@cat-factory/server 0.6.0

package/dist/agents/RunnerJobClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RunnerJobClient.d.ts","sourceRoot":"","sources":["../../src/agents/RunnerJobClient.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,qBAAqB,EACrB,YAAY,EACZ,aAAa,EACb,eAAe,EAChB,MAAM,qBAAqB,CAAA;AAE5B;;;;;;GAMG;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,eAAe,CAAC,CAAA;AAElG;;;;;;;;;;;GAWG;AACH,qBAAa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAA7C,YAA6B,gBAAgB,EAAE,sBAAsB,EAAI;IAEzE;;;;OAIG;IACG,QAAQ,CACZ,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,EAAE,kBAAkB,EACxB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAGf;IAED,2EAA2E;IACrE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAGrF;IAED;;;;;OAKG;IACG,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAG/E;CACF"}

package/dist/agents/RunnerJobClient.js

@@ -0,0 +1,43 @@
+/**
+ * The shared dispatch → poll → release plumbing every container-backed flow rides
+ * (the implementation executor and the repo bootstrapper today; the scanner next).
+ * Each flow keeps its own "mint tokens + build the harness body" and "map the
+ * runner view into its result" — the parts that genuinely differ — and delegates
+ * the backend-polymorphic transport mechanics here so they are written once.
+ *
+ * It is a thin wrapper over {@link ResolveRunnerTransport}: it resolves the right
+ * backend (Cloudflare container vs. self-hosted pool) for the job's workspace on
+ * every call, then dispatches/polls/releases through it. Stateless, so a caller may
+ * construct one per flow and reuse it across jobs.
+ */
+export class RunnerJobClient {
+    resolveTransport;
+    constructor(resolveTransport) {
+        this.resolveTransport = resolveTransport;
+    }
+    /**
+     * Start (or idempotently re-attach to) job `ref` for `workspaceId`. `kind`
+     * selects the harness endpoint; the Cloudflare backend serves every kind, a
+     * self-hosted pool only `run` (and throws a clear "unsupported" for the rest).
+     */
+    async dispatch(workspaceId, ref, spec, kind, options) {
+        const transport = await this.resolveTransport(workspaceId);
+        await transport.dispatch(ref, spec, kind, options);
+    }
+    /** Poll the job's current state from the same backend it dispatched to. */
+    async poll(workspaceId, ref) {
+        const transport = await this.resolveTransport(workspaceId);
+        return transport.poll(ref);
+    }
+    /**
+     * Reclaim a run's backing runner (for the Cloudflare backend, SIGKILL the per-run
+     * container instead of letting it idle out its sleep timer; for a pool, cancel the
+     * run's in-flight job `ref.jobId`). Best-effort and idempotent: a transport without
+     * `release`, or an already-gone run/job, is a no-op.
+     */
+    async release(workspaceId, ref) {
+        const transport = await this.resolveTransport(workspaceId);
+        await transport.release?.(ref);
+    }
+}
+//# sourceMappingURL=RunnerJobClient.js.map

package/dist/agents/RunnerJobClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RunnerJobClient.js","sourceRoot":"","sources":["../../src/agents/RunnerJobClient.ts"],"names":[],"mappings":"AAiBA;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,eAAe;IACG,gBAAgB;IAA7C,YAA6B,gBAAwC;gCAAxC,gBAAgB;IAA2B,CAAC;IAEzE;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CACZ,WAA+B,EAC/B,GAAiB,EACjB,IAA6B,EAC7B,IAAwB,EACxB,OAA+B;QAE/B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAA;QAC1D,MAAM,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IACpD,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,IAAI,CAAC,WAA+B,EAAE,GAAiB;QAC3D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAA;QAC1D,OAAO,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC5B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,WAA+B,EAAE,GAAiB;QAC9D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAA;QAC1D,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAA;IAChC,CAAC;CACF"}

package/dist/agents/modelProviderResolver.d.ts

@@ -0,0 +1,33 @@
+import { type ProviderRegistry } from '@cat-factory/agents';
+import type { ApiKeyService } from '@cat-factory/integrations';
+import type { LlmTraceSink, ModelProviderResolver } from '@cat-factory/kernel';
+export interface ScopedModelProviderOptions {
+    /**
+     * The direct-provider API-key pool (account/workspace/user scoped). Absent (no
+     * ENCRYPTION_KEY) → no direct providers are configured; only the opt-in registries
+     * (Cloudflare/Bedrock) can resolve, and a direct-provider ref fails clearly.
+     */
+    apiKeys?: ApiKeyService;
+    /** Base URL for a direct provider's API (the OpenAI-compatible vendors need one). */
+    baseUrlFor: (provider: string) => string | undefined;
+    /** Opt-in registries that need no DB key — the Cloudflare lib + Bedrock. */
+    extraRegistries?: ProviderRegistry[];
+    /**
+     * Resolve a user's locally-run model endpoints (Ollama / LM Studio / …) so inline LLM
+     * calls reach them like the proxied path. Keyless by design (the endpoint carries an
+     * optional key), so these register into the per-scope registry directly rather than via
+     * the DB API-key pool. Keyed by the scope's user (the run initiator).
+     */
+    localEndpointsFor?: (userId: string) => Promise<{
+        provider: string;
+        baseUrl: string;
+        apiKey: string | null;
+    }[]>;
+    /** Wrap the scoped provider so inline calls feed the trace sink (Langfuse). */
+    instrument?: {
+        traceSink: LlmTraceSink;
+        recordPrompts?: boolean;
+    };
+}
+export declare function createScopedModelProviderResolver(opts: ScopedModelProviderOptions): ModelProviderResolver;
+//# sourceMappingURL=modelProviderResolver.d.ts.map

package/dist/agents/modelProviderResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"modelProviderResolver.d.ts","sourceRoot":"","sources":["../../src/agents/modelProviderResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,gBAAgB,EAItB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,KAAK,EACV,YAAY,EAEZ,qBAAqB,EAEtB,MAAM,qBAAqB,CAAA;AAa5B,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,OAAO,CAAC,EAAE,aAAa,CAAA;IACvB,qFAAqF;IACrF,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;IACpD,4EAA4E;IAC5E,eAAe,CAAC,EAAE,gBAAgB,EAAE,CAAA;IACpC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,CAClB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC,CAAA;IAC5E,+EAA+E;IAC/E,UAAU,CAAC,EAAE;QAAE,SAAS,EAAE,YAAY,CAAC;QAAC,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAClE;AAED,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,0BAA0B,GAC/B,qBAAqB,CAqCvB"}

package/dist/agents/modelProviderResolver.js

@@ -0,0 +1,48 @@
+import { CompositeModelProvider, InstrumentedModelProvider, anthropicResolver, openAiCompatibleResolver, openAiResolver, } from '@cat-factory/agents';
+export function createScopedModelProviderResolver(opts) {
+    return {
+        async forScope(scope) {
+            const poolOpts = { accountId: scope.accountId, userId: scope.userId };
+            const registry = {};
+            if (opts.apiKeys) {
+                const providers = await opts.apiKeys.configuredProviders(scope.workspaceId, poolOpts);
+                for (const provider of providers) {
+                    const leased = await opts.apiKeys.lease(scope.workspaceId, provider, poolOpts);
+                    registry[provider] = buildDirectResolver(provider, leased.secret, opts.baseUrlFor(provider));
+                }
+            }
+            // The initiating user's locally-run runners (keyless OpenAI-compatible endpoints).
+            if (scope.userId && opts.localEndpointsFor) {
+                for (const ep of await opts.localEndpointsFor(scope.userId)) {
+                    registry[ep.provider] = openAiCompatibleResolver({
+                        name: ep.provider,
+                        apiKey: ep.apiKey || 'local',
+                        baseURL: ep.baseUrl,
+                    });
+                }
+            }
+            const composite = new CompositeModelProvider(registry, ...(opts.extraRegistries ?? []));
+            if (opts.instrument) {
+                return new InstrumentedModelProvider({
+                    inner: composite,
+                    traceSink: opts.instrument.traceSink,
+                    recordPrompts: opts.instrument.recordPrompts,
+                });
+            }
+            return composite;
+        },
+    };
+}
+/** Build the AI-SDK resolver for one direct provider given a leased key + base URL. */
+function buildDirectResolver(provider, apiKey, baseURL) {
+    if (provider === 'openai')
+        return openAiResolver({ apiKey, baseURL });
+    if (provider === 'anthropic')
+        return anthropicResolver({ apiKey, baseURL });
+    // qwen / deepseek / moonshot expose an OpenAI-compatible API and need a base URL.
+    if (!baseURL) {
+        throw new Error(`No base URL configured for OpenAI-compatible provider '${provider}'`);
+    }
+    return openAiCompatibleResolver({ name: provider, apiKey, baseURL });
+}
+//# sourceMappingURL=modelProviderResolver.js.map

package/dist/agents/modelProviderResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"modelProviderResolver.js","sourceRoot":"","sources":["../../src/agents/modelProviderResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EAGzB,iBAAiB,EACjB,wBAAwB,EACxB,cAAc,GACf,MAAM,qBAAqB,CAAA;AA4C5B,MAAM,UAAU,iCAAiC,CAC/C,IAAgC;IAEhC,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,KAAiB;YAC9B,MAAM,QAAQ,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAA;YACrE,MAAM,QAAQ,GAAqB,EAAE,CAAA;YACrC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;gBACrF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;oBACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;oBAC9E,QAAQ,CAAC,QAAQ,CAAC,GAAG,mBAAmB,CACtC,QAAQ,EACR,MAAM,CAAC,MAAM,EACb,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAC1B,CAAA;gBACH,CAAC;YACH,CAAC;YACD,mFAAmF;YACnF,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC3C,KAAK,MAAM,EAAE,IAAI,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC5D,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,wBAAwB,CAAC;wBAC/C,IAAI,EAAE,EAAE,CAAC,QAAQ;wBACjB,MAAM,EAAE,EAAE,CAAC,MAAM,IAAI,OAAO;wBAC5B,OAAO,EAAE,EAAE,CAAC,OAAO;qBACpB,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,sBAAsB,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAA;YACvF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,OAAO,IAAI,yBAAyB,CAAC;oBACnC,KAAK,EAAE,SAAS;oBAChB,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS;oBACpC,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,aAAa;iBAC7C,CAAC,CAAA;YACJ,CAAC;YACD,OAAO,SAAS,CAAA;QAClB,CAAC;KACF,CAAA;AACH,CAAC;AAED,uFAAuF;AACvF,SAAS,mBAAmB,CAC1B,QAAgB,EAChB,MAAc,EACd,OAA2B;IAE3B,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;IACrE,IAAI,QAAQ,KAAK,WAAW;QAAE,OAAO,iBAAiB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;IAC3E,kFAAkF;IAClF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,0DAA0D,QAAQ,GAAG,CAAC,CAAA;IACxF,CAAC;IACD,OAAO,wBAAwB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;AACtE,CAAC"}

package/dist/agents/providerCapabilities.d.ts

@@ -0,0 +1,22 @@
+import type { ApiKeyService, LocalModelEndpointService, PersonalSubscriptionService, ProviderSubscriptionService } from '@cat-factory/integrations';
+import { type ProviderCapabilities } from '@cat-factory/kernel';
+export interface CapabilityServices {
+    apiKeys?: ApiKeyService;
+    subscriptions?: ProviderSubscriptionService;
+    personalSubscriptions?: PersonalSubscriptionService;
+    /** Whether the opt-in Cloudflare Workers AI lib is registered for this deployment. */
+    cloudflareModelsEnabled?: boolean;
+    /**
+     * The deployment's base-URL resolver (the same one the model-provider resolver uses).
+     * OpenAI-compatible providers (everything but `openai`/`anthropic`) cannot resolve
+     * without a base URL — most carry a built-in default, but an operator-hosted gateway
+     * like LiteLLM has none until `LITELLM_BASE_URL` is set. When this resolver is wired, a
+     * configured key for such a provider is treated as selectable ONLY once its base URL
+     * resolves, so the catalog + start guard don't offer a model that fails at dispatch.
+     */
+    baseUrlFor?: (provider: string) => string | null | undefined;
+    /** Per-user locally-run model endpoints (resolved by the requesting/initiating user). */
+    localModelEndpoints?: LocalModelEndpointService;
+}
+export declare function resolveWorkspaceCapabilities(services: CapabilityServices, workspaceId: string, userId?: string | null): Promise<ProviderCapabilities>;
+//# sourceMappingURL=providerCapabilities.d.ts.map

package/dist/agents/providerCapabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerCapabilities.d.ts","sourceRoot":"","sources":["../../src/agents/providerCapabilities.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC5B,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAEL,KAAK,oBAAoB,EAE1B,MAAM,qBAAqB,CAAA;AAM5B,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,aAAa,CAAA;IACvB,aAAa,CAAC,EAAE,2BAA2B,CAAA;IAC3C,qBAAqB,CAAC,EAAE,2BAA2B,CAAA;IACnD,sFAAsF;IACtF,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IAC5D,yFAAyF;IACzF,mBAAmB,CAAC,EAAE,yBAAyB,CAAA;CAChD;AAOD,wBAAsB,4BAA4B,CAChD,QAAQ,EAAE,kBAAkB,EAC5B,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GACrB,OAAO,CAAC,oBAAoB,CAAC,CAoC/B"}

package/dist/agents/providerCapabilities.js

@@ -0,0 +1,43 @@
+import { ALL_SUBSCRIPTION_VENDORS, } from '@cat-factory/kernel';
+// Direct providers whose AI-SDK resolver works without an explicit base URL (the SDK
+// has a built-in default). Every OTHER direct provider is OpenAI-compatible and needs a
+// base URL (see `buildDirectResolver`), so it is unusable until that URL resolves.
+const BASE_URL_OPTIONAL = new Set(['openai', 'anthropic']);
+export async function resolveWorkspaceCapabilities(services, workspaceId, userId) {
+    const configured = services.apiKeys
+        ? await services.apiKeys.configuredProviders(workspaceId, { userId })
+        : [];
+    const baseUrlFor = services.baseUrlFor;
+    const directProviders = new Set(
+    // Drop a key whose provider needs a base URL the deployment hasn't configured: it
+    // would pass the catalog/start guard but throw "No base URL configured" at dispatch.
+    baseUrlFor ? configured.filter((p) => BASE_URL_OPTIONAL.has(p) || !!baseUrlFor(p)) : configured);
+    const subscriptionVendors = new Set();
+    for (const vendor of ALL_SUBSCRIPTION_VENDORS) {
+        const pooled = services.subscriptions
+            ? await services.subscriptions.hasToken(workspaceId, vendor)
+            : false;
+        const personal = !pooled && userId && services.personalSubscriptions
+            ? await services.personalSubscriptions.has(userId, vendor)
+            : false;
+        if (pooled || personal)
+            subscriptionVendors.add(vendor);
+    }
+    // Local runners are per-user: a model is usable when the resolving user has enabled it.
+    // Keyed by the dynamic model id (`"<provider>:<model>"`) so usability is model-granular
+    // (a runner configured but with this model un-enabled must not pass).
+    const localModels = new Set();
+    if (userId && services.localModelEndpoints) {
+        for (const cap of await services.localModelEndpoints.capabilitiesFor(userId)) {
+            for (const model of cap.models)
+                localModels.add(`${cap.provider}:${model}`);
+        }
+    }
+    return {
+        directProviders,
+        subscriptionVendors,
+        cloudflareEnabled: services.cloudflareModelsEnabled ?? false,
+        localModels,
+    };
+}
+//# sourceMappingURL=providerCapabilities.js.map

package/dist/agents/providerCapabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerCapabilities.js","sourceRoot":"","sources":["../../src/agents/providerCapabilities.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,wBAAwB,GAGzB,MAAM,qBAAqB,CAAA;AAyB5B,qFAAqF;AACrF,wFAAwF;AACxF,mFAAmF;AACnF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAA;AAE1D,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,QAA4B,EAC5B,WAAmB,EACnB,MAAsB;IAEtB,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO;QACjC,CAAC,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC;QACrE,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAA;IACtC,MAAM,eAAe,GAAG,IAAI,GAAG;IAC7B,kFAAkF;IAClF,qFAAqF;IACrF,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAChG,CAAA;IACD,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAsB,CAAA;IACzD,KAAK,MAAM,MAAM,IAAI,wBAAwB,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa;YACnC,CAAC,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;YAC5D,CAAC,CAAC,KAAK,CAAA;QACT,MAAM,QAAQ,GACZ,CAAC,MAAM,IAAI,MAAM,IAAI,QAAQ,CAAC,qBAAqB;YACjD,CAAC,CAAC,MAAM,QAAQ,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;YAC1D,CAAC,CAAC,KAAK,CAAA;QACX,IAAI,MAAM,IAAI,QAAQ;YAAE,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACzD,CAAC;IACD,wFAAwF;IACxF,wFAAwF;IACxF,sEAAsE;IACtE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;IACrC,IAAI,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,QAAQ,CAAC,mBAAmB,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7E,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM;gBAAE,WAAW,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAA;QAC7E,CAAC;IACH,CAAC;IACD,OAAO;QACL,eAAe;QACf,mBAAmB;QACnB,iBAAiB,EAAE,QAAQ,CAAC,uBAAuB,IAAI,KAAK;QAC5D,WAAW;KACZ,CAAA;AACH,CAAC"}

package/dist/agents/resolveRepoTarget.d.ts

@@ -0,0 +1,33 @@
+import type { BlockRepository, GitHubInstallationRepository, RepoProjectionRepository, ServiceRepository } from '@cat-factory/kernel';
+import type { ResolveRepoTarget } from './ContainerAgentExecutor.js';
+export interface ResolveRepoTargetDependencies {
+    installationRepository: Pick<GitHubInstallationRepository, 'getByWorkspace'>;
+    repoProjectionRepository: Pick<RepoProjectionRepository, 'list'>;
+    blockRepository: Pick<BlockRepository, 'get'>;
+    /**
+     * Resolves the {@link Service} owning a frame block, used to find which repo a
+     * frame targets AND (for a monorepo) the subdirectory the service pins. Optional:
+     * a facade/test without in-org services wired falls back to the repo-projection
+     * `block_id` link (one whole-repo service per repo, no subdirectory).
+     */
+    serviceRepository?: Pick<ServiceRepository, 'getByFrameBlock'>;
+}
+/**
+ * Resolve the repo linked to a running block's enclosing service, shared verbatim by
+ * both runtime facades (Worker D1 + Node Drizzle/Postgres). Repos are linked at the
+ * service-frame level (see `linkBlock`), but execution runs at the task/module level,
+ * so we walk up the block's ancestry to find the frame's repo.
+ *
+ * There is deliberately NO "first repo" fallback: a workspace can have many repos, and
+ * guessing silently pushes work into the wrong one (this is how a simple-service task
+ * ended up force-pushing to butter-spread). If nothing in the chain is linked we throw
+ * so the misconfiguration surfaces instead of corrupting another repo. Returns null
+ * (rather than throwing) only when GitHub isn't connected at all — no installation, or
+ * no repos projected yet — so an unconfigured workspace degrades cleanly.
+ *
+ * Single-sourcing this here keeps the security-sensitive ancestry walk from drifting
+ * between the two stores (the per-facade conformance suites can't catch a divergence
+ * because each wires its own resolver).
+ */
+export declare function buildResolveRepoTarget(deps: ResolveRepoTargetDependencies): ResolveRepoTarget;
+//# sourceMappingURL=resolveRepoTarget.d.ts.map

package/dist/agents/resolveRepoTarget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveRepoTarget.d.ts","sourceRoot":"","sources":["../../src/agents/resolveRepoTarget.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,4BAA4B,EAC5B,wBAAwB,EACxB,iBAAiB,EAClB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAMpE,MAAM,WAAW,6BAA6B;IAC5C,sBAAsB,EAAE,IAAI,CAAC,4BAA4B,EAAE,gBAAgB,CAAC,CAAA;IAC5E,wBAAwB,EAAE,IAAI,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAA;IAChE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAA;IAC7C;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAA;CAC/D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,6BAA6B,GAAG,iBAAiB,CAmE7F"}

package/dist/agents/resolveRepoTarget.js

@@ -0,0 +1,81 @@
+/**
+ * Resolve the repo linked to a running block's enclosing service, shared verbatim by
+ * both runtime facades (Worker D1 + Node Drizzle/Postgres). Repos are linked at the
+ * service-frame level (see `linkBlock`), but execution runs at the task/module level,
+ * so we walk up the block's ancestry to find the frame's repo.
+ *
+ * There is deliberately NO "first repo" fallback: a workspace can have many repos, and
+ * guessing silently pushes work into the wrong one (this is how a simple-service task
+ * ended up force-pushing to butter-spread). If nothing in the chain is linked we throw
+ * so the misconfiguration surfaces instead of corrupting another repo. Returns null
+ * (rather than throwing) only when GitHub isn't connected at all — no installation, or
+ * no repos projected yet — so an unconfigured workspace degrades cleanly.
+ *
+ * Single-sourcing this here keeps the security-sensitive ancestry walk from drifting
+ * between the two stores (the per-facade conformance suites can't catch a divergence
+ * because each wires its own resolver).
+ */
+export function buildResolveRepoTarget(deps) {
+    const { installationRepository, repoProjectionRepository, blockRepository, serviceRepository } = deps;
+    return async (workspaceId, blockId) => {
+        const installation = await installationRepository.getByWorkspace(workspaceId);
+        if (!installation)
+            return null;
+        const repos = await repoProjectionRepository.list(workspaceId);
+        if (repos.length === 0)
+            return null;
+        const reposByGithubId = new Map(repos.map((r) => [r.githubId, r]));
+        const reposByBlock = new Map(repos.filter((r) => r.blockId).map((r) => [r.blockId, r]));
+        // Walk up the block's ancestry to the enclosing service frame, then resolve its
+        // repo. Two linkage mechanisms, checked in this order at each level:
+        //  1. The account-owned `Service` for the frame (`getByFrameBlock`) → its
+        //     `repoGithubId`. This is the only mechanism that supports a MONOREPO, where
+        //     several frames each own a service pinned to a different subdirectory of the
+        //     SAME repo (the projection's single `block_id` can't express that), and it is
+        //     the only one carrying the per-service `directory`.
+        //  2. The legacy repo-projection `block_id` link (one whole-repo service per repo),
+        //     for frames created before in-org services / without a service wired.
+        // There is deliberately NO "first repo" fallback: a workspace can have many repos,
+        // and guessing silently pushes work into the wrong one. If nothing in the chain is
+        // linked we throw so the misconfiguration surfaces instead of corrupting another repo.
+        let resolved;
+        let cursor = blockId;
+        const seen = new Set();
+        while (cursor && !seen.has(cursor)) {
+            const service = await serviceRepository?.getByFrameBlock(cursor);
+            if (service?.repoGithubId != null) {
+                const repo = reposByGithubId.get(service.repoGithubId);
+                if (repo) {
+                    resolved = { repo, directory: service.directory ?? null };
+                    break;
+                }
+            }
+            const linked = reposByBlock.get(cursor);
+            if (linked) {
+                resolved = { repo: linked, directory: null };
+                break;
+            }
+            seen.add(cursor);
+            const block = await blockRepository.get(workspaceId, cursor);
+            cursor = block?.parentId ?? null;
+        }
+        if (!resolved) {
+            throw new Error(`Block '${blockId}' is not under a service linked to a GitHub repository ` +
+                `(workspace '${workspaceId}'). Link the service frame to its repo so execution ` +
+                `targets the right repository instead of guessing one.`);
+        }
+        const { repo, directory } = resolved;
+        // The subdirectory is fed to agents ONLY when the repo is flagged a monorepo: a
+        // single-service repo's service may carry a stale/irrelevant directory, but its
+        // agents must keep operating on the repo root (the historical behaviour).
+        const serviceDirectory = repo.isMonorepo && directory ? directory : undefined;
+        return {
+            installationId: installation.installationId,
+            owner: repo.owner,
+            name: repo.name,
+            baseBranch: repo.defaultBranch ?? 'main',
+            ...(serviceDirectory ? { serviceDirectory } : {}),
+        };
+    };
+}
+//# sourceMappingURL=resolveRepoTarget.js.map

package/dist/agents/resolveRepoTarget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveRepoTarget.js","sourceRoot":"","sources":["../../src/agents/resolveRepoTarget.ts"],"names":[],"mappings":"AAyBA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAmC;IACxE,MAAM,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,eAAe,EAAE,iBAAiB,EAAE,GAC5F,IAAI,CAAA;IACN,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE;QACpC,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QAC7E,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAA;QAC9B,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC9D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QACnC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAClE,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAiB,EAAE,CAAC,CAAC,CAAC,CACpE,CAAA;QAED,gFAAgF;QAChF,qEAAqE;QACrE,0EAA0E;QAC1E,iFAAiF;QACjF,kFAAkF;QAClF,mFAAmF;QACnF,yDAAyD;QACzD,oFAAoF;QACpF,2EAA2E;QAC3E,mFAAmF;QACnF,mFAAmF;QACnF,uFAAuF;QACvF,IAAI,QAAgF,CAAA;QACpF,IAAI,MAAM,GAAkB,OAAO,CAAA;QACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;QAC9B,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,MAAM,iBAAiB,EAAE,eAAe,CAAC,MAAM,CAAC,CAAA;YAChE,IAAI,OAAO,EAAE,YAAY,IAAI,IAAI,EAAE,CAAC;gBAClC,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;gBACtD,IAAI,IAAI,EAAE,CAAC;oBACT,QAAQ,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI,EAAE,CAAA;oBACzD,MAAK;gBACP,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACvC,IAAI,MAAM,EAAE,CAAC;gBACX,QAAQ,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;gBAC5C,MAAK;YACP,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAChB,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;YAC5D,MAAM,GAAG,KAAK,EAAE,QAAQ,IAAI,IAAI,CAAA;QAClC,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,UAAU,OAAO,yDAAyD;gBACxE,eAAe,WAAW,sDAAsD;gBAChF,uDAAuD,CAC1D,CAAA;QACH,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAA;QACpC,gFAAgF;QAChF,gFAAgF;QAChF,0EAA0E;QAC1E,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;QAC7E,OAAO;YACL,cAAc,EAAE,YAAY,CAAC,cAAc;YAC3C,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU,EAAE,IAAI,CAAC,aAAa,IAAI,MAAM;YACxC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAA;IACH,CAAC,CAAA;AACH,CAAC"}

package/dist/app.d.ts

@@ -0,0 +1,12 @@
+import type { Hono } from 'hono';
+import type { AppEnv } from './http/env.js';
+/**
+ * Mount the runtime-neutral controllers onto a facade's Hono app, preserving the
+ * canonical mount prefixes. A facade (the Cloudflare Worker, the Node service)
+ * creates its own app — adding CORS, the per-request container, the auth gate and
+ * any runtime-specific controllers (events/webhooks/llm-proxy) — then calls this to
+ * mount everything shared. The app's Env may extend {@link AppEnv} with runtime
+ * `Bindings`; the controllers only touch `Variables` (`container`, `user`).
+ */
+export declare function registerCoreControllers<E extends AppEnv>(app: Hono<E>): void;
+//# sourceMappingURL=app.d.ts.map

package/dist/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAChC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AA0C3C;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAuD5E"}

package/dist/app.js

@@ -0,0 +1,102 @@
+import { accountController } from './modules/accounts/AccountController.js';
+import { agentRunController } from './modules/agentRuns/AgentRunController.js';
+import { authController } from './modules/auth/AuthController.js';
+import { boardController } from './modules/board/BoardController.js';
+import { bootstrapController } from './modules/bootstrap/BootstrapController.js';
+import { documentSourceController } from './modules/documents/DocumentSourceController.js';
+import { environmentController } from './modules/environments/EnvironmentController.js';
+import { eventsController } from './modules/events/EventsController.js';
+import { executionController } from './modules/execution/ExecutionController.js';
+import { fragmentLibraryController } from './modules/fragmentLibrary/FragmentLibraryController.js';
+import { githubController } from './modules/github/GitHubController.js';
+import { githubWebhookController } from './modules/github/GitHubWebhookController.js';
+import { llmProxyController } from './modules/llmProxy/LlmProxyController.js';
+import { mergePresetController } from './modules/merge/MergePresetController.js';
+import { workspaceSettingsController } from './modules/settings/WorkspaceSettingsController.js';
+import { releaseHealthController } from './modules/releaseHealth/ReleaseHealthController.js';
+import { modelDefaultsController } from './modules/modelDefaults/ModelDefaultsController.js';
+import { serviceFragmentDefaultsController } from './modules/serviceFragmentDefaults/ServiceFragmentDefaultsController.js';
+import { modelController } from './modules/models/ModelController.js';
+import { notificationController } from './modules/notifications/NotificationController.js';
+import { pipelineController } from './modules/pipelines/PipelineController.js';
+import { promptFragmentController } from './modules/promptFragments/PromptFragmentController.js';
+import { recurringPipelineController } from './modules/recurring/RecurringPipelineController.js';
+import { trackerSettingsController } from './modules/recurring/TrackerSettingsController.js';
+import { requirementReviewController } from './modules/requirements/RequirementReviewController.js';
+import { consensusController } from './modules/consensus/ConsensusController.js';
+import { clarityReviewController } from './modules/clarity/ClarityReviewController.js';
+import { webSearchProxyController } from './modules/webSearch/WebSearchProxyController.js';
+import { runnerPoolController } from './modules/runners/RunnerPoolController.js';
+import { slackController, slackOAuthController } from './modules/slack/SlackController.js';
+import { vendorCredentialController } from './modules/providers/VendorCredentialController.js';
+import { personalSubscriptionController } from './modules/providers/PersonalSubscriptionController.js';
+import { localModelEndpointController } from './modules/localModels/LocalModelEndpointController.js';
+import { userApiKeyController, workspaceApiKeyController, } from './modules/providers/ApiKeyController.js';
+import { serviceMountController } from './modules/services/ServiceMountController.js';
+import { taskSourceController } from './modules/tasks/TaskSourceController.js';
+import { workspaceController } from './modules/workspaces/WorkspaceController.js';
+/**
+ * Mount the runtime-neutral controllers onto a facade's Hono app, preserving the
+ * canonical mount prefixes. A facade (the Cloudflare Worker, the Node service)
+ * creates its own app — adding CORS, the per-request container, the auth gate and
+ * any runtime-specific controllers (events/webhooks/llm-proxy) — then calls this to
+ * mount everything shared. The app's Env may extend {@link AppEnv} with runtime
+ * `Bindings`; the controllers only touch `Variables` (`container`, `user`).
+ */
+export function registerCoreControllers(app) {
+    // OpenAI-compatible LLM proxy for implementation containers (authenticated by a
+    // signed, model-locked container token; upstream/in-process via the llmUpstream gateway).
+    app.route('/', llmProxyController());
+    // SearXNG-compatible web-search proxy for implementation containers (same
+    // model-locked container token; the search runs server-side under the deployment's
+    // own key via the `webSearch` gateway, so no provider key reaches the sandbox). A
+    // no-op 503 when no upstream is wired.
+    app.route('/', webSearchProxyController());
+    // "Login with GitHub" (public; no-op endpoints when auth is unconfigured).
+    app.route('/auth', authController());
+    // Read-only catalogs + account/workspace roots (gated by the facade's auth middleware).
+    app.route('/', promptFragmentController());
+    app.route('/', modelController());
+    app.route('/', accountController());
+    app.route('/', personalSubscriptionController());
+    app.route('/', localModelEndpointController());
+    app.route('/', userApiKeyController());
+    app.route('/accounts/:accountId', fragmentLibraryController('account'));
+    app.route('/', workspaceController());
+    // Real-time WebSocket event stream (self-authenticates via ?ticket=; the facade's
+    // gate bypasses only its exact upgrade shape). The upgrade is delegated to the
+    // facade's realtime gateway.
+    app.route('/', eventsController());
+    // Per-workspace API.
+    app.route('/workspaces/:workspaceId', boardController());
+    app.route('/workspaces/:workspaceId', pipelineController());
+    app.route('/workspaces/:workspaceId', executionController());
+    app.route('/workspaces/:workspaceId', documentSourceController());
+    app.route('/workspaces/:workspaceId', taskSourceController());
+    app.route('/workspaces/:workspaceId', environmentController());
+    app.route('/workspaces/:workspaceId', runnerPoolController());
+    app.route('/workspaces/:workspaceId', vendorCredentialController());
+    app.route('/workspaces/:workspaceId', workspaceApiKeyController());
+    app.route('/workspaces/:workspaceId', bootstrapController());
+    app.route('/workspaces/:workspaceId', agentRunController());
+    app.route('/workspaces/:workspaceId', requirementReviewController());
+    app.route('/workspaces/:workspaceId', consensusController());
+    app.route('/workspaces/:workspaceId', clarityReviewController());
+    app.route('/workspaces/:workspaceId', notificationController());
+    app.route('/workspaces/:workspaceId', mergePresetController());
+    app.route('/workspaces/:workspaceId', workspaceSettingsController());
+    app.route('/workspaces/:workspaceId', releaseHealthController());
+    app.route('/workspaces/:workspaceId', modelDefaultsController());
+    app.route('/workspaces/:workspaceId', serviceFragmentDefaultsController());
+    app.route('/workspaces/:workspaceId', recurringPipelineController());
+    app.route('/workspaces/:workspaceId', trackerSettingsController());
+    app.route('/workspaces/:workspaceId', serviceMountController());
+    app.route('/workspaces/:workspaceId', fragmentLibraryController('workspace'));
+    app.route('/workspaces/:workspaceId', githubController());
+    app.route('/workspaces/:workspaceId', slackController());
+    // GitHub-facing (webhooks + setup callback); not workspace-scoped.
+    app.route('/github', githubWebhookController());
+    // Slack-facing OAuth callback (browser redirect); not workspace-scoped.
+    app.route('/slack', slackOAuthController());
+}
+//# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAA;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAA;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAA;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAA;AACvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAA;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAA;AAClG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAA;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAA;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAA;AAChF,OAAO,EAAE,2BAA2B,EAAE,MAAM,mDAAmD,CAAA;AAC/F,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAA;AAC5F,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAA;AAC5F,OAAO,EAAE,iCAAiC,EAAE,MAAM,wEAAwE,CAAA;AAC1H,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAA;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,mDAAmD,CAAA;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAA;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,uDAAuD,CAAA;AAChG,OAAO,EAAE,2BAA2B,EAAE,MAAM,oDAAoD,CAAA;AAChG,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAA;AAC5F,OAAO,EAAE,2BAA2B,EAAE,MAAM,uDAAuD,CAAA;AACnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAA;AACtF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAA;AAC1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAA;AAChF,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAA;AAC1F,OAAO,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAA;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,uDAAuD,CAAA;AACtG,OAAO,EAAE,4BAA4B,EAAE,MAAM,uDAAuD,CAAA;AACpG,OAAO,EACL,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,yCAAyC,CAAA;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAA;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAA;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAA;AAEjF;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAmB,GAAY;IACpE,gFAAgF;IAChF,0FAA0F;IAC1F,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,kBAAkB,EAAE,CAAC,CAAA;IACpC,0EAA0E;IAC1E,mFAAmF;IACnF,kFAAkF;IAClF,uCAAuC;IACvC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,wBAAwB,EAAE,CAAC,CAAA;IAC1C,2EAA2E;IAC3E,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,CAAA;IACpC,wFAAwF;IACxF,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,wBAAwB,EAAE,CAAC,CAAA;IAC1C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,eAAe,EAAE,CAAC,CAAA;IACjC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAA;IACnC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,8BAA8B,EAAE,CAAC,CAAA;IAChD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,4BAA4B,EAAE,CAAC,CAAA;IAC9C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,EAAE,CAAC,CAAA;IACtC,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,yBAAyB,CAAC,SAAS,CAAC,CAAC,CAAA;IACvE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAA;IACrC,kFAAkF;IAClF,+EAA+E;IAC/E,6BAA6B;IAC7B,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,EAAE,CAAC,CAAA;IAClC,qBAAqB;IACrB,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,eAAe,EAAE,CAAC,CAAA;IACxD,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC3D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAC5D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,wBAAwB,EAAE,CAAC,CAAA;IACjE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,0BAA0B,EAAE,CAAC,CAAA;IACnE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,yBAAyB,EAAE,CAAC,CAAA;IAClE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAC5D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC3D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,2BAA2B,EAAE,CAAC,CAAA;IACpE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAC5D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,uBAAuB,EAAE,CAAC,CAAA;IAChE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,sBAAsB,EAAE,CAAC,CAAA;IAC/D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,2BAA2B,EAAE,CAAC,CAAA;IACpE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,uBAAuB,EAAE,CAAC,CAAA;IAChE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,uBAAuB,EAAE,CAAC,CAAA;IAChE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,iCAAiC,EAAE,CAAC,CAAA;IAC1E,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,2BAA2B,EAAE,CAAC,CAAA;IACpE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,yBAAyB,EAAE,CAAC,CAAA;IAClE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,sBAAsB,EAAE,CAAC,CAAA;IAC/D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAA;IAC7E,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,gBAAgB,EAAE,CAAC,CAAA;IACzD,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,eAAe,EAAE,CAAC,CAAA;IACxD,mEAAmE;IACnE,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,uBAAuB,EAAE,CAAC,CAAA;IAC/C,wEAAwE;IACxE,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,oBAAoB,EAAE,CAAC,CAAA;AAC7C,CAAC"}

package/dist/auth/GitHubOAuth.d.ts

@@ -0,0 +1,39 @@
+export interface GitHubOAuthDependencies {
+    clientId: string;
+    clientSecret: string;
+    /** REST API base (e.g. https://api.github.com), used to read the user. */
+    apiBase: string;
+    /** OAuth host (e.g. https://github.com), used for authorize/token. */
+    oauthBase: string;
+}
+/** The GitHub identity behind an access token (the OAuth provider's subject). */
+export interface GitHubIdentity {
+    /** GitHub numeric user id (stable across renames) — the identity subject. */
+    id: number;
+    login: string;
+    name: string | null;
+    avatarUrl: string | null;
+    email: string | null;
+}
+export declare class GitHubOAuth {
+    private readonly deps;
+    constructor(deps: GitHubOAuthDependencies);
+    /** The github.com URL the browser is sent to in order to authorise. */
+    authorizeUrl(params: {
+        redirectUri: string;
+        state: string;
+        scope?: string;
+    }): string;
+    /** Exchange the callback `code` for a user access token. */
+    exchangeCode(code: string, redirectUri: string): Promise<string>;
+    /** Resolve the authenticated GitHub user behind an access token. */
+    fetchUser(accessToken: string): Promise<GitHubIdentity>;
+    /**
+     * List the orgs the token's user belongs to, as lowercased logins. Requires
+     * the token to carry `read:org` (the login flow requests it only when an org
+     * allowlist is configured) so private memberships are visible. A single page
+     * of up to 100 is read — well beyond any realistic membership count.
+     */
+    fetchUserOrgs(accessToken: string): Promise<string[]>;
+}
+//# sourceMappingURL=GitHubOAuth.d.ts.map

package/dist/auth/GitHubOAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubOAuth.d.ts","sourceRoot":"","sources":["../../src/auth/GitHubOAuth.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAA;IACf,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAA;CAClB;AAgBD,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAMD,qBAAa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,uBAAuB,EAAI;IAE9D,uEAAuE;IACvE,YAAY,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAUnF;IAED,4DAA4D;IACtD,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAqBrE;IAED,oEAAoE;IAC9D,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAkB5D;IAED;;;;;OAKG;IACG,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAY1D;CACF"}

package/dist/auth/GitHubOAuth.js

@@ -0,0 +1,90 @@
+// Minimal GitHub OAuth web-flow client (the user-to-server login flow). Works
+// with either a GitHub App's OAuth credentials or a classic OAuth App — both
+// expose the same `/login/oauth/*` endpoints on github.com and `/user` on the
+// REST API. Built on `fetch` only, so it runs in a plain Workers isolate and in Node.
+const USER_AGENT = 'cat-factory';
+const API_VERSION = '2022-11-28';
+export class GitHubOAuth {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** The github.com URL the browser is sent to in order to authorise. */
+    authorizeUrl(params) {
+        const url = new URL('/login/oauth/authorize', this.deps.oauthBase);
+        url.searchParams.set('client_id', this.deps.clientId);
+        url.searchParams.set('redirect_uri', params.redirectUri);
+        url.searchParams.set('state', params.state);
+        // read:user is enough to identify the signer; harmless for GitHub Apps,
+        // whose effective access is governed by the App's configured permissions.
+        url.searchParams.set('scope', params.scope ?? 'read:user');
+        url.searchParams.set('allow_signup', 'false');
+        return url.toString();
+    }
+    /** Exchange the callback `code` for a user access token. */
+    async exchangeCode(code, redirectUri) {
+        const res = await fetch(new URL('/login/oauth/access_token', this.deps.oauthBase), {
+            method: 'POST',
+            headers: {
+                accept: 'application/json',
+                'content-type': 'application/json',
+                'user-agent': USER_AGENT,
+            },
+            body: JSON.stringify({
+                client_id: this.deps.clientId,
+                client_secret: this.deps.clientSecret,
+                code,
+                redirect_uri: redirectUri,
+            }),
+        });
+        if (!res.ok)
+            throw new Error(`GitHub token exchange failed (HTTP ${res.status})`);
+        const body = (await res.json());
+        if (!body.access_token) {
+            throw new Error(body.error_description || body.error || 'GitHub returned no access token');
+        }
+        return body.access_token;
+    }
+    /** Resolve the authenticated GitHub user behind an access token. */
+    async fetchUser(accessToken) {
+        const res = await fetch(new URL('/user', this.deps.apiBase), {
+            headers: {
+                accept: 'application/vnd.github+json',
+                authorization: `Bearer ${accessToken}`,
+                'user-agent': USER_AGENT,
+                'x-github-api-version': API_VERSION,
+            },
+        });
+        if (!res.ok)
+            throw new Error(`GitHub user fetch failed (HTTP ${res.status})`);
+        const user = (await res.json());
+        return {
+            id: user.id,
+            login: user.login,
+            name: user.name,
+            avatarUrl: user.avatar_url,
+            email: user.email ?? null,
+        };
+    }
+    /**
+     * List the orgs the token's user belongs to, as lowercased logins. Requires
+     * the token to carry `read:org` (the login flow requests it only when an org
+     * allowlist is configured) so private memberships are visible. A single page
+     * of up to 100 is read — well beyond any realistic membership count.
+     */
+    async fetchUserOrgs(accessToken) {
+        const res = await fetch(new URL('/user/orgs?per_page=100', this.deps.apiBase), {
+            headers: {
+                accept: 'application/vnd.github+json',
+                authorization: `Bearer ${accessToken}`,
+                'user-agent': USER_AGENT,
+                'x-github-api-version': API_VERSION,
+            },
+        });
+        if (!res.ok)
+            throw new Error(`GitHub org list failed (HTTP ${res.status})`);
+        const orgs = (await res.json());
+        return orgs.map((org) => org.login.toLowerCase());
+    }
+}
+//# sourceMappingURL=GitHubOAuth.js.map