@cat-factory/server 0.170.1 → 0.172.0

package/dist/modules/workspaces/WorkspaceMemberController.js

@@ -3,7 +3,7 @@ import { buildHonoRoute } from '@toad-contracts/hono';
 import { Hono } from 'hono';
 import { param } from '../../http/params.js';
 import { requirePermission } from '../../http/workspaceAccess.js';
-import { UnavailableError } from '@cat-factory/kernel';
+import { requireCapability } from '../../http/guards.js';
 // ---------------------------------------------------------------------------
 // Workspace-membership management (workspace-rbac initiative, slice 5). All routes are
 // mounted under `/workspaces/:workspaceId`, so the shared `mountAuthGate` has already
@@ -15,49 +15,40 @@ import { UnavailableError } from '@cat-factory/kernel';
 // The service is present only when the facade wired the workspace-member repository (both
 // do); absent ⇒ every route reports 503 rather than 500-ing on an undefined service.
 // ---------------------------------------------------------------------------
-const unavailable = () => {
-    throw new UnavailableError('Workspace membership is not configured');
-};
+/** Resolve the workspace-membership service, or refuse with a 503 naming what isn't wired. */
+function requireMemberService(c) {
+    return requireCapability(c.get('container').workspaceMemberService, 'Workspace membership is not configured');
+}
 export function workspaceMemberController() {
     const app = new Hono();
     // Roster — any resolved role may read it (gate resolution already guaranteed ≥ viewer).
     buildHonoRoute(app, listWorkspaceMembersContract, async (c) => {
-        const service = c.get('container').workspaceMemberService;
-        if (!service)
-            return unavailable();
+        const service = requireMemberService(c);
         return c.json(await service.list(param(c, 'workspaceId')), 200);
     });
     buildHonoRoute(app, addWorkspaceMemberContract, async (c) => {
-        const service = c.get('container').workspaceMemberService;
-        if (!service)
-            return unavailable();
+        const service = requireMemberService(c);
         requirePermission(c, 'members.manage');
         const body = c.req.valid('json');
         const member = await service.add(param(c, 'workspaceId'), body.userId, body.role, c.get('user')?.id ?? null);
         return c.json(member, 201);
     });
     buildHonoRoute(app, setWorkspaceMemberRoleContract, async (c) => {
-        const service = c.get('container').workspaceMemberService;
-        if (!service)
-            return unavailable();
+        const service = requireMemberService(c);
         requirePermission(c, 'members.manage');
         const { workspaceId, userId } = c.req.valid('param');
         const member = await service.setRole(workspaceId, userId, c.req.valid('json').role);
         return c.json(member, 200);
     });
     buildHonoRoute(app, removeWorkspaceMemberContract, async (c) => {
-        const service = c.get('container').workspaceMemberService;
-        if (!service)
-            return unavailable();
+        const service = requireMemberService(c);
         requirePermission(c, 'members.manage');
         const { workspaceId, userId } = c.req.valid('param');
         await service.remove(workspaceId, userId);
         return c.body(null, 204);
     });
     buildHonoRoute(app, setWorkspaceAccessModeContract, async (c) => {
-        const service = c.get('container').workspaceMemberService;
-        if (!service)
-            return unavailable();
+        const service = requireMemberService(c);
         requirePermission(c, 'members.manage');
         const workspace = await service.setAccessMode(param(c, 'workspaceId'), c.req.valid('json').accessMode);
         return c.json(workspace, 200);

package/dist/modules/workspaces/WorkspaceMemberController.js.map

@@ -1 +1 @@
-{"version":3,"file":"WorkspaceMemberController.js","sourceRoot":"","sources":["../../../src/modules/workspaces/WorkspaceMemberController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,6BAA6B,EAC7B,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD,8EAA8E;AAC9E,uFAAuF;AACvF,sFAAsF;AACtF,qFAAqF;AACrF,sFAAsF;AACtF,iFAAiF;AACjF,+DAA+D;AAC/D,EAAE;AACF,0FAA0F;AAC1F,qFAAqF;AACrF,8EAA8E;AAE9E,MAAM,WAAW,GAAG,GAAU,EAAE;IAC9B,MAAM,IAAI,gBAAgB,CAAC,wCAAwC,CAAC,CAAA;AACtE,CAAC,CAAA;AAED,MAAM,UAAU,yBAAyB;IACvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,wFAAwF;IACxF,cAAc,CAAC,GAAG,EAAE,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5D,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,sBAAsB,CAAA;QACzD,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,EAAE,CAAA;QAClC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1D,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,sBAAsB,CAAA;QACzD,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,EAAE,CAAA;QAClC,iBAAiB,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAA;QACtC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAChC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,IAAI,EACT,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,IAAI,CAC1B,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9D,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,sBAAsB,CAAA;QACzD,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,EAAE,CAAA;QAClC,iBAAiB,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAA;QACtC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACpD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAA;QACnF,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7D,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,sBAAsB,CAAA;QACzD,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,EAAE,CAAA;QAClC,iBAAiB,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAA;QACtC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACpD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;QACzC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9D,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,sBAAsB,CAAA;QACzD,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,EAAE,CAAA;QAClC,iBAAiB,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAA;QACtC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,aAAa,CAC3C,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,UAAU,CAC/B,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"WorkspaceMemberController.js","sourceRoot":"","sources":["../../../src/modules/workspaces/WorkspaceMemberController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,6BAA6B,EAC7B,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAExD,8EAA8E;AAC9E,uFAAuF;AACvF,sFAAsF;AACtF,qFAAqF;AACrF,sFAAsF;AACtF,iFAAiF;AACjF,+DAA+D;AAC/D,EAAE;AACF,0FAA0F;AAC1F,qFAAqF;AACrF,8EAA8E;AAE9E,8FAA8F;AAC9F,SAAS,oBAAoB,CAAmB,CAAa;IAC3D,OAAO,iBAAiB,CACtB,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,sBAAsB,EACzC,wCAAwC,CACzC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,wFAAwF;IACxF,cAAc,CAAC,GAAG,EAAE,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5D,MAAM,OAAO,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;QACvC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1D,MAAM,OAAO,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;QACvC,iBAAiB,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAA;QACtC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAChC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,IAAI,EACT,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,IAAI,CAC1B,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9D,MAAM,OAAO,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;QACvC,iBAAiB,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAA;QACtC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACpD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAA;QACnF,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7D,MAAM,OAAO,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;QACvC,iBAAiB,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAA;QACtC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACpD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;QACzC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9D,MAAM,OAAO,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;QACvC,iBAAiB,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAA;QACtC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,aAAa,CAC3C,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,UAAU,CAC/B,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/server",
-  "version": "0.170.1",
+  "version": "0.172.0",
   "description": "Runtime-neutral HTTP layer for the Agent Architecture Board: the Hono controllers, middleware (auth/authz/CORS/error), request helpers and the gateway seams shared by every deployment facade (Cloudflare Worker, Node service).",
   "repository": {
     "type": "git",
@@ -30,13 +30,13 @@
     "hono": "^4.12.32",
     "pino": "^10.3.1",
     "valibot": "^1.4.2",
-    "@cat-factory/agents": "0.82.3",
+    "@cat-factory/agents": "0.82.4",
     "@cat-factory/contracts": "0.189.0",
-    "@cat-factory/integrations": "0.109.2",
-    "@cat-factory/kernel": "0.183.0",
-    "@cat-factory/orchestration": "0.161.0",
+    "@cat-factory/integrations": "0.109.3",
+    "@cat-factory/kernel": "0.184.0",
+    "@cat-factory/orchestration": "0.162.0",
     "@cat-factory/prompt-fragments": "0.15.12",
-    "@cat-factory/spend": "0.12.112"
+    "@cat-factory/spend": "0.12.113"
   },
   "devDependencies": {
     "@types/node": "^26.1.1",

package/dist/agents/storeAgentContextGate.d.ts

@@ -1,36 +0,0 @@
-import type { WorkspaceBodiesGate } from '@cat-factory/agents';
-import { type GroupCacheHandle, type WorkspaceSettingsCacheValue, type WorkspaceSettingsRepository } from '@cat-factory/kernel';
-/**
- * Build the per-workspace `storeAgentContext` gate the INLINE LLM path applies to
- * prompt/response bodies before they reach a trace sink.
- *
- * This is deliberately the same rule the proxied path already runs
- * (`LlmObservabilityService.bodiesEnabled`), expressed once so the two cannot drift: the
- * inline path having no gate at all — while the proxy path had one — is what let an
- * opted-out workspace keep shipping its inline bodies to Langfuse/OTel
- * (observability-logging-gaps.md, C2). It lives in the shared server layer because that is
- * where BOTH facades assemble the scoped model provider, so wiring it is symmetric by
- * construction rather than a per-runtime obligation to remember.
- *
- * Two `true` answers are deliberate, not lenient defaults:
- *  - **No settings source wired** — defer to the deployment's own `LLM_RECORD_PROMPTS`
- *    switch, exactly as the proxy path does. There is no stored opt-out to honour.
- *  - **No workspace on the call** — an untagged inline call has no workspace whose opt-out
- *    could apply, so the deployment switch alone governs it.
- *
- * A read that THROWS is not handled here: the caller fails closed on it (see
- * `InstrumentedModelProvider.bodiesAllowed`), because an unreadable settings row is not
- * consent.
- */
-export declare function createStoreAgentContextGate(deps: {
-    repository?: WorkspaceSettingsRepository;
-    /**
-     * The shared `AppCaches.workspaceSettings` slice, when the facade has one to hand. Absent
-     * ⇒ a direct repository read per call. That is the Worker's situation and it costs
-     * nothing: `workspaceSettings` is `enabled: false` in the isolate-safe profile (our own
-     * mutable state, with no cross-isolate invalidation bus), so the slice would be a
-     * pass-through there anyway.
-     */
-    cache?: GroupCacheHandle<WorkspaceSettingsCacheValue>;
-}): WorkspaceBodiesGate;
-//# sourceMappingURL=storeAgentContextGate.d.ts.map

package/dist/agents/storeAgentContextGate.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"storeAgentContextGate.d.ts","sourceRoot":"","sources":["../../src/agents/storeAgentContextGate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAC9D,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EACjC,MAAM,qBAAqB,CAAA;AAE5B;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,UAAU,CAAC,EAAE,2BAA2B,CAAA;IACxC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC,2BAA2B,CAAC,CAAA;CACtD,GAAG,mBAAmB,CAUtB"}

package/dist/agents/storeAgentContextGate.js

@@ -1,36 +0,0 @@
-import { DEFAULT_WORKSPACE_SETTINGS, readCachedWorkspaceSettings, } from '@cat-factory/kernel';
-/**
- * Build the per-workspace `storeAgentContext` gate the INLINE LLM path applies to
- * prompt/response bodies before they reach a trace sink.
- *
- * This is deliberately the same rule the proxied path already runs
- * (`LlmObservabilityService.bodiesEnabled`), expressed once so the two cannot drift: the
- * inline path having no gate at all — while the proxy path had one — is what let an
- * opted-out workspace keep shipping its inline bodies to Langfuse/OTel
- * (observability-logging-gaps.md, C2). It lives in the shared server layer because that is
- * where BOTH facades assemble the scoped model provider, so wiring it is symmetric by
- * construction rather than a per-runtime obligation to remember.
- *
- * Two `true` answers are deliberate, not lenient defaults:
- *  - **No settings source wired** — defer to the deployment's own `LLM_RECORD_PROMPTS`
- *    switch, exactly as the proxy path does. There is no stored opt-out to honour.
- *  - **No workspace on the call** — an untagged inline call has no workspace whose opt-out
- *    could apply, so the deployment switch alone governs it.
- *
- * A read that THROWS is not handled here: the caller fails closed on it (see
- * `InstrumentedModelProvider.bodiesAllowed`), because an unreadable settings row is not
- * consent.
- */
-export function createStoreAgentContextGate(deps) {
-    const { repository, cache } = deps;
-    if (!repository)
-        return () => Promise.resolve(true);
-    return async (workspaceId) => {
-        if (!workspaceId)
-            return true;
-        const settings = (await readCachedWorkspaceSettings(cache, repository, workspaceId)) ??
-            DEFAULT_WORKSPACE_SETTINGS;
-        return settings.storeAgentContext;
-    };
-}
-//# sourceMappingURL=storeAgentContextGate.js.map

package/dist/agents/storeAgentContextGate.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"storeAgentContextGate.js","sourceRoot":"","sources":["../../src/agents/storeAgentContextGate.ts"],"names":[],"mappings":"AACA,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,GAI5B,MAAM,qBAAqB,CAAA;AAE5B;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAU3C;IACC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;IAClC,IAAI,CAAC,UAAU;QAAE,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACnD,OAAO,KAAK,EAAE,WAA0B,EAAoB,EAAE;QAC5D,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAA;QAC7B,MAAM,QAAQ,GACZ,CAAC,MAAM,2BAA2B,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;YACnE,0BAA0B,CAAA;QAC5B,OAAO,QAAQ,CAAC,iBAAiB,CAAA;IACnC,CAAC,CAAA;AACH,CAAC"}