@cat-factory/server 0.274.0 → 0.275.0

package/dist/modules/publicApi/openapiDocument.generated.js.map

@@ -1 +1 @@
-{"version":3,"file":"openapiDocument.generated.js","sourceRoot":"","sources":["../../../src/modules/publicApi/openapiDocument.generated.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,EAAE;AACF,0FAA0F;AAC1F,8FAA8F;AAC9F,8FAA8F;AAC9F,8EAA8E;AAE9E,MAAM,CAAC,MAAM,YAAY,GAAG,ui1oBAAui1oB,CAAA"}
+{"version":3,"file":"openapiDocument.generated.js","sourceRoot":"","sources":["../../../src/modules/publicApi/openapiDocument.generated.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,EAAE;AACF,0FAA0F;AAC1F,8FAA8F;AAC9F,8FAA8F;AAC9F,8EAA8E;AAE9E,MAAM,CAAC,MAAM,YAAY,GAAG,4/hqBAA4/hqB,CAAA"}

package/dist/modules/publicApi/personalUnlock.d.ts

@@ -0,0 +1,51 @@
+import type { PublicApiKeyAuth } from '@cat-factory/integrations';
+import type { Context } from 'hono';
+import type { AppEnv } from '../../http/env.js';
+import { type PersonalCredentialOwner } from '../providers/personalCredentialGate.js';
+/** The two inputs the personal-credential gate takes, resolved from a key-authenticated call. */
+export interface PublicPersonalUnlock {
+    /**
+     * The user this key was bound to, or `undefined` for an unbound key (the default). Also the
+     * run's INITIATOR: a bound key's runs are that person's runs, whatever model they resolve to.
+     *
+     * Attributing every run rather than only the ones that need an unlock is deliberate. The
+     * alternative makes a key's own runs attributed or unattributed depending on which model a task
+     * happened to pin, so the same key would produce runs under two different identities, with two
+     * different credential scopes and two different merge-policy roles, and nothing in the request
+     * would say which. One binding, one answer.
+     */
+    user: PersonalCredentialOwner | undefined;
+    /** The `X-Personal-Password` this call carried, if any. Never stored, never logged. */
+    password: string | undefined;
+}
+/**
+ * Resolve what this call may unlock. Both halves are absent for an ordinary key, which is exactly
+ * the pre-binding behaviour: the gate then refuses an individual-usage run as it always did.
+ */
+export declare function personalUnlockFor<E extends AppEnv>(c: Context<E>, auth: PublicApiKeyAuth): PublicPersonalUnlock;
+/**
+ * Whether a `CredentialRequiredError` from the gate should be flattened into the surface's
+ * `409 individual_model_unsupported`, or left to propagate as its own `428 credential_required`.
+ *
+ * The distinction is whether the caller can DO anything about it. An unbound key cannot: no
+ * password would help, so a 428 inviting one is a prompt to nowhere and the flat 409 naming the
+ * unsupported case is the honest answer. A bound key can, and the 428 carries the two things it
+ * needs — which vendor, and whether the password was missing or wrong — so flattening it there
+ * would throw away the only actionable part of the refusal.
+ */
+export declare function unlockIsUnavailable(unlock: PublicPersonalUnlock): boolean;
+/**
+ * The `409` body every public start/retry surface answers when {@link unlockIsUnavailable} holds.
+ *
+ * One factory rather than a literal per route, because a caller that hits this on `POST /jobs`,
+ * again on `POST /tasks/:id/start` and again on `retry` must not be told three different stories
+ * about the same key. The `code` is the machine-readable half and is identical everywhere; only the
+ * remedy tail differs, and it differs because it has to be TRUE: a board task can also be started
+ * by its owner in the app, while a headless job has no board affordance to fall back on, so
+ * offering one there would send an operator looking for a button that does not exist.
+ */
+export declare function individualModelUnsupported(subject: 'task' | 'job'): {
+    code: string;
+    message: string;
+};
+//# sourceMappingURL=personalUnlock.d.ts.map

package/dist/modules/publicApi/personalUnlock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"personalUnlock.d.ts","sourceRoot":"","sources":["../../../src/modules/publicApi/personalUnlock.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AACjE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AACnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,wCAAwC,CAAA;AAY/C,iGAAiG;AACjG,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;;OASG;IACH,IAAI,EAAE,uBAAuB,GAAG,SAAS,CAAA;IACzC,uFAAuF;IACvF,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;CAC7B;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,EAChD,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EACb,IAAI,EAAE,gBAAgB,GACrB,oBAAoB,CAKtB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAEzE;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,GAAG;IACnE,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB,CAWA"}

package/dist/modules/publicApi/personalUnlock.js

@@ -0,0 +1,45 @@
+import { readPersonalPassword, } from '../providers/personalCredentialGate.js';
+/**
+ * Resolve what this call may unlock. Both halves are absent for an ordinary key, which is exactly
+ * the pre-binding behaviour: the gate then refuses an individual-usage run as it always did.
+ */
+export function personalUnlockFor(c, auth) {
+    return {
+        user: auth.actsAsUserId ? { id: auth.actsAsUserId } : undefined,
+        password: readPersonalPassword(c),
+    };
+}
+/**
+ * Whether a `CredentialRequiredError` from the gate should be flattened into the surface's
+ * `409 individual_model_unsupported`, or left to propagate as its own `428 credential_required`.
+ *
+ * The distinction is whether the caller can DO anything about it. An unbound key cannot: no
+ * password would help, so a 428 inviting one is a prompt to nowhere and the flat 409 naming the
+ * unsupported case is the honest answer. A bound key can, and the 428 carries the two things it
+ * needs — which vendor, and whether the password was missing or wrong — so flattening it there
+ * would throw away the only actionable part of the refusal.
+ */
+export function unlockIsUnavailable(unlock) {
+    return unlock.user === undefined;
+}
+/**
+ * The `409` body every public start/retry surface answers when {@link unlockIsUnavailable} holds.
+ *
+ * One factory rather than a literal per route, because a caller that hits this on `POST /jobs`,
+ * again on `POST /tasks/:id/start` and again on `retry` must not be told three different stories
+ * about the same key. The `code` is the machine-readable half and is identical everywhere; only the
+ * remedy tail differs, and it differs because it has to be TRUE: a board task can also be started
+ * by its owner in the app, while a headless job has no board affordance to fall back on, so
+ * offering one there would send an operator looking for a button that does not exist.
+ */
+export function individualModelUnsupported(subject) {
+    const remedy = subject === 'task'
+        ? 'start or retry it from the app, or use a key bound to the subscription owner and send the'
+        : 'use a key bound to the subscription owner and send the';
+    return {
+        code: 'individual_model_unsupported',
+        message: `This ${subject} runs on an individual-usage model that needs a personal-credential ` +
+            `unlock; ${remedy} X-Personal-Password header`,
+    };
+}
+//# sourceMappingURL=personalUnlock.js.map

package/dist/modules/publicApi/personalUnlock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"personalUnlock.js","sourceRoot":"","sources":["../../../src/modules/publicApi/personalUnlock.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,oBAAoB,GAErB,MAAM,wCAAwC,CAAA;AA6B/C;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,CAAa,EACb,IAAsB;IAEtB,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS;QAC/D,QAAQ,EAAE,oBAAoB,CAAC,CAAC,CAAC;KAClC,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA4B;IAC9D,OAAO,MAAM,CAAC,IAAI,KAAK,SAAS,CAAA;AAClC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAuB;IAIhE,MAAM,MAAM,GACV,OAAO,KAAK,MAAM;QAChB,CAAC,CAAC,2FAA2F;QAC7F,CAAC,CAAC,wDAAwD,CAAA;IAC9D,OAAO;QACL,IAAI,EAAE,8BAA8B;QACpC,OAAO,EACL,QAAQ,OAAO,sEAAsE;YACrF,WAAW,MAAM,6BAA6B;KACjD,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/server",
-  "version": "0.274.0",
+  "version": "0.275.0",
   "description": "Runtime-neutral HTTP layer for the Agent Architecture Board: the Hono controllers, middleware (auth/authz/CORS/error), request helpers and the gateway seams shared by every deployment facade (Cloudflare Worker, Node service).",
   "repository": {
     "type": "git",
@@ -31,13 +31,13 @@
     "jose": "^6.2.8",
     "pino": "^10.3.1",
     "valibot": "^1.4.2",
-    "@cat-factory/agents": "0.126.0",
-    "@cat-factory/contracts": "0.297.0",
-    "@cat-factory/integrations": "0.158.0",
-    "@cat-factory/kernel": "0.288.0",
-    "@cat-factory/orchestration": "0.260.0",
-    "@cat-factory/spend": "0.15.73",
-    "@cat-factory/mcp-server": "0.32.0"
+    "@cat-factory/agents": "0.126.1",
+    "@cat-factory/contracts": "0.298.0",
+    "@cat-factory/mcp-server": "0.33.0",
+    "@cat-factory/integrations": "0.159.0",
+    "@cat-factory/kernel": "0.289.0",
+    "@cat-factory/orchestration": "0.260.1",
+    "@cat-factory/spend": "0.15.74"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",