a key mismatch
+        // (that surfaces below as an authentication failure). Usual causes: a truncated database
+        // column, or a value copied between environments on a different encryption scheme/version.
+        // Both funnel through one actionable message (original kept as `cause`).
+        let salt;
+        let iv;
+        let ciphertext;
+        try {
+            const parts = envelope.split('.');
+            if (parts.length !== 4 || parts[0] !== VERSION) {
+                throw new Error(`unexpected envelope structure (${parts.length} segments)`);
+            }
+            salt = base64urlToBytes(parts[1]);
+            iv = base64urlToBytes(parts[2]);
+            ciphertext = base64urlToBytes(parts[3]);
+        }
+        catch (e) {
+            throw new Error('A stored secret is not a valid encryption envelope: it is truncated or corrupted, ' +
+                'or was written by a different encryption scheme/version — most likely a truncated ' +
+                'database column, or a value copied between environments. Re-enter the affected ' +
+                'credential to re-seal it under the current ENCRYPTION_KEY.', { cause: e });
         }
-        const salt = base64urlToBytes(parts[1]);
-        const iv = base64urlToBytes(parts[2]);
-        const ciphertext = base64urlToBytes(parts[3]);
         const key = await this.deriveKey(salt);
         let plain;
         try {

package/dist/crypto/WebCryptoSecretCipher.js.map

@@ -1 +1 @@
-{"version":3,"file":"WebCryptoSecretCipher.js","sourceRoot":"","sources":["../../src/crypto/WebCryptoSecretCipher.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAE3D,+EAA+E;AAC/E,oFAAoF;AACpF,yEAAyE;AACzE,8EAA8E;AAC9E,8EAA8E;AAC9E,kFAAkF;AAClF,qDAAqD;AACrD,EAAE;AACF,+FAA+F;AAE/F,MAAM,OAAO,GAAG,IAAI,CAAA;AACpB,MAAM,UAAU,GAAG,EAAE,CAAA;AACrB,MAAM,QAAQ,GAAG,EAAE,CAAA;AACnB,iFAAiF;AACjF,MAAM,YAAY,GAAG,0BAA0B,CAAA;AAc/C,MAAM,OAAO,qBAAqB;IAChC,8EAA8E;IAC9E,iEAAiE;IAChD,SAAS,CAAyB;IAClC,IAAI,CAAyB;IACtC,cAAc,CAAqB;IAE3C,YAAY,EAAE,eAAe,EAAE,IAAI,EAAgC;QACjE,IAAI,CAAC,SAAS,GAAG,gBAAgB,CAAC,eAAe,CAAC,IAAI,EAAE,CAA4B,CAAA;QACpF,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QACpE,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,YAAY,CAA4B,CAAA;IACvF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAA;QAC/D,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC3D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACxC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EACvB,GAAG,EACH,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CACpC,CAAA;QACD,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC/F,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAgB;QAC5B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;QAC5C,CAAC;QACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAE,CAA4B,CAAA;QACnE,MAAM,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAE,CAA4B,CAAA;QACjE,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAE,CAA4B,CAAA;QACzE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACtC,IAAI,KAAkB,CAAA;QACtB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,CAAA;QAC/E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,qFAAqF;YACrF,mFAAmF;YACnF,oFAAoF;YACpF,qFAAqF;YACrF,uFAAuF;YACvF,sEAAsE;YACtE,MAAM,IAAI,KAAK,CACb,uFAAuF;gBACrF,iFAAiF;gBACjF,oGAAoG,EACtG,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAA;QACH,CAAC;QACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACxC,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE;gBAClF,WAAW;aACZ,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAA6B;QACnD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EACxD,MAAM,IAAI,CAAC,OAAO,EAAE,EACpB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAA;IACH,CAAC;CACF"}
+{"version":3,"file":"WebCryptoSecretCipher.js","sourceRoot":"","sources":["../../src/crypto/WebCryptoSecretCipher.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAE3D,+EAA+E;AAC/E,oFAAoF;AACpF,yEAAyE;AACzE,8EAA8E;AAC9E,8EAA8E;AAC9E,kFAAkF;AAClF,qDAAqD;AACrD,EAAE;AACF,+FAA+F;AAE/F,MAAM,OAAO,GAAG,IAAI,CAAA;AACpB,MAAM,UAAU,GAAG,EAAE,CAAA;AACrB,MAAM,QAAQ,GAAG,EAAE,CAAA;AACnB,iFAAiF;AACjF,MAAM,YAAY,GAAG,0BAA0B,CAAA;AAc/C,MAAM,OAAO,qBAAqB;IAChC,8EAA8E;IAC9E,iEAAiE;IAChD,SAAS,CAAyB;IAClC,IAAI,CAAyB;IACtC,cAAc,CAAqB;IAE3C,YAAY,EAAE,eAAe,EAAE,IAAI,EAAgC;QACjE,IAAI,CAAC,SAAS,GAAG,gBAAgB,CAAC,eAAe,CAAC,IAAI,EAAE,CAA4B,CAAA;QACpF,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QACpE,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,YAAY,CAA4B,CAAA;IACvF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAA;QAC/D,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC3D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACxC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EACvB,GAAG,EACH,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CACpC,CAAA;QACD,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC/F,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAgB;QAC5B,iFAAiF;QACjF,uFAAuF;QACvF,uFAAuF;QACvF,yFAAyF;QACzF,2FAA2F;QAC3F,yEAAyE;QACzE,IAAI,IAA6B,CAAA;QACjC,IAAI,EAA2B,CAAA;QAC/B,IAAI,UAAmC,CAAA;QACvC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,kCAAkC,KAAK,CAAC,MAAM,YAAY,CAAC,CAAA;YAC7E,CAAC;YACD,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAE,CAA4B,CAAA;YAC7D,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAE,CAA4B,CAAA;YAC3D,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAE,CAA4B,CAAA;QACrE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,oFAAoF;gBAClF,oFAAoF;gBACpF,iFAAiF;gBACjF,4DAA4D,EAC9D,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAA;QACH,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACtC,IAAI,KAAkB,CAAA;QACtB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,CAAA;QAC/E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,qFAAqF;YACrF,mFAAmF;YACnF,oFAAoF;YACpF,qFAAqF;YACrF,uFAAuF;YACvF,sEAAsE;YACtE,MAAM,IAAI,KAAK,CACb,uFAAuF;gBACrF,iFAAiF;gBACjF,oGAAoG,EACtG,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAA;QACH,CAAC;QACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACxC,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE;gBAClF,WAAW;aACZ,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAA6B;QACnD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EACxD,MAAM,IAAI,CAAC,OAAO,EAAE,EACpB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAA;IACH,CAAC;CACF"}

package/dist/modules/forkDecision/ForkDecisionController.d.ts

@@ -4,9 +4,10 @@ import type { AppEnv } from '../../http/env.js';
  * Workspace-scoped implementation-fork decision endpoints. Before the Coder writes code the
  * read-only proposer surfaces materially different ways to implement the task and the run
  * parks; these endpoints let a human read the surfaced approaches and CHOOSE one (a proposed
- * fork or their own free-text approach). Choosing re-runs the Coder with the chosen approach
- * folded in as a binding directive. The read returns null when no coder step carries fork
- * state. Chat is added in a later slice. Mounted under `/workspaces/:workspaceId`.
+ * fork or their own free-text approach) or CHAT about them before deciding. Choosing re-runs the
+ * Coder with the chosen approach folded in as a binding directive; a chat message is answered by
+ * an inline grounded LLM in the durable driver (the reply arrives via the execution stream). The
+ * read returns null when no coder step carries fork state. Mounted under `/workspaces/:workspaceId`.
  */
 export declare function forkDecisionController(): Hono<AppEnv>;
 //# sourceMappingURL=ForkDecisionController.d.ts.map

package/dist/modules/forkDecision/ForkDecisionController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ForkDecisionController.d.ts","sourceRoot":"","sources":["../../../src/modules/forkDecision/ForkDecisionController.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAG/C;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAAC,MAAM,CAAC,CAyBrD"}
+{"version":3,"file":"ForkDecisionController.d.ts","sourceRoot":"","sources":["../../../src/modules/forkDecision/ForkDecisionController.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAG/C;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAAC,MAAM,CAAC,CAuCrD"}

package/dist/modules/forkDecision/ForkDecisionController.js

@@ -1,4 +1,4 @@
-import { chooseForkContract, getForkDecisionContract } from '@cat-factory/contracts';
+import { chooseForkContract, forkChatContract, getForkDecisionContract, } from '@cat-factory/contracts';
 import { buildHonoRoute } from '@toad-contracts/hono';
 import { Hono } from 'hono';
 import { runWithInitiator } from '../../github/runInitiatorContext.js';
@@ -7,9 +7,10 @@ import { param } from '../../http/params.js';
  * Workspace-scoped implementation-fork decision endpoints. Before the Coder writes code the
  * read-only proposer surfaces materially different ways to implement the task and the run
  * parks; these endpoints let a human read the surfaced approaches and CHOOSE one (a proposed
- * fork or their own free-text approach). Choosing re-runs the Coder with the chosen approach
- * folded in as a binding directive. The read returns null when no coder step carries fork
- * state. Chat is added in a later slice. Mounted under `/workspaces/:workspaceId`.
+ * fork or their own free-text approach) or CHAT about them before deciding. Choosing re-runs the
+ * Coder with the chosen approach folded in as a binding directive; a chat message is answered by
+ * an inline grounded LLM in the durable driver (the reply arrives via the execution stream). The
+ * read returns null when no coder step carries fork state. Mounted under `/workspaces/:workspaceId`.
  */
 export function forkDecisionController() {
     const app = new Hono();
@@ -20,6 +21,17 @@ export function forkDecisionController() {
             .executionService.getForkDecision(param(c, 'workspaceId'), c.req.valid('param').executionId);
         return c.json(state, 200);
     });
+    // Send a grounded chat message about the surfaced forks. The reply is computed inline in the
+    // durable driver (off this request) and delivered via the execution stream; the response is the
+    // immediate `answering` state. Runs under the acting user's ambient context so an inline
+    // subscription/local model served through a per-run activation can lease the initiator's credential.
+    buildHonoRoute(app, forkChatContract, async (c) => {
+        const { executionId } = c.req.valid('param');
+        const input = c.req.valid('json');
+        const userId = c.get('user')?.id;
+        const state = await runWithInitiator(userId, () => c.get('container').executionService.forkChat(param(c, 'workspaceId'), executionId, input));
+        return c.json(state, 200);
+    });
     // Choose an implementation approach (a proposed fork id or a custom approach) — the Coder
     // then runs with it folded in. Runs under the acting user's ambient context so the resumed
     // run's container work (clone/push) uses their per-user credentials where applicable.

package/dist/modules/forkDecision/ForkDecisionController.js.map

@@ -1 +1 @@
-{"version":3,"file":"ForkDecisionController.js","sourceRoot":"","sources":["../../../src/modules/forkDecision/ForkDecisionController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAA;AAEtE,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAE5C;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,8EAA8E;IAC9E,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,KAAK,GAAG,MAAM,CAAC;aAClB,GAAG,CAAC,WAAW,CAAC;aAChB,gBAAgB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAA;QAC9F,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,0FAA0F;IAC1F,2FAA2F;IAC3F,sFAAsF;IACtF,cAAc,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClD,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC5C,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACjC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAAA;QAChC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,CAChD,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,gBAAgB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,CAC5F,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"ForkDecisionController.js","sourceRoot":"","sources":["../../../src/modules/forkDecision/ForkDecisionController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAA;AAEtE,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAE5C;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,8EAA8E;IAC9E,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,KAAK,GAAG,MAAM,CAAC;aAClB,GAAG,CAAC,WAAW,CAAC;aAChB,gBAAgB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAA;QAC9F,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,6FAA6F;IAC7F,gGAAgG;IAChG,yFAAyF;IACzF,qGAAqG;IACrG,cAAc,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChD,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC5C,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACjC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAAA;QAChC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,CAChD,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,CAC1F,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,0FAA0F;IAC1F,2FAA2F;IAC3F,sFAAsF;IACtF,cAAc,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClD,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC5C,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACjC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAAA;QAChC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,CAChD,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,gBAAgB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,CAC5F,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/server",
-  "version": "0.111.0",
+  "version": "0.112.1",
   "description": "Runtime-neutral HTTP layer for the Agent Architecture Board: the Hono controllers, middleware (auth/authz/CORS/error), request helpers and the gateway seams shared by every deployment facade (Cloudflare Worker, Node service).",
   "repository": {
     "type": "git",
@@ -30,13 +30,13 @@
     "hono": "^4.12.27",
     "pino": "^10.3.1",
     "valibot": "^1.4.2",
-    "@cat-factory/agents": "0.53.6",
-    "@cat-factory/contracts": "0.126.0",
-    "@cat-factory/integrations": "0.81.5",
-    "@cat-factory/kernel": "0.121.1",
-    "@cat-factory/orchestration": "0.105.6",
-    "@cat-factory/prompt-fragments": "0.13.12",
-    "@cat-factory/spend": "0.12.15"
+    "@cat-factory/agents": "0.54.0",
+    "@cat-factory/integrations": "0.81.7",
+    "@cat-factory/contracts": "0.127.0",
+    "@cat-factory/kernel": "0.121.2",
+    "@cat-factory/orchestration": "0.106.1",
+    "@cat-factory/prompt-fragments": "0.13.13",
+    "@cat-factory/spend": "0.12.16"
   },
   "devDependencies": {
     "@types/node": "^26.1.0",