@cat-factory/server 0.96.0 → 0.97.0

package/dist/agents/repoFiles.d.ts

@@ -1,8 +1,21 @@
-import type { DeployCloneTarget, GitHubClient, GitHubInstallationRepository, GitHubRepoRef, RepoFiles, RepoProjectionRepository, ResolveRepoFiles, ResolveRunRepoContext, RunRepoContext } from '@cat-factory/kernel';
+import type { CachedRepoRead, DeployCloneTarget, GitHubClient, GitHubInstallationRepository, GitHubRepoRef, GroupCacheHandle, RepoFiles, RepoProjectionRepository, ResolveRepoFiles, ResolveRunRepoContext, RunRepoContext } from '@cat-factory/kernel';
 import type { MintInstallationToken, RepoTarget, ResolveRepoTarget } from './ContainerAgentExecutor.js';
 export { runRepoOps } from '@cat-factory/agents';
-/** Bind a {@link GitHubClient} to one installation + repo as a {@link RepoFiles}. */
-export declare function makeRepoFiles(client: GitHubClient, installationId: number, ref: GitHubRepoRef): RepoFiles;
+/**
+ * Bind a {@link GitHubClient} to one installation + repo as a {@link RepoFiles}.
+ *
+ * When `cache` (the app's `repoFiles` cache, slice 4) is supplied, `getFile`/`listDirectory`
+ * against a NAMED ref read through it — grouped per `(installation, owner, repo, ref)` so one
+ * `commitFiles` (or a push webhook) drops exactly the branch it touched, and keyed per path
+ * (`f:`/`d:` prefixes). Each entry remembers the branch head sha it reflects, so an entry
+ * entering its refresh window re-validates with a single cheap `branchHeadSha` compare instead
+ * of re-fetching every file; a sha-pinned read is immutable (no probe). The head sha a cold
+ * batch stamps onto its entries is read ONCE per branch (memoised for this instance's lifetime,
+ * cleared when we commit to that branch), so caching N files on a branch costs one extra head
+ * read, not N. Reads with no `gitRef` (the repo default branch, whose name we don't know here)
+ * bypass the cache. Absent `cache` ⇒ the original direct pass-through.
+ */
+export declare function makeRepoFiles(client: GitHubClient, installationId: number, ref: GitHubRepoRef, cache?: GroupCacheHandle<CachedRepoRead>): RepoFiles;
 /** A {@link ResolveRepoFiles} backed by a single wired {@link GitHubClient}. */
 export declare function makeResolveRepoFiles(client: GitHubClient): ResolveRepoFiles;
 /**
@@ -14,8 +27,12 @@ export declare function makeResolveRepoFiles(client: GitHubClient): ResolveRepoF
  * no repo (GitHub not connected); a throw from the target resolver (a block under no
  * linked service) propagates so the misconfiguration surfaces — failing the run loudly —
  * rather than guessing a repo, exactly as it does for a container kind at dispatch.
+ *
+ * `cache` (the app's `repoFiles` cache, slice 4) is threaded into the bound {@link RepoFiles}
+ * so a registered kind's pre/post-op idempotency re-reads hit the read-through cache; absent
+ * (tests / the pass-through profile) ⇒ direct reads, unchanged.
  */
-export declare function makeResolveRunRepoContext(client: GitHubClient, resolveRepoTarget: ResolveRepoTarget): ResolveRunRepoContext;
+export declare function makeResolveRunRepoContext(client: GitHubClient, resolveRepoTarget: ResolveRepoTarget, cache?: GroupCacheHandle<CachedRepoRead>): ResolveRunRepoContext;
 /**
  * Compose a {@link DeployCloneTarget} resolver for the async, container-backed Kubernetes
  * deploy path (slice 9's `resolveDeployCloneTarget` provisioning seam) from the wired

package/dist/agents/repoFiles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repoFiles.d.ts","sourceRoot":"","sources":["../../src/agents/repoFiles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EACjB,YAAY,EACZ,4BAA4B,EAC5B,aAAa,EACb,SAAS,EACT,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACf,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EACV,qBAAqB,EACrB,UAAU,EACV,iBAAiB,EAClB,MAAM,6BAA6B,CAAA;AAIpC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAUhD,qFAAqF;AACrF,wBAAgB,aAAa,CAC3B,MAAM,EAAE,YAAY,EACpB,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,GACjB,SAAS,CAWX;AAED,gFAAgF;AAChF,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,GAAG,gBAAgB,CAE3E;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,YAAY,EACpB,iBAAiB,EAAE,iBAAiB,GACnC,qBAAqB,CAYvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAC1C,iBAAiB,EAAE,iBAAiB,EACpC,qBAAqB,EAAE,qBAAqB,EAC5C,OAAO,CAAC,EAAE;IACR,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;OAIG;IACH,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,CAAA;CACjD,GACA,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAe3F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,YAAY,EACpB,sBAAsB,EAAE,IAAI,CAAC,4BAA4B,EAAE,gBAAgB,CAAC,EAC5E,wBAAwB,EAAE,IAAI,CAAC,wBAAwB,EAAE,MAAM,CAAC,GAC/D,CACD,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;CAAE,KACpE,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAiBlC"}
+{"version":3,"file":"repoFiles.d.ts","sourceRoot":"","sources":["../../src/agents/repoFiles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,4BAA4B,EAC5B,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACf,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EACV,qBAAqB,EACrB,UAAU,EACV,iBAAiB,EAClB,MAAM,6BAA6B,CAAA;AAIpC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAsBhD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,YAAY,EACpB,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,KAAK,CAAC,EAAE,gBAAgB,CAAC,cAAc,CAAC,GACvC,SAAS,CA2GX;AAED,gFAAgF;AAChF,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,GAAG,gBAAgB,CAE3E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,YAAY,EACpB,iBAAiB,EAAE,iBAAiB,EACpC,KAAK,CAAC,EAAE,gBAAgB,CAAC,cAAc,CAAC,GACvC,qBAAqB,CAcvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAC1C,iBAAiB,EAAE,iBAAiB,EACpC,qBAAqB,EAAE,qBAAqB,EAC5C,OAAO,CAAC,EAAE;IACR,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;OAIG;IACH,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,CAAA;CACjD,GACA,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAe3F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,YAAY,EACpB,sBAAsB,EAAE,IAAI,CAAC,4BAA4B,EAAE,gBAAgB,CAAC,EAC5E,wBAAwB,EAAE,IAAI,CAAC,wBAAwB,EAAE,MAAM,CAAC,GAC/D,CACD,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;CAAE,KACpE,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAiBlC"}

package/dist/agents/repoFiles.js

@@ -1,3 +1,4 @@
+import { repoFilesCacheGroup } from '@cat-factory/kernel';
 // `runRepoOps` lives in @cat-factory/agents (so the orchestration engine can drive the
 // hooks without importing this HTTP layer); re-exported here for the existing callers.
 export { runRepoOps } from '@cat-factory/agents';
@@ -8,18 +9,128 @@ export { runRepoOps } from '@cat-factory/agents';
 // uses to read a targeted subset of the repo and commit rendered artifact files without
 // cloning. Each instance is bound to ONE installation + repo, so a repo-op names only
 // paths/branches.
-/** Bind a {@link GitHubClient} to one installation + repo as a {@link RepoFiles}. */
-export function makeRepoFiles(client, installationId, ref) {
-    return {
+/**
+ * A full 40-hex commit sha — an immutable ref, so its reads skip the head-sha probe. This is a
+ * shape check: a branch literally named as 40 hex chars would be misclassified as immutable and
+ * never revalidated. There is no cheap way to disambiguate a sha from an identically-shaped
+ * branch (it needs a ref lookup), and the actual callers never collide — the engine's pre/post-op
+ * refs are `cat-factory/<blockId>` branch names (always contain `/`) or genuine pinned shas — so
+ * the mismatch is a bounded, accepted edge, not a live hazard.
+ */
+function isPinnedSha(gitRef) {
+    return /^[0-9a-f]{40}$/i.test(gitRef);
+}
+/**
+ * Bind a {@link GitHubClient} to one installation + repo as a {@link RepoFiles}.
+ *
+ * When `cache` (the app's `repoFiles` cache, slice 4) is supplied, `getFile`/`listDirectory`
+ * against a NAMED ref read through it — grouped per `(installation, owner, repo, ref)` so one
+ * `commitFiles` (or a push webhook) drops exactly the branch it touched, and keyed per path
+ * (`f:`/`d:` prefixes). Each entry remembers the branch head sha it reflects, so an entry
+ * entering its refresh window re-validates with a single cheap `branchHeadSha` compare instead
+ * of re-fetching every file; a sha-pinned read is immutable (no probe). The head sha a cold
+ * batch stamps onto its entries is read ONCE per branch (memoised for this instance's lifetime,
+ * cleared when we commit to that branch), so caching N files on a branch costs one extra head
+ * read, not N. Reads with no `gitRef` (the repo default branch, whose name we don't know here)
+ * bypass the cache. Absent `cache` ⇒ the original direct pass-through.
+ */
+export function makeRepoFiles(client, installationId, ref, cache) {
+    const headSha = (branch) => client.branchHeadSha(installationId, ref, branch);
+    // The direct pass-through facade. When a cache is supplied we override only the three methods
+    // it actually changes (getFile/listDirectory/commitFiles) and inherit the rest from here, so
+    // the shared bindings can't drift between the cached and uncached paths.
+    const base = {
         getFile: (path, gitRef) => client.getFileContent(installationId, ref, path, gitRef),
         listDirectory: (path, gitRef) => client.listDirectory(installationId, ref, path, gitRef),
         // Exact single-ref lookup — correct even on repos with more branches than one
         // `listBranches` page. Null ⇒ the branch does not exist yet (create-vs-commit).
-        headSha: (branch) => client.branchHeadSha(installationId, ref, branch),
+        headSha,
         createBranch: (branch, fromSha) => client.createBranch(installationId, ref, branch, fromSha),
         commitFiles: (input) => client.commitFiles(installationId, ref, input),
         openPullRequest: (input) => client.openPullRequest(installationId, ref, input),
     };
+    if (!cache)
+        return base;
+    // Dedupe an in-flight `branchHeadSha` read per branch. A REJECTED read is ALWAYS evicted so
+    // one transient head-read blip never sticks for the instance's lifetime; `retainResolved`
+    // then keeps a successful read for the whole batch (the cold-load memo — N files on a branch
+    // share one head read) or drops it on settle (the probe memo — each refresh sweep must read
+    // the CURRENT head afresh, but concurrent probes for the same branch still coalesce to ONE
+    // request instead of one-per-cached-entry).
+    const dedupeHead = (store, branch, retainResolved) => {
+        let pending = store.get(branch);
+        if (!pending) {
+            pending = headSha(branch);
+            store.set(branch, pending);
+            const evict = () => {
+                if (store.get(branch) === pending)
+                    store.delete(branch);
+            };
+            void pending.then(retainResolved ? undefined : evict, evict);
+        }
+        return pending;
+    };
+    const loadHeadMemo = new Map();
+    const probeHeadMemo = new Map();
+    const group = (gitRef) => repoFilesCacheGroup(installationId, ref.owner, ref.repo, gitRef);
+    // The refresh-window probe: a pinned sha is immutable (always current); a branch entry is
+    // current only while the branch head still matches the sha it was read at. A head-read blip
+    // during the probe reports "stale" (reload) rather than throwing out of the caching layer.
+    const probeFor = (gitRef) => isPinnedSha(gitRef)
+        ? () => Promise.resolve(true)
+        : async (cached) => {
+            try {
+                return (await dedupeHead(probeHeadMemo, gitRef, false)) === cached.headSha;
+            }
+            catch {
+                return false;
+            }
+        };
+    // The head sha stamped onto a cold entry, for the probe to compare against. A pinned ref is
+    // immutable (null ⇒ never probed). A transient head-read failure degrades to an UNSTAMPED
+    // entry (null ⇒ the probe always reloads) rather than failing the content read — the uncached
+    // path never read the head at all, so a head blip must not make a cached read less robust.
+    const headForLoad = async (gitRef) => {
+        if (isPinnedSha(gitRef))
+            return null;
+        try {
+            return await dedupeHead(loadHeadMemo, gitRef, true);
+        }
+        catch {
+            return null;
+        }
+    };
+    return {
+        ...base,
+        getFile: async (path, gitRef) => {
+            if (!gitRef)
+                return client.getFileContent(installationId, ref, path, gitRef);
+            const cached = await cache.get(`f:${path}`, group(gitRef), async () => ({
+                kind: 'file',
+                headSha: await headForLoad(gitRef),
+                content: await client.getFileContent(installationId, ref, path, gitRef),
+            }), probeFor(gitRef));
+            return cached.kind === 'file' ? cached.content : null;
+        },
+        listDirectory: async (path, gitRef) => {
+            if (!gitRef)
+                return client.listDirectory(installationId, ref, path, gitRef);
+            const cached = await cache.get(`d:${path}`, group(gitRef), async () => ({
+                kind: 'dir',
+                headSha: await headForLoad(gitRef),
+                entries: await client.listDirectory(installationId, ref, path, gitRef),
+            }), probeFor(gitRef));
+            return cached.kind === 'dir' ? cached.entries : [];
+        },
+        commitFiles: async (input) => {
+            const result = await client.commitFiles(installationId, ref, input);
+            // The branch moved: drop its cached reads (this replica's, and — when a notification
+            // pair is wired — every peer's) and forget its memoised head so a later read re-stamps.
+            loadHeadMemo.delete(input.branch);
+            await cache.invalidateGroup(group(input.branch));
+            return result;
+        },
+    };
 }
 /** A {@link ResolveRepoFiles} backed by a single wired {@link GitHubClient}. */
 export function makeResolveRepoFiles(client) {
@@ -34,17 +145,18 @@ export function makeResolveRepoFiles(client) {
  * no repo (GitHub not connected); a throw from the target resolver (a block under no
  * linked service) propagates so the misconfiguration surfaces — failing the run loudly —
  * rather than guessing a repo, exactly as it does for a container kind at dispatch.
+ *
+ * `cache` (the app's `repoFiles` cache, slice 4) is threaded into the bound {@link RepoFiles}
+ * so a registered kind's pre/post-op idempotency re-reads hit the read-through cache; absent
+ * (tests / the pass-through profile) ⇒ direct reads, unchanged.
  */
-export function makeResolveRunRepoContext(client, resolveRepoTarget) {
+export function makeResolveRunRepoContext(client, resolveRepoTarget, cache) {
     return async (workspaceId, blockId) => {
         const target = await resolveRepoTarget(workspaceId, blockId);
         if (!target)
             return null;
         return {
-            repo: makeRepoFiles(client, target.installationId, {
-                owner: target.owner,
-                repo: target.name,
-            }),
+            repo: makeRepoFiles(client, target.installationId, { owner: target.owner, repo: target.name }, cache),
             baseBranch: target.baseBranch,
         };
     };

package/dist/agents/repoFiles.js.map

@@ -1 +1 @@
-{"version":3,"file":"repoFiles.js","sourceRoot":"","sources":["../../src/agents/repoFiles.ts"],"names":[],"mappings":"AAiBA,uFAAuF;AACvF,uFAAuF;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAEhD,4EAA4E;AAC5E,wFAAwF;AACxF,sFAAsF;AACtF,sFAAsF;AACtF,wFAAwF;AACxF,sFAAsF;AACtF,kBAAkB;AAElB,qFAAqF;AACrF,MAAM,UAAU,aAAa,CAC3B,MAAoB,EACpB,cAAsB,EACtB,GAAkB;IAElB,OAAO;QACL,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,cAAc,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC;QACnF,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC;QACxF,8EAA8E;QAC9E,gFAAgF;QAChF,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC;QACtE,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC;QAC5F,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,cAAc,EAAE,GAAG,EAAE,KAAK,CAAC;QACtE,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,cAAc,EAAE,GAAG,EAAE,KAAK,CAAC;KAC/E,CAAA;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,oBAAoB,CAAC,MAAoB;IACvD,OAAO,CAAC,cAAc,EAAE,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,CAAA;AAC5E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAoB,EACpB,iBAAoC;IAEpC,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE;QACpC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QAC5D,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,OAAO;YACL,IAAI,EAAE,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,EAAE;gBACjD,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC;YACF,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAA;IACH,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B,CAC1C,iBAAoC,EACpC,qBAA4C,EAC5C,OASC;IAED,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,UAAU,IAAI,oBAAoB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACjF,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;QACzC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QAC5D,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;QAChE,MAAM,QAAQ,GAAG,OAAO,EAAE,eAAe;YACvC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;YACjC,CAAC,CAAC,GAAG,OAAO,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,MAAM,CAAA;QACnD,OAAO;YACL,QAAQ;YACR,GAAG,EAAE,GAAG,IAAI,MAAM,CAAC,UAAU;YAC7B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5B,CAAA;IACH,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,6BAA6B,CAC3C,MAAoB,EACpB,sBAA4E,EAC5E,wBAAgE;IAKhE,OAAO,KAAK,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;QACtD,iFAAiF;QACjF,qFAAqF;QACrF,oFAAoF;QACpF,6CAA6C;QAC7C,IAAI,QAAQ,IAAI,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QAClD,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QAC7E,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAA;QAC9B,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;QACrE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,OAAO;YACL,IAAI,EAAE,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACzE,UAAU,EAAE,KAAK,CAAC,aAAa,IAAI,MAAM;SAC1C,CAAA;IACH,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"repoFiles.js","sourceRoot":"","sources":["../../src/agents/repoFiles.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAOzD,uFAAuF;AACvF,uFAAuF;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAEhD,4EAA4E;AAC5E,wFAAwF;AACxF,sFAAsF;AACtF,sFAAsF;AACtF,wFAAwF;AACxF,sFAAsF;AACtF,kBAAkB;AAElB;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AACvC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAoB,EACpB,cAAsB,EACtB,GAAkB,EAClB,KAAwC;IAExC,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;IACrF,8FAA8F;IAC9F,6FAA6F;IAC7F,yEAAyE;IACzE,MAAM,IAAI,GAAc;QACtB,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,cAAc,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC;QACnF,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC;QACxF,8EAA8E;QAC9E,gFAAgF;QAChF,OAAO;QACP,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC;QAC5F,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,cAAc,EAAE,GAAG,EAAE,KAAK,CAAC;QACtE,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,cAAc,EAAE,GAAG,EAAE,KAAK,CAAC;KAC/E,CAAA;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IAEvB,4FAA4F;IAC5F,0FAA0F;IAC1F,6FAA6F;IAC7F,4FAA4F;IAC5F,2FAA2F;IAC3F,4CAA4C;IAC5C,MAAM,UAAU,GAAG,CACjB,KAA0C,EAC1C,MAAc,EACd,cAAuB,EACC,EAAE;QAC1B,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;YACzB,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;YAC1B,MAAM,KAAK,GAAG,GAAG,EAAE;gBACjB,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,OAAO;oBAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YACzD,CAAC,CAAA;YACD,KAAK,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QAC9D,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC,CAAA;IACD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkC,CAAA;IAC9D,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkC,CAAA;IAC/D,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,mBAAmB,CAAC,cAAc,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAClG,0FAA0F;IAC1F,4FAA4F;IAC5F,2FAA2F;IAC3F,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAkD,EAAE,CAClF,WAAW,CAAC,MAAM,CAAC;QACjB,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QAC7B,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,IAAI,CAAC;gBACH,OAAO,CAAC,MAAM,UAAU,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,KAAK,MAAM,CAAC,OAAO,CAAA;YAC5E,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC,CAAA;IACP,4FAA4F;IAC5F,0FAA0F;IAC1F,8FAA8F;IAC9F,2FAA2F;IAC3F,MAAM,WAAW,GAAG,KAAK,EAAE,MAAc,EAA0B,EAAE;QACnE,IAAI,WAAW,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAA;QACpC,IAAI,CAAC;YACH,OAAO,MAAM,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC,CAAA;IAED,OAAO;QACL,GAAG,IAAI;QACP,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;YAC9B,IAAI,CAAC,MAAM;gBAAE,OAAO,MAAM,CAAC,cAAc,CAAC,cAAc,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;YAC5E,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAC5B,KAAK,IAAI,EAAE,EACX,KAAK,CAAC,MAAM,CAAC,EACb,KAAK,IAAI,EAAE,CAAC,CAAC;gBACX,IAAI,EAAE,MAAe;gBACrB,OAAO,EAAE,MAAM,WAAW,CAAC,MAAM,CAAC;gBAClC,OAAO,EAAE,MAAM,MAAM,CAAC,cAAc,CAAC,cAAc,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC;aACxE,CAAC,EACF,QAAQ,CAAC,MAAM,CAAC,CACjB,CAAA;YACD,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;QACvD,CAAC;QACD,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;YACpC,IAAI,CAAC,MAAM;gBAAE,OAAO,MAAM,CAAC,aAAa,CAAC,cAAc,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;YAC3E,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAC5B,KAAK,IAAI,EAAE,EACX,KAAK,CAAC,MAAM,CAAC,EACb,KAAK,IAAI,EAAE,CAAC,CAAC;gBACX,IAAI,EAAE,KAAc;gBACpB,OAAO,EAAE,MAAM,WAAW,CAAC,MAAM,CAAC;gBAClC,OAAO,EAAE,MAAM,MAAM,CAAC,aAAa,CAAC,cAAc,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC;aACvE,CAAC,EACF,QAAQ,CAAC,MAAM,CAAC,CACjB,CAAA;YACD,OAAO,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;QACpD,CAAC;QACD,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC3B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,cAAc,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;YACnE,qFAAqF;YACrF,wFAAwF;YACxF,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YACjC,MAAM,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;YAChD,OAAO,MAAM,CAAA;QACf,CAAC;KACF,CAAA;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,oBAAoB,CAAC,MAAoB;IACvD,OAAO,CAAC,cAAc,EAAE,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,CAAA;AAC5E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAoB,EACpB,iBAAoC,EACpC,KAAwC;IAExC,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE;QACpC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QAC5D,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,OAAO;YACL,IAAI,EAAE,aAAa,CACjB,MAAM,EACN,MAAM,CAAC,cAAc,EACrB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAC1C,KAAK,CACN;YACD,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAA;IACH,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B,CAC1C,iBAAoC,EACpC,qBAA4C,EAC5C,OASC;IAED,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,UAAU,IAAI,oBAAoB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACjF,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;QACzC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QAC5D,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;QAChE,MAAM,QAAQ,GAAG,OAAO,EAAE,eAAe;YACvC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;YACjC,CAAC,CAAC,GAAG,OAAO,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,MAAM,CAAA;QACnD,OAAO;YACL,QAAQ;YACR,GAAG,EAAE,GAAG,IAAI,MAAM,CAAC,UAAU;YAC7B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5B,CAAA;IACH,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,6BAA6B,CAC3C,MAAoB,EACpB,sBAA4E,EAC5E,wBAAgE;IAKhE,OAAO,KAAK,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;QACtD,iFAAiF;QACjF,qFAAqF;QACrF,oFAAoF;QACpF,6CAA6C;QAC7C,IAAI,QAAQ,IAAI,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QAClD,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QAC7E,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAA;QAC9B,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;QACrE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,OAAO;YACL,IAAI,EAAE,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACzE,UAAU,EAAE,KAAK,CAAC,aAAa,IAAI,MAAM;SAC1C,CAAA;IACH,CAAC,CAAA;AACH,CAAC"}

package/dist/config/misconfiguredApp.d.ts

@@ -0,0 +1,15 @@
+import type { ConfigProblem } from '@cat-factory/contracts';
+import { Hono } from 'hono';
+/**
+ * Build the Response for one request against the fallback backend, keyed off the URL pathname.
+ * Pure (no CORS, no framework) so the Worker can reuse it INSIDE its already-CORS'd request
+ * pipeline; {@link createMisconfiguredApp} wraps it with CORS for the standalone Node serve.
+ */
+export declare function buildMisconfiguredResponse(pathname: string, problems: ConfigProblem[]): Response;
+/**
+ * The standalone fallback Hono app (used by the Node/local facades, which `serve()` it on the
+ * normal port when their boot throws a {@link ConfigValidationError}). Reflects any origin so the
+ * SPA can read it cross-origin.
+ */
+export declare function createMisconfiguredApp(problems: ConfigProblem[]): Hono;
+//# sourceMappingURL=misconfiguredApp.d.ts.map

package/dist/config/misconfiguredApp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"misconfiguredApp.d.ts","sourceRoot":"","sources":["../../src/config/misconfiguredApp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AA4B3B;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,QAAQ,CAsBhG;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,IAAI,CActE"}

package/dist/config/misconfiguredApp.js

@@ -0,0 +1,67 @@
+import { Hono } from 'hono';
+import { cors } from 'hono/cors';
+import { CORS_ALLOWED_HEADERS } from '../http/cors.js';
+// ---------------------------------------------------------------------------
+// The misconfiguration fallback backend.
+//
+// When a facade fails to boot because a mandatory env var / binding is missing, it serves THIS
+// minimal app instead of exiting. Its whole job is to keep the deployment reachable so the SPA
+// can render a dedicated error screen (see the frontend `BackendMisconfiguredScreen`) telling the
+// developer exactly what's missing and how to fix it — rather than the generic
+// "can't reach the backend" panel a dead process produces.
+//
+//   - `GET /auth/config` — the SPA's boot handshake. Returns a normally-shaped, auth-disabled
+//     config WITH the `misconfigured` problem list, so the boot succeeds and the SPA branches to
+//     the error screen.
+//   - `GET /health` — liveness. Returns 200 with `status: 'misconfigured'` so the orchestrator
+//     does NOT crash-loop the container (which would just restart into the same misconfig, hiding
+//     the screen). Honest but alive.
+//   - everything else — 503 with the structured problem list, for non-browser / direct callers.
+//
+// It reflects any request Origin (the problem list carries no secret — only var names, meanings,
+// and remedies), so the SPA on a separate dev origin can always read it, regardless of whether the
+// (failed) config load ever resolved CORS_ALLOWED_ORIGINS / ENVIRONMENT.
+// ---------------------------------------------------------------------------
+const AUTH_DISABLED_PROVIDERS = { github: false, password: false, google: false };
+/**
+ * Build the Response for one request against the fallback backend, keyed off the URL pathname.
+ * Pure (no CORS, no framework) so the Worker can reuse it INSIDE its already-CORS'd request
+ * pipeline; {@link createMisconfiguredApp} wraps it with CORS for the standalone Node serve.
+ */
+export function buildMisconfiguredResponse(pathname, problems) {
+    if (pathname === '/auth/config') {
+        return Response.json({
+            enabled: false,
+            providers: AUTH_DISABLED_PROVIDERS,
+            misconfigured: { problems },
+        });
+    }
+    if (pathname === '/health') {
+        return Response.json({ status: 'misconfigured' });
+    }
+    return Response.json({
+        error: {
+            code: 'backend_misconfigured',
+            message: 'The backend is not configured correctly and cannot serve requests. See `problems` for what to fix.',
+            problems,
+        },
+    }, { status: 503 });
+}
+/**
+ * The standalone fallback Hono app (used by the Node/local facades, which `serve()` it on the
+ * normal port when their boot throws a {@link ConfigValidationError}). Reflects any origin so the
+ * SPA can read it cross-origin.
+ */
+export function createMisconfiguredApp(problems) {
+    const app = new Hono();
+    app.use('*', cors({
+        // The fallback exposes nothing secret (only the problem list + an auth-disabled config), and
+        // a failed boot may never have resolved the real allow-list — so reflect the caller's origin
+        // unconditionally to guarantee the SPA can read the error screen's data.
+        origin: (origin) => origin ?? '*',
+        allowHeaders: [...CORS_ALLOWED_HEADERS],
+    }));
+    app.all('*', (c) => buildMisconfiguredResponse(new URL(c.req.url).pathname, problems));
+    return app;
+}
+//# sourceMappingURL=misconfiguredApp.js.map

package/dist/config/misconfiguredApp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"misconfiguredApp.js","sourceRoot":"","sources":["../../src/config/misconfiguredApp.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAEtD,8EAA8E;AAC9E,yCAAyC;AACzC,EAAE;AACF,+FAA+F;AAC/F,+FAA+F;AAC/F,kGAAkG;AAClG,+EAA+E;AAC/E,2DAA2D;AAC3D,EAAE;AACF,8FAA8F;AAC9F,iGAAiG;AACjG,wBAAwB;AACxB,+FAA+F;AAC/F,kGAAkG;AAClG,qCAAqC;AACrC,gGAAgG;AAChG,EAAE;AACF,iGAAiG;AACjG,mGAAmG;AACnG,yEAAyE;AACzE,8EAA8E;AAE9E,MAAM,uBAAuB,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;AAEjF;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB,EAAE,QAAyB;IACpF,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;QAChC,OAAO,QAAQ,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,uBAAuB;YAClC,aAAa,EAAE,EAAE,QAAQ,EAAE;SAC5B,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAA;IACnD,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAClB;QACE,KAAK,EAAE;YACL,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EACL,oGAAoG;YACtG,QAAQ;SACT;KACF,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAyB;IAC9D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,GAAG,CAAC,GAAG,CACL,GAAG,EACH,IAAI,CAAC;QACH,6FAA6F;QAC7F,6FAA6F;QAC7F,yEAAyE;QACzE,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,IAAI,GAAG;QACjC,YAAY,EAAE,CAAC,GAAG,oBAAoB,CAAC;KACxC,CAAC,CACH,CAAA;IACD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,0BAA0B,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAA;IACtF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/config/problems.d.ts

@@ -0,0 +1,75 @@
+import type { ConfigProblem } from '@cat-factory/contracts';
+export type { ConfigProblem };
+/**
+ * Thrown by a facade's config loader (or its container build) when one or more MANDATORY env
+ * vars / bindings are missing or invalid. Unlike a bare `Error`, it carries a STRUCTURED,
+ * human-readable list of problems, which lets the boot sequence do two things instead of just
+ * dying with a terse message:
+ *
+ *   1. log a clear, actionable operator message ({@link formatConfigProblems}); and
+ *   2. serve the misconfiguration fallback backend ({@link createMisconfiguredApp}) rather than
+ *      exiting — so the SPA renders a dedicated "backend misconfigured" screen telling the
+ *      developer exactly which variables are missing and how to fill them.
+ *
+ * A {@link ConfigProblem} NEVER carries a secret value — only the variable's name, meaning, and
+ * remedy — so it is safe to both log and surface to the browser.
+ */
+export declare class ConfigValidationError extends Error {
+    readonly problems: ConfigProblem[];
+    constructor(problems: ConfigProblem[]);
+}
+export declare function isConfigValidationError(err: unknown): err is ConfigValidationError;
+/** Build a {@link ConfigValidationError} for a single problem (the common case). */
+export declare function configProblem(problem: ConfigProblem): ConfigValidationError;
+/** Render the problem list as a multi-line, operator-facing message (used as the Error message). */
+export declare function formatConfigProblems(problems: ConfigProblem[]): string;
+/**
+ * The canonical human-readable description of each mandatory env var / binding: what it means and
+ * how to fill it. Keeping these here (rather than re-writing the prose at every throw site) unifies
+ * the phrasing across the three facades, so `ENCRYPTION_KEY` reads the same whether it's the Node
+ * loader, the Worker loader, or local mode that flags it. A throw site spreads the matching entry:
+ *
+ *   throw configProblem({ key: 'ENCRYPTION_KEY', ...ENV_HELP.ENCRYPTION_KEY })
+ *
+ * A site with an extra nuance (a length/format detail beyond "missing") overrides `remedy` inline.
+ */
+export declare const ENV_HELP: {
+    DATABASE_URL: {
+        summary: string;
+        remedy: string;
+    };
+    ENCRYPTION_KEY: {
+        summary: string;
+        remedy: string;
+    };
+    AUTH_SESSION_SECRET: {
+        summary: string;
+        remedy: string;
+    };
+    AUTH_PROVIDER: {
+        summary: string;
+        remedy: string;
+    };
+    TELEMETRY_DB: {
+        summary: string;
+        remedy: string;
+    };
+    AGENT_MODELS: {
+        summary: string;
+        remedy: string;
+    };
+    CONTAINER_EXECUTOR: {
+        summary: string;
+        remedy: string;
+    };
+};
+/**
+ * Read a mandatory env var, throwing a {@link ConfigValidationError} with a human-readable
+ * meaning + remedy when it is missing/blank. `help` defaults to the {@link ENV_HELP} entry for
+ * `key` when one exists, so the common case is just `requireEnv(env, 'DATABASE_URL')`.
+ */
+export declare function requireEnv(env: Record<string, string | undefined>, key: string, help?: {
+    summary: string;
+    remedy: string;
+}): string;
+//# sourceMappingURL=problems.d.ts.map

package/dist/config/problems.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"problems.d.ts","sourceRoot":"","sources":["../../src/config/problems.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE3D,YAAY,EAAE,aAAa,EAAE,CAAA;AAE7B;;;;;;;;;;;;;GAaG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAA;IAElC,YAAY,QAAQ,EAAE,aAAa,EAAE,EAIpC;CACF;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,qBAAqB,CAElF;AAED,oFAAoF;AACpF,wBAAgB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,qBAAqB,CAE3E;AAED,oGAAoG;AACpG,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,CAOtE;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ;;QAEjB,OAAO;QAEP,MAAM;;;QAIN,OAAO;QAEP,MAAM;;;QAIN,OAAO;QAEP,MAAM;;;QAIN,OAAO;QAEP,MAAM;;;QAIN,OAAO;QAEP,MAAM;;;QAIN,OAAO;QAEP,MAAM;;;QAIN,OAAO;QAEP,MAAM;;CAGqD,CAAA;AAE/D;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACvC,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzC,MAAM,CAYR"}

package/dist/config/problems.js

@@ -0,0 +1,97 @@
+/**
+ * Thrown by a facade's config loader (or its container build) when one or more MANDATORY env
+ * vars / bindings are missing or invalid. Unlike a bare `Error`, it carries a STRUCTURED,
+ * human-readable list of problems, which lets the boot sequence do two things instead of just
+ * dying with a terse message:
+ *
+ *   1. log a clear, actionable operator message ({@link formatConfigProblems}); and
+ *   2. serve the misconfiguration fallback backend ({@link createMisconfiguredApp}) rather than
+ *      exiting — so the SPA renders a dedicated "backend misconfigured" screen telling the
+ *      developer exactly which variables are missing and how to fill them.
+ *
+ * A {@link ConfigProblem} NEVER carries a secret value — only the variable's name, meaning, and
+ * remedy — so it is safe to both log and surface to the browser.
+ */
+export class ConfigValidationError extends Error {
+    problems;
+    constructor(problems) {
+        super(formatConfigProblems(problems));
+        this.name = 'ConfigValidationError';
+        this.problems = problems;
+    }
+}
+export function isConfigValidationError(err) {
+    return err instanceof ConfigValidationError;
+}
+/** Build a {@link ConfigValidationError} for a single problem (the common case). */
+export function configProblem(problem) {
+    return new ConfigValidationError([problem]);
+}
+/** Render the problem list as a multi-line, operator-facing message (used as the Error message). */
+export function formatConfigProblems(problems) {
+    const header = problems.length === 1
+        ? 'cat-factory cannot start: a mandatory configuration value is missing or invalid.'
+        : `cat-factory cannot start: ${problems.length} mandatory configuration values are missing or invalid.`;
+    const lines = problems.map((p) => `  • ${p.key}: ${p.summary}\n    → ${p.remedy}`);
+    return [header, ...lines].join('\n');
+}
+/**
+ * The canonical human-readable description of each mandatory env var / binding: what it means and
+ * how to fill it. Keeping these here (rather than re-writing the prose at every throw site) unifies
+ * the phrasing across the three facades, so `ENCRYPTION_KEY` reads the same whether it's the Node
+ * loader, the Worker loader, or local mode that flags it. A throw site spreads the matching entry:
+ *
+ *   throw configProblem({ key: 'ENCRYPTION_KEY', ...ENV_HELP.ENCRYPTION_KEY })
+ *
+ * A site with an extra nuance (a length/format detail beyond "missing") overrides `remedy` inline.
+ */
+export const ENV_HELP = {
+    DATABASE_URL: {
+        summary: 'Postgres connection string — the Node service stores ALL of its state (workspaces, boards, runs, credentials) there.',
+        remedy: 'Set DATABASE_URL to your Postgres URL, e.g. `postgres://user:password@localhost:5432/cat_factory`. In local mode, `docker compose up` in deploy/local starts one and prints the URL.',
+    },
+    ENCRYPTION_KEY: {
+        summary: 'Master key that seals every per-workspace credential at rest (document/task/runner/Slack integrations, personal subscriptions, observability connections).',
+        remedy: 'Set ENCRYPTION_KEY to a base64-encoded key of at least 32 bytes. Generate one with `pnpm secrets` (deploy/local) or `openssl rand -base64 32`. It must stay STABLE across restarts — a fresh value orphans everything sealed under the previous one.',
+    },
+    AUTH_SESSION_SECRET: {
+        summary: 'HMAC key that signs the session, proxy, and machine tokens — the whole auth surface trusts it.',
+        remedy: 'Set AUTH_SESSION_SECRET to a random string of at least 32 characters. Generate one with `pnpm secrets` (deploy/local) or `openssl rand -hex 32`. It must stay STABLE across restarts — a fresh value forces every user to re-login.',
+    },
+    AUTH_PROVIDER: {
+        summary: 'A remote deployment has no anonymous tier, so at least one login provider must be configured or every protected route fails closed.',
+        remedy: 'Enable one of: GitHub OAuth (GITHUB_OAUTH_CLIENT_ID + GITHUB_OAUTH_CLIENT_SECRET), Google OAuth (GOOGLE_OAUTH_CLIENT_ID + GOOGLE_OAUTH_CLIENT_SECRET), or password login (AUTH_PASSWORD_ENABLED=true) — each alongside a 32+ character AUTH_SESSION_SECRET. For local dev or tests, set AUTH_DEV_OPEN=true in a non-production ENVIRONMENT instead.',
+    },
+    TELEMETRY_DB: {
+        summary: 'The dedicated telemetry D1 database (per-LLM-call metrics + agent-context snapshots) — kept separate from the transactional data so its append-heavy, short-retention writes never contend with domain reads.',
+        remedy: 'Add a `[[d1_databases]]` entry with `binding = "TELEMETRY_DB"` to your wrangler.toml and create the database with `wrangler d1 create`.',
+    },
+    AGENT_MODELS: {
+        summary: 'Optional per-kind model routing override, supplied as a JSON object mapping an agent kind to `{ "provider", "model" }`.',
+        remedy: 'Either unset AGENT_MODELS to use the built-in routing, or set it to valid JSON where every entry has string "provider" and "model" fields, e.g. `{"coder":{"provider":"workers-ai","model":"@cf/zai-org/glm-5.2"}}`.',
+    },
+    CONTAINER_EXECUTOR: {
+        summary: 'The repo-operating agent steps (coder, tester, merger, …) need a fully-wired container executor; running them as one-shot LLM calls would silently produce broken results.',
+        remedy: 'Configure a GitHub App (GITHUB_APP_PRIVATE_KEY + GITHUB_APP_ID), WORKER_PUBLIC_URL, AUTH_SESSION_SECRET, and a runner backend (the EXEC_CONTAINER binding, or a registered runner pool with RUNNERS_ENABLED).',
+    },
+};
+/**
+ * Read a mandatory env var, throwing a {@link ConfigValidationError} with a human-readable
+ * meaning + remedy when it is missing/blank. `help` defaults to the {@link ENV_HELP} entry for
+ * `key` when one exists, so the common case is just `requireEnv(env, 'DATABASE_URL')`.
+ */
+export function requireEnv(env, key, help) {
+    const value = env[key]?.trim();
+    if (value)
+        return value;
+    const meaning = help ?? ENV_HELP[key];
+    if (!meaning) {
+        throw configProblem({
+            key,
+            summary: `The mandatory environment variable ${key} is not set.`,
+            remedy: `Set ${key} in your environment (or .env) and restart.`,
+        });
+    }
+    throw configProblem({ key, ...meaning });
+}
+//# sourceMappingURL=problems.js.map

package/dist/config/problems.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"problems.js","sourceRoot":"","sources":["../../src/config/problems.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,QAAQ,CAAiB;IAElC,YAAY,QAAyB;QACnC,KAAK,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAA;QACrC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAA;QACnC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;CACF;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAY;IAClD,OAAO,GAAG,YAAY,qBAAqB,CAAA;AAC7C,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,OAAsB;IAClD,OAAO,IAAI,qBAAqB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;AAC7C,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,oBAAoB,CAAC,QAAyB;IAC5D,MAAM,MAAM,GACV,QAAQ,CAAC,MAAM,KAAK,CAAC;QACnB,CAAC,CAAC,kFAAkF;QACpF,CAAC,CAAC,6BAA6B,QAAQ,CAAC,MAAM,yDAAyD,CAAA;IAC3G,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;IAClF,OAAO,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACtC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,YAAY,EAAE;QACZ,OAAO,EACL,sHAAsH;QACxH,MAAM,EACJ,sLAAsL;KACzL;IACD,cAAc,EAAE;QACd,OAAO,EACL,4JAA4J;QAC9J,MAAM,EACJ,sPAAsP;KACzP;IACD,mBAAmB,EAAE;QACnB,OAAO,EACL,gGAAgG;QAClG,MAAM,EACJ,qOAAqO;KACxO;IACD,aAAa,EAAE;QACb,OAAO,EACL,qIAAqI;QACvI,MAAM,EACJ,qVAAqV;KACxV;IACD,YAAY,EAAE;QACZ,OAAO,EACL,+MAA+M;QACjN,MAAM,EACJ,yIAAyI;KAC5I;IACD,YAAY,EAAE;QACZ,OAAO,EACL,yHAAyH;QAC3H,MAAM,EACJ,sNAAsN;KACzN;IACD,kBAAkB,EAAE;QAClB,OAAO,EACL,4KAA4K;QAC9K,MAAM,EACJ,+MAA+M;KAClN;CAC4D,CAAA;AAE/D;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,GAAuC,EACvC,GAAW,EACX,IAA0C;IAE1C,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAA;IAC9B,IAAI,KAAK;QAAE,OAAO,KAAK,CAAA;IACvB,MAAM,OAAO,GAAG,IAAI,IAAK,QAAgE,CAAC,GAAG,CAAC,CAAA;IAC9F,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,aAAa,CAAC;YAClB,GAAG;YACH,OAAO,EAAE,sCAAsC,GAAG,cAAc;YAChE,MAAM,EAAE,OAAO,GAAG,6CAA6C;SAChE,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,aAAa,CAAC,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;AAC1C,CAAC"}

package/dist/index.d.ts

@@ -30,6 +30,8 @@ export { mountAuthGate } from './http/authGate.js';
 export { param } from './http/params.js';
 export { handleError } from './http/errorHandler.js';
 export { CORS_ALLOWED_HEADERS, corsReflectsWhenUnset, parseAllowedOrigins, resolveCorsOrigin, } from './http/cors.js';
+export { ConfigValidationError, isConfigValidationError, configProblem, formatConfigProblems, requireEnv, ENV_HELP, type ConfigProblem, } from './config/problems.js';
+export { createMisconfiguredApp, buildMisconfiguredResponse } from './config/misconfiguredApp.js';
 export { base64url, base64urlToBytes, pkcs8PemToDer, timingSafeEqual } from './crypto/encoding.js';
 export { WebCryptoSecretCipher, type WebCryptoSecretCipherOptions, } from './crypto/WebCryptoSecretCipher.js';
 export { WebCryptoPersonalSecretCipher } from './crypto/WebCryptoPersonalSecretCipher.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,KAAK,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,mBAAmB,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAA;AAC3F,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAE,KAAK,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,SAAS,GACf,MAAM,yCAAyC,CAAA;AAIhD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,EACvC,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,GAC5B,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,uBAAuB,EAAE,KAAK,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAC1F,OAAO,EACL,iCAAiC,EACjC,KAAK,0BAA0B,GAChC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,4BAA4B,EAC5B,KAAK,kBAAkB,GACxB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,yBAAyB,EACzB,KAAK,qCAAqC,GAC3C,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,0BAA0B,EAC1B,KAAK,sCAAsC,GAC5C,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,YAAY,GAClB,MAAM,+BAA+B,CAAA;AAGtC,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,qBAAqB,EACrB,KAAK,6BAA6B,GACnC,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EACL,oBAAoB,EACpB,KAAK,gCAAgC,GACtC,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAIlG,OAAO,EACL,qBAAqB,EACrB,KAAK,4BAA4B,GAClC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAA;AACzF,OAAO,EAAE,aAAa,EAAE,KAAK,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AACzF,OAAO,EACL,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAKpF,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,KAAK,6BAA6B,GACnC,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,oCAAoC,CAAA;AAG3C,OAAO,EACL,6BAA6B,EAC7B,KAAK,yCAAyC,GAC/C,MAAM,2CAA2C,CAAA;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,GACxC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,wBAAwB,EACxB,KAAK,oCAAoC,GAC1C,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,+BAA+B,EAC/B,KAAK,2CAA2C,GACjD,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,KAAK,sCAAsC,GAC5C,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,mBAAmB,EACnB,KAAK,+BAA+B,GACrC,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,uBAAuB,EACvB,KAAK,mCAAmC,GACzC,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,UAAU,EACV,cAAc,EACd,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,KAAK,QAAQ,EACb,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,YAAY,EACZ,SAAS,EACT,UAAU,EACV,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,WAAW,GACZ,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EAAE,+BAA+B,EAAE,MAAM,4BAA4B,CAAA;AAI5E,cAAc,0BAA0B,CAAA;AACxC,cAAc,kCAAkC,CAAA;AAGhD,cAAc,yBAAyB,CAAA;AAMvC,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,KAAK,oBAAoB,EACzB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qCAAqC,CAAA;AAI5C,OAAO,EACL,8BAA8B,EAC9B,KAAK,kCAAkC,EACvC,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,8BAA8B,GACpC,MAAM,sCAAsC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,KAAK,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,mBAAmB,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAA;AAC3F,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAE,KAAK,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,SAAS,GACf,MAAM,yCAAyC,CAAA;AAIhD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,EACvC,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,GAC5B,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,uBAAuB,EAAE,KAAK,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAC1F,OAAO,EACL,iCAAiC,EACjC,KAAK,0BAA0B,GAChC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,4BAA4B,EAC5B,KAAK,kBAAkB,GACxB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,yBAAyB,EACzB,KAAK,qCAAqC,GAC3C,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,0BAA0B,EAC1B,KAAK,sCAAsC,GAC5C,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,YAAY,GAClB,MAAM,+BAA+B,CAAA;AAGtC,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,qBAAqB,EACrB,KAAK,6BAA6B,GACnC,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EACL,oBAAoB,EACpB,KAAK,gCAAgC,GACtC,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,QAAQ,EACR,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAA;AACjG,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAIlG,OAAO,EACL,qBAAqB,EACrB,KAAK,4BAA4B,GAClC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAA;AACzF,OAAO,EAAE,aAAa,EAAE,KAAK,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AACzF,OAAO,EACL,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAKpF,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,KAAK,6BAA6B,GACnC,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,oCAAoC,CAAA;AAG3C,OAAO,EACL,6BAA6B,EAC7B,KAAK,yCAAyC,GAC/C,MAAM,2CAA2C,CAAA;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,GACxC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,wBAAwB,EACxB,KAAK,oCAAoC,GAC1C,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,+BAA+B,EAC/B,KAAK,2CAA2C,GACjD,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,KAAK,sCAAsC,GAC5C,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,mBAAmB,EACnB,KAAK,+BAA+B,GACrC,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,uBAAuB,EACvB,KAAK,mCAAmC,GACzC,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,UAAU,EACV,cAAc,EACd,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,KAAK,QAAQ,EACb,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,YAAY,EACZ,SAAS,EACT,UAAU,EACV,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,WAAW,GACZ,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EAAE,+BAA+B,EAAE,MAAM,4BAA4B,CAAA;AAI5E,cAAc,0BAA0B,CAAA;AACxC,cAAc,kCAAkC,CAAA;AAGhD,cAAc,yBAAyB,CAAA;AAMvC,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,KAAK,oBAAoB,EACzB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qCAAqC,CAAA;AAI5C,OAAO,EACL,8BAA8B,EAC9B,KAAK,kCAAkC,EACvC,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,8BAA8B,GACpC,MAAM,sCAAsC,CAAA"}

package/dist/index.js

@@ -39,6 +39,8 @@ export { mountAuthGate } from './http/authGate.js';
 export { param } from './http/params.js';
 export { handleError } from './http/errorHandler.js';
 export { CORS_ALLOWED_HEADERS, corsReflectsWhenUnset, parseAllowedOrigins, resolveCorsOrigin, } from './http/cors.js';
+export { ConfigValidationError, isConfigValidationError, configProblem, formatConfigProblems, requireEnv, ENV_HELP, } from './config/problems.js';
+export { createMisconfiguredApp, buildMisconfiguredResponse } from './config/misconfiguredApp.js';
 export { base64url, base64urlToBytes, pkcs8PemToDer, timingSafeEqual } from './crypto/encoding.js';
 // Runtime-neutral (Web Crypto) credential encryption + GitHub-App authentication,
 // shared by both facades so the Node service can mint installation tokens and

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,gFAAgF;AAChF,8EAA8E;AAC9E,qEAAqE;AACrE,OAAO,EAAE,MAAM,EAAe,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAA+D,MAAM,eAAe,CAAA;AAC3F,OAAO,EAYN,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,WAAW,EAAqB,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,WAAW,GAGZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,WAAW,GAGZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAgC,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GAGvB,MAAM,yCAAyC,CAAA;AAChD,mFAAmF;AACnF,kFAAkF;AAClF,oFAAoF;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EACL,sBAAsB,GASvB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,uBAAuB,EAA8B,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,eAAe,EAA+B,MAAM,6BAA6B,CAAA;AAC1F,OAAO,EACL,iCAAiC,GAElC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,4BAA4B,GAE7B,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,yBAAyB,GAE1B,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,0BAA0B,GAE3B,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GAMxB,MAAM,+BAA+B,CAAA;AACtC,qFAAqF;AACrF,4FAA4F;AAC5F,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,qBAAqB,GAEtB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EACL,oBAAoB,GAErB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAClG,kFAAkF;AAClF,8EAA8E;AAC9E,kEAAkE;AAClE,OAAO,EACL,qBAAqB,GAEtB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAA;AACzF,OAAO,EAAE,aAAa,EAAkC,MAAM,2BAA2B,CAAA;AACzF,OAAO,EACL,iBAAiB,GAIlB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AACpF,gFAAgF;AAChF,kFAAkF;AAClF,qFAAqF;AACrF,6BAA6B;AAC7B,OAAO,EACL,iBAAiB,EACjB,cAAc,GAEf,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,sBAAsB,GAEvB,MAAM,oCAAoC,CAAA;AAC3C,oFAAoF;AACpF,qEAAqE;AACrE,OAAO,EACL,6BAA6B,GAE9B,MAAM,2CAA2C,CAAA;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,sBAAsB,GAEvB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,wBAAwB,GAEzB,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,+BAA+B,GAEhC,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,GAErB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,mBAAmB,GAEpB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,uBAAuB,GAExB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,UAAU,EACV,cAAc,GAKf,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,GAGb,MAAM,oBAAoB,CAAA;AAsB3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EAAE,+BAA+B,EAAE,MAAM,4BAA4B,CAAA;AAE5E,mFAAmF;AACnF,iEAAiE;AACjE,cAAc,0BAA0B,CAAA;AACxC,cAAc,kCAAkC,CAAA;AAChD,4FAA4F;AAC5F,6FAA6F;AAC7F,cAAc,yBAAyB,CAAA;AAEvC,6FAA6F;AAC7F,wFAAwF;AACxF,6FAA6F;AAC7F,0EAA0E;AAC1E,OAAO,EAWL,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAEL,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qCAAqC,CAAA;AAE5C,2FAA2F;AAC3F,sEAAsE;AACtE,OAAO,EACL,8BAA8B,GAK/B,MAAM,sCAAsC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,gFAAgF;AAChF,8EAA8E;AAC9E,qEAAqE;AACrE,OAAO,EAAE,MAAM,EAAe,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAA+D,MAAM,eAAe,CAAA;AAC3F,OAAO,EAYN,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,WAAW,EAAqB,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,WAAW,GAGZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,WAAW,GAGZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAgC,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GAGvB,MAAM,yCAAyC,CAAA;AAChD,mFAAmF;AACnF,kFAAkF;AAClF,oFAAoF;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EACL,sBAAsB,GASvB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,uBAAuB,EAA8B,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,eAAe,EAA+B,MAAM,6BAA6B,CAAA;AAC1F,OAAO,EACL,iCAAiC,GAElC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,4BAA4B,GAE7B,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,yBAAyB,GAE1B,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,0BAA0B,GAE3B,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GAMxB,MAAM,+BAA+B,CAAA;AACtC,qFAAqF;AACrF,4FAA4F;AAC5F,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,qBAAqB,GAEtB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EACL,oBAAoB,GAErB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,QAAQ,GAET,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAA;AACjG,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAClG,kFAAkF;AAClF,8EAA8E;AAC9E,kEAAkE;AAClE,OAAO,EACL,qBAAqB,GAEtB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAA;AACzF,OAAO,EAAE,aAAa,EAAkC,MAAM,2BAA2B,CAAA;AACzF,OAAO,EACL,iBAAiB,GAIlB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AACpF,gFAAgF;AAChF,kFAAkF;AAClF,qFAAqF;AACrF,6BAA6B;AAC7B,OAAO,EACL,iBAAiB,EACjB,cAAc,GAEf,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,sBAAsB,GAEvB,MAAM,oCAAoC,CAAA;AAC3C,oFAAoF;AACpF,qEAAqE;AACrE,OAAO,EACL,6BAA6B,GAE9B,MAAM,2CAA2C,CAAA;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,sBAAsB,GAEvB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,wBAAwB,GAEzB,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,+BAA+B,GAEhC,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,GAErB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,mBAAmB,GAEpB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,uBAAuB,GAExB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,UAAU,EACV,cAAc,GAKf,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,GAGb,MAAM,oBAAoB,CAAA;AAsB3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EAAE,+BAA+B,EAAE,MAAM,4BAA4B,CAAA;AAE5E,mFAAmF;AACnF,iEAAiE;AACjE,cAAc,0BAA0B,CAAA;AACxC,cAAc,kCAAkC,CAAA;AAChD,4FAA4F;AAC5F,6FAA6F;AAC7F,cAAc,yBAAyB,CAAA;AAEvC,6FAA6F;AAC7F,wFAAwF;AACxF,6FAA6F;AAC7F,0EAA0E;AAC1E,OAAO,EAWL,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAEL,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qCAAqC,CAAA;AAE5C,2FAA2F;AAC3F,sEAAsE;AACtE,OAAO,EACL,8BAA8B,GAK/B,MAAM,sCAAsC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/server",
-  "version": "0.96.0",
+  "version": "0.97.0",
   "description": "Runtime-neutral HTTP layer for the Agent Architecture Board: the Hono controllers, middleware (auth/authz/CORS/error), request helpers and the gateway seams shared by every deployment facade (Cloudflare Worker, Node service).",
   "repository": {
     "type": "git",
@@ -30,13 +30,13 @@
     "hono": "^4.12.27",
     "pino": "^10.3.1",
     "valibot": "^1.4.2",
-    "@cat-factory/contracts": "0.113.0",
-    "@cat-factory/integrations": "0.75.1",
-    "@cat-factory/kernel": "0.103.0",
-    "@cat-factory/agents": "0.40.8",
-    "@cat-factory/orchestration": "0.86.0",
-    "@cat-factory/spend": "0.11.5",
-    "@cat-factory/prompt-fragments": "0.10.21"
+    "@cat-factory/agents": "0.40.9",
+    "@cat-factory/contracts": "0.114.0",
+    "@cat-factory/integrations": "0.76.0",
+    "@cat-factory/kernel": "0.104.0",
+    "@cat-factory/orchestration": "0.87.0",
+    "@cat-factory/prompt-fragments": "0.10.22",
+    "@cat-factory/spend": "0.11.6"
   },
   "devDependencies": {
     "@types/node": "^26.1.0",