@cat-factory/server 0.241.0 → 0.242.0

package/dist/modules/publicApi/openapiDocument.generated.js.map

@@ -1 +1 @@
-{"version":3,"file":"openapiDocument.generated.js","sourceRoot":"","sources":["../../../src/modules/publicApi/openapiDocument.generated.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,EAAE;AACF,0FAA0F;AAC1F,8FAA8F;AAC9F,8FAA8F;AAC9F,8EAA8E;AAE9E,MAAM,CAAC,MAAM,YAAY,GAAG,q2hbAAq2hb,CAAA"}
+{"version":3,"file":"openapiDocument.generated.js","sourceRoot":"","sources":["../../../src/modules/publicApi/openapiDocument.generated.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,EAAE;AACF,0FAA0F;AAC1F,8FAA8F;AAC9F,8FAA8F;AAC9F,8EAA8E;AAE9E,MAAM,CAAC,MAAM,YAAY,GAAG,slkbAAslkb,CAAA"}

package/dist/modules/publicApi/taskTypeFields.d.ts

@@ -1,4 +1,4 @@
-import type { CreatePublicTaskInput, PublicTaskType, TaskTypeFields } from '@cat-factory/contracts';
+import type { Block, CreatePublicTaskInput, DescriptorFieldValues, PublicTaskType, TaskTypeFields, UpdateBlockInput } from '@cat-factory/contracts';
 import type { TaskTypeRegistry } from '@cat-factory/kernel';
 /**
  * The catalog for one workspace: the built-in create types, then the deployment's registered custom
@@ -23,4 +23,32 @@ export declare function publicTaskTypeCatalog(registry: TaskTypeRegistry | undef
  * field per round trip against a form it cannot see is the experience this surface exists to avoid.
  */
 export declare function resolveTaskTypeFields(body: CreatePublicTaskInput, registry: TaskTypeRegistry | undefined): TaskTypeFields | undefined;
+/**
+ * Turn a caller's PARTIAL `fields` bag on `PATCH /api/v1/tasks/:taskId` into the internal patch
+ * keys, checked against the same descriptors creation uses.
+ *
+ * The public surface MERGES where the internal one replaces, and the asymmetry is the point: this
+ * API does not serve the bag back (see `updatePublicTaskSchema.fields`), so a replacing patch
+ * would ask a caller to restate values it cannot read. The merge therefore happens HERE, at the
+ * door that offers the ergonomic, and what reaches `updateBlock` is a whole half exactly as the
+ * app's own form sends one. Validation runs on the MERGED bag rather than the fragment, or a type
+ * whose descriptor declares a required field would refuse every patch that does not restate it.
+ *
+ * A built-in type's INTERNAL-only keys (a document's `targetPath`, the per-`DocKind` prose the
+ * public descriptors deliberately omit) are carried through untouched: the caller cannot name
+ * them, and a replace that dropped what it could not see would delete a value the app collected.
+ *
+ * Two things the merge is careful about, both of them cases where "what is stored" is not simply
+ * "what the caller kept":
+ *
+ * - Values the caller did NOT name are not re-judged (`validatePatchedDescriptorFields`). The
+ *   public descriptors for a built-in type are a deliberately NARROWER restatement of
+ *   `taskTypeFieldsSchema` (`stepsToReproduce` is 2000 here against the schema's 4000), so judging
+ *   a stored value by them refuses a patch for something the patch did not do, and refuses every
+ *   later one identically: a task authored in the app with a 2500-character reproduction would be
+ *   permanently un-repairable over the surface that exists to repair it.
+ * - Keys the request SUPERSEDES are dropped before merging rather than merged back in. Today that
+ *   is a `review` task's two spellings of one target; see {@link supersededBuiltinFieldKeys}.
+ */
+export declare function resolveTaskTypeFieldsPatch(block: Block, fields: DescriptorFieldValues, registry: TaskTypeRegistry | undefined): Pick<UpdateBlockInput, 'customTaskTypeFields' | 'builtinTaskTypeFields'>;
 //# sourceMappingURL=taskTypeFields.d.ts.map

package/dist/modules/publicApi/taskTypeFields.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"taskTypeFields.d.ts","sourceRoot":"","sources":["../../../src/modules/publicApi/taskTypeFields.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACV,qBAAqB,EAErB,cAAc,EACd,cAAc,EACf,MAAM,wBAAwB,CAAA;AAE/B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAsB3D;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,EACtC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,GAC9B,cAAc,EAAE,CAyBlB;AAuBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,qBAAqB,EAC3B,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GACrC,cAAc,GAAG,SAAS,CAiC5B"}
+{"version":3,"file":"taskTypeFields.d.ts","sourceRoot":"","sources":["../../../src/modules/publicApi/taskTypeFields.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,KAAK,EACL,qBAAqB,EAErB,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,gBAAgB,EACjB,MAAM,wBAAwB,CAAA;AAE/B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAsB3D;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,EACtC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,GAC9B,cAAc,EAAE,CAyBlB;AAuBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,qBAAqB,EAC3B,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GACrC,cAAc,GAAG,SAAS,CA8B5B;AAkDD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GACrC,IAAI,CAAC,gBAAgB,EAAE,sBAAsB,GAAG,uBAAuB,CAAC,CAyB1E"}

package/dist/modules/publicApi/taskTypeFields.js

@@ -1,4 +1,4 @@
-import { BUILTIN_CREATE_TASK_TYPES, builtinPublicTaskFields, isBuiltinCreateTaskType, parseBuiltinPublicTaskFields, sanitizeDescriptorFields, validateDescriptorFields, withDescriptorFieldDefaults, } from '@cat-factory/contracts';
+import { BUILTIN_CREATE_TASK_TYPES, builtinPublicTaskFields, isBuiltinCreateTaskType, parseBuiltinPublicTaskFields, sanitizeDescriptorFields, supersededBuiltinFieldKeys, validateDescriptorFields, validatePatchedDescriptorFields, withDescriptorFieldDefaults, } from '@cat-factory/contracts';
 import { ValidationError } from '@cat-factory/kernel';
 // The public API's task-type half: the CATALOG `GET /api/v1/task-types` serves, and the mapping
 // from a caller's `fields` bag onto the internal `taskTypeFields` the board writes.
@@ -110,8 +110,99 @@ export function resolveTaskTypeFields(body, registry) {
     // `prNumber` of `3.7` passed the descriptor and landed on the block as the PR to review.
     const parsed = parseBuiltinPublicTaskFields(sanitized);
     if (!parsed.ok) {
-        throw new ValidationError(`The fields supplied for task type '${taskType}' do not match what it accepts: ${parsed.problems.join(' ')}`, { reason: 'task_type_fields_invalid', problems: parsed.problems });
+        throw refusal(taskType, parsed.problems);
     }
     return parsed.fields;
 }
+/** The ONE refusal shape for a `fields` bag, at either door and for either half. */
+function refusal(taskType, problems) {
+    return new ValidationError(`The fields supplied for task type '${taskType}' do not match what it accepts: ${problems.join(' ')}`, { reason: 'task_type_fields_invalid', problems });
+}
+/**
+ * The values a task's stored bag already carries for the descriptors this type declares, minus the
+ * keys this request SUPERSEDES (see {@link supersededBuiltinFieldKeys}).
+ */
+function storedValuesFor(descriptors, stored, superseded) {
+    const current = {};
+    for (const { key } of descriptors) {
+        const value = stored[key];
+        if (value !== undefined && !superseded.has(key)) {
+            current[key] = value;
+        }
+    }
+    return current;
+}
+/**
+ * The stored built-in keys to carry under a settled patch: everything on the row that is not the
+ * `custom` sub-bag and not superseded.
+ *
+ * The carry-through is what keeps a built-in type's INTERNAL-only keys (a document's `targetPath`,
+ * the per-`DocKind` prose the public descriptors deliberately omit) alive across a patch that
+ * cannot name them. Supersession is the one exception, and it has to be applied HERE as well as to
+ * the validated bag: a `prNumber` dropped from the values but left on the carry-through would be
+ * spread straight back over the caller's `prUrl`, which is the revert this exists to prevent.
+ */
+function carriedBuiltinKeys(stored, superseded) {
+    const carried = {};
+    for (const [key, value] of Object.entries(stored)) {
+        if (key !== 'custom' && !superseded.has(key))
+            carried[key] = value;
+    }
+    return carried;
+}
+/**
+ * Turn a caller's PARTIAL `fields` bag on `PATCH /api/v1/tasks/:taskId` into the internal patch
+ * keys, checked against the same descriptors creation uses.
+ *
+ * The public surface MERGES where the internal one replaces, and the asymmetry is the point: this
+ * API does not serve the bag back (see `updatePublicTaskSchema.fields`), so a replacing patch
+ * would ask a caller to restate values it cannot read. The merge therefore happens HERE, at the
+ * door that offers the ergonomic, and what reaches `updateBlock` is a whole half exactly as the
+ * app's own form sends one. Validation runs on the MERGED bag rather than the fragment, or a type
+ * whose descriptor declares a required field would refuse every patch that does not restate it.
+ *
+ * A built-in type's INTERNAL-only keys (a document's `targetPath`, the per-`DocKind` prose the
+ * public descriptors deliberately omit) are carried through untouched: the caller cannot name
+ * them, and a replace that dropped what it could not see would delete a value the app collected.
+ *
+ * Two things the merge is careful about, both of them cases where "what is stored" is not simply
+ * "what the caller kept":
+ *
+ * - Values the caller did NOT name are not re-judged (`validatePatchedDescriptorFields`). The
+ *   public descriptors for a built-in type are a deliberately NARROWER restatement of
+ *   `taskTypeFieldsSchema` (`stepsToReproduce` is 2000 here against the schema's 4000), so judging
+ *   a stored value by them refuses a patch for something the patch did not do, and refuses every
+ *   later one identically: a task authored in the app with a 2500-character reproduction would be
+ *   permanently un-repairable over the surface that exists to repair it.
+ * - Keys the request SUPERSEDES are dropped before merging rather than merged back in. Today that
+ *   is a `review` task's two spellings of one target; see {@link supersededBuiltinFieldKeys}.
+ */
+export function resolveTaskTypeFieldsPatch(block, fields, registry) {
+    const taskType = block.taskType ?? 'feature';
+    const stored = block.taskTypeFields ?? {};
+    const descriptors = descriptorsFor(taskType, registry);
+    const named = Object.keys(fields);
+    // Nothing to check against (an unregistered namespaced type, or one whose bespoke form owns the
+    // bag): carry the values verbatim, as creation does, merged over what is there.
+    if (!descriptors)
+        return { customTaskTypeFields: { ...stored.custom, ...fields } };
+    const builtin = isBuiltinCreateTaskType(taskType);
+    const superseded = new Set(builtin ? supersededBuiltinFieldKeys(taskType, named) : []);
+    const current = builtin ? storedValuesFor(descriptors, stored, superseded) : (stored.custom ?? {});
+    const merged = withDescriptorFieldDefaults(descriptors, { ...current, ...fields });
+    const problems = validatePatchedDescriptorFields(descriptors, merged, named);
+    if (problems.length > 0)
+        throw refusal(taskType, problems);
+    const sanitized = sanitizeDescriptorFields(descriptors, merged);
+    // A stored CUSTOM key the descriptor no longer declares does not survive: `sanitizeDescriptorFields`
+    // keeps the declared keys only, which is what the internal door writes on every save from the
+    // app's own form, and what `checkCustomFields` (the authority behind that door) would refuse to
+    // accept back. Carrying it here would diverge the two doors and then be rejected one layer down.
+    if (!builtin)
+        return { customTaskTypeFields: sanitized };
+    const parsed = parseBuiltinPublicTaskFields(sanitized);
+    if (!parsed.ok)
+        throw refusal(taskType, parsed.problems);
+    return { builtinTaskTypeFields: { ...carriedBuiltinKeys(stored, superseded), ...parsed.fields } };
+}
 //# sourceMappingURL=taskTypeFields.js.map

package/dist/modules/publicApi/taskTypeFields.js.map

@@ -1 +1 @@
-{"version":3,"file":"taskTypeFields.js","sourceRoot":"","sources":["../../../src/modules/publicApi/taskTypeFields.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,wBAAwB,CAAA;AAO/B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAGrD,gGAAgG;AAChG,oFAAoF;AACpF,EAAE;AACF,6FAA6F;AAC7F,gGAAgG;AAChG,+FAA+F;AAC/F,mGAAmG;AACnG,kGAAkG;AAClG,+BAA+B;AAE/B,4FAA4F;AAC5F,MAAM,cAAc,GAAqC;IACvD,OAAO,EAAE,SAAS;IAClB,GAAG,EAAE,KAAK;IACV,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,qBAAqB;IAC7B,KAAK,EAAE,OAAO;CACf,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAsC,EACtC,UAA+B;IAE/B,MAAM,QAAQ,GAAqB,yBAAyB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC9E,QAAQ;QACR,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,cAAc,CAAC,QAAQ,CAAC,IAAI,QAAQ;QAC3C,MAAM,EAAE,CAAC,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;KAC/C,CAAC,CAAC,CAAA;IACH,MAAM,MAAM,GAAqB,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;SACrD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAChD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACd,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK;QAC9B,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,WAAW;QAC1C,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,0FAA0F;QAC1F,6FAA6F;QAC7F,wFAAwF;QACxF,2FAA2F;QAC3F,2FAA2F;QAC3F,oEAAoE;QACpE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACtD,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjF,CAAC,CAAC,CAAA;IACL,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAA;AACjC,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,cAAc,CACrB,QAAgB,EAChB,QAAsC;IAEtC,IAAI,uBAAuB,CAAC,QAAQ,CAAC;QAAE,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAA;IAC/E,MAAM,UAAU,GAAG,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC1C,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,SAAS;QAAE,OAAO,SAAS,CAAA;IACzD,OAAO,UAAU,CAAC,MAAM,IAAI,EAAE,CAAA;AAChC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAA2B,EAC3B,QAAsC;IAEtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAA;IAC3C,MAAM,WAAW,GAAG,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;IACtD,6FAA6F;IAC7F,gGAAgG;IAChG,+FAA+F;IAC/F,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAC7F,CAAC;IACD,MAAM,MAAM,GAAG,2BAA2B,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;IAC1E,MAAM,QAAQ,GAAG,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;IAC9D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,eAAe,CACvB,sCAAsC,QAAQ,mCAAmC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EACrG,EAAE,MAAM,EAAE,0BAA0B,EAAE,QAAQ,EAAE,CACjD,CAAA;IACH,CAAC;IACD,MAAM,SAAS,GAAG,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;IAC/D,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACzD,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IACpE,+FAA+F;IAC/F,8FAA8F;IAC9F,8FAA8F;IAC9F,4FAA4F;IAC5F,yFAAyF;IACzF,MAAM,MAAM,GAAG,4BAA4B,CAAC,SAAS,CAAC,CAAA;IACtD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CACvB,sCAAsC,QAAQ,mCAAmC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAC5G,EAAE,MAAM,EAAE,0BAA0B,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAClE,CAAA;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAA;AACtB,CAAC"}
+{"version":3,"file":"taskTypeFields.js","sourceRoot":"","sources":["../../../src/modules/publicApi/taskTypeFields.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EACxB,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,wBAAwB,CAAA;AAU/B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAGrD,gGAAgG;AAChG,oFAAoF;AACpF,EAAE;AACF,6FAA6F;AAC7F,gGAAgG;AAChG,+FAA+F;AAC/F,mGAAmG;AACnG,kGAAkG;AAClG,+BAA+B;AAE/B,4FAA4F;AAC5F,MAAM,cAAc,GAAqC;IACvD,OAAO,EAAE,SAAS;IAClB,GAAG,EAAE,KAAK;IACV,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,qBAAqB;IAC7B,KAAK,EAAE,OAAO;CACf,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAsC,EACtC,UAA+B;IAE/B,MAAM,QAAQ,GAAqB,yBAAyB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC9E,QAAQ;QACR,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,cAAc,CAAC,QAAQ,CAAC,IAAI,QAAQ;QAC3C,MAAM,EAAE,CAAC,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;KAC/C,CAAC,CAAC,CAAA;IACH,MAAM,MAAM,GAAqB,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;SACrD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAChD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACd,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK;QAC9B,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,WAAW;QAC1C,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,0FAA0F;QAC1F,6FAA6F;QAC7F,wFAAwF;QACxF,2FAA2F;QAC3F,2FAA2F;QAC3F,oEAAoE;QACpE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACtD,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjF,CAAC,CAAC,CAAA;IACL,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAA;AACjC,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,cAAc,CACrB,QAAgB,EAChB,QAAsC;IAEtC,IAAI,uBAAuB,CAAC,QAAQ,CAAC;QAAE,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAA;IAC/E,MAAM,UAAU,GAAG,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC1C,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,SAAS;QAAE,OAAO,SAAS,CAAA;IACzD,OAAO,UAAU,CAAC,MAAM,IAAI,EAAE,CAAA;AAChC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAA2B,EAC3B,QAAsC;IAEtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAA;IAC3C,MAAM,WAAW,GAAG,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;IACtD,6FAA6F;IAC7F,gGAAgG;IAChG,+FAA+F;IAC/F,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAC7F,CAAC;IACD,MAAM,MAAM,GAAG,2BAA2B,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;IAC1E,MAAM,QAAQ,GAAG,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;IAC9D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,eAAe,CACvB,sCAAsC,QAAQ,mCAAmC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EACrG,EAAE,MAAM,EAAE,0BAA0B,EAAE,QAAQ,EAAE,CACjD,CAAA;IACH,CAAC;IACD,MAAM,SAAS,GAAG,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;IAC/D,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACzD,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IACpE,+FAA+F;IAC/F,8FAA8F;IAC9F,8FAA8F;IAC9F,4FAA4F;IAC5F,yFAAyF;IACzF,MAAM,MAAM,GAAG,4BAA4B,CAAC,SAAS,CAAC,CAAA;IACtD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;IAC1C,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAA;AACtB,CAAC;AAED,oFAAoF;AACpF,SAAS,OAAO,CAAC,QAAgB,EAAE,QAAkB;IACnD,OAAO,IAAI,eAAe,CACxB,sCAAsC,QAAQ,mCAAmC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EACrG,EAAE,MAAM,EAAE,0BAA0B,EAAE,QAAQ,EAAE,CACjD,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,WAAuC,EACvC,MAAyC,EACzC,UAA+B;IAE/B,MAAM,OAAO,GAA0B,EAAE,CAAA;IACzC,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QACzB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,GAAG,KAAsC,CAAA;QACvD,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,kBAAkB,CACzB,MAAyC,EACzC,UAA+B;IAE/B,MAAM,OAAO,GAA4B,EAAE,CAAA;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,GAAG,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IACpE,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAY,EACZ,MAA6B,EAC7B,QAAsC;IAEtC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,SAAS,CAAA;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,cAAc,IAAI,EAAE,CAAA;IACzC,MAAM,WAAW,GAAG,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;IACtD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACjC,gGAAgG;IAChG,gFAAgF;IAChF,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,oBAAoB,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,EAAE,CAAA;IAElF,MAAM,OAAO,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAA;IACjD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACtF,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;IAClG,MAAM,MAAM,GAAG,2BAA2B,CAAC,WAAW,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC,CAAA;IAClF,MAAM,QAAQ,GAAG,+BAA+B,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;IAC5E,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;IAC1D,MAAM,SAAS,GAAG,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;IAC/D,qGAAqG;IACrG,8FAA8F;IAC9F,gGAAgG;IAChG,iGAAiG;IACjG,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,CAAA;IAExD,MAAM,MAAM,GAAG,4BAA4B,CAAC,SAAS,CAAC,CAAA;IACtD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;IACxD,OAAO,EAAE,qBAAqB,EAAE,EAAE,GAAG,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,CAAA;AACnG,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/server",
-  "version": "0.241.0",
+  "version": "0.242.0",
   "description": "Runtime-neutral HTTP layer for the Agent Architecture Board: the Hono controllers, middleware (auth/authz/CORS/error), request helpers and the gateway seams shared by every deployment facade (Cloudflare Worker, Node service).",
   "repository": {
     "type": "git",
@@ -31,13 +31,13 @@
     "jose": "^6.2.8",
     "pino": "^10.3.1",
     "valibot": "^1.4.2",
-    "@cat-factory/agents": "0.117.1",
-    "@cat-factory/kernel": "0.262.1",
-    "@cat-factory/integrations": "0.141.1",
+    "@cat-factory/integrations": "0.141.2",
+    "@cat-factory/agents": "0.117.2",
     "@cat-factory/mcp-server": "0.17.0",
-    "@cat-factory/contracts": "0.263.0",
-    "@cat-factory/orchestration": "0.231.0",
-    "@cat-factory/spend": "0.15.29"
+    "@cat-factory/orchestration": "0.232.0",
+    "@cat-factory/contracts": "0.264.0",
+    "@cat-factory/spend": "0.15.30",
+    "@cat-factory/kernel": "0.262.2"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",