@cat-factory/server 0.323.0 → 0.324.0

package/dist/modules/publicApi/openapiDocument.generated.js.map

@@ -1 +1 @@
-{"version":3,"file":"openapiDocument.generated.js","sourceRoot":"","sources":["../../../src/modules/publicApi/openapiDocument.generated.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,EAAE;AACF,0FAA0F;AAC1F,8FAA8F;AAC9F,8FAA8F;AAC9F,8EAA8E;AAE9E,MAAM,CAAC,MAAM,YAAY,GAAG,8y9vBAA8y9vB,CAAA"}
+{"version":3,"file":"openapiDocument.generated.js","sourceRoot":"","sources":["../../../src/modules/publicApi/openapiDocument.generated.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,EAAE;AACF,0FAA0F;AAC1F,8FAA8F;AAC9F,8FAA8F;AAC9F,8EAA8E;AAE9E,MAAM,CAAC,MAAM,YAAY,GAAG,i+pwBAAi+pwB,CAAA"}

package/dist/modules/publicApi/taskCreation.d.ts

@@ -8,6 +8,8 @@ export interface PublicTaskCreationDeps {
     taskTypeRegistry: ServerContainer['taskTypeRegistry'];
     tasks: ServerContainer['tasks'];
     documents: ServerContainer['documents'];
+    /** The merged best-practice catalog a named `fragmentIds` is checked against; absent ⇒ a 503. */
+    fragmentLibrary: ServerContainer['fragmentLibrary'];
     logger: Logger;
 }
 /** Read the collaborators this module drives off the request's container. */

package/dist/modules/publicApi/taskCreation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"taskCreation.d.ts","sourceRoot":"","sources":["../../../src/modules/publicApi/taskCreation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAyBxD,4DAA4D;AAC5D,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,eAAe,CAAC,cAAc,CAAC,CAAA;IAC7C,iGAAiG;IACjG,gBAAgB,EAAE,eAAe,CAAC,kBAAkB,CAAC,CAAA;IACrD,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,CAAA;IAC/B,SAAS,EAAE,eAAe,CAAC,WAAW,CAAC,CAAA;IACvC,MAAM,EAAE,MAAM,CAAA;CACf;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,eAAe,GAAG,sBAAsB,CAQnF;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,sBAAsB,EAC5B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,KAAK,CAAC,CAgDhB"}
+{"version":3,"file":"taskCreation.d.ts","sourceRoot":"","sources":["../../../src/modules/publicApi/taskCreation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAsCxD,4DAA4D;AAC5D,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,eAAe,CAAC,cAAc,CAAC,CAAA;IAC7C,iGAAiG;IACjG,gBAAgB,EAAE,eAAe,CAAC,kBAAkB,CAAC,CAAA;IACrD,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,CAAA;IAC/B,SAAS,EAAE,eAAe,CAAC,WAAW,CAAC,CAAA;IACvC,iGAAiG;IACjG,eAAe,EAAE,eAAe,CAAC,iBAAiB,CAAC,CAAA;IACnD,MAAM,EAAE,MAAM,CAAA;CACf;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,eAAe,GAAG,sBAAsB,CASnF;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,sBAAsB,EAC5B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,KAAK,CAAC,CAsDhB"}

package/dist/modules/publicApi/taskCreation.js

@@ -1,5 +1,6 @@
 import { UNATTRIBUTED_BLOCK_EDIT_AUTHORITY } from '@cat-factory/contracts';
 import { releaseUnattachedTask, resolveDocuments } from './documentAttachment.js';
+import { assertFragmentsResolvable } from './fragmentCatalog.js';
 import { resolveTaskTypeFields } from './taskTypeFields.js';
 import { resolveTicket } from './ticketLinkage.js';
 /** Read the collaborators this module drives off the request's container. */
@@ -9,6 +10,7 @@ export function taskCreationDeps(container) {
         taskTypeRegistry: container.taskTypeRegistry,
         tasks: container.tasks,
         documents: container.documents,
+        fragmentLibrary: container.fragmentLibrary,
         logger: container.logger,
     };
 }
@@ -26,19 +28,25 @@ export async function createTaskWithAttachments(deps, workspaceId, serviceId, bo
     // is a pure, deterministic refusal, so it must land ahead of the outbound ticket/document
     // fetches, exactly like the container check below.
     const taskTypeFields = resolveTaskTypeFields(body, deps.taskTypeRegistry);
-    // `modelPresetId` and `riskPolicyId` ride the spread because the public surface spells them
-    // exactly as `AddTaskInput` does, which is the ONE reason a spread is safe here and is pinned by
-    // `blockEditAuthority.coverage.spec.ts`. Whether either id names a real row is `addServiceTask`'s
-    // to refuse, on the service where every other door reaches it too (`presetPinGuard.ts`).
+    // The container is checked before anything is fetched, read per workspace, or written, and
+    // UNCONDITIONALLY, not only when there is an outbound fetch to save. A `serviceId` that names
+    // nothing is the caller's most basic mistake, and every refusal that runs ahead of it answers a
+    // request about a service that does not exist by complaining about something else: a typo'd
+    // path carrying an unknown standard would come back `422 prompt_fragment_not_found`, telling the
+    // integrator its service was fine and sending it to fix the wrong end. `addServiceTask`
+    // re-applies the same rule (it is the one that must hold at the moment of the write); this moves
+    // the cheap, deterministic half of it in front of everything.
+    await deps.boardService.assertTaskContainer(workspaceId, serviceId);
+    // Then the standards: one the workspace does not resolve is refused before anything is fetched
+    // or written. See `fragmentCatalog.ts` for why the run path's "drop a stale id" is the wrong
+    // disposition for a list a caller just named.
+    await assertFragmentsResolvable(deps.fragmentLibrary, workspaceId, body.fragmentIds);
+    // `modelPresetId`, `riskPolicyId` and `fragmentIds` ride the spread because the public surface
+    // spells each exactly as `AddTaskInput` does, which is the ONE reason a spread is safe here and
+    // is pinned by `blockEditAuthority.coverage.spec.ts`. Whether the two PINS name a real row is
+    // `addServiceTask`'s to refuse, on the service where every other door reaches it too
+    // (`presetPinGuard.ts`); the standards were settled a few lines up, at this door.
     const input = { ...rest, ...(taskTypeFields ? { taskTypeFields } : {}) };
-    if (ticket || documents?.length) {
-        // The container is checked FIRST because resolving a ticket or a source document is an
-        // outbound call to the workspace's own tracker/wiki: a bad `serviceId` should be answered by
-        // the 404 it could have had for free, not paid for with a live third-party fetch.
-        // `addServiceTask` re-applies the same rule (it is the one that must hold at the moment of the
-        // write); this only moves the cheap, deterministic half of it in front of the expensive work.
-        await deps.boardService.assertTaskContainer(workspaceId, serviceId);
-    }
     const linkage = ticket ? await resolveTicket(deps, workspaceId, ticket) : null;
     const attachment = documents?.length ? await resolveDocuments(deps, workspaceId, documents) : null;
     // Unattributed by the same reading the headless RUN start gets (ADR 0037): an API key holds

package/dist/modules/publicApi/taskCreation.js.map

@@ -1 +1 @@
-{"version":3,"file":"taskCreation.js","sourceRoot":"","sources":["../../../src/modules/publicApi/taskCreation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,wBAAwB,CAAA;AAI1E,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAgClD,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,SAA0B;IACzD,OAAO;QACL,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;QAC5C,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,MAAM,EAAE,SAAS,CAAC,MAAM;KACzB,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAA4B,EAC5B,WAAmB,EACnB,SAAiB,EACjB,IAA2B;IAE3B,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAA;IAC5D,gGAAgG;IAChG,0FAA0F;IAC1F,mDAAmD;IACnD,MAAM,cAAc,GAAG,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAA;IACzE,4FAA4F;IAC5F,iGAAiG;IACjG,kGAAkG;IAClG,yFAAyF;IACzF,MAAM,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;IACxE,IAAI,MAAM,IAAI,SAAS,EAAE,MAAM,EAAE,CAAC;QAChC,uFAAuF;QACvF,6FAA6F;QAC7F,kFAAkF;QAClF,+FAA+F;QAC/F,8FAA8F;QAC9F,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC9E,MAAM,UAAU,GAAG,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAElG,4FAA4F;IAC5F,+FAA+F;IAC/F,qFAAqF;IACrF,qFAAqF;IACrF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CAClD,WAAW,EACX,SAAS,EACT,KAAK,EACL,iCAAiC,CAClC,CAAA;IAED,IAAI,UAAU,EAAE,CAAC;QACf,0FAA0F;QAC1F,8FAA8F;QAC9F,gEAAgE;QAChE,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,qBAAqB,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;YACxD,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IACD,+FAA+F;IAC/F,wEAAwE;IACxE,IAAI,OAAO;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC1C,OAAO,KAAK,CAAA;AACd,CAAC"}
+{"version":3,"file":"taskCreation.js","sourceRoot":"","sources":["../../../src/modules/publicApi/taskCreation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,wBAAwB,CAAA;AAI1E,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AA8ClD,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,SAA0B;IACzD,OAAO;QACL,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;QAC5C,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,eAAe,EAAE,SAAS,CAAC,eAAe;QAC1C,MAAM,EAAE,SAAS,CAAC,MAAM;KACzB,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAA4B,EAC5B,WAAmB,EACnB,SAAiB,EACjB,IAA2B;IAE3B,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAA;IAC5D,gGAAgG;IAChG,0FAA0F;IAC1F,mDAAmD;IACnD,MAAM,cAAc,GAAG,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAA;IACzE,2FAA2F;IAC3F,8FAA8F;IAC9F,gGAAgG;IAChG,4FAA4F;IAC5F,iGAAiG;IACjG,wFAAwF;IACxF,iGAAiG;IACjG,8DAA8D;IAC9D,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;IACnE,+FAA+F;IAC/F,6FAA6F;IAC7F,8CAA8C;IAC9C,MAAM,yBAAyB,CAAC,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;IACpF,+FAA+F;IAC/F,gGAAgG;IAChG,8FAA8F;IAC9F,qFAAqF;IACrF,kFAAkF;IAClF,MAAM,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;IACxE,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC9E,MAAM,UAAU,GAAG,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAElG,4FAA4F;IAC5F,+FAA+F;IAC/F,qFAAqF;IACrF,qFAAqF;IACrF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CAClD,WAAW,EACX,SAAS,EACT,KAAK,EACL,iCAAiC,CAClC,CAAA;IAED,IAAI,UAAU,EAAE,CAAC;QACf,0FAA0F;QAC1F,8FAA8F;QAC9F,gEAAgE;QAChE,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,qBAAqB,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;YACxD,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IACD,+FAA+F;IAC/F,wEAAwE;IACxE,IAAI,OAAO;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC1C,OAAO,KAAK,CAAA;AACd,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/server",
-  "version": "0.323.0",
+  "version": "0.324.0",
   "description": "Runtime-neutral HTTP layer for the Agent Architecture Board: the Hono controllers, middleware (auth/authz/CORS/error), request helpers and the gateway seams shared by every deployment facade (Cloudflare Worker, Node service).",
   "repository": {
     "type": "git",
@@ -24,13 +24,13 @@
     "access": "public"
   },
   "dependencies": {
-    "@cat-factory/agents": "0.165.0",
-    "@cat-factory/contracts": "0.353.0",
-    "@cat-factory/integrations": "0.173.1",
-    "@cat-factory/kernel": "0.346.1",
-    "@cat-factory/mcp-server": "0.50.0",
-    "@cat-factory/orchestration": "0.311.0",
-    "@cat-factory/spend": "0.21.7",
+    "@cat-factory/agents": "0.166.0",
+    "@cat-factory/contracts": "0.354.0",
+    "@cat-factory/integrations": "0.173.2",
+    "@cat-factory/kernel": "0.346.2",
+    "@cat-factory/mcp-server": "0.51.0",
+    "@cat-factory/orchestration": "0.312.0",
+    "@cat-factory/spend": "0.21.8",
     "@toad-contracts/core": "0.4.0",
     "@toad-contracts/hono": "0.3.2",
     "@toad-contracts/valibot": "0.5.0",