@cat-factory/server 0.170.1 → 0.172.0

package/dist/modules/modelPresets/ModelPresetController.js.map

@@ -1 +1 @@
-{"version":3,"file":"ModelPresetController.js","sourceRoot":"","sources":["../../../src/modules/modelPresets/ModelPresetController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAA;AAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD,uFAAuF;AACvF,SAAS,mBAAmB,CAAmB,CAAa;IAC1D,OAAO,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,YAAY,IAAI,IAAI,CAAA;AAChD,CAAC;AAED,MAAM,WAAW,GAAG,GAAU,EAAE;IAC9B,MAAM,IAAI,gBAAgB,CAAC,kCAAkC,CAAC,CAAA;AAChE,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,0BAA0B,CAAC,iBAAiB,CAAC,CAAC,CAAA;IAE3D,cAAc,CAAC,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxD,MAAM,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAA;QACtC,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,EAAE,CAAA;QAClC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACzE,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzD,MAAM,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAA;QACtC,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,EAAE,CAAA;QAClC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;QACzF,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzD,MAAM,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAA;QACtC,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,EAAE,CAAA;QAClC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,CACzC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,EAC7B,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CACpB,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzD,MAAM,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAA;QACtC,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,EAAE,CAAA;QAClC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAA;QACpF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzD,MAAM,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAA;QACtC,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,EAAE,CAAA;QAClC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,CACzC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAC9B,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"ModelPresetController.js","sourceRoot":"","sources":["../../../src/modules/modelPresets/ModelPresetController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAA;AAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAExD,qFAAqF;AACrF,SAAS,mBAAmB,CAAmB,CAAa;IAC1D,OAAO,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,YAAY,EAAE,kCAAkC,CAAC,CAAA;AAC/F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,0BAA0B,CAAC,iBAAiB,CAAC,CAAC,CAAA;IAE3D,cAAc,CAAC,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxD,MAAM,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAA;QACtC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACzE,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzD,MAAM,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAA;QACtC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;QACzF,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzD,MAAM,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAA;QACtC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,CACzC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,EAC7B,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CACpB,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzD,MAAM,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAA;QACtC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAA;QACpF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzD,MAAM,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAA;QACtC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,CACzC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAC9B,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/modules/notificationWebhook/NotificationWebhookController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"NotificationWebhookController.d.ts","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/NotificationWebhookController.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAc/C;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,IAAI,IAAI,CAAC,MAAM,CAAC,CAyB5D"}
+{"version":3,"file":"NotificationWebhookController.d.ts","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/NotificationWebhookController.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAa/C;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,IAAI,IAAI,CAAC,MAAM,CAAC,CAsB5D"}

package/dist/modules/notificationWebhook/NotificationWebhookController.js

@@ -3,14 +3,11 @@ import { buildHonoRoute } from '@toad-contracts/hono';
 import { Hono } from 'hono';
 import { requireWorkspacePermission } from '../../http/workspaceAccess.js';
 import { param } from '../../http/params.js';
-import { UnavailableError } from '@cat-factory/kernel';
-/** Resolve the webhook service or send a 503, returning null when unconfigured. */
+import { requireCapability } from '../../http/guards.js';
+/** Resolve the webhook service, or refuse with a 503 naming what isn't wired. */
 function requireWebhooks(c) {
-    return c.get('container').notificationWebhooks ?? null;
+    return requireCapability(c.get('container').notificationWebhooks, 'Notification webhooks are not configured');
 }
-const unavailable = () => {
-    throw new UnavailableError('Notification webhooks are not configured');
-};
 /**
  * Workspace-scoped management of the OUTBOUND notification webhook: the one HTTPS endpoint a
  * workspace registers to receive its notifications by push. This is how a headless integration —
@@ -27,21 +24,15 @@ export function notificationWebhookController() {
     app.use('*', requireWorkspacePermission('integrations.manage'));
     buildHonoRoute(app, getNotificationWebhookContract, async (c) => {
         const webhooks = requireWebhooks(c);
-        if (!webhooks)
-            return unavailable();
         return c.json(await webhooks.get(param(c, 'workspaceId')), 200);
     });
     buildHonoRoute(app, putNotificationWebhookContract, async (c) => {
         const webhooks = requireWebhooks(c);
-        if (!webhooks)
-            return unavailable();
         const saved = await webhooks.put(param(c, 'workspaceId'), c.req.valid('json'));
         return c.json(saved, 200);
     });
     buildHonoRoute(app, deleteNotificationWebhookContract, async (c) => {
         const webhooks = requireWebhooks(c);
-        if (!webhooks)
-            return unavailable();
         await webhooks.remove(param(c, 'workspaceId'));
         return c.body(null, 204);
     });

package/dist/modules/notificationWebhook/NotificationWebhookController.js.map

@@ -1 +1 @@
-{"version":3,"file":"NotificationWebhookController.js","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/NotificationWebhookController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iCAAiC,EACjC,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAA;AAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD,mFAAmF;AACnF,SAAS,eAAe,CAAmB,CAAa;IACtD,OAAO,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,oBAAoB,IAAI,IAAI,CAAA;AACxD,CAAC;AAED,MAAM,WAAW,GAAG,GAAU,EAAE;IAC9B,MAAM,IAAI,gBAAgB,CAAC,0CAA0C,CAAC,CAAA;AACxE,CAAC,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,6BAA6B;IAC3C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,0BAA0B,CAAC,qBAAqB,CAAC,CAAC,CAAA;IAE/D,cAAc,CAAC,GAAG,EAAE,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9D,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,CAAA;QACnC,IAAI,CAAC,QAAQ;YAAE,OAAO,WAAW,EAAE,CAAA;QACnC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9D,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,CAAA;QACnC,IAAI,CAAC,QAAQ;YAAE,OAAO,WAAW,EAAE,CAAA;QACnC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;QAC9E,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,iCAAiC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjE,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,CAAA;QACnC,IAAI,CAAC,QAAQ;YAAE,OAAO,WAAW,EAAE,CAAA;QACnC,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAA;QAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"NotificationWebhookController.js","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/NotificationWebhookController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iCAAiC,EACjC,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAA;AAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAExD,iFAAiF;AACjF,SAAS,eAAe,CAAmB,CAAa;IACtD,OAAO,iBAAiB,CACtB,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,oBAAoB,EACvC,0CAA0C,CAC3C,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,6BAA6B;IAC3C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,0BAA0B,CAAC,qBAAqB,CAAC,CAAC,CAAA;IAE/D,cAAc,CAAC,GAAG,EAAE,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9D,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,CAAA;QACnC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9D,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,CAAA;QACnC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;QAC9E,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,iCAAiC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjE,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,CAAA;QACnC,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAA;QAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/modules/notifications/NotificationController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"NotificationController.d.ts","sourceRoot":"","sources":["../../../src/modules/notifications/NotificationController.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAe/C;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAAC,MAAM,CAAC,CA2DrD"}
+{"version":3,"file":"NotificationController.d.ts","sourceRoot":"","sources":["../../../src/modules/notifications/NotificationController.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAW/C;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAAC,MAAM,CAAC,CAwDrD"}

package/dist/modules/notifications/NotificationController.js

@@ -4,14 +4,11 @@ import { Hono } from 'hono';
 import { optionalJsonBody } from '../../http/optionalJsonBody.js';
 import { param } from '../../http/params.js';
 import { notificationActEffect } from './notificationActions.js';
-import { UnavailableError } from '@cat-factory/kernel';
-/** Resolve the notifications module or send a 503, returning null when unconfigured. */
+import { requireCapability } from '../../http/guards.js';
+/** Resolve the notifications module, or refuse with a 503 naming what isn't wired. */
 function requireNotifications(c) {
-    return c.get('container').notifications ?? null;
+    return requireCapability(c.get('container').notifications, 'Notifications are not configured');
 }
-const unavailable = () => {
-    throw new UnavailableError('Notifications are not configured');
-};
 /**
  * Human-actionable notifications. `act` performs the notification's typed
  * side-effect (merge the PR for a `merge_review` / `pipeline_complete`, retry the
@@ -26,8 +23,6 @@ export function notificationController() {
     // Open notifications for the board inbox (the snapshot also carries these).
     buildHonoRoute(app, listNotificationsContract, async (c) => {
         const notifications = requireNotifications(c);
-        if (!notifications)
-            return unavailable();
         return c.json(await notifications.service.listOpen(param(c, 'workspaceId')), 200);
     });
     // Act on a notification: atomically claim it (`open` → `acted`), then run its side-effect
@@ -39,8 +34,6 @@ export function notificationController() {
     app.use('/notifications/:notificationId/act', optionalJsonBody);
     buildHonoRoute(app, actNotificationContract, async (c) => {
         const notifications = requireNotifications(c);
-        if (!notifications)
-            return unavailable();
         const workspaceId = param(c, 'workspaceId');
         const id = c.req.valid('param').notificationId;
         const container = c.get('container');
@@ -54,8 +47,6 @@ export function notificationController() {
     // Dismiss a notification without acting on it.
     buildHonoRoute(app, dismissNotificationContract, async (c) => {
         const notifications = requireNotifications(c);
-        if (!notifications)
-            return unavailable();
         const container = c.get('container');
         const workspaceId = param(c, 'workspaceId');
         const dismissed = await notifications.service.resolve(workspaceId, c.req.valid('param').notificationId, 'dismiss');

package/dist/modules/notifications/NotificationController.js.map

@@ -1 +1 @@
-{"version":3,"file":"NotificationController.js","sourceRoot":"","sources":["../../../src/modules/notifications/NotificationController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AACjE,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAA;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD,wFAAwF;AACxF,SAAS,oBAAoB,CAAmB,CAAa;IAC3D,OAAO,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,aAAa,IAAI,IAAI,CAAA;AACjD,CAAC;AAED,MAAM,WAAW,GAAG,GAAU,EAAE;IAC9B,MAAM,IAAI,gBAAgB,CAAC,kCAAkC,CAAC,CAAA;AAChE,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,4EAA4E;IAC5E,cAAc,CAAC,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzD,MAAM,aAAa,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;QAC7C,IAAI,CAAC,aAAa;YAAE,OAAO,WAAW,EAAE,CAAA;QACxC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACnF,CAAC,CAAC,CAAA;IAEF,0FAA0F;IAC1F,0FAA0F;IAC1F,4FAA4F;IAC5F,2CAA2C;IAC3C,0FAA0F;IAC1F,2DAA2D;IAC3D,GAAG,CAAC,GAAG,CAAC,oCAAoC,EAAE,gBAAgB,CAAC,CAAA;IAC/D,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,aAAa,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;QAC7C,IAAI,CAAC,aAAa;YAAE,OAAO,WAAW,EAAE,CAAA;QACxC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAA;QAC3C,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,cAAc,CAAA;QAC9C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAAA;QAChC,uFAAuF;QACvF,6EAA6E;QAC7E,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC5C,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,CAC3C,WAAW,EACX,EAAE,EACF,qBAAqB,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,CACpE,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,+CAA+C;IAC/C,cAAc,CAAC,GAAG,EAAE,2BAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3D,MAAM,aAAa,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;QAC7C,IAAI,CAAC,aAAa;YAAE,OAAO,WAAW,EAAE,CAAA;QACxC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAA;QAC3C,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,OAAO,CACnD,WAAW,EACX,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,cAAc,EACnC,SAAS,CACV,CAAA;QACD,2FAA2F;QAC3F,4FAA4F;QAC5F,0FAA0F;QAC1F,IACE,CAAC,SAAS,CAAC,IAAI,KAAK,cAAc,IAAI,SAAS,CAAC,IAAI,KAAK,mBAAmB,CAAC;YAC7E,SAAS,CAAC,WAAW,EACrB,CAAC;YACD,MAAM,SAAS,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"NotificationController.js","sourceRoot":"","sources":["../../../src/modules/notifications/NotificationController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AACjE,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAA;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAExD,sFAAsF;AACtF,SAAS,oBAAoB,CAAmB,CAAa;IAC3D,OAAO,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,aAAa,EAAE,kCAAkC,CAAC,CAAA;AAChG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,4EAA4E;IAC5E,cAAc,CAAC,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzD,MAAM,aAAa,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;QAC7C,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACnF,CAAC,CAAC,CAAA;IAEF,0FAA0F;IAC1F,0FAA0F;IAC1F,4FAA4F;IAC5F,2CAA2C;IAC3C,0FAA0F;IAC1F,2DAA2D;IAC3D,GAAG,CAAC,GAAG,CAAC,oCAAoC,EAAE,gBAAgB,CAAC,CAAA;IAC/D,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,aAAa,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;QAC7C,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAA;QAC3C,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,cAAc,CAAA;QAC9C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAAA;QAChC,uFAAuF;QACvF,6EAA6E;QAC7E,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC5C,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,CAC3C,WAAW,EACX,EAAE,EACF,qBAAqB,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,CACpE,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,+CAA+C;IAC/C,cAAc,CAAC,GAAG,EAAE,2BAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3D,MAAM,aAAa,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;QAC7C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAA;QAC3C,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,OAAO,CACnD,WAAW,EACX,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,cAAc,EACnC,SAAS,CACV,CAAA;QACD,2FAA2F;QAC3F,4FAA4F;QAC5F,0FAA0F;QAC1F,IACE,CAAC,SAAS,CAAC,IAAI,KAAK,cAAc,IAAI,SAAS,CAAC,IAAI,KAAK,mBAAmB,CAAC;YAC7E,SAAS,CAAC,WAAW,EACrB,CAAC;YACD,MAAM,SAAS,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/modules/observability/PlatformObservabilityController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PlatformObservabilityController.d.ts","sourceRoot":"","sources":["../../../src/modules/observability/PlatformObservabilityController.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAa/C;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,IAAI,IAAI,CAAC,MAAM,CAAC,CAiB9D"}
+{"version":3,"file":"PlatformObservabilityController.d.ts","sourceRoot":"","sources":["../../../src/modules/observability/PlatformObservabilityController.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAU/C;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,IAAI,IAAI,CAAC,MAAM,CAAC,CAgB9D"}

package/dist/modules/observability/PlatformObservabilityController.js

@@ -1,15 +1,13 @@
 import { getPlatformObservabilityContract } from '@cat-factory/contracts';
 import { buildHonoRoute } from '@toad-contracts/hono';
 import { Hono } from 'hono';
-import { UnavailableError, UnauthorizedError } from '@cat-factory/kernel';
-/** The signed-in user, or null. Generic over the (contract-typed) env, like AccountController. */
-function accountUser(c) {
-    const user = c.get('user');
-    return user ? { id: user.id, login: user.login, name: user.name } : null;
+import { UnavailableError } from '@cat-factory/kernel';
+import { requireUser } from '../../http/guards.js';
+/** The signed-in user, or a 401. Generic over the (contract-typed) env, like AccountController. */
+function requireAccountUser(c) {
+    const user = requireUser(c, 'Sign in to view platform observability');
+    return { id: user.id, login: user.login, name: user.name };
 }
-const signInRequired = () => {
-    throw new UnauthorizedError('Sign in to view platform observability');
-};
 /**
  * Platform-operator observability: `GET /accounts/:accountId/observability/platform` — the
  * deployment-level aggregate health of an account's runs (outcomes, failure taxonomy,
@@ -22,9 +20,7 @@ const signInRequired = () => {
 export function platformObservabilityController() {
     const app = new Hono();
     buildHonoRoute(app, getPlatformObservabilityContract, async (c) => {
-        const user = accountUser(c);
-        if (!user)
-            return signInRequired();
+        const user = requireAccountUser(c);
         const container = c.get('container');
         if (!container.platformObservability) {
             throw new UnavailableError('Platform observability is not available on this deployment');

package/dist/modules/observability/PlatformObservabilityController.js.map

@@ -1 +1 @@
-{"version":3,"file":"PlatformObservabilityController.js","sourceRoot":"","sources":["../../../src/modules/observability/PlatformObservabilityController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,wBAAwB,CAAA;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAEzE,kGAAkG;AAClG,SAAS,WAAW,CAAmB,CAAa;IAClD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC1B,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAC1E,CAAC;AAED,MAAM,cAAc,GAAG,GAAU,EAAE;IACjC,MAAM,IAAI,iBAAiB,CAAC,wCAAwC,CAAC,CAAA;AACvE,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,+BAA+B;IAC7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,cAAc,CAAC,GAAG,EAAE,gCAAgC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChE,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;QAC3B,IAAI,CAAC,IAAI;YAAE,OAAO,cAAc,EAAE,CAAA;QAClC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,IAAI,CAAC,SAAS,CAAC,qBAAqB,EAAE,CAAC;YACrC,MAAM,IAAI,gBAAgB,CAAC,4DAA4D,CAAC,CAAA;QAC1F,CAAC;QACD,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC1C,MAAM,SAAS,CAAC,cAAc,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/D,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,KAAK,CAAA;QACnD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,qBAAqB,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;IACxF,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"PlatformObservabilityController.js","sourceRoot":"","sources":["../../../src/modules/observability/PlatformObservabilityController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,wBAAwB,CAAA;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAElD,mGAAmG;AACnG,SAAS,kBAAkB,CAAmB,CAAa;IACzD,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,EAAE,wCAAwC,CAAC,CAAA;IACrE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAA;AAC5D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,+BAA+B;IAC7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,cAAc,CAAC,GAAG,EAAE,gCAAgC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChE,MAAM,IAAI,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAA;QAClC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,IAAI,CAAC,SAAS,CAAC,qBAAqB,EAAE,CAAC;YACrC,MAAM,IAAI,gBAAgB,CAAC,4DAA4D,CAAC,CAAA;QAC1F,CAAC;QACD,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC1C,MAAM,SAAS,CAAC,cAAc,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/D,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,KAAK,CAAA;QACnD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,qBAAqB,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;IACxF,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/modules/openrouter/OpenRouterCatalogController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OpenRouterCatalogController.d.ts","sourceRoot":"","sources":["../../../src/modules/openrouter/OpenRouterCatalogController.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAiB/C,wBAAgB,2BAA2B,IAAI,IAAI,CAAC,MAAM,CAAC,CA+B1D"}
+{"version":3,"file":"OpenRouterCatalogController.d.ts","sourceRoot":"","sources":["../../../src/modules/openrouter/OpenRouterCatalogController.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AA2B/C,wBAAgB,2BAA2B,IAAI,IAAI,CAAC,MAAM,CAAC,CA2B1D"}

package/dist/modules/openrouter/OpenRouterCatalogController.js

@@ -1,48 +1,44 @@
 import { getOpenRouterCatalogContract, refreshOpenRouterCatalogContract, upsertOpenRouterCatalogContract, } from '@cat-factory/contracts';
 import { buildHonoRoute } from '@toad-contracts/hono';
 import { Hono } from 'hono';
-import { UnavailableError, UnauthorizedError } from '@cat-factory/kernel';
+import { requireCapability, requireUser } from '../../http/guards.js';
 // Per-WORKSPACE OpenRouter dynamic catalog. OpenRouter is a single OpenAI-compatible
 // gateway to 300+ models reached via the workspace's API-key pool; a workspace browses the
 // live catalog (`/refresh`, leasing the pooled OpenRouter key server-side) and enables a
 // subset (`PUT /catalog`). The enabled models surface in the per-workspace model picker and
 // feed the spend budget. Mounted at `/` (workspaceId is a path param); requires a signed-in user.
-const signInRequired = () => {
-    throw new UnauthorizedError('Sign in to manage the OpenRouter catalog');
-};
-const unavailable = () => {
-    throw new UnavailableError('OpenRouter catalog storage is not configured');
-};
+/** Resolve the OpenRouter catalog store, or refuse with a 503 naming what isn't wired. */
+function requireCatalog(c) {
+    return requireCapability(c.get('container').openRouterCatalog, 'OpenRouter catalog storage is not configured');
+}
+/** The signed-in caller, or a 401 wording the prompt for what this controller manages. */
+function requireSignedIn(c) {
+    return requireUser(c, 'Sign in to manage the OpenRouter catalog');
+}
+/** The same 401, for a route that needs a signed-in caller but reads nothing off them. */
+function assertSignedIn(c) {
+    requireSignedIn(c);
+}
 export function openRouterCatalogController() {
     const app = new Hono();
     // The workspace's enabled OpenRouter models (empty when none configured yet).
     buildHonoRoute(app, getOpenRouterCatalogContract, async (c) => {
-        const svc = c.get('container').openRouterCatalog;
-        if (!svc)
-            return unavailable();
-        if (!c.get('user'))
-            return signInRequired();
+        const svc = requireCatalog(c);
+        assertSignedIn(c);
         return c.json(await svc.get(c.req.valid('param').workspaceId), 200);
     });
     // Replace the workspace's enabled subset (the client sends each model's metadata it read
     // from the browse list, so the server + spend table get accurate context + pricing).
     buildHonoRoute(app, upsertOpenRouterCatalogContract, async (c) => {
-        const svc = c.get('container').openRouterCatalog;
-        if (!svc)
-            return unavailable();
-        if (!c.get('user'))
-            return signInRequired();
+        const svc = requireCatalog(c);
+        assertSignedIn(c);
         return c.json(await svc.upsert(c.req.valid('param').workspaceId, c.req.valid('json')), 200);
     });
     // Probe OpenRouter's live `/models` for the browse list (leases the workspace's pooled
     // OpenRouter key server-side). Never throws — failures come back as { reachable: false }.
     buildHonoRoute(app, refreshOpenRouterCatalogContract, async (c) => {
-        const svc = c.get('container').openRouterCatalog;
-        if (!svc)
-            return unavailable();
-        const user = c.get('user');
-        if (!user)
-            return signInRequired();
+        const svc = requireCatalog(c);
+        const user = requireSignedIn(c);
         return c.json(await svc.refresh(c.req.valid('param').workspaceId, { userId: user.id }), 200);
     });
     return app;

package/dist/modules/openrouter/OpenRouterCatalogController.js.map

@@ -1 +1 @@
-{"version":3,"file":"OpenRouterCatalogController.js","sourceRoot":"","sources":["../../../src/modules/openrouter/OpenRouterCatalogController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,gCAAgC,EAChC,+BAA+B,GAChC,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAEzE,qFAAqF;AACrF,2FAA2F;AAC3F,yFAAyF;AACzF,4FAA4F;AAC5F,kGAAkG;AAElG,MAAM,cAAc,GAAG,GAAU,EAAE;IACjC,MAAM,IAAI,iBAAiB,CAAC,0CAA0C,CAAC,CAAA;AACzE,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,GAAU,EAAE;IAC9B,MAAM,IAAI,gBAAgB,CAAC,8CAA8C,CAAC,CAAA;AAC5E,CAAC,CAAA;AAED,MAAM,UAAU,2BAA2B;IACzC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,8EAA8E;IAC9E,cAAc,CAAC,GAAG,EAAE,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5D,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,iBAAiB,CAAA;QAChD,IAAI,CAAC,GAAG;YAAE,OAAO,WAAW,EAAE,CAAA;QAC9B,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,cAAc,EAAE,CAAA;QAC3C,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;IAEF,yFAAyF;IACzF,qFAAqF;IACrF,cAAc,CAAC,GAAG,EAAE,+BAA+B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/D,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,iBAAiB,CAAA;QAChD,IAAI,CAAC,GAAG;YAAE,OAAO,WAAW,EAAE,CAAA;QAC9B,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,cAAc,EAAE,CAAA;QAC3C,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC7F,CAAC,CAAC,CAAA;IAEF,uFAAuF;IACvF,0FAA0F;IAC1F,cAAc,CAAC,GAAG,EAAE,gCAAgC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChE,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,iBAAiB,CAAA;QAChD,IAAI,CAAC,GAAG;YAAE,OAAO,WAAW,EAAE,CAAA;QAC9B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC1B,IAAI,CAAC,IAAI;YAAE,OAAO,cAAc,EAAE,CAAA;QAClC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAA;IAC9F,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"OpenRouterCatalogController.js","sourceRoot":"","sources":["../../../src/modules/openrouter/OpenRouterCatalogController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,gCAAgC,EAChC,+BAA+B,GAChC,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAErE,qFAAqF;AACrF,2FAA2F;AAC3F,yFAAyF;AACzF,4FAA4F;AAC5F,kGAAkG;AAElG,0FAA0F;AAC1F,SAAS,cAAc,CAAmB,CAAa;IACrD,OAAO,iBAAiB,CACtB,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,iBAAiB,EACpC,8CAA8C,CAC/C,CAAA;AACH,CAAC;AAED,0FAA0F;AAC1F,SAAS,eAAe,CAAmB,CAAa;IACtD,OAAO,WAAW,CAAC,CAAC,EAAE,0CAA0C,CAAC,CAAA;AACnE,CAAC;AAED,0FAA0F;AAC1F,SAAS,cAAc,CAAmB,CAAa;IACrD,eAAe,CAAC,CAAC,CAAC,CAAA;AACpB,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,8EAA8E;IAC9E,cAAc,CAAC,GAAG,EAAE,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5D,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;QAC7B,cAAc,CAAC,CAAC,CAAC,CAAA;QACjB,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;IAEF,yFAAyF;IACzF,qFAAqF;IACrF,cAAc,CAAC,GAAG,EAAE,+BAA+B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/D,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;QAC7B,cAAc,CAAC,CAAC,CAAC,CAAA;QACjB,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC7F,CAAC,CAAC,CAAA;IAEF,uFAAuF;IACvF,0FAA0F;IAC1F,cAAc,CAAC,GAAG,EAAE,gCAAgC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChE,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;QAC7B,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,CAAA;QAC/B,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAA;IAC9F,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/modules/packageRegistries/PackageRegistriesController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PackageRegistriesController.d.ts","sourceRoot":"","sources":["../../../src/modules/packageRegistries/PackageRegistriesController.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAc/C;;;;;GAKG;AACH,wBAAgB,2BAA2B,IAAI,IAAI,CAAC,MAAM,CAAC,CAwB1D"}
+{"version":3,"file":"PackageRegistriesController.d.ts","sourceRoot":"","sources":["../../../src/modules/packageRegistries/PackageRegistriesController.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAa/C;;;;;GAKG;AACH,wBAAgB,2BAA2B,IAAI,IAAI,CAAC,MAAM,CAAC,CAqB1D"}

package/dist/modules/packageRegistries/PackageRegistriesController.js

@@ -3,14 +3,11 @@ import { buildHonoRoute } from '@toad-contracts/hono';
 import { Hono } from 'hono';
 import { requireWorkspacePermission } from '../../http/workspaceAccess.js';
 import { param } from '../../http/params.js';
-import { UnavailableError } from '@cat-factory/kernel';
-/** Resolve the package-registries module or send a 503, returning null when unconfigured. */
+import { requireCapability } from '../../http/guards.js';
+/** Resolve the package-registries module, or refuse with a 503 naming what isn't wired. */
 function requirePackageRegistries(c) {
-    return c.get('container').packageRegistries ?? null;
+    return requireCapability(c.get('container').packageRegistries, 'The package-registry integration is not configured');
 }
-const unavailable = () => {
-    throw new UnavailableError('The package-registry integration is not configured');
-};
 /**
  * Per-workspace private package-registry entries (npm private orgs, GitHub Packages)
  * that agent containers use to resolve private dependencies. Tokens are write-only —
@@ -22,20 +19,14 @@ export function packageRegistriesController() {
     app.use('*', requireWorkspacePermission('integrations.manage'));
     buildHonoRoute(app, listPackageRegistriesContract, async (c) => {
         const registries = requirePackageRegistries(c);
-        if (!registries)
-            return unavailable();
         return c.json(await registries.service.list(param(c, 'workspaceId')), 200);
     });
     buildHonoRoute(app, addPackageRegistryContract, async (c) => {
         const registries = requirePackageRegistries(c);
-        if (!registries)
-            return unavailable();
         return c.json(await registries.service.add(param(c, 'workspaceId'), c.req.valid('json')), 200);
     });
     buildHonoRoute(app, deletePackageRegistryContract, async (c) => {
         const registries = requirePackageRegistries(c);
-        if (!registries)
-            return unavailable();
         await registries.service.remove(param(c, 'workspaceId'), c.req.valid('param').entryId);
         return c.body(null, 204);
     });

package/dist/modules/packageRegistries/PackageRegistriesController.js.map

@@ -1 +1 @@
-{"version":3,"file":"PackageRegistriesController.js","sourceRoot":"","sources":["../../../src/modules/packageRegistries/PackageRegistriesController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAI3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAA;AAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD,6FAA6F;AAC7F,SAAS,wBAAwB,CAAmB,CAAa;IAC/D,OAAO,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAA;AACrD,CAAC;AAED,MAAM,WAAW,GAAG,GAAU,EAAE;IAC9B,MAAM,IAAI,gBAAgB,CAAC,oDAAoD,CAAC,CAAA;AAClF,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B;IACzC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,0BAA0B,CAAC,qBAAqB,CAAC,CAAC,CAAA;IAE/D,cAAc,CAAC,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7D,MAAM,UAAU,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAA;QAC9C,IAAI,CAAC,UAAU;YAAE,OAAO,WAAW,EAAE,CAAA;QACrC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1D,MAAM,UAAU,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAA;QAC9C,IAAI,CAAC,UAAU;YAAE,OAAO,WAAW,EAAE,CAAA;QACrC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAChG,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7D,MAAM,UAAU,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAA;QAC9C,IAAI,CAAC,UAAU;YAAE,OAAO,WAAW,EAAE,CAAA;QACrC,MAAM,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAA;QACtF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"PackageRegistriesController.js","sourceRoot":"","sources":["../../../src/modules/packageRegistries/PackageRegistriesController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAI3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAA;AAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAExD,2FAA2F;AAC3F,SAAS,wBAAwB,CAAmB,CAAa;IAC/D,OAAO,iBAAiB,CACtB,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,iBAAiB,EACpC,oDAAoD,CACrD,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B;IACzC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,0BAA0B,CAAC,qBAAqB,CAAC,CAAC,CAAA;IAE/D,cAAc,CAAC,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7D,MAAM,UAAU,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAA;QAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1D,MAAM,UAAU,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAA;QAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAChG,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7D,MAAM,UAAU,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAA;QAC9C,MAAM,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAA;QACtF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/modules/preflight/PreflightController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PreflightController.d.ts","sourceRoot":"","sources":["../../../src/modules/preflight/PreflightController.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAY/C;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAAC,MAAM,CAAC,CAWlD"}
+{"version":3,"file":"PreflightController.d.ts","sourceRoot":"","sources":["../../../src/modules/preflight/PreflightController.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAW/C;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAAC,MAAM,CAAC,CAUlD"}

package/dist/modules/preflight/PreflightController.js

@@ -1,14 +1,11 @@
 import { runPreflightsContract } from '@cat-factory/contracts';
 import { buildHonoRoute } from '@toad-contracts/hono';
 import { Hono } from 'hono';
-import { UnavailableError } from '@cat-factory/kernel';
-/** Resolve the preflight module, or null when the host-probe runtime isn't wired (non-local facade). */
+import { requireCapability } from '../../http/guards.js';
+/** Resolve the preflight module, or 503 when the host-probe runtime isn't wired (non-local facade). */
 function requirePreflight(c) {
-    return c.get('container').preflight ?? null;
+    return requireCapability(c.get('container').preflight, 'Preflight checks are not available on this deployment');
 }
-const unavailable = () => {
-    throw new UnavailableError('Preflight checks are not available on this deployment');
-};
 /**
  * Run a set of preflight checks (machine-prerequisite probes with guided remediation) and return
  * one verdict per ref — the setup wizard's live re-check button (slice 7) + any ad-hoc "am I ready
@@ -19,8 +16,6 @@ export function preflightController() {
     const app = new Hono();
     buildHonoRoute(app, runPreflightsContract, async (c) => {
         const preflight = requirePreflight(c);
-        if (!preflight)
-            return unavailable();
         const { prerequisites } = c.req.valid('json');
         return c.json(await preflight.service.run(prerequisites), 200);
     });

package/dist/modules/preflight/PreflightController.js.map

@@ -1 +1 @@
-{"version":3,"file":"PreflightController.js","sourceRoot":"","sources":["../../../src/modules/preflight/PreflightController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAE9D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD,wGAAwG;AACxG,SAAS,gBAAgB,CAAmB,CAAa;IACvD,OAAO,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,SAAS,IAAI,IAAI,CAAA;AAC7C,CAAC;AAED,MAAM,WAAW,GAAG,GAAU,EAAE;IAC9B,MAAM,IAAI,gBAAgB,CAAC,uDAAuD,CAAC,CAAA;AACrF,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,cAAc,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,IAAI,CAAC,SAAS;YAAE,OAAO,WAAW,EAAE,CAAA;QACpC,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC7C,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"PreflightController.js","sourceRoot":"","sources":["../../../src/modules/preflight/PreflightController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAE9D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAExD,uGAAuG;AACvG,SAAS,gBAAgB,CAAmB,CAAa;IACvD,OAAO,iBAAiB,CACtB,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,SAAS,EAC5B,uDAAuD,CACxD,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,cAAc,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC7C,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/modules/preview/PreviewController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PreviewController.d.ts","sourceRoot":"","sources":["../../../src/modules/preview/PreviewController.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAqB/C;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAAC,MAAM,CAAC,CA0BhD"}
+{"version":3,"file":"PreviewController.d.ts","sourceRoot":"","sources":["../../../src/modules/preview/PreviewController.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAoB/C;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAAC,MAAM,CAAC,CAuBhD"}

package/dist/modules/preview/PreviewController.js

@@ -3,22 +3,18 @@ import { buildHonoRoute } from '@toad-contracts/hono';
 import { Hono } from 'hono';
 import { requireWorkspacePermission } from '../../http/workspaceAccess.js';
 import { param } from '../../http/params.js';
-import { UnavailableError } from '@cat-factory/kernel';
+import { requireCapability } from '../../http/guards.js';
 /**
  * Resolve the preview module, gating on the runtime's `frontendPreview.supported` capability
  * FIRST (defense-in-depth: slice 5a only gated the SPA toggle, so a direct API call on an
- * unsupported runtime — e.g. the Worker — must still be refused here). Returns null (→ 503)
+ * unsupported runtime — e.g. the Worker — must still be refused here). Refuses with a 503
  * when the runtime can't host a preview OR the module isn't wired.
  */
 function requirePreview(c) {
     const container = c.get('container');
-    if (container.config.infrastructure?.frontendPreview?.supported === false)
-        return null;
-    return container.preview ?? null;
+    const supported = container.config.infrastructure?.frontendPreview?.supported !== false;
+    return requireCapability(supported ? container.preview : null, 'Browsable frontend previews are not supported on this runtime');
 }
-const unavailable = () => {
-    throw new UnavailableError('Browsable frontend previews are not supported on this runtime');
-};
 /**
  * Browsable frontend preview (slice 5c): start / poll / stop a long-lived build+serve container
  * for a `frontend` frame, reachable on a host URL. A local/node differentiator — 503 on the
@@ -29,22 +25,16 @@ export function previewController() {
     app.use('*', requireWorkspacePermission('integrations.manage'));
     buildHonoRoute(app, getPreviewContract, async (c) => {
         const preview = requirePreview(c);
-        if (!preview)
-            return unavailable();
         const frameId = c.req.valid('param').frameId;
         return c.json(await preview.service.get(param(c, 'workspaceId'), frameId), 200);
     });
     buildHonoRoute(app, startPreviewContract, async (c) => {
         const preview = requirePreview(c);
-        if (!preview)
-            return unavailable();
         const frameId = c.req.valid('param').frameId;
         return c.json(await preview.service.start(param(c, 'workspaceId'), frameId), 201);
     });
     buildHonoRoute(app, stopPreviewContract, async (c) => {
         const preview = requirePreview(c);
-        if (!preview)
-            return unavailable();
         const frameId = c.req.valid('param').frameId;
         return c.json(await preview.service.stop(param(c, 'workspaceId'), frameId), 200);
     });

package/dist/modules/preview/PreviewController.js.map

@@ -1 +1 @@
-{"version":3,"file":"PreviewController.js","sourceRoot":"","sources":["../../../src/modules/preview/PreviewController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAI3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAA;AAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD;;;;;GAKG;AACH,SAAS,cAAc,CAAmB,CAAa;IACrD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACpC,IAAI,SAAS,CAAC,MAAM,CAAC,cAAc,EAAE,eAAe,EAAE,SAAS,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IACtF,OAAO,SAAS,CAAC,OAAO,IAAI,IAAI,CAAA;AAClC,CAAC;AAED,MAAM,WAAW,GAAG,GAAU,EAAE;IAC9B,MAAM,IAAI,gBAAgB,CAAC,+DAA+D,CAAC,CAAA;AAC7F,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,0BAA0B,CAAC,qBAAqB,CAAC,CAAC,CAAA;IAE/D,cAAc,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClD,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;QACjC,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,EAAE,CAAA;QAClC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAA;QAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpD,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;QACjC,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,EAAE,CAAA;QAClC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAA;QAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,CAAA;IACnF,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnD,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;QACjC,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,EAAE,CAAA;QAClC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAA;QAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,CAAA;IAClF,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"PreviewController.js","sourceRoot":"","sources":["../../../src/modules/preview/PreviewController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAI3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAA;AAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAExD;;;;;GAKG;AACH,SAAS,cAAc,CAAmB,CAAa;IACrD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACpC,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,cAAc,EAAE,eAAe,EAAE,SAAS,KAAK,KAAK,CAAA;IACvF,OAAO,iBAAiB,CACtB,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EACpC,+DAA+D,CAChE,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,0BAA0B,CAAC,qBAAqB,CAAC,CAAC,CAAA;IAE/D,cAAc,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClD,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAA;QAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpD,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAA;QAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,CAAA;IACnF,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnD,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAA;QAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,CAAA;IAClF,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/modules/providers/ApiKeyController.d.ts

@@ -2,7 +2,6 @@ import { type ApiKey } from '@cat-factory/contracts';
 import type { ApiKeySummary } from '@cat-factory/integrations';
 import { Hono } from 'hono';
 import type { AppEnv } from '../../http/env.js';
-/** Project the service summary onto the wire type (already secret-free). */
 export declare function apiKeyToWire(summary: ApiKeySummary): ApiKey;
 /** Workspace-scoped API-key routes, mounted under `/workspaces/:workspaceId`. */
 export declare function workspaceApiKeyController(): Hono<AppEnv>;

package/dist/modules/providers/ApiKeyController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyController.d.ts","sourceRoot":"","sources":["../../../src/modules/providers/ApiKeyController.ts"],"names":[],"mappings":"AAAA,OAAO,EASL,KAAK,MAAM,EACZ,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AAE9D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAqB/C,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAe3D;AAED,iFAAiF;AACjF,wBAAgB,yBAAyB,IAAI,IAAI,CAAC,MAAM,CAAC,CAsCxD;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,IAAI,IAAI,CAAC,MAAM,CAAC,CA6CnD"}
+{"version":3,"file":"ApiKeyController.d.ts","sourceRoot":"","sources":["../../../src/modules/providers/ApiKeyController.ts"],"names":[],"mappings":"AAAA,OAAO,EASL,KAAK,MAAM,EACZ,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AAE9D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAwB/C,wBAAgB,YAAY,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAe3D;AAED,iFAAiF;AACjF,wBAAgB,yBAAyB,IAAI,IAAI,CAAC,MAAM,CAAC,CAkCxD;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,IAAI,IAAI,CAAC,MAAM,CAAC,CAqCnD"}

package/dist/modules/providers/ApiKeyController.js

@@ -3,7 +3,7 @@ import { buildHonoRoute } from '@toad-contracts/hono';
 import { Hono } from 'hono';
 import { requireWorkspacePermission } from '../../http/workspaceAccess.js';
 import { param } from '../../http/params.js';
-import { UnavailableError, UnauthorizedError } from '@cat-factory/kernel';
+import { requireCapability, requireUser } from '../../http/guards.js';
 // Direct-provider API-key endpoints. Keys (OpenAI/Anthropic/Qwen/DeepSeek/Moonshot)
 // are onboarded here and stored encrypted, replacing deployment-env onboarding. The
 // raw key is write-only — only metadata + rolling-window usage is ever returned.
@@ -11,13 +11,15 @@ import { UnavailableError, UnauthorizedError } from '@cat-factory/kernel';
 // This controller mounts the WORKSPACE-scoped routes (under `/workspaces/:workspaceId`)
 // and the USER-scoped routes (`/me/api-keys`, the caller's own pool). ACCOUNT-scoped
 // keys are managed by the AccountController, which admin-gates them.
-const unavailable = () => {
-    throw new UnavailableError('API key storage is not configured');
-};
-const signInRequired = () => {
-    throw new UnauthorizedError('Sign in to manage your API keys');
-};
 /** Project the service summary onto the wire type (already secret-free). */
+/** Resolve the API-key store, or refuse with a 503 naming what isn't wired. */
+function requireApiKeys(c) {
+    return requireCapability(c.get('container').apiKeys, 'API key storage is not configured');
+}
+/** The signed-in caller, or a 401 wording the prompt for what this controller manages. */
+function requireSignedIn(c) {
+    return requireUser(c, 'Sign in to manage your API keys');
+}
 export function apiKeyToWire(summary) {
     return {
         id: summary.id,
@@ -39,30 +41,22 @@ export function workspaceApiKeyController() {
     const app = new Hono();
     app.use('*', requireWorkspacePermission('secrets.manage'));
     buildHonoRoute(app, listWorkspaceApiKeysContract, async (c) => {
-        const apiKeys = c.get('container').apiKeys;
-        if (!apiKeys)
-            return unavailable();
+        const apiKeys = requireApiKeys(c);
         const keys = await apiKeys.listKeys('workspace', param(c, 'workspaceId'));
         return c.json({ keys: keys.map(apiKeyToWire) }, 200);
     });
     buildHonoRoute(app, addWorkspaceApiKeyContract, async (c) => {
-        const apiKeys = c.get('container').apiKeys;
-        if (!apiKeys)
-            return unavailable();
+        const apiKeys = requireApiKeys(c);
         const summary = await apiKeys.addKey('workspace', param(c, 'workspaceId'), c.req.valid('json'));
         return c.json(apiKeyToWire(summary), 201);
     });
     buildHonoRoute(app, updateWorkspaceApiKeyContract, async (c) => {
-        const apiKeys = c.get('container').apiKeys;
-        if (!apiKeys)
-            return unavailable();
+        const apiKeys = requireApiKeys(c);
         const summary = await apiKeys.updateKey('workspace', param(c, 'workspaceId'), c.req.valid('param').id, c.req.valid('json'));
         return c.json(apiKeyToWire(summary), 200);
     });
     buildHonoRoute(app, removeWorkspaceApiKeyContract, async (c) => {
-        const apiKeys = c.get('container').apiKeys;
-        if (!apiKeys)
-            return unavailable();
+        const apiKeys = requireApiKeys(c);
         await apiKeys.removeKey('workspace', param(c, 'workspaceId'), c.req.valid('param').id);
         return c.body(null, 204);
     });
@@ -72,42 +66,26 @@ export function workspaceApiKeyController() {
 export function userApiKeyController() {
     const app = new Hono();
     buildHonoRoute(app, listUserApiKeysContract, async (c) => {
-        const apiKeys = c.get('container').apiKeys;
-        if (!apiKeys)
-            return unavailable();
-        const user = c.get('user');
-        if (!user)
-            return signInRequired();
+        const apiKeys = requireApiKeys(c);
+        const user = requireSignedIn(c);
         const keys = await apiKeys.listKeys('user', user.id);
         return c.json({ keys: keys.map(apiKeyToWire) }, 200);
     });
     buildHonoRoute(app, addUserApiKeyContract, async (c) => {
-        const apiKeys = c.get('container').apiKeys;
-        if (!apiKeys)
-            return unavailable();
-        const user = c.get('user');
-        if (!user)
-            return signInRequired();
+        const apiKeys = requireApiKeys(c);
+        const user = requireSignedIn(c);
         const summary = await apiKeys.addKey('user', user.id, c.req.valid('json'));
         return c.json(apiKeyToWire(summary), 201);
     });
     buildHonoRoute(app, updateUserApiKeyContract, async (c) => {
-        const apiKeys = c.get('container').apiKeys;
-        if (!apiKeys)
-            return unavailable();
-        const user = c.get('user');
-        if (!user)
-            return signInRequired();
+        const apiKeys = requireApiKeys(c);
+        const user = requireSignedIn(c);
         const summary = await apiKeys.updateKey('user', user.id, c.req.valid('param').id, c.req.valid('json'));
         return c.json(apiKeyToWire(summary), 200);
     });
     buildHonoRoute(app, removeUserApiKeyContract, async (c) => {
-        const apiKeys = c.get('container').apiKeys;
-        if (!apiKeys)
-            return unavailable();
-        const user = c.get('user');
-        if (!user)
-            return signInRequired();
+        const apiKeys = requireApiKeys(c);
+        const user = requireSignedIn(c);
         await apiKeys.removeKey('user', user.id, c.req.valid('param').id);
         return c.body(null, 204);
     });