@cat-factory/server 0.6.0

package/dist/modules/webSearch/WebSearchProxyController.js

@@ -0,0 +1,78 @@
+import { Hono } from 'hono';
+import { ContainerSessionService } from '../../containers/ContainerSessionService.js';
+import { logger } from '../../observability/logger.js';
+// The SearXNG-compatible web-search proxy that implementation containers point Pi's
+// `web_search` tool at (rpiv-web-tools, SearXNG provider). It is the seam that keeps a
+// search-provider key out of the container — exactly like the LLM proxy keeps model
+// keys out: the container authenticates with its short-lived, model-locked session
+// token (no provider key), and the facade performs the search server-side under its
+// own key via the `webSearch` gateway.
+//
+// The container reaches it at `${proxyBaseUrl}/web-search`, so the SearXNG client
+// issues `GET ${that}/search?q=...&format=json` with `Authorization: Bearer <token>`.
+// Mounted under `/v1`, which the auth gate treats as public (token-authenticated).
+/** Pull the bearer token from the Authorization header (Pi's SearXNG client sends it). */
+function bearer(header) {
+    if (!header)
+        return null;
+    const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+    return match ? match[1].trim() : null;
+}
+export function webSearchProxyController() {
+    const app = new Hono();
+    // SearXNG's search endpoint shape: `/search?q=...&format=json`. We always answer
+    // JSON regardless of the `format` param (the container only ever asks for json).
+    app.get('/v1/web-search/search', async (c) => {
+        const { config, gateways, spendService } = c.get('container');
+        // No upstream wired ⇒ container web search isn't enabled for this deployment.
+        const upstream = gateways.webSearch;
+        if (!upstream) {
+            return c.json({ error: { message: 'Web search is not configured' } }, 503);
+        }
+        const secret = config.auth.sessionSecret;
+        if (!secret) {
+            logger.error({ scope: 'webSearchProxy' }, 'web-search proxy: session secret not configured');
+            return c.json({ error: { message: 'Web search proxy is not configured' } }, 503);
+        }
+        // Same model-locked container token the LLM proxy verifies: only our own per-run
+        // containers can reach the search upstream, and only while their token is valid.
+        const sessions = new ContainerSessionService({ secret });
+        const session = await sessions.verify(bearer(c.req.header('authorization')));
+        if (!session) {
+            logger.warn({ scope: 'webSearchProxy' }, 'web-search proxy: invalid or expired session token');
+            return c.json({ error: { message: 'Invalid or expired session token' } }, 401);
+        }
+        // Budget gate: a run that has exhausted its workspace's spend budget can't keep
+        // spending on searches either (searches cost money on metered providers).
+        if (await spendService.isOverBudget()) {
+            logger.warn({ scope: 'webSearchProxy', workspaceId: session.workspaceId }, 'web-search proxy: spend budget exhausted — refusing search');
+            return c.json({ error: { message: 'Spend budget exhausted' } }, 402);
+        }
+        const query = (c.req.query('q') ?? '').trim();
+        // SearXNG returns an empty result set (not an error) for a blank query.
+        if (!query)
+            return c.json({ query: '', number_of_results: 0, results: [] });
+        const log = logger.child({
+            scope: 'webSearchProxy',
+            workspaceId: session.workspaceId,
+            executionId: session.executionId,
+            agentKind: session.agentKind,
+        });
+        try {
+            const { results } = await upstream.search(query);
+            log.info({ resultCount: results.length }, 'web-search proxy: served search');
+            // Shape the response as SearXNG's `format=json` payload so the extension reads
+            // `results[].{url,title,content}` unchanged.
+            return c.json({ query, number_of_results: results.length, results });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            log.error({ err: message }, 'web-search proxy: upstream search failed');
+            // SearXNG-shaped empty result on failure so the agent degrades gracefully
+            // (no results) instead of the tool hard-erroring mid-run.
+            return c.json({ query, number_of_results: 0, results: [] }, 502);
+        }
+    });
+    return app;
+}
+//# sourceMappingURL=WebSearchProxyController.js.map

package/dist/modules/webSearch/WebSearchProxyController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebSearchProxyController.js","sourceRoot":"","sources":["../../../src/modules/webSearch/WebSearchProxyController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAA;AAErF,OAAO,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAA;AAEtD,oFAAoF;AACpF,uFAAuF;AACvF,oFAAoF;AACpF,mFAAmF;AACnF,oFAAoF;AACpF,uCAAuC;AACvC,EAAE;AACF,kFAAkF;AAClF,sFAAsF;AACtF,mFAAmF;AAEnF,0FAA0F;AAC1F,SAAS,MAAM,CAAC,MAA0B;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IACpD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AACxC,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,iFAAiF;IACjF,iFAAiF;IACjF,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3C,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAE7D,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAA;QACnC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,8BAA8B,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QAC5E,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAA;QACxC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,iDAAiD,CAAC,CAAA;YAC5F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QAClF,CAAC;QAED,iFAAiF;QACjF,iFAAiF;QACjF,MAAM,QAAQ,GAAG,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;QACxD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;QAC5E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,oDAAoD,CAAC,CAAA;YAC9F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kCAAkC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QAChF,CAAC;QAED,gFAAgF;QAChF,0EAA0E;QAC1E,IAAI,MAAM,YAAY,CAAC,YAAY,EAAE,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CACT,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,EAC7D,4DAA4D,CAC7D,CAAA;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QACtE,CAAC;QAED,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QAC7C,wEAAwE;QACxE,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAA;QAE3E,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC;YACvB,KAAK,EAAE,gBAAgB;YACvB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAA;QAEF,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAChD,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,iCAAiC,CAAC,CAAA;YAC5E,+EAA+E;YAC/E,6CAA6C;YAC7C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAChE,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,0CAA0C,CAAC,CAAA;YACvE,0EAA0E;YAC1E,0DAA0D;YAC1D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QAClE,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/modules/webSearch/upstreams.d.ts

@@ -0,0 +1,50 @@
+import type { WebSearchResponse, WebSearchUpstream } from '../../runtime/gateways.js';
+/** Default number of results requested per search. */
+export declare const DEFAULT_WEB_SEARCH_COUNT = 5;
+/**
+ * Brave Search upstream — the default, mirroring what Claude Code uses. The key
+ * (`WEB_SEARCH_BRAVE_API_KEY`) stays on the backend; the container only ever reaches
+ * this proxy with its session token. Maps Brave's `web.results[].{url,title,description}`
+ * onto the normalised `{url,title,content}` shape.
+ */
+export declare class BraveWebSearchUpstream implements WebSearchUpstream {
+    private readonly apiKey;
+    private readonly endpoint;
+    constructor(apiKey: string, endpoint?: string);
+    search(query: string, opts?: {
+        count?: number;
+        signal?: AbortSignal;
+    }): Promise<WebSearchResponse>;
+}
+/**
+ * SearXNG passthrough upstream — an authenticating reverse proxy to a SearXNG
+ * instance the deployment runs (`WEB_SEARCH_SEARXNG_URL`, with an optional bearer
+ * via `WEB_SEARCH_SEARXNG_API_KEY` when it sits behind an auth proxy). Zero vendor
+ * mapping: SearXNG already aggregates real engines and returns the canonical
+ * `results[].{url,title,content}` we pass straight through. Keeps the SearXNG URL +
+ * credential off the sandbox (the container only sees this backend proxy).
+ */
+export declare class SearxngWebSearchUpstream implements WebSearchUpstream {
+    private readonly apiKey?;
+    private readonly base;
+    constructor(baseUrl: string, apiKey?: string | undefined);
+    search(query: string, opts?: {
+        count?: number;
+        signal?: AbortSignal;
+    }): Promise<WebSearchResponse>;
+}
+/**
+ * Build the container web-search upstream from a deployment's environment, or
+ * undefined when none is configured (⇒ container web search stays off; the proxy
+ * route replies 503). Brave wins when its key is set (the recommended path — one
+ * backend key, nothing in the sandbox); else a self-hosted SearXNG the backend
+ * reverse-proxies. These env vars live on the BACKEND (next to the model keys), not
+ * in the container — distinct from the harness's own `BRAVE_SEARCH_API_KEY` /
+ * `SEARXNG_URL` autodetect, which only applies to self-hosted runner-pool containers.
+ */
+export declare function createWebSearchUpstreamFromEnv(env: {
+    WEB_SEARCH_BRAVE_API_KEY?: string;
+    WEB_SEARCH_SEARXNG_URL?: string;
+    WEB_SEARCH_SEARXNG_API_KEY?: string;
+}): WebSearchUpstream | undefined;
+//# sourceMappingURL=upstreams.d.ts.map

package/dist/modules/webSearch/upstreams.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstreams.d.ts","sourceRoot":"","sources":["../../../src/modules/webSearch/upstreams.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAQrF,sDAAsD;AACtD,eAAO,MAAM,wBAAwB,IAAI,CAAA;AAgBzC;;;;;GAKG;AACH,qBAAa,sBAAuB,YAAW,iBAAiB;IAE5D,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAF3B,YACmB,MAAM,EAAE,MAAM,EACd,QAAQ,SAAmD,EAC1E;IAEE,MAAM,CACV,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GAClD,OAAO,CAAC,iBAAiB,CAAC,CAkB5B;CACF;AAOD;;;;;;;GAOG;AACH,qBAAa,wBAAyB,YAAW,iBAAiB;IAI9D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAH1B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAQ;IAC7B,YACE,OAAO,EAAE,MAAM,EACE,MAAM,CAAC,EAAE,MAAM,YAAA,EAGjC;IAEK,MAAM,CACV,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GAClD,OAAO,CAAC,iBAAiB,CAAC,CAuB5B;CACF;AAED;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE;IAClD,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,0BAA0B,CAAC,EAAE,MAAM,CAAA;CACpC,GAAG,iBAAiB,GAAG,SAAS,CAMhC"}

package/dist/modules/webSearch/upstreams.js

@@ -0,0 +1,107 @@
+// Runtime-neutral web-search upstreams for the container search proxy. Each performs
+// the actual search server-side (under the deployment's own provider key) and maps the
+// provider's payload into the normalised SearXNG-style shape the proxy returns. They
+// use only `fetch`, so the SAME implementation serves both facades — the vendor key
+// lives on the backend, never in the sandbox (mirroring the LLM-proxy posture).
+/** Default number of results requested per search. */
+export const DEFAULT_WEB_SEARCH_COUNT = 5;
+/** Hard cap on results so a hostile `count` can't ask an upstream for an unbounded page. */
+const MAX_WEB_SEARCH_COUNT = 20;
+/** Clamp a requested result count into a sane range, falling back to the default. */
+function clampCount(count) {
+    if (!Number.isFinite(count) || (count ?? 0) <= 0)
+        return DEFAULT_WEB_SEARCH_COUNT;
+    return Math.min(Math.floor(count), MAX_WEB_SEARCH_COUNT);
+}
+/**
+ * Brave Search upstream — the default, mirroring what Claude Code uses. The key
+ * (`WEB_SEARCH_BRAVE_API_KEY`) stays on the backend; the container only ever reaches
+ * this proxy with its session token. Maps Brave's `web.results[].{url,title,description}`
+ * onto the normalised `{url,title,content}` shape.
+ */
+export class BraveWebSearchUpstream {
+    apiKey;
+    endpoint;
+    constructor(apiKey, endpoint = 'https://api.search.brave.com/res/v1/web/search') {
+        this.apiKey = apiKey;
+        this.endpoint = endpoint;
+    }
+    async search(query, opts = {}) {
+        const url = new URL(this.endpoint);
+        url.searchParams.set('q', query);
+        url.searchParams.set('count', String(clampCount(opts.count)));
+        const res = await fetch(url, {
+            headers: { accept: 'application/json', 'x-subscription-token': this.apiKey },
+            ...(opts.signal ? { signal: opts.signal } : {}),
+        });
+        if (!res.ok) {
+            throw new Error(`Brave search failed (HTTP ${res.status})`);
+        }
+        const json = (await res.json());
+        const results = (json.web?.results ?? [])
+            .filter((r) => {
+            return typeof r.url === 'string';
+        })
+            .map((r) => ({ url: r.url, title: r.title ?? '', content: r.description ?? '' }));
+        return { query, results };
+    }
+}
+/**
+ * SearXNG passthrough upstream — an authenticating reverse proxy to a SearXNG
+ * instance the deployment runs (`WEB_SEARCH_SEARXNG_URL`, with an optional bearer
+ * via `WEB_SEARCH_SEARXNG_API_KEY` when it sits behind an auth proxy). Zero vendor
+ * mapping: SearXNG already aggregates real engines and returns the canonical
+ * `results[].{url,title,content}` we pass straight through. Keeps the SearXNG URL +
+ * credential off the sandbox (the container only sees this backend proxy).
+ */
+export class SearxngWebSearchUpstream {
+    apiKey;
+    base;
+    constructor(baseUrl, apiKey) {
+        this.apiKey = apiKey;
+        this.base = baseUrl.replace(/\/+$/, '');
+    }
+    async search(query, opts = {}) {
+        const url = new URL(`${this.base}/search`);
+        url.searchParams.set('q', query);
+        url.searchParams.set('format', 'json');
+        const res = await fetch(url, {
+            headers: {
+                accept: 'application/json',
+                ...(this.apiKey ? { authorization: `Bearer ${this.apiKey}` } : {}),
+            },
+            ...(opts.signal ? { signal: opts.signal } : {}),
+        });
+        if (!res.ok) {
+            throw new Error(`SearXNG search failed (HTTP ${res.status})`);
+        }
+        const json = (await res.json());
+        const limit = clampCount(opts.count);
+        const results = (json.results ?? [])
+            .filter((r) => {
+            return typeof r.url === 'string';
+        })
+            .slice(0, limit)
+            .map((r) => ({ url: r.url, title: r.title ?? '', content: r.content ?? '' }));
+        return { query, results };
+    }
+}
+/**
+ * Build the container web-search upstream from a deployment's environment, or
+ * undefined when none is configured (⇒ container web search stays off; the proxy
+ * route replies 503). Brave wins when its key is set (the recommended path — one
+ * backend key, nothing in the sandbox); else a self-hosted SearXNG the backend
+ * reverse-proxies. These env vars live on the BACKEND (next to the model keys), not
+ * in the container — distinct from the harness's own `BRAVE_SEARCH_API_KEY` /
+ * `SEARXNG_URL` autodetect, which only applies to self-hosted runner-pool containers.
+ */
+export function createWebSearchUpstreamFromEnv(env) {
+    const brave = env.WEB_SEARCH_BRAVE_API_KEY?.trim();
+    if (brave)
+        return new BraveWebSearchUpstream(brave);
+    const searxng = env.WEB_SEARCH_SEARXNG_URL?.trim();
+    if (searxng)
+        return new SearxngWebSearchUpstream(searxng, env.WEB_SEARCH_SEARXNG_API_KEY?.trim());
+    return undefined;
+}
+//# sourceMappingURL=upstreams.js.map

package/dist/modules/webSearch/upstreams.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstreams.js","sourceRoot":"","sources":["../../../src/modules/webSearch/upstreams.ts"],"names":[],"mappings":"AAEA,qFAAqF;AACrF,uFAAuF;AACvF,qFAAqF;AACrF,oFAAoF;AACpF,gFAAgF;AAEhF,sDAAsD;AACtD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAEzC,4FAA4F;AAC5F,MAAM,oBAAoB,GAAG,EAAE,CAAA;AAE/B,qFAAqF;AACrF,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,wBAAwB,CAAA;IACjF,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAe,CAAC,EAAE,oBAAoB,CAAC,CAAA;AACpE,CAAC;AAOD;;;;;GAKG;AACH,MAAM,OAAO,sBAAsB;IAEd,MAAM;IACN,QAAQ;IAF3B,YACmB,MAAc,EACd,QAAQ,GAAG,gDAAgD;sBAD3D,MAAM;wBACN,QAAQ;IACxB,CAAC;IAEJ,KAAK,CAAC,MAAM,CACV,KAAa,EACb,IAAI,GAA6C,EAAE;QAEnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAClC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAChC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC7D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,IAAI,CAAC,MAAM,EAAE;YAC5E,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;QAC7D,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAA;QACtD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC;aACtC,MAAM,CAAC,CAAC,CAAC,EAA8D,EAAE;YACxE,OAAO,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAA;QAClC,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;QACnF,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;IAC3B,CAAC;CACF;AAOD;;;;;;;GAOG;AACH,MAAM,OAAO,wBAAwB;IAIhB,MAAM;IAHR,IAAI,CAAQ;IAC7B,YACE,OAAe,EACE,MAAe;sBAAf,MAAM;QAEvB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACzC,CAAC;IAED,KAAK,CAAC,MAAM,CACV,KAAa,EACb,IAAI,GAA6C,EAAE;QAEnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,SAAS,CAAC,CAAA;QAC1C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAChC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QACtC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnE;YACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;QAC/D,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAA;QACxD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpC,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;aACjC,MAAM,CAAC,CAAC,CAAC,EAA0D,EAAE;YACpE,OAAO,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAA;QAClC,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;aACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;QAC/E,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;IAC3B,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,8BAA8B,CAAC,GAI9C;IACC,MAAM,KAAK,GAAG,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAA;IAClD,IAAI,KAAK;QAAE,OAAO,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAA;IACnD,MAAM,OAAO,GAAG,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,CAAA;IAClD,IAAI,OAAO;QAAE,OAAO,IAAI,wBAAwB,CAAC,OAAO,EAAE,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAA;IACjG,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/modules/workspaces/WorkspaceController.d.ts

@@ -0,0 +1,5 @@
+import { Hono } from 'hono';
+import type { AppEnv } from '../../http/env.js';
+/** Board (workspace) lifecycle and full-snapshot retrieval. */
+export declare function workspaceController(): Hono<AppEnv>;
+//# sourceMappingURL=WorkspaceController.d.ts.map

package/dist/modules/workspaces/WorkspaceController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WorkspaceController.d.ts","sourceRoot":"","sources":["../../../src/modules/workspaces/WorkspaceController.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAkC3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAU/C,+DAA+D;AAC/D,wBAAgB,mBAAmB,IAAI,IAAI,CAAC,MAAM,CAAC,CAwIlD"}

package/dist/modules/workspaces/WorkspaceController.js

@@ -0,0 +1,167 @@
+import { createWorkspaceSchema, renameWorkspaceSchema } from '@cat-factory/contracts';
+import { configContributionCatalog } from '@cat-factory/agents';
+import { Hono } from 'hono';
+/**
+ * The agent config-contribution catalog for a snapshot: the descriptors contributed
+ * across every agent kind used by the workspace's pipelines (deduped by id). Static
+ * metadata derived from the agent registry; the board renders the subset whose
+ * owning kind appears in a task's selected pipeline.
+ */
+function snapshotAgentConfigCatalog(snapshot) {
+    const kinds = new Set();
+    for (const pipeline of snapshot.pipelines)
+        for (const kind of pipeline.agentKinds)
+            kinds.add(kind);
+    return configContributionCatalog(kinds);
+}
+/**
+ * The deployment's env-routing defaults as `provider:model` ref strings, so the
+ * model-defaults panel can name the model behind "Deployment default" per kind.
+ * Derived from the shared agents config, so identical across facades.
+ */
+function deploymentModelDefaults(routing) {
+    const ref = (r) => `${r.provider}:${r.model}`;
+    return {
+        default: ref(routing.default.ref),
+        byKind: Object.fromEntries(Object.entries(routing.byKind)
+            .filter((entry) => entry[1] != null)
+            .map(([kind, cfg]) => [kind, ref(cfg.ref)])),
+    };
+}
+import { param } from '../../http/params.js';
+import { jsonBody } from '../../http/validation.js';
+/** The signed-in user, narrowed to what the tenancy layer needs. */
+function accountUser(c) {
+    const user = c.get('user');
+    return user ? { id: user.id, login: user.login, name: user.name } : null;
+}
+/** Board (workspace) lifecycle and full-snapshot retrieval. */
+export function workspaceController() {
+    const app = new Hono();
+    // Boards visible to the signed-in user: those in any account they belong to,
+    // plus any legacy board they personally own. When auth is disabled (`user`
+    // unset) the scope is null → no scoping (every board, dev behaviour).
+    app.get('/workspaces', async (c) => {
+        const container = c.get('container');
+        const user = accountUser(c);
+        if (!user)
+            return c.json(await container.workspaceService.list(null));
+        await container.accountService.ensurePersonalAccount(user);
+        const accountIds = await container.accountService.accessibleAccountIds(user.id);
+        return c.json(await container.workspaceService.list({ accountIds, ownerUserId: user.id }));
+    });
+    app.post('/workspaces', jsonBody(createWorkspaceSchema), async (c) => {
+        const container = c.get('container');
+        const user = accountUser(c);
+        const body = c.req.valid('json');
+        // Resolve the owning account: an explicit one the caller belongs to, else the
+        // caller's personal account; unscoped when there's no signed-in user (dev).
+        let accountId = null;
+        if (user) {
+            if (body.accountId) {
+                // Membership is required — a non-member is told the account doesn't exist.
+                await container.accountService.requireMember(body.accountId, user.id);
+                accountId = body.accountId;
+            }
+            else {
+                accountId = (await container.accountService.ensurePersonalAccount(user)).id;
+            }
+        }
+        else if (body.accountId) {
+            accountId = body.accountId;
+        }
+        const snapshot = await container.workspaceService.create(body, user?.id ?? null, accountId);
+        const spend = await container.spendService.status();
+        return c.json({
+            ...snapshot,
+            spend,
+            agentConfigCatalog: snapshotAgentConfigCatalog(snapshot),
+            deploymentModelDefaults: deploymentModelDefaults(container.config.agents.routing),
+        }, 201);
+    });
+    app.get('/workspaces/:workspaceId', async (c) => {
+        const container = c.get('container');
+        const workspaceId = param(c, 'workspaceId');
+        const snapshot = await container.workspaceService.snapshot(workspaceId);
+        const spend = await container.spendService.status();
+        // Carry bootstrap runs in the snapshot so the board renders a bootstrap's live
+        // progress / failure + retry the moment it loads (no separate, independently
+        // failing fetch). No-op when the bootstrap module isn't configured.
+        const bootstrapJobs = container.bootstrap
+            ? await container.bootstrap.service.listJobs(workspaceId)
+            : undefined;
+        // Open notifications + merge-preset library, so the board renders the inbox,
+        // per-block badges and the task preset picker on load. No-ops when unconfigured.
+        const notifications = container.notifications
+            ? await container.notifications.service.listOpen(workspaceId)
+            : undefined;
+        const mergePresets = container.mergePresets
+            ? await container.mergePresets.service.list(workspaceId)
+            : undefined;
+        // The workspace's per-agent-kind default models, so the board renders the
+        // model-defaults settings on load. No-op when the module isn't configured.
+        const modelDefaults = container.modelDefaults
+            ? await container.modelDefaults.service.get(workspaceId)
+            : undefined;
+        // The workspace's default service-fragment selection, so the board renders the
+        // defaults settings on load. No-op when the module isn't configured.
+        const serviceFragmentDefaults = container.serviceFragmentDefaults
+            ? await container.serviceFragmentDefaults.service.get(workspaceId)
+            : undefined;
+        // The workspace's recurring pipelines + issue-tracker selection, so the board
+        // renders the recurring-task badges and the tracker config on load. No-ops when
+        // the modules aren't configured. Run history is fetched lazily, not here.
+        const recurringPipelines = container.recurring
+            ? await container.recurring.service.list(workspaceId)
+            : undefined;
+        const trackerSettings = container.tracker
+            ? await container.tracker.service.get(workspaceId)
+            : undefined;
+        // The workspace's runtime settings (human-wait escalation threshold + per-service
+        // task limit), so the board renders the settings panel on load. No-op when unconfigured.
+        const settings = container.settings
+            ? await container.settings.service.get(workspaceId)
+            : undefined;
+        // In-org shared services: the workspace's mounts + the org catalog it can mount from
+        // (each catalog service annotated with its mount count for the "Shared" badge).
+        const mounts = container.services
+            ? await container.services.service.listMounts(workspaceId)
+            : undefined;
+        const accountId = container.services
+            ? await container.workspaceService.accountOf(workspaceId)
+            : undefined;
+        const serviceCatalog = container.services && accountId !== undefined
+            ? await container.services.service.listForAccount(accountId)
+            : undefined;
+        return c.json({
+            ...snapshot,
+            spend,
+            ...(bootstrapJobs ? { bootstrapJobs } : {}),
+            ...(notifications ? { notifications } : {}),
+            ...(mergePresets ? { mergePresets } : {}),
+            ...(modelDefaults ? { modelDefaults } : {}),
+            ...(serviceFragmentDefaults ? { serviceFragmentDefaults } : {}),
+            ...(recurringPipelines ? { recurringPipelines } : {}),
+            ...(trackerSettings ? { trackerSettings } : {}),
+            ...(settings ? { settings } : {}),
+            ...(mounts ? { mounts } : {}),
+            ...(serviceCatalog ? { serviceCatalog } : {}),
+            agentConfigCatalog: snapshotAgentConfigCatalog(snapshot),
+            deploymentModelDefaults: deploymentModelDefaults(container.config.agents.routing),
+        });
+    });
+    app.patch('/workspaces/:workspaceId', jsonBody(renameWorkspaceSchema), async (c) => {
+        const body = c.req.valid('json');
+        const workspace = await c.get('container').workspaceService.update(param(c, 'workspaceId'), {
+            ...(body.name !== undefined ? { name: body.name } : {}),
+            ...('description' in body ? { description: body.description } : {}),
+        });
+        return c.json(workspace);
+    });
+    app.delete('/workspaces/:workspaceId', async (c) => {
+        await c.get('container').workspaceService.delete(param(c, 'workspaceId'));
+        return c.body(null, 204);
+    });
+    return app;
+}
+//# sourceMappingURL=WorkspaceController.js.map

package/dist/modules/workspaces/WorkspaceController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WorkspaceController.js","sourceRoot":"","sources":["../../../src/modules/workspaces/WorkspaceController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AACrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAK3B;;;;;GAKG;AACH,SAAS,0BAA0B,CAAC,QAA2B;IAC7D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS;QAAE,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAClG,OAAO,yBAAyB,CAAC,KAAK,CAAC,CAAA;AACzC,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,OAAqB;IACpD,MAAM,GAAG,GAAG,CAAC,CAAW,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,EAAE,CAAA;IACvD,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;QACjC,MAAM,EAAE,MAAM,CAAC,WAAW,CACxB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;aAC3B,MAAM,CAAC,CAAC,KAAK,EAAqD,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;aACtF,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAC9C;KACF,CAAA;AACH,CAAC;AAGD,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAA;AAEnD,oEAAoE;AACpE,SAAS,WAAW,CAAC,CAAkB;IACrC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC1B,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAC1E,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,6EAA6E;IAC7E,2EAA2E;IAC3E,sEAAsE;IACtE,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;QAC3B,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;QACrE,MAAM,SAAS,CAAC,cAAc,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAA;QAC1D,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/E,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;IAC5F,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnE,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAEhC,8EAA8E;QAC9E,4EAA4E;QAC5E,IAAI,SAAS,GAAkB,IAAI,CAAA;QACnC,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,2EAA2E;gBAC3E,MAAM,SAAS,CAAC,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;gBACrE,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;YAC5B,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,CAAC,MAAM,SAAS,CAAC,cAAc,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;YAC7E,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1B,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;QAC5B,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,SAAS,CAAC,CAAA;QAC3F,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,CAAA;QACnD,OAAO,CAAC,CAAC,IAAI,CACX;YACE,GAAG,QAAQ;YACX,KAAK;YACL,kBAAkB,EAAE,0BAA0B,CAAC,QAAQ,CAAC;YACxD,uBAAuB,EAAE,uBAAuB,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;SAClF,EACD,GAAG,CACJ,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAA;QAC3C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACvE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,CAAA;QACnD,+EAA+E;QAC/E,6EAA6E;QAC7E,oEAAoE;QACpE,MAAM,aAAa,GAAG,SAAS,CAAC,SAAS;YACvC,CAAC,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;YACzD,CAAC,CAAC,SAAS,CAAA;QACb,6EAA6E;QAC7E,iFAAiF;QACjF,MAAM,aAAa,GAAG,SAAS,CAAC,aAAa;YAC3C,CAAC,CAAC,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC7D,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY;YACzC,CAAC,CAAC,MAAM,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;YACxD,CAAC,CAAC,SAAS,CAAA;QACb,0EAA0E;QAC1E,2EAA2E;QAC3E,MAAM,aAAa,GAAG,SAAS,CAAC,aAAa;YAC3C,CAAC,CAAC,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YACxD,CAAC,CAAC,SAAS,CAAA;QACb,+EAA+E;QAC/E,qEAAqE;QACrE,MAAM,uBAAuB,GAAG,SAAS,CAAC,uBAAuB;YAC/D,CAAC,CAAC,MAAM,SAAS,CAAC,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YAClE,CAAC,CAAC,SAAS,CAAA;QACb,8EAA8E;QAC9E,gFAAgF;QAChF,0EAA0E;QAC1E,MAAM,kBAAkB,GAAG,SAAS,CAAC,SAAS;YAC5C,CAAC,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;YACrD,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,eAAe,GAAG,SAAS,CAAC,OAAO;YACvC,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YAClD,CAAC,CAAC,SAAS,CAAA;QACb,kFAAkF;QAClF,yFAAyF;QACzF,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ;YACjC,CAAC,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YACnD,CAAC,CAAC,SAAS,CAAA;QACb,qFAAqF;QACrF,gFAAgF;QAChF,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ;YAC/B,CAAC,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC;YAC1D,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ;YAClC,CAAC,CAAC,MAAM,SAAS,CAAC,gBAAgB,CAAC,SAAS,CAAC,WAAW,CAAC;YACzD,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,cAAc,GAClB,SAAS,CAAC,QAAQ,IAAI,SAAS,KAAK,SAAS;YAC3C,CAAC,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC;YAC5D,CAAC,CAAC,SAAS,CAAA;QACf,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,GAAG,QAAQ;YACX,KAAK;YACL,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,kBAAkB,EAAE,0BAA0B,CAAC,QAAQ,CAAC;YACxD,uBAAuB,EAAE,uBAAuB,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;SAClF,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjF,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAChC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE;YAC1F,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,MAAM,CAAC,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjD,MAAM,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAA;QACzE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/observability/logger.d.ts

@@ -0,0 +1,9 @@
+import pino from 'pino';
+/**
+ * Process-wide logger. Prefer `logger.child({ … })` (or pass a `fields` object)
+ * to attach correlation context — workspaceId, executionId, jobId — so a run can
+ * be traced across the request, the workflow and the container.
+ */
+export declare const logger: pino.Logger<never, boolean>;
+export type Logger = typeof logger;
+//# sourceMappingURL=logger.d.ts.map

package/dist/observability/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/observability/logger.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AAoBvB;;;;GAIG;AACH,eAAO,MAAM,MAAM,6BAajB,CAAA;AAEF,MAAM,MAAM,MAAM,GAAG,OAAO,MAAM,CAAA"}

package/dist/observability/logger.js

@@ -0,0 +1,39 @@
+import pino from 'pino';
+// Structured logging shared by every facade. The default pino transport relies on
+// Node worker threads, which workerd doesn't provide, so we use pino's browser API
+// with an explicit per-level `write` that emits one JSON line to the matching
+// `console` method. Both Cloudflare (via `wrangler tail` / Logpush) and a Node
+// process capture `console.*`, so this gives queryable, level-routed structured
+// logs on either runtime.
+const LEVEL = globalThis.LOG_LEVEL ?? 'info';
+function write(level) {
+    return (o) => {
+        const line = JSON.stringify({ level, ...o });
+        if (level === 'error' || level === 'fatal')
+            console.error(line);
+        else if (level === 'warn')
+            console.warn(line);
+        else
+            console.log(line);
+    };
+}
+/**
+ * Process-wide logger. Prefer `logger.child({ … })` (or pass a `fields` object)
+ * to attach correlation context — workspaceId, executionId, jobId — so a run can
+ * be traced across the request, the workflow and the container.
+ */
+export const logger = pino({
+    level: LEVEL,
+    browser: {
+        asObject: true,
+        write: {
+            trace: write('trace'),
+            debug: write('debug'),
+            info: write('info'),
+            warn: write('warn'),
+            error: write('error'),
+            fatal: write('fatal'),
+        },
+    },
+});
+//# sourceMappingURL=logger.js.map

package/dist/observability/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/observability/logger.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AAEvB,kFAAkF;AAClF,mFAAmF;AACnF,8EAA8E;AAC9E,+EAA+E;AAC/E,gFAAgF;AAChF,0BAA0B;AAE1B,MAAM,KAAK,GAAI,UAAqC,CAAC,SAAS,IAAI,MAAM,CAAA;AAExE,SAAS,KAAK,CAAC,KAAa;IAC1B,OAAO,CAAC,CAAS,EAAE,EAAE;QACnB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;QAC5C,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO;YAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;aAC1D,IAAI,KAAK,KAAK,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;;YACxC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,KAAK;IACZ,OAAO,EAAE;QACP,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE;YACL,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;YACrB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;YACrB,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;YACnB,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;YACnB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;YACrB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;SACtB;KACF;CACF,CAAC,CAAA"}

package/dist/persistence/mappers.d.ts

@@ -0,0 +1,101 @@
+import type { BlockPatch } from '@cat-factory/kernel';
+import type { Block, ExecutionInstance, Pipeline, Workspace } from '@cat-factory/contracts';
+export interface WorkspaceRow {
+    id: string;
+    name: string;
+    description?: string | null;
+    created_at: number;
+    account_id: string | null;
+}
+export declare function rowToWorkspace(row: WorkspaceRow): Workspace;
+export interface BlockRow {
+    id: string;
+    title: string;
+    type: string;
+    description: string;
+    pos_x: number;
+    pos_y: number;
+    width: number | null;
+    height: number | null;
+    status: string;
+    progress: number;
+    depends_on: string;
+    execution_id: string | null;
+    level: string;
+    parent_id: string | null;
+    confidence: number | null;
+    module_name: string | null;
+    fragment_ids: string | null;
+    /** Service-level: the service's selected best-practice fragment ids, JSON array. */
+    service_fragment_ids: string | null;
+    model_id: string | null;
+    pull_request: string | null;
+    merge_preset_id: string | null;
+    pipeline_id: string | null;
+    /** Task-level agent-contributed config values, JSON id→value map. */
+    agent_config: string | null;
+    /** Service-level: docker-compose path for the Tester's local infra. */
+    test_compose_path: string | null;
+    /** Service-level: whether the service has no infra dependencies (0/1). */
+    no_infra_dependencies: number | null;
+    /** Service-level: cloud provider the service's jobs run on. */
+    cloud_provider: string | null;
+    /** Service-level: abstract instance size for the service's jobs. */
+    instance_size: string | null;
+    created_by: string | null;
+    responsible_product_user_id: string | null;
+    /** Task-level: the task-estimator's triage (complexity/risk/impact), JSON object. */
+    estimate?: string | null;
+    /** Task-level: the kind of work (feature/bug/document/spike/recurring). */
+    task_type?: string | null;
+    /** Task-level: small per-type form fields (bug severity, spike timebox…), JSON object. */
+    task_type_fields?: string | null;
+}
+export declare function rowToBlock(row: BlockRow): Block;
+/** Full column tuple for inserting a block. */
+export declare function blockInsertValues(block: Block): Record<string, unknown>;
+/** Map a domain patch onto `{ column: value }` pairs for an UPDATE. */
+export declare function blockPatchToColumns(patch: BlockPatch): Record<string, unknown>;
+export interface PipelineRow {
+    id: string;
+    name: string;
+    agent_kinds: string;
+    /** Nullable JSON array of per-step approval gates (migration 0022). */
+    gates: string | null;
+    /** Nullable JSON array of per-step companion quality thresholds (migration 0035). */
+    thresholds?: string | null;
+    /** Nullable JSON array of per-step enable flags (migration 0002). */
+    enabled?: string | null;
+    /** Truthy (1) for the curated built-in catalog templates (migration 0002). */
+    builtin?: number | boolean | null;
+    /** Nullable JSON array of per-step consensus configs (parallel to agent_kinds). */
+    consensus?: string | null;
+    /** Nullable JSON array of per-step estimate gating (migration 0003). */
+    gating?: string | null;
+    /** Nullable JSON array of organizational labels (migration 0003). */
+    labels?: string | null;
+    /** Truthy (1) when the pipeline is archived / hidden from the default view (migration 0003). */
+    archived?: number | boolean | null;
+}
+export declare function rowToPipeline(row: PipelineRow): Pipeline;
+/**
+ * A `kind='execution'` row of the unified `agent_runs` table (migration 0019).
+ * The pipeline shape (pipelineId/Name, steps, currentStep) lives in the `detail`
+ * JSON column; lifecycle/failure are top-level columns shared with bootstrap.
+ */
+export interface ExecutionRow {
+    id: string;
+    block_id: string | null;
+    status: string;
+    /** JSON {pipelineId,pipelineName,steps,currentStep}. */
+    detail: string;
+    error: string | null;
+    /** JSON-encoded AgentFailure; null unless the run failed. */
+    failure: string | null;
+    updated_at: number;
+    workflow_instance_id: string | null;
+}
+export declare function rowToExecution(row: ExecutionRow): ExecutionInstance;
+/** Build the `agent_runs.detail` JSON for an execution instance (shared by both repos). */
+export declare function executionToDetail(instance: ExecutionInstance): string;
+//# sourceMappingURL=mappers.d.ts.map

package/dist/persistence/mappers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mappers.d.ts","sourceRoot":"","sources":["../../src/persistence/mappers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,KAAK,EAGV,KAAK,EAKL,iBAAiB,EAGjB,QAAQ,EAMR,SAAS,EACV,MAAM,wBAAwB,CAAA;AAK/B,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,CAQ3D;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,oFAAoF;IACpF,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,qEAAqE;IACrE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,uEAAuE;IACvE,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,0EAA0E;IAC1E,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,+DAA+D;IAC/D,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,oEAAoE;IACpE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,2BAA2B,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1C,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,0FAA0F;IAC1F,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,QAAQ,GAAG,KAAK,CAuC/C;AAED,+CAA+C;AAC/C,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAwCvE;AAED,uEAAuE;AACvE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA2E9E;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,uEAAuE;IACvE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;IACjC,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,gGAAgG;IAChG,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;CACnC;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,GAAG,QAAQ,CAcxD;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,6DAA6D;IAC7D,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAEtB,UAAU,EAAE,MAAM,CAAA;IAClB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;CACpC;AAwBD,wBAAgB,cAAc,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAoBnE;AAED,2FAA2F;AAC3F,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,CAUrE"}