@cat-factory/server 0.223.0 → 0.224.0

package/dist/modules/auth/loginFlow.d.ts

@@ -0,0 +1,56 @@
+import type { Context } from 'hono';
+import type { UserRecord } from '@cat-factory/kernel';
+import { type SessionUser, TOKEN_AUDIENCE } from '../../auth/signing.js';
+import type { AuthConfig } from '../../config/types.js';
+import type { AppEnv } from '../../http/env.js';
+/** How long a login round-trip's signed state stays valid. */
+export declare const OAUTH_STATE_TTL_MS: number;
+/** Browser-binding cookie for an OAuth round-trip (the CSRF pair for the signed `state`). */
+export declare const OAUTH_STATE_COOKIE = "cf_oauth_state";
+export interface OAuthState {
+    aud: typeof TOKEN_AUDIENCE.oauthState;
+    nonce: string;
+    /** Where to send the browser (with the token) after a successful login. */
+    redirect: string;
+    /** Optional invite token to redeem after a brand-new Google/GitHub signup. */
+    invite?: string;
+    exp: number;
+}
+export declare function authConfig<E extends AppEnv>(c: Context<E>): AuthConfig;
+/**
+ * Choose the post-login landing URL from the (untrusted) `redirect` query. The
+ * session token is appended as a fragment, so an unrestricted redirect is a
+ * token-exfiltration primitive — only same-origin, an explicitly allowlisted origin, or a
+ * loopback host (the caller's own machine) is honoured, else the request origin.
+ */
+export declare function pickPostLoginRedirect(requested: string | undefined, requestOrigin: string, cfg: Pick<AuthConfig, 'successRedirectUrl' | 'allowedRedirectOrigins'>): string;
+export declare function resolveRedirect<E extends AppEnv>(c: Context<E>, cfg: AuthConfig): string;
+/** Append the session token as a URL fragment on the landing URL. */
+export declare function withToken(redirect: string, token: string): string;
+/** Build the SessionUser surface from a canonical user + chosen display login. */
+export declare function sessionUser(user: UserRecord, login: string): SessionUser;
+/**
+ * Mint a user SESSION token, returning the signed token and the exact `exp` it committed to so a
+ * caller can report the real expiry without a second clock read. Shared by every login path AND
+ * the local-mode mothership-connect controller, so the session claim shape lives in one place.
+ */
+export declare function mintSession(cfg: AuthConfig, user: SessionUser): Promise<{
+    token: string;
+    exp: number;
+}>;
+/** Whether an email's domain is on the self-signup allowlist. */
+export declare function emailDomainAllowed(email: string, cfg: AuthConfig): boolean;
+/**
+ * Set a round-trip's browser-binding cookie. `Lax` is deliberate and sufficient: every callback
+ * this covers arrives as a top-level GET navigation, which Lax permits.
+ */
+export declare function setRoundTripCookie<E extends AppEnv>(c: Context<E>, name: string, value: string): void;
+/** Verify + single-use the OAuth state (signature, expiry, browser-binding cookie). */
+export declare function consumeState<E extends AppEnv>(c: Context<E>, cfg: AuthConfig): Promise<OAuthState | null>;
+/** Begin a redirect round-trip: sign the state and bind it to the browser with a cookie. */
+export declare function beginRoundTrip<E extends AppEnv>(c: Context<E>, cfg: AuthConfig): Promise<string>;
+export declare function peekInvite<E extends AppEnv>(c: Context<E>, token: string): Promise<any>;
+/** Whether a sign-in email matches the address an invitation was sent to. */
+export declare function emailMatchesInvite(signInEmail: string | null | undefined, inviteEmail: string): boolean;
+export declare function acceptInvite<E extends AppEnv>(c: Context<E>, token: string, userId: string, userEmail: string | null): Promise<void>;
+//# sourceMappingURL=loginFlow.d.ts.map

package/dist/modules/auth/loginFlow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loginFlow.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/loginFlow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAGnC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,EAGL,KAAK,WAAW,EAChB,cAAc,EACf,MAAM,uBAAuB,CAAA;AAC9B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAkB/C,8DAA8D;AAC9D,eAAO,MAAM,kBAAkB,QAAiB,CAAA;AAEhD,6FAA6F;AAC7F,eAAO,MAAM,kBAAkB,mBAAmB,CAAA;AAElD,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,OAAO,cAAc,CAAC,UAAU,CAAA;IACrC,KAAK,EAAE,MAAM,CAAA;IACb,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAA;IAChB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,wBAAgB,UAAU,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,UAAU,CAEtE;AAcD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,oBAAoB,GAAG,wBAAwB,CAAC,GACrE,MAAM,CAkBR;AAED,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,GAAG,MAAM,CAExF;AAED,qEAAqE;AACrE,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAIjE;AAED,kFAAkF;AAClF,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,CAQxE;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,UAAU,EACf,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAIzC;AAED,iEAAiE;AACjE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAK1E;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,MAAM,EACjD,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EACb,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,IAAI,CAQN;AAED,uFAAuF;AACvF,wBAAsB,YAAY,CAAC,CAAC,SAAS,MAAM,EACjD,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EACb,GAAG,EAAE,UAAU,GACd,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAQ5B;AAED,4FAA4F;AAC5F,wBAAsB,cAAc,CAAC,CAAC,SAAS,MAAM,EACnD,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EACb,GAAG,EAAE,UAAU,GACd,OAAO,CAAC,MAAM,CAAC,CAYjB;AAED,wBAAsB,UAAU,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,gBAG9E;AAED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACtC,WAAW,EAAE,MAAM,GAClB,OAAO,CAET;AAED,wBAAsB,YAAY,CAAC,CAAC,SAAS,MAAM,EACjD,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EACb,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAAG,IAAI,GACvB,OAAO,CAAC,IAAI,CAAC,CAWf"}

package/dist/modules/auth/loginFlow.js

@@ -0,0 +1,162 @@
+import { deleteCookie, getCookie, setCookie } from 'hono/cookie';
+import { ConflictError, NotFoundError } from '@cat-factory/kernel';
+import { HmacSigner, TOKEN_AUDIENCE, } from '../../auth/signing.js';
+// ---------------------------------------------------------------------------
+// The shared mechanics of a BROWSER login round-trip, used by every provider that redirects:
+// GitHub OAuth, Google OAuth, and enterprise SSO.
+//
+// Extracted from `AuthController` when SSO landed, because the alternative was a second copy of
+// the CSRF state, the redirect allow-listing and the session mint — the three pieces where a
+// divergence is a vulnerability rather than an inconsistency:
+//
+//  - the signed, cookie-bound `state` nonce is the CSRF defence, and "one implementation" is what
+//    the SSO design committed to;
+//  - `pickPostLoginRedirect` guards a token-EXFILTRATION primitive (the session token rides the
+//    landing URL's fragment), so a provider with its own laxer copy would hand an attacker the
+//    session of anyone who clicked their link;
+//  - `mintSession` is the one place the session claim shape lives.
+// ---------------------------------------------------------------------------
+/** How long a login round-trip's signed state stays valid. */
+export const OAUTH_STATE_TTL_MS = 10 * 60 * 1000;
+/** Browser-binding cookie for an OAuth round-trip (the CSRF pair for the signed `state`). */
+export const OAUTH_STATE_COOKIE = 'cf_oauth_state';
+export function authConfig(c) {
+    return c.get('container').config.auth;
+}
+/**
+ * A loopback host (the user's OWN machine): `localhost`, the `127.0.0.0/8` block, or IPv6 `::1`.
+ * A redirect to one of these is not an exfiltration vector — capturing the fragment there means
+ * already running a server on the victim's own machine. This is what lets a mothership honour the
+ * post-login redirect back to a mothership-mode LOCAL node (`http://localhost:PORT`), which is
+ * neither same-origin nor pre-allowlisted, without an operator hand-listing every dev port.
+ */
+function isLoopbackRedirect(url) {
+    const host = url.hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    return host === 'localhost' || host === '::1' || /^127\.\d+\.\d+\.\d+$/.test(host);
+}
+/**
+ * Choose the post-login landing URL from the (untrusted) `redirect` query. The
+ * session token is appended as a fragment, so an unrestricted redirect is a
+ * token-exfiltration primitive — only same-origin, an explicitly allowlisted origin, or a
+ * loopback host (the caller's own machine) is honoured, else the request origin.
+ */
+export function pickPostLoginRedirect(requested, requestOrigin, cfg) {
+    if (cfg.successRedirectUrl)
+        return cfg.successRedirectUrl;
+    const fallback = `${requestOrigin}/`;
+    if (!requested)
+        return fallback;
+    try {
+        const url = new URL(requested);
+        if (url.protocol !== 'http:' && url.protocol !== 'https:')
+            return fallback;
+        if (url.origin === requestOrigin ||
+            cfg.allowedRedirectOrigins.includes(url.origin) ||
+            isLoopbackRedirect(url)) {
+            return requested;
+        }
+    }
+    catch {
+        // fall through to the safe origin-relative default
+    }
+    return fallback;
+}
+export function resolveRedirect(c, cfg) {
+    return pickPostLoginRedirect(c.req.query('redirect'), new URL(c.req.url).origin, cfg);
+}
+/** Append the session token as a URL fragment on the landing URL. */
+export function withToken(redirect, token) {
+    const url = new URL(redirect);
+    url.hash = `token=${token}`;
+    return url.toString();
+}
+/** Build the SessionUser surface from a canonical user + chosen display login. */
+export function sessionUser(user, login) {
+    return {
+        id: user.id,
+        login,
+        name: user.name,
+        avatarUrl: user.avatarUrl,
+        email: user.email,
+    };
+}
+/**
+ * Mint a user SESSION token, returning the signed token and the exact `exp` it committed to so a
+ * caller can report the real expiry without a second clock read. Shared by every login path AND
+ * the local-mode mothership-connect controller, so the session claim shape lives in one place.
+ */
+export async function mintSession(cfg, user) {
+    const exp = Date.now() + cfg.sessionTtlMs;
+    const session = { ...user, aud: TOKEN_AUDIENCE.session, exp };
+    return { token: await new HmacSigner(cfg.sessionSecret).sign(session), exp };
+}
+/** Whether an email's domain is on the self-signup allowlist. */
+export function emailDomainAllowed(email, cfg) {
+    const at = email.lastIndexOf('@');
+    if (at < 0)
+        return false;
+    const domain = email.slice(at + 1).toLowerCase();
+    return cfg.allowedEmailDomains.includes(domain);
+}
+/**
+ * Set a round-trip's browser-binding cookie. `Lax` is deliberate and sufficient: every callback
+ * this covers arrives as a top-level GET navigation, which Lax permits.
+ */
+export function setRoundTripCookie(c, name, value) {
+    setCookie(c, name, value, {
+        httpOnly: true,
+        secure: new URL(c.req.url).protocol === 'https:',
+        sameSite: 'Lax',
+        path: '/auth',
+        maxAge: OAUTH_STATE_TTL_MS / 1000,
+    });
+}
+/** Verify + single-use the OAuth state (signature, expiry, browser-binding cookie). */
+export async function consumeState(c, cfg) {
+    const state = await new HmacSigner(cfg.sessionSecret).verify(c.req.query('state'), {
+        aud: TOKEN_AUDIENCE.oauthState,
+    });
+    const boundNonce = getCookie(c, OAUTH_STATE_COOKIE);
+    deleteCookie(c, OAUTH_STATE_COOKIE, { path: '/auth' });
+    if (!state || !boundNonce || boundNonce !== state.nonce)
+        return null;
+    return state;
+}
+/** Begin a redirect round-trip: sign the state and bind it to the browser with a cookie. */
+export async function beginRoundTrip(c, cfg) {
+    const nonce = crypto.randomUUID();
+    const state = {
+        aud: TOKEN_AUDIENCE.oauthState,
+        nonce,
+        redirect: resolveRedirect(c, cfg),
+        ...(c.req.query('invite') ? { invite: c.req.query('invite') } : {}),
+        exp: Date.now() + OAUTH_STATE_TTL_MS,
+    };
+    const signedState = await new HmacSigner(cfg.sessionSecret).sign(state);
+    setRoundTripCookie(c, OAUTH_STATE_COOKIE, nonce);
+    return signedState;
+}
+export async function peekInvite(c, token) {
+    const inv = c.get('container').invitations;
+    return inv ? inv.peek(token) : null;
+}
+/** Whether a sign-in email matches the address an invitation was sent to. */
+export function emailMatchesInvite(signInEmail, inviteEmail) {
+    return !!signInEmail && signInEmail.toLowerCase().trim() === inviteEmail;
+}
+export async function acceptInvite(c, token, userId, userEmail) {
+    const inv = c.get('container').invitations;
+    if (!inv)
+        return;
+    try {
+        await inv.accept(token, userId, userEmail);
+    }
+    catch (err) {
+        // Expected invite states (expired / already-used / wrong email) must not block an
+        // otherwise-valid login; an unexpected infra error should still surface.
+        if (err instanceof ConflictError || err instanceof NotFoundError)
+            return;
+        throw err;
+    }
+}
+//# sourceMappingURL=loginFlow.js.map

package/dist/modules/auth/loginFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loginFlow.js","sourceRoot":"","sources":["../../../src/modules/auth/loginFlow.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAElE,OAAO,EACL,UAAU,EAGV,cAAc,GACf,MAAM,uBAAuB,CAAA;AAI9B,8EAA8E;AAC9E,6FAA6F;AAC7F,kDAAkD;AAClD,EAAE;AACF,gGAAgG;AAChG,6FAA6F;AAC7F,8DAA8D;AAC9D,EAAE;AACF,kGAAkG;AAClG,kCAAkC;AAClC,gGAAgG;AAChG,+FAA+F;AAC/F,+CAA+C;AAC/C,mEAAmE;AACnE,8EAA8E;AAE9E,8DAA8D;AAC9D,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEhD,6FAA6F;AAC7F,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAA;AAYlD,MAAM,UAAU,UAAU,CAAmB,CAAa;IACxD,OAAO,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,CAAA;AACvC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,GAAQ;IAClC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC/D,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACpF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAA6B,EAC7B,aAAqB,EACrB,GAAsE;IAEtE,IAAI,GAAG,CAAC,kBAAkB;QAAE,OAAO,GAAG,CAAC,kBAAkB,CAAA;IACzD,MAAM,QAAQ,GAAG,GAAG,aAAa,GAAG,CAAA;IACpC,IAAI,CAAC,SAAS;QAAE,OAAO,QAAQ,CAAA;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAA;QAC9B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAA;QAC1E,IACE,GAAG,CAAC,MAAM,KAAK,aAAa;YAC5B,GAAG,CAAC,sBAAsB,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAC/C,kBAAkB,CAAC,GAAG,CAAC,EACvB,CAAC;YACD,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;IACrD,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,eAAe,CAAmB,CAAa,EAAE,GAAe;IAC9E,OAAO,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;AACvF,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,KAAa;IACvD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC7B,GAAG,CAAC,IAAI,GAAG,SAAS,KAAK,EAAE,CAAA;IAC3B,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;AACvB,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,WAAW,CAAC,IAAgB,EAAE,KAAa;IACzD,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAe,EACf,IAAiB;IAEjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,YAAY,CAAA;IACzC,MAAM,OAAO,GAAmB,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,CAAA;IAC7E,OAAO,EAAE,KAAK,EAAE,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAA;AAC9E,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,GAAe;IAC/D,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACxB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IAChD,OAAO,GAAG,CAAC,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,CAAa,EACb,IAAY,EACZ,KAAa;IAEb,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE;QACxB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAChD,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,kBAAkB,GAAG,IAAI;KAClC,CAAC,CAAA;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,CAAa,EACb,GAAe;IAEf,MAAM,KAAK,GAAG,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAa,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;QAC7F,GAAG,EAAE,cAAc,CAAC,UAAU;KAC/B,CAAC,CAAA;IACF,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAA;IACnD,YAAY,CAAC,CAAC,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;IACtD,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,KAAK,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACpE,OAAO,KAAK,CAAA;AACd,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,CAAa,EACb,GAAe;IAEf,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IACjC,MAAM,KAAK,GAAe;QACxB,GAAG,EAAE,cAAc,CAAC,UAAU;QAC9B,KAAK;QACL,QAAQ,EAAE,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC;QACjC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB;KACrC,CAAA;IACD,MAAM,WAAW,GAAG,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACvE,kBAAkB,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAA;IAChD,OAAO,WAAW,CAAA;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAmB,CAAa,EAAE,KAAa;IAC7E,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,WAAW,CAAA;IAC1C,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACrC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB,CAChC,WAAsC,EACtC,WAAmB;IAEnB,OAAO,CAAC,CAAC,WAAW,IAAI,WAAW,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,KAAK,WAAW,CAAA;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,CAAa,EACb,KAAa,EACb,MAAc,EACd,SAAwB;IAExB,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,WAAW,CAAA;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAM;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,kFAAkF;QAClF,yEAAyE;QACzE,IAAI,GAAG,YAAY,aAAa,IAAI,GAAG,YAAY,aAAa;YAAE,OAAM;QACxE,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC"}

package/dist/modules/auth/ssoRoutes.d.ts

@@ -0,0 +1,4 @@
+import type { Hono } from 'hono';
+import type { AppEnv } from '../../http/env.js';
+export declare function registerSsoRoutes(app: Hono<AppEnv>): void;
+//# sourceMappingURL=ssoRoutes.d.ts.map

package/dist/modules/auth/ssoRoutes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssoRoutes.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/ssoRoutes.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAqBhC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAuG/C,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAqFzD"}

package/dist/modules/auth/ssoRoutes.js

@@ -0,0 +1,294 @@
+import { SSO_ERROR_FRAGMENT_KEY, ssoCallbackContract, ssoLoginContract, } from '@cat-factory/contracts';
+import { buildHonoRoute } from '@toad-contracts/hono';
+import { deleteCookie, getCookie } from 'hono/cookie';
+import { UnavailableError, oidcIdentitySubject } from '@cat-factory/kernel';
+import { OidcClient, OidcFlowError, createPkcePair, ssoNotConfigured, } from '../../auth/oidc/OidcClient.js';
+import { OidcProviderDirectory } from '../../auth/oidc/discovery.js';
+import { judgeSsoAdmission, needsUserinfo, readSsoIdentity, userinfoMatchesSubject, } from '../../auth/oidc/claims.js';
+import { HmacSigner, TOKEN_AUDIENCE } from '../../auth/signing.js';
+import { requestLogger } from '../../http/requestLogging.js';
+import { OAUTH_STATE_TTL_MS, acceptInvite, authConfig, emailMatchesInvite, mintSession, peekInvite, pickPostLoginRedirect, resolveRedirect, sessionUser, setRoundTripCookie, withToken, } from './loginFlow.js';
+// ---------------------------------------------------------------------------
+// Enterprise SSO sign-in: `GET /auth/sso/login` → the IdP → `GET /auth/sso/callback`.
+//
+// ONE pair of routes serves every OpenID Connect provider, because the provider's own discovery
+// document supplies the endpoints (see `auth/oidc/discovery.ts`). What this module owns is the
+// round-trip's STATE and its refusals.
+//
+// The state differs from the GitHub/Google flow in one way that matters. Those carry a signed
+// state token in the URL and bind it to a cookie holding just its nonce. SSO cannot: PKCE's
+// `code_verifier` and OIDC's `nonce` are SECRETS that must not travel in a URL — a verifier
+// visible beside the code it protects protects nothing. So the whole round-trip rides in the
+// httpOnly cookie (signed, audience-pinned with the SAME `HmacSigner` the OAuth flow uses, so
+// CSRF protection stays one implementation) and only an opaque nonce goes in the `state`
+// parameter. That also means the post-login redirect target cannot be tampered with in the URL,
+// which is strictly stronger than the OAuth leg.
+//
+// Refusals REDIRECT rather than rendering an error envelope: a browser mid-redirect that lands on
+// raw JSON has no way back, and the reason is a closed vocabulary the SPA maps to translated copy
+// (`SSO_ERROR_REASONS`). The redirect target is only ever a TRUSTED one — the cookie's own
+// recorded target, or `pickPostLoginRedirect` with no requested value — never a query parameter,
+// because the failure path must not become the open redirect the success path is guarded against.
+// ---------------------------------------------------------------------------
+/** The httpOnly cookie carrying one SSO round-trip. Distinct from the OAuth flow's. */
+const SSO_STATE_COOKIE = 'cf_sso_state';
+function ssoConfig(c) {
+    const cfg = authConfig(c).sso;
+    if (!cfg)
+        ssoNotConfigured();
+    return cfg;
+}
+/**
+ * The redirect_uri, which must match what is registered with the IdP EXACTLY. Explicit
+ * configuration wins, because a deployment behind a proxy or a custom domain sees a request
+ * origin that is not its public one, and a derived value would then be rejected by the provider
+ * with the least helpful error it has (`invalid_grant`).
+ */
+function ssoCallbackUrl(c, cfg) {
+    if (cfg.redirectUrl)
+        return cfg.redirectUrl;
+    return `${new URL(c.req.url).origin}/auth/sso/callback`;
+}
+/**
+ * Build the OIDC client for this request. A fresh instance per request is deliberate: the
+ * expensive part (the discovery document) lives in the shared app cache, so the client itself
+ * holds no state worth reusing and none worth leaking between requests.
+ */
+function ssoClient(c, cfg) {
+    const logger = requestLogger(c);
+    return new OidcClient({
+        config: cfg,
+        directory: new OidcProviderDirectory({
+            cache: c.get('container').caches?.ssoDiscovery,
+            logger,
+        }),
+        logger,
+    });
+}
+/** Land the browser back on the SPA with a machine-readable reason instead of a session. */
+function refuse(target, reason) {
+    const url = new URL(target);
+    url.hash = `${SSO_ERROR_FRAGMENT_KEY}=${reason}`;
+    return url.toString();
+}
+export function registerSsoRoutes(app) {
+    buildHonoRoute(app, ssoLoginContract, async (c) => {
+        const cfg = authConfig(c);
+        const sso = ssoConfig(c);
+        const { verifier, challenge } = await createPkcePair();
+        const trip = {
+            aud: TOKEN_AUDIENCE.ssoState,
+            nonce: crypto.randomUUID(),
+            verifier,
+            idNonce: crypto.randomUUID(),
+            redirect: resolveRedirect(c, cfg),
+            ...(c.req.query('invite') ? { invite: c.req.query('invite') } : {}),
+            exp: Date.now() + OAUTH_STATE_TTL_MS,
+        };
+        setRoundTripCookie(c, SSO_STATE_COOKIE, await new HmacSigner(cfg.sessionSecret).sign(trip));
+        // Resolving the provider can fail (an unreachable IdP, a malformed discovery document). It
+        // throws an `UnavailableError` naming which, and the shared error handler renders it: this is
+        // the one leg where an envelope is right, because nothing has redirected yet and the operator
+        // is the audience.
+        const url = await ssoClient(c, sso).authorizeUrl({
+            redirectUri: ssoCallbackUrl(c, sso),
+            state: trip.nonce,
+            nonce: trip.idNonce,
+            codeChallenge: challenge,
+        });
+        return c.redirect(url);
+    });
+    buildHonoRoute(app, ssoCallbackContract, async (c) => {
+        const cfg = authConfig(c);
+        const sso = ssoConfig(c);
+        const trip = await consumeRoundTrip(c, cfg);
+        // With no verified round-trip there is no recorded landing URL, so fall back to the
+        // deployment's own configured target (or its origin) — never the request's `redirect` query,
+        // which is exactly the untrusted value the success path allow-lists.
+        const fallback = pickPostLoginRedirect(undefined, new URL(c.req.url).origin, cfg);
+        if (!trip)
+            return c.redirect(refuse(fallback, 'state_invalid'));
+        // The IdP's own refusal (`access_denied` when a user cancels or the app is not assigned to
+        // them) is reported as itself rather than as a token failure: there is nothing on this side
+        // to fix, and saying "invalid token" would send an operator hunting one.
+        if (c.req.query('error')) {
+            requestLogger(c).info('sso.provider_denied', { error: c.req.query('error') });
+            return c.redirect(refuse(trip.redirect, 'provider_denied'));
+        }
+        const code = c.req.query('code');
+        if (!code)
+            return c.redirect(refuse(trip.redirect, 'state_invalid'));
+        const client = ssoClient(c, sso);
+        let resolved;
+        try {
+            resolved = await resolveIdentity(client, sso, {
+                code,
+                redirectUri: ssoCallbackUrl(c, sso),
+                trip,
+                logger: requestLogger(c),
+            });
+        }
+        catch (err) {
+            // An IdP that stopped answering mid-round-trip is an OUTAGE, not a bad token and not this
+            // deployment's credentials, so it gets its own reason. It also has to REDIRECT: on the login
+            // leg an envelope is right (nothing has redirected yet, the operator is the audience), but
+            // here the browser is mid-flow and raw JSON leaves it with no way back.
+            if (err instanceof UnavailableError) {
+                requestLogger(c).warn('sso.provider_unreachable', { detail: err.message });
+                return c.redirect(refuse(trip.redirect, 'provider_unreachable'));
+            }
+            if (!(err instanceof OidcFlowError))
+                throw err;
+            // The message names the operator-actionable cause (a wrong secret, a redirect_uri the IdP
+            // does not hold, a clock skew); the user gets the reason code. Logged at WARN because a
+            // deployment whose SSO cannot complete is broken, not busy.
+            requestLogger(c).warn(`sso.${err.reason}`, { detail: err.message });
+            return c.redirect(refuse(trip.redirect, err.reason));
+        }
+        const { identity, issuer } = resolved;
+        if (!identity)
+            return c.redirect(refuse(trip.redirect, 'subject_missing'));
+        const admission = judgeSsoAdmission(identity, sso);
+        if (!admission.allowed) {
+            requestLogger(c).info('sso.refused', { reason: admission.reason, login: identity.login });
+            return c.redirect(refuse(trip.redirect, admission.reason));
+        }
+        const token = await establishSession(c, cfg, identity, issuer, trip);
+        return c.redirect(withToken(trip.redirect, token));
+    });
+}
+/**
+ * Exchange the code, verify the ID token, and merge in userinfo when — and only when — a claim
+ * admission depends on is missing from the token. `identity` is null when the verified token
+ * carries no `sub`, the one shape that leaves nothing to key an identity on.
+ *
+ * Returns the DISCOVERED issuer alongside it, so the caller keying the user's identity on it does
+ * not resolve the provider a second time: that second read is what put an IdP outage AFTER the
+ * admission decision, where nothing was left to report it with.
+ */
+async function resolveIdentity(client, sso, params) {
+    const tokens = await client.exchangeCode({
+        code: params.code,
+        redirectUri: params.redirectUri,
+        codeVerifier: params.trip.verifier,
+    });
+    const claims = (await client.verifyIdToken(tokens.idToken, {
+        nonce: params.trip.idNonce,
+    }));
+    let merged = claims;
+    if (tokens.accessToken && needsUserinfo(claims, sso)) {
+        const extra = await client.fetchUserInfo(tokens.accessToken);
+        // The ID token's claims WIN over userinfo's: the token is signed and the userinfo response is
+        // only bearer-authenticated, so on a disagreement the verified half is authoritative. `sub`
+        // in particular must never be taken from userinfo.
+        //
+        // And the response is only merged AT ALL when it describes the same subject the token did
+        // (OIDC Core 5.3.2): spreading `claims` last protects `sub` itself, but `email` and `groups`
+        // ride the same response and both decide admission, so another subject's response would
+        // satisfy a group gate with somebody else's membership. Dropped LOUDLY, because the visible
+        // consequence otherwise is a `group_required` refusal blamed on the operator's group names.
+        if (extra && userinfoMatchesSubject(extra, claims))
+            merged = { ...extra, ...claims };
+        else if (extra) {
+            params.logger.warn('sso.userinfo.subject_mismatch', {
+                // Separates a non-conformant provider OMITTING the required claim (an operator fixes which
+                // claims it releases) from a response genuinely describing somebody else (alarming, and a
+                // different conversation). Neither subject value is logged.
+                userinfoHasSub: typeof extra.sub === 'string' && extra.sub.trim() !== '',
+            });
+        }
+    }
+    const { metadata } = await client.provider();
+    return { identity: readSsoIdentity(merged, sso), issuer: metadata.issuer };
+}
+/**
+ * Resolve the canonical user for a verified SSO identity and mint its session.
+ *
+ * The subject is `<discovered issuer>#<sub>`, never the email: emails are reassigned inside orgs
+ * and some directories let a user change their own, so keying on one would hand a departed
+ * employee's account to whoever inherits their address.
+ */
+async function establishSession(c, cfg, identity, issuer, trip) {
+    const container = c.get('container');
+    const user = await container.userService.findOrCreateByIdentity('oidc', oidcIdentitySubject(issuer, identity.sub), {
+        name: identity.name,
+        email: identity.email,
+        emailVerified: identity.emailVerified,
+        avatarUrl: identity.avatarUrl,
+        metadata: { issuer, login: identity.login },
+    });
+    await container.accountService.ensurePersonalAccount({
+        id: user.id,
+        login: identity.login,
+        name: user.name,
+    });
+    // An SSO user reached here through the IdP's own app assignment, so an invite is not what
+    // ADMITTED them — it only decides which org they join. Honoured when present (a person invited
+    // by email who then signs in with SSO), and bound to the invited address exactly as every other
+    // provider binds it, so a leaked link cannot pull an arbitrary directory user into an org.
+    if (trip.invite) {
+        const invited = await peekInvite(c, trip.invite);
+        if (invited && emailMatchesInvite(identity.email, invited.email)) {
+            await acceptInvite(c, trip.invite, user.id, user.email);
+        }
+    }
+    const { token } = await mintSession(cfg, sessionUser(user, identity.login));
+    logSignIn(requestLogger(c), user.id, identity, issuer);
+    return token;
+}
+/**
+ * One line per successful SSO sign-in, at INFO.
+ *
+ * Deliberate: an org adopting SSO is doing it to answer "who has access", and a login that leaves
+ * no trace answers nothing. Group memberships are logged as a COUNT rather than a list — the list
+ * is directory data of unbounded size, and its presence or absence is what diagnoses a
+ * `group_required` refusal.
+ */
+function logSignIn(logger, userId, identity, issuer) {
+    logger.info('sso.signed_in', {
+        userId,
+        issuer,
+        login: identity.login,
+        emailVerified: identity.emailVerified,
+        groupCount: identity.groups.length,
+    });
+}
+/**
+ * Verify + single-use the round-trip cookie, and check it against the `state` parameter the IdP
+ * echoed back. Returns null on any mismatch, which the caller reports as `state_invalid`.
+ *
+ * The cookie is deleted whatever the outcome, so one round-trip can be completed exactly once —
+ * which is also what makes a captured callback URL useless on a second visit.
+ */
+async function consumeRoundTrip(c, cfg) {
+    const raw = getCookie(c, SSO_STATE_COOKIE);
+    deleteCookie(c, SSO_STATE_COOKIE, { path: '/auth' });
+    const trip = await new HmacSigner(cfg.sessionSecret).verify(raw, {
+        aud: TOKEN_AUDIENCE.ssoState,
+    });
+    if (!isCompleteRoundTrip(trip))
+        return null;
+    const state = c.req.query('state');
+    if (!state || state !== trip.nonce)
+        return null;
+    return trip;
+}
+/**
+ * Whether a verified cookie payload actually carries the round-trip this leg needs.
+ *
+ * `HmacSigner.verify` proves THIS deployment signed the value and pins its audience; neither
+ * proves its SHAPE, and the generic parameter is a cast rather than a check. Without this, a
+ * payload missing the two secrets would flow on as `undefined`: a PKCE `code_verifier` of
+ * `"undefined"` in the token form and a nonce compared against `undefined`, both of which a
+ * conformant provider refuses — which is exactly why the check belongs here instead of resting on
+ * one being conformant.
+ */
+function isCompleteRoundTrip(trip) {
+    const present = (value) => typeof value === 'string' && value !== '';
+    return (trip !== null &&
+        present(trip.nonce) &&
+        present(trip.verifier) &&
+        present(trip.idNonce) &&
+        present(trip.redirect));
+}
+//# sourceMappingURL=ssoRoutes.js.map

package/dist/modules/auth/ssoRoutes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssoRoutes.js","sourceRoot":"","sources":["../../../src/modules/auth/ssoRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAGrD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAE3E,OAAO,EACL,UAAU,EACV,aAAa,EACb,cAAc,EACd,gBAAgB,GACjB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,sBAAsB,GACvB,MAAM,2BAA2B,CAAA;AAElC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAGlE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAC5D,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,WAAW,EACX,UAAU,EACV,qBAAqB,EACrB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,SAAS,GACV,MAAM,gBAAgB,CAAA;AAEvB,8EAA8E;AAC9E,sFAAsF;AACtF,EAAE;AACF,gGAAgG;AAChG,+FAA+F;AAC/F,uCAAuC;AACvC,EAAE;AACF,8FAA8F;AAC9F,4FAA4F;AAC5F,4FAA4F;AAC5F,6FAA6F;AAC7F,8FAA8F;AAC9F,yFAAyF;AACzF,gGAAgG;AAChG,iDAAiD;AACjD,EAAE;AACF,kGAAkG;AAClG,kGAAkG;AAClG,2FAA2F;AAC3F,iGAAiG;AACjG,kGAAkG;AAClG,8EAA8E;AAE9E,uFAAuF;AACvF,MAAM,gBAAgB,GAAG,cAAc,CAAA;AAsBvC,SAAS,SAAS,CAAmB,CAAa;IAChD,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;IAC7B,IAAI,CAAC,GAAG;QAAE,gBAAgB,EAAE,CAAA;IAC5B,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAmB,CAAa,EAAE,GAAc;IACrE,IAAI,GAAG,CAAC,WAAW;QAAE,OAAO,GAAG,CAAC,WAAW,CAAA;IAC3C,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,oBAAoB,CAAA;AACzD,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAmB,CAAa,EAAE,GAAc;IAChE,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;IAC/B,OAAO,IAAI,UAAU,CAAC;QACpB,MAAM,EAAE,GAAG;QACX,SAAS,EAAE,IAAI,qBAAqB,CAAC;YACnC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,YAAY;YAC9C,MAAM;SACP,CAAC;QACF,MAAM;KACP,CAAC,CAAA;AACJ,CAAC;AAED,4FAA4F;AAC5F,SAAS,MAAM,CAAC,MAAc,EAAE,MAAsB;IACpD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IAC3B,GAAG,CAAC,IAAI,GAAG,GAAG,sBAAsB,IAAI,MAAM,EAAE,CAAA;IAChD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;AACvB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAiB;IACjD,cAAc,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChD,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;QACzB,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAA;QACxB,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,cAAc,EAAE,CAAA;QACtD,MAAM,IAAI,GAAiB;YACzB,GAAG,EAAE,cAAc,CAAC,QAAQ;YAC5B,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE;YAC1B,QAAQ;YACR,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;YAC5B,QAAQ,EAAE,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC;YACjC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB;SACrC,CAAA;QACD,kBAAkB,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;QAC3F,2FAA2F;QAC3F,8FAA8F;QAC9F,8FAA8F;QAC9F,mBAAmB;QACnB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,YAAY,CAAC;YAC/C,WAAW,EAAE,cAAc,CAAC,CAAC,EAAE,GAAG,CAAC;YACnC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,OAAO;YACnB,aAAa,EAAE,SAAS;SACzB,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnD,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;QACzB,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAA;QACxB,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAC3C,oFAAoF;QACpF,6FAA6F;QAC7F,qEAAqE;QACrE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,SAAS,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACjF,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAA;QAE/D,2FAA2F;QAC3F,4FAA4F;QAC5F,yEAAyE;QACzE,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;YAC7E,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAA;QAC7D,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAChC,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAA;QAEpE,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAChC,IAAI,QAA0D,CAAA;QAC9D,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE;gBAC5C,IAAI;gBACJ,WAAW,EAAE,cAAc,CAAC,CAAC,EAAE,GAAG,CAAC;gBACnC,IAAI;gBACJ,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;aACzB,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0FAA0F;YAC1F,6FAA6F;YAC7F,2FAA2F;YAC3F,wEAAwE;YACxE,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;gBACpC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC1E,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC,CAAA;YAClE,CAAC;YACD,IAAI,CAAC,CAAC,GAAG,YAAY,aAAa,CAAC;gBAAE,MAAM,GAAG,CAAA;YAC9C,0FAA0F;YAC1F,wFAAwF;YACxF,4DAA4D;YAC5D,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;YACnE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;QACtD,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAA;QACrC,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAA;QAE1E,MAAM,SAAS,GAAG,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;QAClD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;YACzF,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;QAC5D,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;QACpE,OAAO,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,eAAe,CAC5B,MAAkB,EAClB,GAAc,EACd,MAAiF;IAEjF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC;QACvC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;KACnC,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE;QACzD,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO;KAC3B,CAAC,CAA4B,CAAA;IAC9B,IAAI,MAAM,GAAG,MAAM,CAAA;IACnB,IAAI,MAAM,CAAC,WAAW,IAAI,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QAC5D,8FAA8F;QAC9F,4FAA4F;QAC5F,mDAAmD;QACnD,EAAE;QACF,0FAA0F;QAC1F,6FAA6F;QAC7F,wFAAwF;QACxF,4FAA4F;QAC5F,4FAA4F;QAC5F,IAAI,KAAK,IAAI,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,MAAM,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,EAAE,CAAA;aAC/E,IAAI,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;gBAClD,2FAA2F;gBAC3F,0FAA0F;gBAC1F,4DAA4D;gBAC5D,cAAc,EAAE,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;aACzE,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAA;IAC5C,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAA;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAC7B,CAAa,EACb,GAAe,EACf,QAAqB,EACrB,MAAc,EACd,IAAkB;IAElB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACpC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,sBAAsB,CAC7D,MAAM,EACN,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,EACzC;QACE,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE;KAC5C,CACF,CAAA;IACD,MAAM,SAAS,CAAC,cAAc,CAAC,qBAAqB,CAAC;QACnD,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC,CAAA;IACF,0FAA0F;IAC1F,+FAA+F;IAC/F,gGAAgG;IAChG,2FAA2F;IAC3F,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QAChD,IAAI,OAAO,IAAI,kBAAkB,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjE,MAAM,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;QACzD,CAAC;IACH,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IAC3E,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IACtD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,SAAS,CAAC,MAAc,EAAE,MAAc,EAAE,QAAqB,EAAE,MAAc;IACtF,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE;QAC3B,MAAM;QACN,MAAM;QACN,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM;KACnC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAC7B,CAAa,EACb,GAAe;IAEf,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAA;IAC1C,YAAY,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;IACpD,MAAM,IAAI,GAAG,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAe,GAAG,EAAE;QAC7E,GAAG,EAAE,cAAc,CAAC,QAAQ;KAC7B,CAAC,CAAA;IACF,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3C,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAClC,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IAC/C,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,mBAAmB,CAAC,IAAyB;IACpD,MAAM,OAAO,GAAG,CAAC,KAAc,EAAW,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAA;IACtF,OAAO,CACL,IAAI,KAAK,IAAI;QACb,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CACvB,CAAA;AACH,CAAC"}

package/dist/modules/localSettings/MothershipConnectController.js

@@ -1,7 +1,7 @@
 import { connectMothershipContract } from '@cat-factory/contracts';
 import { buildHonoRoute } from '@toad-contracts/hono';
 import { Hono } from 'hono';
-import { mintSession } from '../auth/AuthController.js';
+import { mintSession } from '../auth/loginFlow.js';
 import { UnavailableError } from '@cat-factory/kernel';
 /**
  * Local-mode mothership login: `POST /local/mothership/connect`.

package/dist/modules/localSettings/MothershipConnectController.js.map

@@ -1 +1 @@
-{"version":3,"file":"MothershipConnectController.js","sourceRoot":"","sources":["../../../src/modules/localSettings/MothershipConnectController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAA;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,2BAA2B;IACzC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,cAAc,CAAC,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,iBAAiB,CAAA;QACtD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CACxB,sEAAsE,CACvE,CAAA;QACH,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAC/C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,6FAA6F;YAC7F,yEAAyE;YACzE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,CAAA;YAC7D,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,EAClF,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CACnB,CAAA;QACH,CAAC;QACD,6FAA6F;QAC7F,0FAA0F;QAC1F,yFAAyF;QACzF,yFAAyF;QACzF,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,CAAA;QAC1C,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QACxE,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAChF,GAAG,CACJ,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"MothershipConnectController.js","sourceRoot":"","sources":["../../../src/modules/localSettings/MothershipConnectController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAA;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,2BAA2B;IACzC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,cAAc,CAAC,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,iBAAiB,CAAA;QACtD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CACxB,sEAAsE,CACvE,CAAA;QACH,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAC/C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,6FAA6F;YAC7F,yEAAyE;YACzE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,CAAA;YAC7D,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,EAClF,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CACnB,CAAA;QACH,CAAC;QACD,6FAA6F;QAC7F,0FAA0F;QAC1F,yFAAyF;QACzF,yFAAyF;QACzF,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,CAAA;QAC1C,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QACxE,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAChF,GAAG,CACJ,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/server",
-  "version": "0.223.0",
+  "version": "0.224.0",
   "description": "Runtime-neutral HTTP layer for the Agent Architecture Board: the Hono controllers, middleware (auth/authz/CORS/error), request helpers and the gateway seams shared by every deployment facade (Cloudflare Worker, Node service).",
   "repository": {
     "type": "git",
@@ -28,16 +28,17 @@
     "@toad-contracts/hono": "0.3.2",
     "@toad-contracts/valibot": "0.5.0",
     "hono": "^4.13.0",
+    "jose": "^6.2.8",
     "pino": "^10.3.1",
     "valibot": "^1.4.2",
-    "@cat-factory/agents": "0.113.0",
-    "@cat-factory/contracts": "0.246.0",
-    "@cat-factory/integrations": "0.131.0",
-    "@cat-factory/kernel": "0.244.0",
+    "@cat-factory/agents": "0.114.0",
+    "@cat-factory/contracts": "0.247.0",
+    "@cat-factory/integrations": "0.131.1",
+    "@cat-factory/kernel": "0.245.0",
     "@cat-factory/mcp-server": "0.12.0",
-    "@cat-factory/orchestration": "0.213.0",
-    "@cat-factory/prompt-fragments": "0.15.72",
-    "@cat-factory/spend": "0.15.9"
+    "@cat-factory/orchestration": "0.214.0",
+    "@cat-factory/prompt-fragments": "0.15.73",
+    "@cat-factory/spend": "0.15.10"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",