@cat-factory/worker 0.33.5 → 0.33.7

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAE/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAK3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAA;AAEzD,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,SAAS,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACrC,mFAAmF;IACnF,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC,gFAAgF;IAChF,aAAa,CAAC,EAAE,qBAAqB,CAAA;CACtC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,OAAO,GAAE,gBAAqB,GAAG,IAAI,CAAC,MAAM,CAAC,CA2CtE"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAE/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAK3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAA;AAEzD,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,SAAS,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACrC,mFAAmF;IACnF,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC,gFAAgF;IAChF,aAAa,CAAC,EAAE,qBAAqB,CAAA;CACtC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,OAAO,GAAE,gBAAqB,GAAG,IAAI,CAAC,MAAM,CAAC,CA6CtE"}

package/dist/app.js

@@ -1,7 +1,7 @@
 import { mountAuthGate, registerCoreControllers } from '@cat-factory/server';
 import { Hono } from 'hono';
 import { cors } from 'hono/cors';
-import { resolveCorsOrigin } from './infrastructure/config/cors';
+import { CORS_ALLOWED_HEADERS, resolveCorsOrigin } from './infrastructure/config/cors';
 import { buildContainer } from './infrastructure/container';
 import { handleError } from './infrastructure/http/errorHandler';
 /**
@@ -24,9 +24,11 @@ export function createApp(options = {}) {
     // bearer header (not cookies), so credentials mode stays off.
     app.use('*', cors({
         origin: (origin, c) => resolveCorsOrigin(origin, c.env.CORS_ALLOWED_ORIGINS),
-        // X-Personal-Password carries the ambient personal-subscription unlock password
-        // (individual-usage vendors); it must be allow-listed or the browser drops it.
-        allowHeaders: ['Content-Type', 'Authorization', 'X-Personal-Password'],
+        // The shared allow-list (kept in @cat-factory/server so both facades match): the
+        // SPA sends X-Personal-Password (personal-subscription unlock) and X-Connection-Id
+        // (real-time self-echo suppression) on its calls, so each must be allow-listed or
+        // the browser drops the whole request with "CORS Missing Allow Header".
+        allowHeaders: [...CORS_ALLOWED_HEADERS],
     }));
     app.use('*', async (c, next) => {
         c.set('container', buildContainer(c.env, options.overrides, {

package/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAE5E,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAA;AAYhE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS,CAAC,OAAO,GAAqB,EAAE;IACtD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,6EAA6E;IAC7E,yEAAyE;IACzE,yEAAyE;IACzE,gFAAgF;IAChF,8DAA8D;IAC9D,GAAG,CAAC,GAAG,CACL,GAAG,EACH,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC5E,gFAAgF;QAChF,+EAA+E;QAC/E,YAAY,EAAE,CAAC,cAAc,EAAE,eAAe,EAAE,qBAAqB,CAAC;KACvE,CAAC,CACH,CAAA;IACD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC7B,CAAC,CAAC,GAAG,CACH,WAAW,EACX,cAAc,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE;YACvC,uBAAuB,EAAE,OAAO,CAAC,uBAAuB;YACxD,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC,CAAC,CACH,CAAA;QACD,MAAM,IAAI,EAAE,CAAA;IACd,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAEnD,iFAAiF;IACjF,mFAAmF;IACnF,aAAa,CAAC,GAAG,CAAC,CAAA;IAElB,mFAAmF;IACnF,mFAAmF;IACnF,8EAA8E;IAC9E,gCAAgC;IAChC,uBAAuB,CAAC,GAAG,CAAC,CAAA;IAE5B,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IAExB,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAE5E,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AACtF,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAA;AAYhE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS,CAAC,OAAO,GAAqB,EAAE;IACtD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,6EAA6E;IAC7E,yEAAyE;IACzE,yEAAyE;IACzE,gFAAgF;IAChF,8DAA8D;IAC9D,GAAG,CAAC,GAAG,CACL,GAAG,EACH,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC5E,iFAAiF;QACjF,mFAAmF;QACnF,kFAAkF;QAClF,wEAAwE;QACxE,YAAY,EAAE,CAAC,GAAG,oBAAoB,CAAC;KACxC,CAAC,CACH,CAAA;IACD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC7B,CAAC,CAAC,GAAG,CACH,WAAW,EACX,cAAc,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE;YACvC,uBAAuB,EAAE,OAAO,CAAC,uBAAuB;YACxD,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC,CAAC,CACH,CAAA;QACD,MAAM,IAAI,EAAE,CAAA;IACd,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAEnD,iFAAiF;IACjF,mFAAmF;IACnF,aAAa,CAAC,GAAG,CAAC,CAAA;IAElB,mFAAmF;IACnF,mFAAmF;IACnF,8EAA8E;IAC9E,gCAAgC;IAChC,uBAAuB,CAAC,GAAG,CAAC,CAAA;IAE5B,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IAExB,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/infrastructure/config/cors.d.ts

@@ -1,2 +1,2 @@
-export { parseAllowedOrigins, resolveCorsOrigin } from '@cat-factory/server';
+export { CORS_ALLOWED_HEADERS, parseAllowedOrigins, resolveCorsOrigin } from '@cat-factory/server';
 //# sourceMappingURL=cors.d.ts.map

package/dist/infrastructure/config/cors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/config/cors.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/config/cors.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/config/cors.js

@@ -1,3 +1,3 @@
 // Moved to the shared @cat-factory/server package; re-exported for existing imports.
-export { parseAllowedOrigins, resolveCorsOrigin } from '@cat-factory/server';
+export { CORS_ALLOWED_HEADERS, parseAllowedOrigins, resolveCorsOrigin } from '@cat-factory/server';
 //# sourceMappingURL=cors.js.map

package/dist/infrastructure/config/cors.js.map

@@ -1 +1 @@
-{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../../src/infrastructure/config/cors.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../../src/infrastructure/config/cors.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/worker",
-  "version": "0.33.5",
+  "version": "0.33.7",
   "description": "Reusable Cloudflare Worker library (Hono + D1) exposing the Agent Architecture Board core: the `createApp()` Hono factory, the default fetch/scheduled/queue handler, and the Durable Object + Workflow classes. Deployments (see deploy/backend) supply the wrangler.toml + config and re-export these.",
   "repository": {
     "type": "git",
@@ -42,19 +42,19 @@
     "pino": "^10.3.1",
     "valibot": "^1.4.1",
     "workers-ai-provider": "^3.2.0",
-    "@cat-factory/agents": "0.21.4",
-    "@cat-factory/consensus": "0.7.62",
-    "@cat-factory/contracts": "0.43.1",
-    "@cat-factory/gates": "0.2.14",
-    "@cat-factory/gitlab": "0.1.5",
-    "@cat-factory/integrations": "0.26.3",
-    "@cat-factory/kernel": "0.45.3",
-    "@cat-factory/observability-langfuse": "0.7.58",
-    "@cat-factory/orchestration": "0.36.3",
-    "@cat-factory/prompt-fragments": "0.8.1",
-    "@cat-factory/provider-cloudflare": "0.7.62",
-    "@cat-factory/server": "0.39.5",
-    "@cat-factory/spend": "0.10.19"
+    "@cat-factory/agents": "0.21.5",
+    "@cat-factory/consensus": "0.7.63",
+    "@cat-factory/contracts": "0.43.2",
+    "@cat-factory/gates": "0.2.15",
+    "@cat-factory/gitlab": "0.1.6",
+    "@cat-factory/integrations": "0.26.4",
+    "@cat-factory/kernel": "0.45.4",
+    "@cat-factory/observability-langfuse": "0.7.59",
+    "@cat-factory/orchestration": "0.36.4",
+    "@cat-factory/prompt-fragments": "0.8.2",
+    "@cat-factory/provider-cloudflare": "0.7.63",
+    "@cat-factory/server": "0.39.7",
+    "@cat-factory/spend": "0.10.20"
   },
   "devDependencies": {
     "@cloudflare/vitest-pool-workers": "^0.16.19",
@@ -62,7 +62,7 @@
     "typescript": "7.0.1-rc",
     "vitest": "^4.1.9",
     "wrangler": "^4.104.0",
-    "@cat-factory/conformance": "0.9.12"
+    "@cat-factory/conformance": "0.9.13"
   },
   "scripts": {
     "build": "tsc -b tsconfig.build.json",