@cat-factory/server 0.248.0 → 0.250.0

package/dist/persistence/secretDelegation.d.ts

@@ -3,8 +3,12 @@ import type { DelegatedSealRef, DelegatedSecretRef, OrgSecretSource, SecretDeleg
 export interface DelegatedUnsealRequest {
     source: OrgSecretSource;
     workspaceId: string;
-    /** Trailing identifier args of the source's declared read (see `SEALED_SECRET_SOURCES`). */
-    key?: (string | null)[];
+    /**
+     * Trailing identifier args of the source's declared read, in declaration order. How many the
+     * source takes is kernel's `ORG_SECRET_KEY_ARITY`, which both halves read: the node builds this
+     * through `orgSecretRef` and the endpoint rejects a list that disagrees.
+     */
+    key?: readonly (string | null)[];
 }
 export interface DelegatedUnsealResponse {
     ok: true;

package/dist/persistence/secretDelegation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secretDelegation.d.ts","sourceRoot":"","sources":["../../src/persistence/secretDelegation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACf,MAAM,qBAAqB,CAAA;AAa5B,iFAAiF;AACjF,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,eAAe,CAAA;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,4FAA4F;IAC5F,GAAG,CAAC,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,IAAI,CAAA;IACR,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,kGAAkG;AAClG,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,eAAe,CAAA;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,IAAI,CAAA;IACR,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAA;IACf,6FAA6F;IAC7F,KAAK,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAA;IACrC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAID;;;;;;;GAOG;AACH,qBAAa,uCAAwC,SAAQ,KAAK;IAChE,YAAY,OAAO,SAA+D,EAGjF;CACF;AAED;;;;;;;;;GASG;AACH,qBAAa,kBAAmB,YAAW,cAAc;IAC3C,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,yBAAyB,EAAI;IAE1D,MAAM,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAWrD;IAEK,IAAI,CAAC,GAAG,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAWpE;YAEa,IAAI;CAqBnB"}
+{"version":3,"file":"secretDelegation.d.ts","sourceRoot":"","sources":["../../src/persistence/secretDelegation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACf,MAAM,qBAAqB,CAAA;AAa5B,iFAAiF;AACjF,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,eAAe,CAAA;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB;;;;OAIG;IACH,GAAG,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;CACjC;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,IAAI,CAAA;IACR,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,kGAAkG;AAClG,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,eAAe,CAAA;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,IAAI,CAAA;IACR,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAA;IACf,6FAA6F;IAC7F,KAAK,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAA;IACrC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAID;;;;;;;GAOG;AACH,qBAAa,uCAAwC,SAAQ,KAAK;IAChE,YAAY,OAAO,SAA+D,EAGjF;CACF;AAED;;;;;;;;;GASG;AACH,qBAAa,kBAAmB,YAAW,cAAc;IAC3C,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,yBAAyB,EAAI;IAE1D,MAAM,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAWrD;IAEK,IAAI,CAAC,GAAG,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAWpE;YAEa,IAAI;CAqBnB"}

package/dist/persistence/secretDelegation.js.map

@@ -1 +1 @@
-{"version":3,"file":"secretDelegation.js","sourceRoot":"","sources":["../../src/persistence/secretDelegation.ts"],"names":[],"mappings":"AAuDA,MAAM,kBAAkB,GAAG,MAAM,CAAA;AAEjC;;;;;;;GAOG;AACH,MAAM,OAAO,uCAAwC,SAAQ,KAAK;IAChE,YAAY,OAAO,GAAG,4DAA4D;QAChF,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,yCAAyC,CAAA;IACvD,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,kBAAkB;IACA,IAAI;IAAjC,YAA6B,IAA+B;oBAA/B,IAAI;IAA8B,CAAC;IAEhE,KAAK,CAAC,MAAM,CAAC,GAAuB;QAClC,MAAM,IAAI,GAA2B;YACnC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrC,CAAA;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAA0B,QAAQ,EAAE,IAAI,CAAC,CAAA;QACpE,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;QACnE,CAAC;QACD,OAAO,GAAG,CAAC,SAAS,CAAA;IACtB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAqB,EAAE,SAAiB;QACjD,MAAM,IAAI,GAAyB;YACjC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,SAAS;SACV,CAAA;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAwB,MAAM,EAAE,IAAI,CAAC,CAAA;QAChE,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;QAChE,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,CAAA;IACrB,CAAC;IAEO,KAAK,CAAC,IAAI,CAAI,KAAwB,EAAE,IAAa;QAC3D,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAA;QACzF,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,uCAAuC,EAAE,CAAA;QAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;QAC9C,MAAM,GAAG,GAAG,MAAM,SAAS,CACzB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,KAAK,EAAE,EACnE;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;YACjF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;SACvE,CACF,CAAA;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,uFAAuF;YACvF,yFAAyF;YACzF,sEAAsE;YACtE,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,qBAAqB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QAC9E,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAA;IAChC,CAAC;CACF"}
+{"version":3,"file":"secretDelegation.js","sourceRoot":"","sources":["../../src/persistence/secretDelegation.ts"],"names":[],"mappings":"AA2DA,MAAM,kBAAkB,GAAG,MAAM,CAAA;AAEjC;;;;;;;GAOG;AACH,MAAM,OAAO,uCAAwC,SAAQ,KAAK;IAChE,YAAY,OAAO,GAAG,4DAA4D;QAChF,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,yCAAyC,CAAA;IACvD,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,kBAAkB;IACA,IAAI;IAAjC,YAA6B,IAA+B;oBAA/B,IAAI;IAA8B,CAAC;IAEhE,KAAK,CAAC,MAAM,CAAC,GAAuB;QAClC,MAAM,IAAI,GAA2B;YACnC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrC,CAAA;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAA0B,QAAQ,EAAE,IAAI,CAAC,CAAA;QACpE,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;QACnE,CAAC;QACD,OAAO,GAAG,CAAC,SAAS,CAAA;IACtB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAqB,EAAE,SAAiB;QACjD,MAAM,IAAI,GAAyB;YACjC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,SAAS;SACV,CAAA;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAwB,MAAM,EAAE,IAAI,CAAC,CAAA;QAChE,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;QAChE,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,CAAA;IACrB,CAAC;IAEO,KAAK,CAAC,IAAI,CAAI,KAAwB,EAAE,IAAa;QAC3D,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAA;QACzF,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,uCAAuC,EAAE,CAAA;QAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;QAC9C,MAAM,GAAG,GAAG,MAAM,SAAS,CACzB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,KAAK,EAAE,EACnE;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;YACjF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;SACvE,CACF,CAAA;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,uFAAuF;YACvF,yFAAyF;YACzF,sEAAsE;YACtE,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,qBAAqB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QAC9E,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAA;IAChC,CAAC;CACF"}

package/dist/secrets/sealedSecretSources.d.ts

@@ -9,13 +9,6 @@ export interface SealedSecretSourceSpec {
      * caller a choice the scope check never saw.
      */
     method: string;
-    /**
-     * How many trailing identifier args the read takes after `workspaceId`. The request's `key` must
-     * supply EXACTLY this many. Arity is part of the shape because the args are spread into the
-     * call, so a short list would read a different row than the caller named (and a long one would
-     * pass an argument the port never declared).
-     */
-    keyArity: number;
     /** The record field holding the sealed envelope. */
     field: string;
     /** The HKDF `info` domain-separation tag the envelope was sealed under. */
@@ -29,12 +22,25 @@ export interface SealedSecretSourceSpec {
  * infrastructure, it probes the monitor), not merely the row.
  */
 export declare const SEALED_SECRET_SOURCES: Record<OrgSecretSource, SealedSecretSourceSpec>;
+/**
+ * A resolved binding: the mothership-side spec plus the source's own name and its declared key
+ * arity, READ from kernel's `ORG_SECRET_KEY_ARITY` rather than restated here.
+ *
+ * Arity belongs to the source, not to this table, and both halves of the delegation need it: the
+ * node to build a well-formed `key`, this endpoint to reject one that disagrees. Kept in one
+ * declaration so the check and the call site cannot drift into disagreeing about a row.
+ */
+export interface SealedSecretSourceBinding extends SealedSecretSourceSpec {
+    source: OrgSecretSource;
+    /** How many trailing args the read takes after `workspaceId`; the request's `key` must match. */
+    keyArity: number;
+}
 /**
  * Look a source up by its wire value. OWN-PROPERTY only, exactly like the persistence allow-list:
  * an attacker-supplied `__proto__` / `constructor` / `toString` must not reach a prototype member
  * and be treated as a spec.
  */
-export declare function sealedSecretSourceSpec(source: unknown): SealedSecretSourceSpec | undefined;
+export declare function sealedSecretSourceSpec(source: unknown): SealedSecretSourceBinding | undefined;
 /** The declared vocabulary, for tests and for the boot-time completeness assertions. */
 export declare const SEALED_SECRET_SOURCE_NAMES: readonly OrgSecretSource[];
 //# sourceMappingURL=sealedSecretSources.d.ts.map

package/dist/secrets/sealedSecretSources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sealedSecretSources.d.ts","sourceRoot":"","sources":["../../src/secrets/sealedSecretSources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAe9E,iFAAiF;AACjF,MAAM,WAAW,sBAAsB;IACrC,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAA;IACZ;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAA;IACb,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAA;IACZ,oFAAoF;IACpF,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAmDjF,CAAA;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,OAAO,GAAG,sBAAsB,GAAG,SAAS,CAI1F;AAED,wFAAwF;AACxF,eAAO,MAAM,0BAA0B,EAAE,SAAS,eAAe,EAAuB,CAAA"}
+{"version":3,"file":"sealedSecretSources.d.ts","sourceRoot":"","sources":["../../src/secrets/sealedSecretSources.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4C,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAepG,iFAAiF;AACjF,MAAM,WAAW,sBAAsB;IACrC,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAA;IACZ;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAA;IACd,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAA;IACb,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAA;IACZ,oFAAoF;IACpF,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAmEjF,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,yBAA0B,SAAQ,sBAAsB;IACvE,MAAM,EAAE,eAAe,CAAA;IACvB,iGAAiG;IACjG,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,OAAO,GAAG,yBAAyB,GAAG,SAAS,CAK7F;AAED,wFAAwF;AACxF,eAAO,MAAM,0BAA0B,EAAE,SAAS,eAAe,EAAuB,CAAA"}

package/dist/secrets/sealedSecretSources.js

@@ -1,4 +1,4 @@
-import { ORG_SECRET_SOURCES } from '@cat-factory/kernel';
+import { ORG_SECRET_KEY_ARITY, ORG_SECRET_SOURCES } from '@cat-factory/kernel';
 /**
  * Every source, bound. Each entry admits ONE org credential to a mothership-mode laptop, so the
  * bar for adding one is that a run genuinely needs the PLAINTEXT on the node (it provisions the
@@ -10,7 +10,6 @@ export const SEALED_SECRET_SOURCES = {
     environment_access: {
         repo: 'environmentRegistryRepository',
         method: 'get',
-        keyArity: 1,
         field: 'accessCipher',
         info: 'cat-factory:environments',
         label: 'environment access handle',
@@ -20,7 +19,6 @@ export const SEALED_SECRET_SOURCES = {
     environment_provision_fields: {
         repo: 'environmentRegistryRepository',
         method: 'get',
-        keyArity: 1,
         field: 'provisionFieldsCipher',
         info: 'cat-factory:environments',
         label: 'environment provision fields',
@@ -30,7 +28,6 @@ export const SEALED_SECRET_SOURCES = {
     environment_connection: {
         repo: 'environmentConnectionRepository',
         method: 'getByWorkspaceAndType',
-        keyArity: 2,
         field: 'secretsCipher',
         info: 'cat-factory:environments',
         label: 'environment connection secrets',
@@ -40,7 +37,6 @@ export const SEALED_SECRET_SOURCES = {
     observability_connection: {
         repo: 'observabilityConnectionRepository',
         method: 'get',
-        keyArity: 0,
         field: 'credentials',
         info: 'cat-factory:observability',
         label: 'observability connection credentials',
@@ -50,11 +46,31 @@ export const SEALED_SECRET_SOURCES = {
     incident_enrichment_connection: {
         repo: 'incidentEnrichmentConnectionRepository',
         method: 'get',
-        keyArity: 0,
         field: 'credentials',
         info: 'cat-factory:incident-enrichment',
         label: 'incident enrichment credentials',
     },
+    // A workspace's document-source credential bag (a Figma/Confluence/Notion token), keyed by
+    // `source`. The node needs the PLAINTEXT rather than the row: the dispatch-time freshness
+    // refresh authenticates against the source on the run path, and an import is the node's own
+    // outbound call. Until the row carried an envelope at all there was nothing here to name, which
+    // is why this integration was the last one parked off the persistence RPC.
+    document_source_connection: {
+        repo: 'documentConnectionRepository',
+        method: 'getByWorkspace',
+        field: 'credentialsCipher',
+        info: 'cat-factory:documents',
+        label: 'document source credentials',
+    },
+    // The tracker sibling, keyed the same way. Same argument: the `tracker` step files a real
+    // ticket from wherever the run runs.
+    task_source_connection: {
+        repo: 'taskConnectionRepository',
+        method: 'getByWorkspace',
+        field: 'credentialsCipher',
+        info: 'cat-factory:tasks',
+        label: 'task source credentials',
+    },
 };
 /**
  * Look a source up by its wire value. OWN-PROPERTY only, exactly like the persistence allow-list:
@@ -66,7 +82,8 @@ export function sealedSecretSourceSpec(source) {
         return undefined;
     if (!Object.prototype.hasOwnProperty.call(SEALED_SECRET_SOURCES, source))
         return undefined;
-    return SEALED_SECRET_SOURCES[source];
+    const name = source;
+    return { ...SEALED_SECRET_SOURCES[name], source: name, keyArity: ORG_SECRET_KEY_ARITY[name] };
 }
 /** The declared vocabulary, for tests and for the boot-time completeness assertions. */
 export const SEALED_SECRET_SOURCE_NAMES = ORG_SECRET_SOURCES;

package/dist/secrets/sealedSecretSources.js.map

@@ -1 +1 @@
-{"version":3,"file":"sealedSecretSources.js","sourceRoot":"","sources":["../../src/secrets/sealedSecretSources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAwB,MAAM,qBAAqB,CAAA;AAwC9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAoD;IACpF,8FAA8F;IAC9F,oFAAoF;IACpF,kBAAkB,EAAE;QAClB,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,CAAC;QACX,KAAK,EAAE,cAAc;QACrB,IAAI,EAAE,0BAA0B;QAChC,KAAK,EAAE,2BAA2B;KACnC;IACD,6FAA6F;IAC7F,0FAA0F;IAC1F,4BAA4B,EAAE;QAC5B,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,CAAC;QACX,KAAK,EAAE,uBAAuB;QAC9B,IAAI,EAAE,0BAA0B;QAChC,KAAK,EAAE,8BAA8B;KACtC;IACD,yFAAyF;IACzF,+EAA+E;IAC/E,sBAAsB,EAAE;QACtB,IAAI,EAAE,iCAAiC;QACvC,MAAM,EAAE,uBAAuB;QAC/B,QAAQ,EAAE,CAAC;QACX,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,0BAA0B;QAChC,KAAK,EAAE,gCAAgC;KACxC;IACD,6FAA6F;IAC7F,sEAAsE;IACtE,wBAAwB,EAAE;QACxB,IAAI,EAAE,mCAAmC;QACzC,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,CAAC;QACX,KAAK,EAAE,aAAa;QACpB,IAAI,EAAE,2BAA2B;QACjC,KAAK,EAAE,sCAAsC;KAC9C;IACD,4FAA4F;IAC5F,0CAA0C;IAC1C,8BAA8B,EAAE;QAC9B,IAAI,EAAE,wCAAwC;QAC9C,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,CAAC;QACX,KAAK,EAAE,aAAa;QACpB,IAAI,EAAE,iCAAiC;QACvC,KAAK,EAAE,iCAAiC;KACzC;CACF,CAAA;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAe;IACpD,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAChD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC;QAAE,OAAO,SAAS,CAAA;IAC1F,OAAO,qBAAqB,CAAC,MAAyB,CAAC,CAAA;AACzD,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,MAAM,0BAA0B,GAA+B,kBAAkB,CAAA"}
+{"version":3,"file":"sealedSecretSources.js","sourceRoot":"","sources":["../../src/secrets/sealedSecretSources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAwB,MAAM,qBAAqB,CAAA;AAiCpG;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAoD;IACpF,8FAA8F;IAC9F,oFAAoF;IACpF,kBAAkB,EAAE;QAClB,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,KAAK;QACb,KAAK,EAAE,cAAc;QACrB,IAAI,EAAE,0BAA0B;QAChC,KAAK,EAAE,2BAA2B;KACnC;IACD,6FAA6F;IAC7F,0FAA0F;IAC1F,4BAA4B,EAAE;QAC5B,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,KAAK;QACb,KAAK,EAAE,uBAAuB;QAC9B,IAAI,EAAE,0BAA0B;QAChC,KAAK,EAAE,8BAA8B;KACtC;IACD,yFAAyF;IACzF,+EAA+E;IAC/E,sBAAsB,EAAE;QACtB,IAAI,EAAE,iCAAiC;QACvC,MAAM,EAAE,uBAAuB;QAC/B,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,0BAA0B;QAChC,KAAK,EAAE,gCAAgC;KACxC;IACD,6FAA6F;IAC7F,sEAAsE;IACtE,wBAAwB,EAAE;QACxB,IAAI,EAAE,mCAAmC;QACzC,MAAM,EAAE,KAAK;QACb,KAAK,EAAE,aAAa;QACpB,IAAI,EAAE,2BAA2B;QACjC,KAAK,EAAE,sCAAsC;KAC9C;IACD,4FAA4F;IAC5F,0CAA0C;IAC1C,8BAA8B,EAAE;QAC9B,IAAI,EAAE,wCAAwC;QAC9C,MAAM,EAAE,KAAK;QACb,KAAK,EAAE,aAAa;QACpB,IAAI,EAAE,iCAAiC;QACvC,KAAK,EAAE,iCAAiC;KACzC;IACD,2FAA2F;IAC3F,0FAA0F;IAC1F,4FAA4F;IAC5F,gGAAgG;IAChG,2EAA2E;IAC3E,0BAA0B,EAAE;QAC1B,IAAI,EAAE,8BAA8B;QACpC,MAAM,EAAE,gBAAgB;QACxB,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,uBAAuB;QAC7B,KAAK,EAAE,6BAA6B;KACrC;IACD,0FAA0F;IAC1F,qCAAqC;IACrC,sBAAsB,EAAE;QACtB,IAAI,EAAE,0BAA0B;QAChC,MAAM,EAAE,gBAAgB;QACxB,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,yBAAyB;KACjC;CACF,CAAA;AAgBD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAe;IACpD,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAChD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC;QAAE,OAAO,SAAS,CAAA;IAC1F,MAAM,IAAI,GAAG,MAAyB,CAAA;IACtC,OAAO,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAA;AAC/F,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,MAAM,0BAA0B,GAA+B,kBAAkB,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/server",
-  "version": "0.248.0",
+  "version": "0.250.0",
   "description": "Runtime-neutral HTTP layer for the Agent Architecture Board: the Hono controllers, middleware (auth/authz/CORS/error), request helpers and the gateway seams shared by every deployment facade (Cloudflare Worker, Node service).",
   "repository": {
     "type": "git",
@@ -31,13 +31,13 @@
     "jose": "^6.2.8",
     "pino": "^10.3.1",
     "valibot": "^1.4.2",
-    "@cat-factory/contracts": "0.270.0",
-    "@cat-factory/integrations": "0.146.0",
-    "@cat-factory/kernel": "0.268.0",
+    "@cat-factory/agents": "0.117.10",
+    "@cat-factory/contracts": "0.272.0",
+    "@cat-factory/integrations": "0.148.0",
+    "@cat-factory/kernel": "0.270.0",
     "@cat-factory/mcp-server": "0.22.0",
-    "@cat-factory/agents": "0.117.8",
-    "@cat-factory/orchestration": "0.236.0",
-    "@cat-factory/spend": "0.15.36"
+    "@cat-factory/orchestration": "0.238.0",
+    "@cat-factory/spend": "0.15.38"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",