@cat-factory/worker 0.6.0 → 0.7.2

package/dist/infrastructure/documents/NotionProvider.js

@@ -1,220 +0,0 @@
-import { ValidationError, } from '@cat-factory/kernel';
-import { NOTION_DESCRIPTOR, notionLogic } from '@cat-factory/integrations';
-// NotionProvider: the document-source provider for Notion. It authenticates with
-// a single internal-integration token (Bearer), fetches a page for its title and
-// URL, then pages through the page's top-level blocks and converts them to the
-// Markdown the planner consumes. Because the API host is fixed
-// (`api.notion.com`) and there is no per-site base URL, there is no SSRF surface.
-// Notion-specific *pure* logic (ref parsing, block → Markdown) lives in
-// `@cat-factory/integrations`; this class is the thin `fetch` shell.
-const API_BASE = 'https://api.notion.com/v1';
-const NOTION_API_HOST = 'api.notion.com';
-const NOTION_VERSION = '2022-06-28';
-const USER_AGENT = 'cat-factory';
-/** Bound the block backfill so a huge page can't stall an import (100 blocks/page). */
-const MAX_BLOCK_PAGES = 5;
-/** Bound the redirect chain so the fixed API host can't 302 us elsewhere. */
-const MAX_REDIRECTS = 5;
-/** Hard cap on the bytes read off any response body, to protect the isolate. */
-const MAX_RESPONSE_BYTES = 5_000_000;
-/** Carries the HTTP status so callers can surface a meaningful error. */
-export class NotionApiError extends Error {
-    status;
-    constructor(status, message) {
-        super(message);
-        this.status = status;
-        this.name = 'NotionApiError';
-    }
-}
-/**
- * The Notion API host is fixed, so any redirect must stay on `api.notion.com`
- * over https. A redirect off-host (e.g. to an internal address) is treated as an
- * SSRF attempt and rejected. Mirrors the per-hop guard the site-configurable
- * providers run.
- */
-function assertSafeNotionUrl(url) {
-    let parsed;
-    try {
-        parsed = new URL(url);
-    }
-    catch {
-        throw new NotionApiError(502, `Notion request URL is invalid: ${url}`);
-    }
-    if (parsed.protocol !== 'https:') {
-        throw new NotionApiError(502, 'Notion request must use https');
-    }
-    if (parsed.hostname.toLowerCase() !== NOTION_API_HOST) {
-        throw new NotionApiError(502, `Notion redirect to a disallowed host: ${parsed.hostname}`);
-    }
-}
-/**
- * `fetch` with redirects followed by hand so the host guard runs against EVERY
- * hop. With the default `redirect: 'follow'` a 302 from the API could be chased
- * to an internal target (or downgraded to http), leaking the Bearer token. We
- * force `redirect: 'manual'`, re-resolve the `Location`, and re-validate.
- */
-async function safeFetch(url, init) {
-    let current = url;
-    for (let hop = 0;; hop++) {
-        assertSafeNotionUrl(current);
-        const res = await fetch(current, { ...init, redirect: 'manual' });
-        if (res.status >= 300 && res.status < 400) {
-            const location = res.headers.get('location');
-            if (!location)
-                return res;
-            if (hop >= MAX_REDIRECTS) {
-                throw new NotionApiError(502, 'Notion returned too many redirects');
-            }
-            current = new URL(location, current).toString();
-            continue;
-        }
-        return res;
-    }
-}
-/**
- * Read a response body with a running byte cap so a hostile/huge response can't
- * OOM the isolate. Checks the declared Content-Length first, then enforces the
- * cap while streaming.
- */
-async function readCappedText(res, maxBytes) {
-    const declared = res.headers.get('content-length');
-    if (declared && Number(declared) > maxBytes) {
-        throw new NotionApiError(502, 'Notion response too large');
-    }
-    const body = res.body;
-    if (!body)
-        return '';
-    const reader = body.getReader();
-    const chunks = [];
-    let total = 0;
-    try {
-        for (;;) {
-            const { done, value } = await reader.read();
-            if (done)
-                break;
-            if (!value)
-                continue;
-            total += value.byteLength;
-            if (total > maxBytes) {
-                await reader.cancel();
-                throw new NotionApiError(502, 'Notion response too large');
-            }
-            chunks.push(value);
-        }
-    }
-    finally {
-        reader.releaseLock();
-    }
-    const merged = new Uint8Array(total);
-    let offset = 0;
-    for (const c of chunks) {
-        merged.set(c, offset);
-        offset += c.byteLength;
-    }
-    return new TextDecoder().decode(merged);
-}
-export class NotionProvider {
-    kind = 'notion';
-    descriptor = NOTION_DESCRIPTOR;
-    normalizeConnection(input) {
-        const apiToken = input.apiToken?.trim();
-        if (!apiToken) {
-            throw new ValidationError('Notion requires an internal integration token');
-        }
-        return { credentials: { apiToken }, label: 'Notion workspace' };
-    }
-    parseRef(input) {
-        return notionLogic.parseNotionRef(input);
-    }
-    async fetchDocument(credentials, externalId) {
-        const page = await this.get(credentials, `/pages/${encodeURIComponent(externalId)}`);
-        if (!page.id) {
-            throw new NotionApiError(502, `Notion returned an unexpected body for page ${externalId}`);
-        }
-        const blocks = await this.fetchBlocks(credentials, page.id);
-        return {
-            externalId: page.id,
-            title: notionLogic.notionPageTitle(page.properties),
-            url: page.url ?? `https://www.notion.so/${page.id.replace(/-/g, '')}`,
-            body: notionLogic.notionBlocksToMarkdown(blocks),
-        };
-    }
-    async search(credentials, query) {
-        const res = await safeFetch(`${API_BASE}/search`, {
-            method: 'POST',
-            headers: {
-                authorization: `Bearer ${credentials.apiToken}`,
-                'notion-version': NOTION_VERSION,
-                accept: 'application/json',
-                'content-type': 'application/json',
-                'user-agent': USER_AGENT,
-            },
-            body: JSON.stringify({
-                query,
-                filter: { property: 'object', value: 'page' },
-                page_size: 20,
-            }),
-        });
-        if (!res.ok) {
-            const text = await readCappedText(res, MAX_RESPONSE_BYTES).catch(() => '');
-            throw new NotionApiError(res.status, `Notion search → ${res.status}: ${text.slice(0, 300)}`);
-        }
-        const text = await readCappedText(res, MAX_RESPONSE_BYTES);
-        const json = (() => {
-            try {
-                return JSON.parse(text);
-            }
-            catch {
-                return null;
-            }
-        })();
-        return notionLogic.parseNotionSearchResults(json);
-    }
-    /** Page through a page's top-level blocks (bounded), returning them in order. */
-    async fetchBlocks(credentials, pageId) {
-        const blocks = [];
-        let cursor;
-        for (let i = 0; i < MAX_BLOCK_PAGES; i++) {
-            const query = cursor
-                ? `?page_size=100&start_cursor=${encodeURIComponent(cursor)}`
-                : '?page_size=100';
-            const res = await this.get(credentials, `/blocks/${encodeURIComponent(pageId)}/children${query}`);
-            if (Array.isArray(res.results))
-                blocks.push(...res.results);
-            if (!res.has_more || !res.next_cursor)
-                break;
-            cursor = res.next_cursor;
-        }
-        return blocks;
-    }
-    async get(credentials, path) {
-        const url = `${API_BASE}${path}`;
-        const res = await safeFetch(url, {
-            method: 'GET',
-            headers: {
-                authorization: `Bearer ${credentials.apiToken}`,
-                'notion-version': NOTION_VERSION,
-                accept: 'application/json',
-                'user-agent': USER_AGENT,
-            },
-        });
-        if (!res.ok) {
-            const text = await readCappedText(res, MAX_RESPONSE_BYTES).catch(() => '');
-            throw new NotionApiError(res.status, `Notion GET ${url} → ${res.status}: ${text.slice(0, 300)}`);
-        }
-        const text = await readCappedText(res, MAX_RESPONSE_BYTES);
-        const json = (() => {
-            try {
-                return JSON.parse(text);
-            }
-            catch {
-                return null;
-            }
-        })();
-        if (json === null) {
-            throw new NotionApiError(502, `Notion returned an unparseable body for ${path}`);
-        }
-        return json;
-    }
-}
-//# sourceMappingURL=NotionProvider.js.map

package/dist/infrastructure/documents/NotionProvider.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"NotionProvider.js","sourceRoot":"","sources":["../../../src/infrastructure/documents/NotionProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,GAMhB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AAE1E,iFAAiF;AACjF,iFAAiF;AACjF,+EAA+E;AAC/E,+DAA+D;AAC/D,kFAAkF;AAClF,wEAAwE;AACxE,qEAAqE;AAErE,MAAM,QAAQ,GAAG,2BAA2B,CAAA;AAC5C,MAAM,eAAe,GAAG,gBAAgB,CAAA;AACxC,MAAM,cAAc,GAAG,YAAY,CAAA;AACnC,MAAM,UAAU,GAAG,aAAa,CAAA;AAChC,uFAAuF;AACvF,MAAM,eAAe,GAAG,CAAC,CAAA;AACzB,6EAA6E;AAC7E,MAAM,aAAa,GAAG,CAAC,CAAA;AACvB,gFAAgF;AAChF,MAAM,kBAAkB,GAAG,SAAS,CAAA;AAEpC,yEAAyE;AACzE,MAAM,OAAO,cAAe,SAAQ,KAAK;IAE5B,MAAM;IADjB,YACW,MAAc,EACvB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAA;sBAHL,MAAM;QAIf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAA;IAC9B,CAAC;CACF;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,MAAW,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,kCAAkC,GAAG,EAAE,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAA;IAChE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,eAAe,EAAE,CAAC;QACtD,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,yCAAyC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC3F,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,IAAiB;IACrD,IAAI,OAAO,GAAG,GAAG,CAAA;IACjB,KAAK,IAAI,GAAG,GAAG,CAAC,GAAI,GAAG,EAAE,EAAE,CAAC;QAC1B,mBAAmB,CAAC,OAAO,CAAC,CAAA;QAC5B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;QACjE,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;YAC5C,IAAI,CAAC,QAAQ;gBAAE,OAAO,GAAG,CAAA;YACzB,IAAI,GAAG,IAAI,aAAa,EAAE,CAAC;gBACzB,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,oCAAoC,CAAC,CAAA;YACrE,CAAC;YACD,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAA;YAC/C,SAAQ;QACV,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAAC,GAAa,EAAE,QAAgB;IAC3D,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IAClD,IAAI,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;IACrB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAA;IACpB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAA;IAC/B,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YAC3C,IAAI,IAAI;gBAAE,MAAK;YACf,IAAI,CAAC,KAAK;gBAAE,SAAQ;YACpB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAA;YACzB,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAA;gBACrB,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAA;YAC5D,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAA;IACtB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACpC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACrB,MAAM,IAAI,CAAC,CAAC,UAAU,CAAA;IACxB,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AACzC,CAAC;AAcD,MAAM,OAAO,cAAc;IAChB,IAAI,GAAG,QAAiB,CAAA;IACxB,UAAU,GAAG,iBAAiB,CAAA;IAEvC,mBAAmB,CAAC,KAA0B;QAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAA;QACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,eAAe,CAAC,+CAA+C,CAAC,CAAA;QAC5E,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAA;IACjE,CAAC;IAED,QAAQ,CAAC,KAAa;QACpB,OAAO,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;IAC1C,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,WAAgC,EAChC,UAAkB;QAElB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CACzB,WAAW,EACX,UAAU,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAC3C,CAAA;QACD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,+CAA+C,UAAU,EAAE,CAAC,CAAA;QAC5F,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QAC3D,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,EAAE;YACnB,KAAK,EAAE,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC;YACnD,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,yBAAyB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE;YACrE,IAAI,EAAE,WAAW,CAAC,sBAAsB,CAAC,MAAM,CAAC;SACjD,CAAA;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAgC,EAAE,KAAa;QAC1D,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,QAAQ,SAAS,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,CAAC,QAAQ,EAAE;gBAC/C,gBAAgB,EAAE,cAAc;gBAChC,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,UAAU;aACzB;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK;gBACL,MAAM,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE;gBAC7C,SAAS,EAAE,EAAE;aACd,CAAC;SACH,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAC1E,MAAM,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,mBAAmB,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;QAC9F,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;QAC1D,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE;YACjB,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;QACJ,OAAO,WAAW,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAA;IACnD,CAAC;IAED,iFAAiF;IACzE,KAAK,CAAC,WAAW,CACvB,WAAgC,EAChC,MAAc;QAEd,MAAM,MAAM,GAA8B,EAAE,CAAA;QAC5C,IAAI,MAA0B,CAAA;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,MAAM;gBAClB,CAAC,CAAC,+BAA+B,kBAAkB,CAAC,MAAM,CAAC,EAAE;gBAC7D,CAAC,CAAC,gBAAgB,CAAA;YACpB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CACxB,WAAW,EACX,WAAW,kBAAkB,CAAC,MAAM,CAAC,YAAY,KAAK,EAAE,CACzD,CAAA;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,CAAA;YAC3D,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,MAAK;YAC5C,MAAM,GAAG,GAAG,CAAC,WAAW,CAAA;QAC1B,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAEO,KAAK,CAAC,GAAG,CAAI,WAAgC,EAAE,IAAY;QACjE,MAAM,GAAG,GAAG,GAAG,QAAQ,GAAG,IAAI,EAAE,CAAA;QAChC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YAC/B,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,CAAC,QAAQ,EAAE;gBAC/C,gBAAgB,EAAE,cAAc;gBAChC,MAAM,EAAE,kBAAkB;gBAC1B,YAAY,EAAE,UAAU;aACzB;SACF,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAC1E,MAAM,IAAI,cAAc,CACtB,GAAG,CAAC,MAAM,EACV,cAAc,GAAG,MAAM,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC3D,CAAA;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;QAC1D,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE;YACjB,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAA;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;QACJ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,2CAA2C,IAAI,EAAE,CAAC,CAAA;QAClF,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;CACF"}

package/dist/infrastructure/environments/HttpEnvironmentProvider.d.ts

@@ -1,27 +0,0 @@
-import { type EnvironmentProvider, type EnvironmentStatusRequest, type EnvironmentTeardownRequest, type EnvironmentStatus, type ProvisionEnvironmentRequest, type ProvisionedEnvironment } from '@cat-factory/kernel';
-/** Carries the HTTP status so the API can surface a meaningful (redacted) error. */
-export declare class EnvironmentApiError extends Error {
-    readonly status: number;
-    constructor(status: number, message: string);
-}
-export interface HttpEnvironmentProviderOptions {
-    defaultTimeoutMs?: number;
-}
-export declare class HttpEnvironmentProvider implements EnvironmentProvider {
-    private readonly defaultTimeoutMs;
-    /** Per-isolate OAuth token cache, keyed by token URL + client id. */
-    private readonly oauthCache;
-    constructor(options?: HttpEnvironmentProviderOptions);
-    provision(req: ProvisionEnvironmentRequest): Promise<ProvisionedEnvironment>;
-    status(req: EnvironmentStatusRequest): Promise<ProvisionedEnvironment>;
-    teardown(req: EnvironmentTeardownRequest): Promise<{
-        status: EnvironmentStatus;
-    }>;
-    private execute;
-    private buildUrl;
-    private authHeaders;
-    private oauthToken;
-    private mapResponse;
-    private mapAccess;
-}
-//# sourceMappingURL=HttpEnvironmentProvider.d.ts.map

package/dist/infrastructure/environments/HttpEnvironmentProvider.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"HttpEnvironmentProvider.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/environments/HttpEnvironmentProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,mBAAmB,EAExB,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,EACtB,KAAK,2BAA2B,EAEhC,KAAK,sBAAsB,EAE5B,MAAM,qBAAqB,CAAA;AAqB5B,oFAAoF;AACpF,qBAAa,mBAAoB,SAAQ,KAAK;IAE1C,QAAQ,CAAC,MAAM,EAAE,MAAM;IADzB,YACW,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM,EAIhB;CACF;AAqFD,MAAM,WAAW,8BAA8B;IAC7C,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,qBAAa,uBAAwB,YAAW,mBAAmB;IACjE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAQ;IACzC,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA0D;IAErF,YAAY,OAAO,GAAE,8BAAmC,EAEvD;IAEK,SAAS,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAajF;IAEK,MAAM,CAAC,GAAG,EAAE,wBAAwB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAwB3E;IAEK,QAAQ,CAAC,GAAG,EAAE,0BAA0B,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAatF;YAIa,OAAO;IAmDrB,OAAO,CAAC,QAAQ;YAoBF,WAAW;YAgCX,UAAU;IAsDxB,OAAO,CAAC,WAAW;IA4BnB,OAAO,CAAC,SAAS;CAiBlB"}

package/dist/infrastructure/environments/HttpEnvironmentProvider.js

@@ -1,314 +0,0 @@
-import {} from '@cat-factory/kernel';
-import { environmentsLogic } from '@cat-factory/integrations';
-// The single generic adapter that interprets ANY environment manifest. There are
-// no per-provider presets: an org's self-rolled management API is described as
-// HTTP request templates with `{{var}}` interpolation, an auth scheme, and a
-// dot-path mapping from its (arbitrary) response onto the canonical handle.
-//
-// Security: every URL is SSRF-guarded before it is fetched; the per-tenant
-// secrets are resolved in-memory via the injected resolver and only ever placed
-// in request headers — never logged or echoed in errors (error bodies are
-// length-capped and carry no request headers).
-const DEFAULT_TIMEOUT_MS = 15_000;
-const MAX_RESPONSE_CHARS = 200_000;
-/** Hard cap on the bytes read off any response body (mirrors MAX_RESPONSE_CHARS). */
-const MAX_RESPONSE_BYTES = MAX_RESPONSE_CHARS;
-/** Bound the redirect chain so a permitted first hop can't walk us anywhere. */
-const MAX_REDIRECTS = 5;
-const USER_AGENT = 'cat-factory';
-/** Carries the HTTP status so the API can surface a meaningful (redacted) error. */
-export class EnvironmentApiError extends Error {
-    status;
-    constructor(status, message) {
-        super(message);
-        this.status = status;
-        this.name = 'EnvironmentApiError';
-    }
-}
-/**
- * `fetch` with redirects followed by hand so the SSRF guard runs against EVERY
- * hop, not just the first URL. With the default `redirect: 'follow'` a permitted
- * host can 302 to an internal target (e.g. 169.254.169.254) — or downgrade
- * https→http — and the runtime would follow it unchecked. We force
- * `redirect: 'manual'`, re-resolve the `Location` against the current URL, and
- * re-run the same `assertSafe` guard (which also enforces https-only) before
- * following. A redirect target that fails the guard throws exactly as an invalid
- * initial URL would.
- */
-async function safeFetch(url, init, assertSafe) {
-    let current = url;
-    for (let hop = 0;; hop++) {
-        assertSafe(current);
-        const res = await fetch(current, { ...init, redirect: 'manual' });
-        if (res.status >= 300 && res.status < 400) {
-            const location = res.headers.get('location');
-            if (!location)
-                return res;
-            if (hop >= MAX_REDIRECTS) {
-                throw new EnvironmentApiError(502, 'Environment provider returned too many redirects');
-            }
-            // Resolve relative redirects against the current URL, then re-validate.
-            current = new URL(location, current).toString();
-            continue;
-        }
-        return res;
-    }
-}
-/**
- * Read a response body with a running byte cap so a hostile/huge response can't
- * OOM the isolate. Checks the declared Content-Length first, then enforces the
- * cap while streaming. When `throwOnOverflow` is false (error snippets) the body
- * is truncated instead of throwing.
- */
-async function readCappedText(res, maxBytes, throwOnOverflow = true) {
-    const declared = res.headers.get('content-length');
-    if (declared && Number(declared) > maxBytes) {
-        if (throwOnOverflow) {
-            throw new EnvironmentApiError(502, 'Environment provider response too large');
-        }
-    }
-    const body = res.body;
-    if (!body)
-        return '';
-    const reader = body.getReader();
-    const chunks = [];
-    let total = 0;
-    try {
-        for (;;) {
-            const { done, value } = await reader.read();
-            if (done)
-                break;
-            if (!value)
-                continue;
-            total += value.byteLength;
-            if (total > maxBytes) {
-                await reader.cancel();
-                if (throwOnOverflow) {
-                    throw new EnvironmentApiError(502, 'Environment provider response too large');
-                }
-                chunks.push(value);
-                break;
-            }
-            chunks.push(value);
-        }
-    }
-    finally {
-        reader.releaseLock();
-    }
-    const merged = new Uint8Array(chunks.reduce((n, c) => n + c.byteLength, 0));
-    let offset = 0;
-    for (const c of chunks) {
-        merged.set(c, offset);
-        offset += c.byteLength;
-    }
-    return new TextDecoder().decode(merged).slice(0, maxBytes);
-}
-export class HttpEnvironmentProvider {
-    defaultTimeoutMs;
-    /** Per-isolate OAuth token cache, keyed by token URL + client id. */
-    oauthCache = new Map();
-    constructor(options = {}) {
-        this.defaultTimeoutMs = options.defaultTimeoutMs ?? DEFAULT_TIMEOUT_MS;
-    }
-    async provision(req) {
-        const json = await this.execute(req.manifest, req.manifest.provision, {
-            input: req.inputs,
-            provision: {},
-        }, req.resolveSecret);
-        // A successful provision call defaults to 'ready' unless the manifest maps a
-        // status string (e.g. an async provisioner returning 'pending').
-        return this.mapResponse(req.manifest, json, 'ready');
-    }
-    async status(req) {
-        if (!req.manifest.status) {
-            // No status endpoint declared: treat the environment as ready and echo what
-            // we captured at provision time.
-            return {
-                externalId: req.externalId,
-                url: req.provisionFields.url ?? null,
-                status: 'ready',
-                expiresAt: null,
-                access: null,
-                fields: req.provisionFields,
-            };
-        }
-        const json = await this.execute(req.manifest, req.manifest.status, {
-            input: {},
-            provision: req.provisionFields,
-        }, req.resolveSecret);
-        const mapped = this.mapResponse(req.manifest, json, 'ready');
-        return { ...mapped, externalId: mapped.externalId ?? req.externalId };
-    }
-    async teardown(req) {
-        if (req.manifest.teardown) {
-            await this.execute(req.manifest, req.manifest.teardown, {
-                input: {},
-                provision: req.provisionFields,
-            }, req.resolveSecret);
-        }
-        return { status: 'torn_down' };
-    }
-    // --- internals ----------------------------------------------------------
-    async execute(manifest, template, scope, resolveSecret) {
-        const url = this.buildUrl(manifest.baseUrl, template, scope);
-        const headers = {
-            accept: 'application/json',
-            'user-agent': USER_AGENT,
-            ...(await this.authHeaders(manifest.auth, resolveSecret)),
-        };
-        for (const h of template.headers ?? []) {
-            headers[h.name] = environmentsLogic.interpolateTemplate(h.value, scope);
-        }
-        let body;
-        if (template.bodyTemplate !== undefined && template.method !== 'GET') {
-            body = environmentsLogic.interpolateTemplate(template.bodyTemplate, scope);
-            if (!headers['content-type'])
-                headers['content-type'] = 'application/json';
-        }
-        const res = await safeFetch(url, {
-            method: template.method,
-            headers,
-            body,
-            signal: AbortSignal.timeout(template.timeoutMs ?? this.defaultTimeoutMs),
-        }, (u) => environmentsLogic.assertSafeEnvironmentUrl(u, 'request URL'));
-        if (!res.ok) {
-            const errText = await readCappedText(res, MAX_RESPONSE_BYTES, false).catch(() => '');
-            throw new EnvironmentApiError(res.status, `Environment provider ${template.method} → ${res.status}: ${errText.slice(0, 300)}`);
-        }
-        const text = await readCappedText(res, MAX_RESPONSE_BYTES);
-        if (!text)
-            return {};
-        try {
-            return JSON.parse(text);
-        }
-        catch {
-            // Non-JSON responses leave the mapping to resolve to nulls.
-            return {};
-        }
-    }
-    buildUrl(baseUrl, template, scope) {
-        const base = baseUrl.replace(/\/+$/, '');
-        const path = environmentsLogic.interpolateTemplate(template.pathTemplate, scope);
-        let url = path ? `${base}${path.startsWith('/') ? '' : '/'}${path}` : base;
-        const query = (template.query ?? [])
-            .map((q) => `${encodeURIComponent(q.key)}=${encodeURIComponent(environmentsLogic.interpolateTemplate(q.value, scope))}`)
-            .join('&');
-        if (query)
-            url += `${url.includes('?') ? '&' : '?'}${query}`;
-        return url;
-    }
-    async authHeaders(auth, resolveSecret) {
-        const secret = (key) => {
-            const value = resolveSecret(key);
-            if (value === undefined)
-                throw new EnvironmentApiError(500, `Missing secret '${key}'`);
-            return value;
-        };
-        switch (auth.type) {
-            case 'none':
-                return {};
-            case 'api_key':
-                return { [auth.headerName]: `${auth.valuePrefix ?? ''}${secret(auth.secretRef.key)}` };
-            case 'bearer':
-                return { authorization: `Bearer ${secret(auth.secretRef.key)}` };
-            case 'basic':
-                return {
-                    authorization: `Basic ${btoa(`${secret(auth.usernameSecretRef.key)}:${secret(auth.passwordSecretRef.key)}`)}`,
-                };
-            case 'oauth2_client_credentials':
-                return { authorization: `Bearer ${await this.oauthToken(auth, secret)}` };
-            case 'custom_headers': {
-                const headers = {};
-                for (const h of auth.headers)
-                    headers[h.name] = secret(h.secretRef.key);
-                return headers;
-            }
-        }
-    }
-    async oauthToken(auth, secret) {
-        const clientId = secret(auth.clientIdSecretRef.key);
-        const cacheKey = `${auth.tokenUrl}::${clientId}`;
-        const cached = this.oauthCache.get(cacheKey);
-        if (cached && cached.expiresAt > Date.now() + 5_000)
-            return cached.token;
-        const form = new URLSearchParams({
-            grant_type: 'client_credentials',
-            client_id: clientId,
-            client_secret: secret(auth.clientSecretSecretRef.key),
-        });
-        if (auth.scope)
-            form.set('scope', auth.scope);
-        if (auth.audience)
-            form.set('audience', auth.audience);
-        const res = await safeFetch(auth.tokenUrl, {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/x-www-form-urlencoded',
-                accept: 'application/json',
-                'user-agent': USER_AGENT,
-            },
-            body: form.toString(),
-            signal: AbortSignal.timeout(this.defaultTimeoutMs),
-        }, (u) => environmentsLogic.assertSafeEnvironmentUrl(u, 'OAuth token URL'));
-        if (!res.ok) {
-            const text = await readCappedText(res, MAX_RESPONSE_BYTES, false).catch(() => '');
-            throw new EnvironmentApiError(res.status, `OAuth token request → ${res.status}: ${text.slice(0, 200)}`);
-        }
-        const tokenText = await readCappedText(res, MAX_RESPONSE_BYTES);
-        const json = (() => {
-            try {
-                return JSON.parse(tokenText);
-            }
-            catch {
-                return null;
-            }
-        })();
-        if (!json?.access_token) {
-            throw new EnvironmentApiError(502, 'OAuth token response missing access_token');
-        }
-        const ttlMs = (typeof json.expires_in === 'number' ? json.expires_in : 300) * 1000;
-        this.oauthCache.set(cacheKey, { token: json.access_token, expiresAt: Date.now() + ttlMs });
-        return json.access_token;
-    }
-    mapResponse(manifest, json, fallbackStatus) {
-        const r = manifest.response;
-        const externalId = environmentsLogic.extractString(json, r.externalIdPath) ?? null;
-        const url = environmentsLogic.extractString(json, r.urlPath) ?? null;
-        const rawStatus = environmentsLogic.extractString(json, r.statusPath);
-        const status = environmentsLogic.mapStatus(rawStatus, r.statusMap, fallbackStatus);
-        const expiresAt = r.expiresAtPath
-            ? environmentsLogic.coerceExpiresAt(environmentsLogic.extractByPath(json, r.expiresAtPath))
-            : null;
-        const fields = {};
-        if (externalId)
-            fields.externalId = externalId;
-        if (url)
-            fields.url = url;
-        return {
-            externalId,
-            url,
-            status,
-            expiresAt,
-            access: this.mapAccess(r.access, json),
-            fields,
-        };
-    }
-    mapAccess(mapping, json) {
-        if (!mapping)
-            return null;
-        const access = { scheme: mapping.scheme };
-        if (mapping.scheme === 'bearer') {
-            access.token = environmentsLogic.extractString(json, mapping.tokenPath);
-        }
-        else if (mapping.scheme === 'basic') {
-            access.username = environmentsLogic.extractString(json, mapping.usernamePath);
-            access.password = environmentsLogic.extractString(json, mapping.passwordPath);
-        }
-        else if (mapping.scheme === 'custom_header') {
-            access.headerName = mapping.headerName;
-            access.headerValue = environmentsLogic.extractString(json, mapping.headerValuePath);
-        }
-        return access;
-    }
-}
-//# sourceMappingURL=HttpEnvironmentProvider.js.map

package/dist/infrastructure/environments/HttpEnvironmentProvider.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"HttpEnvironmentProvider.js","sourceRoot":"","sources":["../../../src/infrastructure/environments/HttpEnvironmentProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAcN,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAE7D,iFAAiF;AACjF,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,EAAE;AACF,2EAA2E;AAC3E,gFAAgF;AAChF,0EAA0E;AAC1E,+CAA+C;AAE/C,MAAM,kBAAkB,GAAG,MAAM,CAAA;AACjC,MAAM,kBAAkB,GAAG,OAAO,CAAA;AAClC,qFAAqF;AACrF,MAAM,kBAAkB,GAAG,kBAAkB,CAAA;AAC7C,gFAAgF;AAChF,MAAM,aAAa,GAAG,CAAC,CAAA;AACvB,MAAM,UAAU,GAAG,aAAa,CAAA;AAEhC,oFAAoF;AACpF,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAEjC,MAAM;IADjB,YACW,MAAc,EACvB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAA;sBAHL,MAAM;QAIf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,SAAS,CACtB,GAAW,EACX,IAAiB,EACjB,UAA+B;IAE/B,IAAI,OAAO,GAAG,GAAG,CAAA;IACjB,KAAK,IAAI,GAAG,GAAG,CAAC,GAAI,GAAG,EAAE,EAAE,CAAC;QAC1B,UAAU,CAAC,OAAO,CAAC,CAAA;QACnB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;QACjE,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;YAC5C,IAAI,CAAC,QAAQ;gBAAE,OAAO,GAAG,CAAA;YACzB,IAAI,GAAG,IAAI,aAAa,EAAE,CAAC;gBACzB,MAAM,IAAI,mBAAmB,CAAC,GAAG,EAAE,kDAAkD,CAAC,CAAA;YACxF,CAAC;YACD,wEAAwE;YACxE,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAA;YAC/C,SAAQ;QACV,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAC3B,GAAa,EACb,QAAgB,EAChB,eAAe,GAAG,IAAI;IAEtB,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IAClD,IAAI,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,QAAQ,EAAE,CAAC;QAC5C,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,IAAI,mBAAmB,CAAC,GAAG,EAAE,yCAAyC,CAAC,CAAA;QAC/E,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;IACrB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAA;IACpB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAA;IAC/B,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YAC3C,IAAI,IAAI;gBAAE,MAAK;YACf,IAAI,CAAC,KAAK;gBAAE,SAAQ;YACpB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAA;YACzB,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAA;gBACrB,IAAI,eAAe,EAAE,CAAC;oBACpB,MAAM,IAAI,mBAAmB,CAAC,GAAG,EAAE,yCAAyC,CAAC,CAAA;gBAC/E,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAClB,MAAK;YACP,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAA;IACtB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAA;IAC3E,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACrB,MAAM,IAAI,CAAC,CAAC,UAAU,CAAA;IACxB,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;AAC5D,CAAC;AAMD,MAAM,OAAO,uBAAuB;IACjB,gBAAgB,CAAQ;IACzC,qEAAqE;IACpD,UAAU,GAAG,IAAI,GAAG,EAAgD,CAAA;IAErF,YAAY,OAAO,GAAmC,EAAE;QACtD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,kBAAkB,CAAA;IACxE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAgC;QAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,GAAG,CAAC,QAAQ,EACZ,GAAG,CAAC,QAAQ,CAAC,SAAS,EACtB;YACE,KAAK,EAAE,GAAG,CAAC,MAAM;YACjB,SAAS,EAAE,EAAE;SACd,EACD,GAAG,CAAC,aAAa,CAClB,CAAA;QACD,6EAA6E;QAC7E,iEAAiE;QACjE,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IACtD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAA6B;QACxC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACzB,4EAA4E;YAC5E,iCAAiC;YACjC,OAAO;gBACL,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,GAAG,EAAE,GAAG,CAAC,eAAe,CAAC,GAAG,IAAI,IAAI;gBACpC,MAAM,EAAE,OAAO;gBACf,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,GAAG,CAAC,eAAe;aAC5B,CAAA;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,GAAG,CAAC,QAAQ,EACZ,GAAG,CAAC,QAAQ,CAAC,MAAM,EACnB;YACE,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,GAAG,CAAC,eAAe;SAC/B,EACD,GAAG,CAAC,aAAa,CAClB,CAAA;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QAC5D,OAAO,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,EAAE,CAAA;IACvE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAA+B;QAC5C,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,OAAO,CAChB,GAAG,CAAC,QAAQ,EACZ,GAAG,CAAC,QAAQ,CAAC,QAAQ,EACrB;gBACE,KAAK,EAAE,EAAE;gBACT,SAAS,EAAE,GAAG,CAAC,eAAe;aAC/B,EACD,GAAG,CAAC,aAAa,CAClB,CAAA;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IAChC,CAAC;IAED,2EAA2E;IAEnE,KAAK,CAAC,OAAO,CACnB,QAA6B,EAC7B,QAAoC,EACpC,KAA2C,EAC3C,aAA6B;QAE7B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;QAE5D,MAAM,OAAO,GAA2B;YACtC,MAAM,EAAE,kBAAkB;YAC1B,YAAY,EAAE,UAAU;YACxB,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;SAC1D,CAAA;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YACvC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,mBAAmB,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACzE,CAAC;QAED,IAAI,IAAwB,CAAA;QAC5B,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACrE,IAAI,GAAG,iBAAiB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;YAC1E,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;gBAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAA;QAC5E,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,SAAS,CACzB,GAAG,EACH;YACE,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO;YACP,IAAI;YACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC;SACzE,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,CAAC,EAAE,aAAa,CAAC,CACpE,CAAA;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YACpF,MAAM,IAAI,mBAAmB,CAC3B,GAAG,CAAC,MAAM,EACV,wBAAwB,QAAQ,CAAC,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACpF,CAAA;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;QAC1D,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAA;QACpB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;YAC5D,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;IAEO,QAAQ,CACd,OAAe,EACf,QAAoC,EACpC,KAA2C;QAE3C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QACxC,MAAM,IAAI,GAAG,iBAAiB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;QAChF,IAAI,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QAC1E,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;aACjC,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAChD,iBAAiB,CAAC,mBAAmB,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CACtD,EAAE,CACN;aACA,IAAI,CAAC,GAAG,CAAC,CAAA;QACZ,IAAI,KAAK;YAAE,GAAG,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,EAAE,CAAA;QAC5D,OAAO,GAAG,CAAA;IACZ,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,IAA2B,EAC3B,aAA6B;QAE7B,MAAM,MAAM,GAAG,CAAC,GAAW,EAAU,EAAE;YACrC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;YAChC,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,IAAI,mBAAmB,CAAC,GAAG,EAAE,mBAAmB,GAAG,GAAG,CAAC,CAAA;YACtF,OAAO,KAAK,CAAA;QACd,CAAC,CAAA;QACD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,MAAM;gBACT,OAAO,EAAE,CAAA;YACX,KAAK,SAAS;gBACZ,OAAO,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;YACxF,KAAK,QAAQ;gBACX,OAAO,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;YAClE,KAAK,OAAO;gBACV,OAAO;oBACL,aAAa,EAAE,SAAS,IAAI,CAC1B,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAC9E,EAAE;iBACJ,CAAA;YACH,KAAK,2BAA2B;gBAC9B,OAAO,EAAE,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAA;YAC3E,KAAK,gBAAgB,EAAE,CAAC;gBACtB,MAAM,OAAO,GAA2B,EAAE,CAAA;gBAC1C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO;oBAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;gBACvE,OAAO,OAAO,CAAA;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,IAA2E,EAC3E,MAA+B;QAE/B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAA;QACnD,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAA;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC5C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAAE,OAAO,MAAM,CAAC,KAAK,CAAA;QAExE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC;SACtD,CAAC,CAAA;QACF,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7C,IAAI,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;QAEtD,MAAM,GAAG,GAAG,MAAM,SAAS,CACzB,IAAI,CAAC,QAAQ,EACb;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;gBAC1B,YAAY,EAAE,UAAU;aACzB;YACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC;SACnD,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,CAAC,EAAE,iBAAiB,CAAC,CACxE,CAAA;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YACjF,MAAM,IAAI,mBAAmB,CAC3B,GAAG,CAAC,MAAM,EACV,yBAAyB,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC7D,CAAA;QACH,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;QAC/D,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE;YACjB,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAmD,CAAA;YAChF,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;QACJ,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;YACxB,MAAM,IAAI,mBAAmB,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAA;QACjF,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;QAClF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;QAC1F,OAAO,IAAI,CAAC,YAAY,CAAA;IAC1B,CAAC;IAEO,WAAW,CACjB,QAA6B,EAC7B,IAAa,EACb,cAAiC;QAEjC,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAA;QAC3B,MAAM,UAAU,GAAG,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,IAAI,CAAA;QAClF,MAAM,GAAG,GAAG,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAA;QACpE,MAAM,SAAS,GAAG,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,CAAA;QACrE,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;QAClF,MAAM,SAAS,GAAG,CAAC,CAAC,aAAa;YAC/B,CAAC,CAAC,iBAAiB,CAAC,eAAe,CAAC,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC;YAC3F,CAAC,CAAC,IAAI,CAAA;QAER,MAAM,MAAM,GAAoB,EAAE,CAAA;QAClC,IAAI,UAAU;YAAE,MAAM,CAAC,UAAU,GAAG,UAAU,CAAA;QAC9C,IAAI,GAAG;YAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAA;QAEzB,OAAO;YACL,UAAU;YACV,GAAG;YACH,MAAM;YACN,SAAS;YACT,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC;YACtC,MAAM;SACP,CAAA;IACH,CAAC;IAEO,SAAS,CACf,OAA6C,EAC7C,IAAa;QAEb,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAA;QACzB,MAAM,MAAM,GAA4B,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;QAClE,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,CAAC,KAAK,GAAG,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;QACzE,CAAC;aAAM,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACtC,MAAM,CAAC,QAAQ,GAAG,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;YAC7E,MAAM,CAAC,QAAQ,GAAG,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;QAC/E,CAAC;aAAM,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YAC9C,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;YACtC,MAAM,CAAC,WAAW,GAAG,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,CAAC,CAAA;QACrF,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;CACF"}

package/dist/infrastructure/events/InAppNotificationChannel.d.ts

@@ -1,19 +0,0 @@
-import type { ExecutionEventPublisher, Notification, NotificationChannel } from '@cat-factory/kernel';
-/**
- * The in-app notification channel: pushes the `notification` WorkspaceEvent to the
- * board (via the same event publisher that carries execution/board events) so the
- * inbox + per-block badge update live. The canonical row is already persisted by
- * the NotificationService, so this is purely the live push — best-effort, errors
- * swallowed by the publisher.
- *
- * This is the only channel today; future EmailNotificationChannel /
- * SlackNotificationChannel implement the same {@link NotificationChannel} port and
- * are composed alongside it via CompositeNotificationChannel, with no change to the
- * code that raises notifications.
- */
-export declare class InAppNotificationChannel implements NotificationChannel {
-    private readonly publisher;
-    constructor(publisher: ExecutionEventPublisher);
-    deliver(workspaceId: string, notification: Notification): Promise<void>;
-}
-//# sourceMappingURL=InAppNotificationChannel.d.ts.map

package/dist/infrastructure/events/InAppNotificationChannel.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"InAppNotificationChannel.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/events/InAppNotificationChannel.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,YAAY,EACZ,mBAAmB,EACpB,MAAM,qBAAqB,CAAA;AAE5B;;;;;;;;;;;GAWG;AACH,qBAAa,wBAAyB,YAAW,mBAAmB;IACtD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAAtC,YAA6B,SAAS,EAAE,uBAAuB,EAAI;IAE7D,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5E;CACF"}

package/dist/infrastructure/events/InAppNotificationChannel.js

@@ -1,22 +0,0 @@
-/**
- * The in-app notification channel: pushes the `notification` WorkspaceEvent to the
- * board (via the same event publisher that carries execution/board events) so the
- * inbox + per-block badge update live. The canonical row is already persisted by
- * the NotificationService, so this is purely the live push — best-effort, errors
- * swallowed by the publisher.
- *
- * This is the only channel today; future EmailNotificationChannel /
- * SlackNotificationChannel implement the same {@link NotificationChannel} port and
- * are composed alongside it via CompositeNotificationChannel, with no change to the
- * code that raises notifications.
- */
-export class InAppNotificationChannel {
-    publisher;
-    constructor(publisher) {
-        this.publisher = publisher;
-    }
-    async deliver(workspaceId, notification) {
-        await this.publisher.notificationChanged?.(workspaceId, notification);
-    }
-}
-//# sourceMappingURL=InAppNotificationChannel.js.map

package/dist/infrastructure/events/InAppNotificationChannel.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"InAppNotificationChannel.js","sourceRoot":"","sources":["../../../src/infrastructure/events/InAppNotificationChannel.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,wBAAwB;IACN,SAAS;IAAtC,YAA6B,SAAkC;yBAAlC,SAAS;IAA4B,CAAC;IAEnE,KAAK,CAAC,OAAO,CAAC,WAAmB,EAAE,YAA0B;QAC3D,MAAM,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;IACvE,CAAC;CACF"}