@cat-factory/worker 0.6.0 → 0.7.3

package/dist/infrastructure/environments/HttpEnvironmentProvider.js

@@ -1,314 +0,0 @@
-import {} from '@cat-factory/kernel';
-import { environmentsLogic } from '@cat-factory/integrations';
-// The single generic adapter that interprets ANY environment manifest. There are
-// no per-provider presets: an org's self-rolled management API is described as
-// HTTP request templates with `{{var}}` interpolation, an auth scheme, and a
-// dot-path mapping from its (arbitrary) response onto the canonical handle.
-//
-// Security: every URL is SSRF-guarded before it is fetched; the per-tenant
-// secrets are resolved in-memory via the injected resolver and only ever placed
-// in request headers — never logged or echoed in errors (error bodies are
-// length-capped and carry no request headers).
-const DEFAULT_TIMEOUT_MS = 15_000;
-const MAX_RESPONSE_CHARS = 200_000;
-/** Hard cap on the bytes read off any response body (mirrors MAX_RESPONSE_CHARS). */
-const MAX_RESPONSE_BYTES = MAX_RESPONSE_CHARS;
-/** Bound the redirect chain so a permitted first hop can't walk us anywhere. */
-const MAX_REDIRECTS = 5;
-const USER_AGENT = 'cat-factory';
-/** Carries the HTTP status so the API can surface a meaningful (redacted) error. */
-export class EnvironmentApiError extends Error {
-    status;
-    constructor(status, message) {
-        super(message);
-        this.status = status;
-        this.name = 'EnvironmentApiError';
-    }
-}
-/**
- * `fetch` with redirects followed by hand so the SSRF guard runs against EVERY
- * hop, not just the first URL. With the default `redirect: 'follow'` a permitted
- * host can 302 to an internal target (e.g. 169.254.169.254) — or downgrade
- * https→http — and the runtime would follow it unchecked. We force
- * `redirect: 'manual'`, re-resolve the `Location` against the current URL, and
- * re-run the same `assertSafe` guard (which also enforces https-only) before
- * following. A redirect target that fails the guard throws exactly as an invalid
- * initial URL would.
- */
-async function safeFetch(url, init, assertSafe) {
-    let current = url;
-    for (let hop = 0;; hop++) {
-        assertSafe(current);
-        const res = await fetch(current, { ...init, redirect: 'manual' });
-        if (res.status >= 300 && res.status < 400) {
-            const location = res.headers.get('location');
-            if (!location)
-                return res;
-            if (hop >= MAX_REDIRECTS) {
-                throw new EnvironmentApiError(502, 'Environment provider returned too many redirects');
-            }
-            // Resolve relative redirects against the current URL, then re-validate.
-            current = new URL(location, current).toString();
-            continue;
-        }
-        return res;
-    }
-}
-/**
- * Read a response body with a running byte cap so a hostile/huge response can't
- * OOM the isolate. Checks the declared Content-Length first, then enforces the
- * cap while streaming. When `throwOnOverflow` is false (error snippets) the body
- * is truncated instead of throwing.
- */
-async function readCappedText(res, maxBytes, throwOnOverflow = true) {
-    const declared = res.headers.get('content-length');
-    if (declared && Number(declared) > maxBytes) {
-        if (throwOnOverflow) {
-            throw new EnvironmentApiError(502, 'Environment provider response too large');
-        }
-    }
-    const body = res.body;
-    if (!body)
-        return '';
-    const reader = body.getReader();
-    const chunks = [];
-    let total = 0;
-    try {
-        for (;;) {
-            const { done, value } = await reader.read();
-            if (done)
-                break;
-            if (!value)
-                continue;
-            total += value.byteLength;
-            if (total > maxBytes) {
-                await reader.cancel();
-                if (throwOnOverflow) {
-                    throw new EnvironmentApiError(502, 'Environment provider response too large');
-                }
-                chunks.push(value);
-                break;
-            }
-            chunks.push(value);
-        }
-    }
-    finally {
-        reader.releaseLock();
-    }
-    const merged = new Uint8Array(chunks.reduce((n, c) => n + c.byteLength, 0));
-    let offset = 0;
-    for (const c of chunks) {
-        merged.set(c, offset);
-        offset += c.byteLength;
-    }
-    return new TextDecoder().decode(merged).slice(0, maxBytes);
-}
-export class HttpEnvironmentProvider {
-    defaultTimeoutMs;
-    /** Per-isolate OAuth token cache, keyed by token URL + client id. */
-    oauthCache = new Map();
-    constructor(options = {}) {
-        this.defaultTimeoutMs = options.defaultTimeoutMs ?? DEFAULT_TIMEOUT_MS;
-    }
-    async provision(req) {
-        const json = await this.execute(req.manifest, req.manifest.provision, {
-            input: req.inputs,
-            provision: {},
-        }, req.resolveSecret);
-        // A successful provision call defaults to 'ready' unless the manifest maps a
-        // status string (e.g. an async provisioner returning 'pending').
-        return this.mapResponse(req.manifest, json, 'ready');
-    }
-    async status(req) {
-        if (!req.manifest.status) {
-            // No status endpoint declared: treat the environment as ready and echo what
-            // we captured at provision time.
-            return {
-                externalId: req.externalId,
-                url: req.provisionFields.url ?? null,
-                status: 'ready',
-                expiresAt: null,
-                access: null,
-                fields: req.provisionFields,
-            };
-        }
-        const json = await this.execute(req.manifest, req.manifest.status, {
-            input: {},
-            provision: req.provisionFields,
-        }, req.resolveSecret);
-        const mapped = this.mapResponse(req.manifest, json, 'ready');
-        return { ...mapped, externalId: mapped.externalId ?? req.externalId };
-    }
-    async teardown(req) {
-        if (req.manifest.teardown) {
-            await this.execute(req.manifest, req.manifest.teardown, {
-                input: {},
-                provision: req.provisionFields,
-            }, req.resolveSecret);
-        }
-        return { status: 'torn_down' };
-    }
-    // --- internals ----------------------------------------------------------
-    async execute(manifest, template, scope, resolveSecret) {
-        const url = this.buildUrl(manifest.baseUrl, template, scope);
-        const headers = {
-            accept: 'application/json',
-            'user-agent': USER_AGENT,
-            ...(await this.authHeaders(manifest.auth, resolveSecret)),
-        };
-        for (const h of template.headers ?? []) {
-            headers[h.name] = environmentsLogic.interpolateTemplate(h.value, scope);
-        }
-        let body;
-        if (template.bodyTemplate !== undefined && template.method !== 'GET') {
-            body = environmentsLogic.interpolateTemplate(template.bodyTemplate, scope);
-            if (!headers['content-type'])
-                headers['content-type'] = 'application/json';
-        }
-        const res = await safeFetch(url, {
-            method: template.method,
-            headers,
-            body,
-            signal: AbortSignal.timeout(template.timeoutMs ?? this.defaultTimeoutMs),
-        }, (u) => environmentsLogic.assertSafeEnvironmentUrl(u, 'request URL'));
-        if (!res.ok) {
-            const errText = await readCappedText(res, MAX_RESPONSE_BYTES, false).catch(() => '');
-            throw new EnvironmentApiError(res.status, `Environment provider ${template.method} → ${res.status}: ${errText.slice(0, 300)}`);
-        }
-        const text = await readCappedText(res, MAX_RESPONSE_BYTES);
-        if (!text)
-            return {};
-        try {
-            return JSON.parse(text);
-        }
-        catch {
-            // Non-JSON responses leave the mapping to resolve to nulls.
-            return {};
-        }
-    }
-    buildUrl(baseUrl, template, scope) {
-        const base = baseUrl.replace(/\/+$/, '');
-        const path = environmentsLogic.interpolateTemplate(template.pathTemplate, scope);
-        let url = path ? `${base}${path.startsWith('/') ? '' : '/'}${path}` : base;
-        const query = (template.query ?? [])
-            .map((q) => `${encodeURIComponent(q.key)}=${encodeURIComponent(environmentsLogic.interpolateTemplate(q.value, scope))}`)
-            .join('&');
-        if (query)
-            url += `${url.includes('?') ? '&' : '?'}${query}`;
-        return url;
-    }
-    async authHeaders(auth, resolveSecret) {
-        const secret = (key) => {
-            const value = resolveSecret(key);
-            if (value === undefined)
-                throw new EnvironmentApiError(500, `Missing secret '${key}'`);
-            return value;
-        };
-        switch (auth.type) {
-            case 'none':
-                return {};
-            case 'api_key':
-                return { [auth.headerName]: `${auth.valuePrefix ?? ''}${secret(auth.secretRef.key)}` };
-            case 'bearer':
-                return { authorization: `Bearer ${secret(auth.secretRef.key)}` };
-            case 'basic':
-                return {
-                    authorization: `Basic ${btoa(`${secret(auth.usernameSecretRef.key)}:${secret(auth.passwordSecretRef.key)}`)}`,
-                };
-            case 'oauth2_client_credentials':
-                return { authorization: `Bearer ${await this.oauthToken(auth, secret)}` };
-            case 'custom_headers': {
-                const headers = {};
-                for (const h of auth.headers)
-                    headers[h.name] = secret(h.secretRef.key);
-                return headers;
-            }
-        }
-    }
-    async oauthToken(auth, secret) {
-        const clientId = secret(auth.clientIdSecretRef.key);
-        const cacheKey = `${auth.tokenUrl}::${clientId}`;
-        const cached = this.oauthCache.get(cacheKey);
-        if (cached && cached.expiresAt > Date.now() + 5_000)
-            return cached.token;
-        const form = new URLSearchParams({
-            grant_type: 'client_credentials',
-            client_id: clientId,
-            client_secret: secret(auth.clientSecretSecretRef.key),
-        });
-        if (auth.scope)
-            form.set('scope', auth.scope);
-        if (auth.audience)
-            form.set('audience', auth.audience);
-        const res = await safeFetch(auth.tokenUrl, {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/x-www-form-urlencoded',
-                accept: 'application/json',
-                'user-agent': USER_AGENT,
-            },
-            body: form.toString(),
-            signal: AbortSignal.timeout(this.defaultTimeoutMs),
-        }, (u) => environmentsLogic.assertSafeEnvironmentUrl(u, 'OAuth token URL'));
-        if (!res.ok) {
-            const text = await readCappedText(res, MAX_RESPONSE_BYTES, false).catch(() => '');
-            throw new EnvironmentApiError(res.status, `OAuth token request → ${res.status}: ${text.slice(0, 200)}`);
-        }
-        const tokenText = await readCappedText(res, MAX_RESPONSE_BYTES);
-        const json = (() => {
-            try {
-                return JSON.parse(tokenText);
-            }
-            catch {
-                return null;
-            }
-        })();
-        if (!json?.access_token) {
-            throw new EnvironmentApiError(502, 'OAuth token response missing access_token');
-        }
-        const ttlMs = (typeof json.expires_in === 'number' ? json.expires_in : 300) * 1000;
-        this.oauthCache.set(cacheKey, { token: json.access_token, expiresAt: Date.now() + ttlMs });
-        return json.access_token;
-    }
-    mapResponse(manifest, json, fallbackStatus) {
-        const r = manifest.response;
-        const externalId = environmentsLogic.extractString(json, r.externalIdPath) ?? null;
-        const url = environmentsLogic.extractString(json, r.urlPath) ?? null;
-        const rawStatus = environmentsLogic.extractString(json, r.statusPath);
-        const status = environmentsLogic.mapStatus(rawStatus, r.statusMap, fallbackStatus);
-        const expiresAt = r.expiresAtPath
-            ? environmentsLogic.coerceExpiresAt(environmentsLogic.extractByPath(json, r.expiresAtPath))
-            : null;
-        const fields = {};
-        if (externalId)
-            fields.externalId = externalId;
-        if (url)
-            fields.url = url;
-        return {
-            externalId,
-            url,
-            status,
-            expiresAt,
-            access: this.mapAccess(r.access, json),
-            fields,
-        };
-    }
-    mapAccess(mapping, json) {
-        if (!mapping)
-            return null;
-        const access = { scheme: mapping.scheme };
-        if (mapping.scheme === 'bearer') {
-            access.token = environmentsLogic.extractString(json, mapping.tokenPath);
-        }
-        else if (mapping.scheme === 'basic') {
-            access.username = environmentsLogic.extractString(json, mapping.usernamePath);
-            access.password = environmentsLogic.extractString(json, mapping.passwordPath);
-        }
-        else if (mapping.scheme === 'custom_header') {
-            access.headerName = mapping.headerName;
-            access.headerValue = environmentsLogic.extractString(json, mapping.headerValuePath);
-        }
-        return access;
-    }
-}
-//# sourceMappingURL=HttpEnvironmentProvider.js.map

package/dist/infrastructure/environments/HttpEnvironmentProvider.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"HttpEnvironmentProvider.js","sourceRoot":"","sources":["../../../src/infrastructure/environments/HttpEnvironmentProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAcN,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAE7D,iFAAiF;AACjF,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,EAAE;AACF,2EAA2E;AAC3E,gFAAgF;AAChF,0EAA0E;AAC1E,+CAA+C;AAE/C,MAAM,kBAAkB,GAAG,MAAM,CAAA;AACjC,MAAM,kBAAkB,GAAG,OAAO,CAAA;AAClC,qFAAqF;AACrF,MAAM,kBAAkB,GAAG,kBAAkB,CAAA;AAC7C,gFAAgF;AAChF,MAAM,aAAa,GAAG,CAAC,CAAA;AACvB,MAAM,UAAU,GAAG,aAAa,CAAA;AAEhC,oFAAoF;AACpF,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAEjC,MAAM;IADjB,YACW,MAAc,EACvB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAA;sBAHL,MAAM;QAIf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,SAAS,CACtB,GAAW,EACX,IAAiB,EACjB,UAA+B;IAE/B,IAAI,OAAO,GAAG,GAAG,CAAA;IACjB,KAAK,IAAI,GAAG,GAAG,CAAC,GAAI,GAAG,EAAE,EAAE,CAAC;QAC1B,UAAU,CAAC,OAAO,CAAC,CAAA;QACnB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;QACjE,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;YAC5C,IAAI,CAAC,QAAQ;gBAAE,OAAO,GAAG,CAAA;YACzB,IAAI,GAAG,IAAI,aAAa,EAAE,CAAC;gBACzB,MAAM,IAAI,mBAAmB,CAAC,GAAG,EAAE,kDAAkD,CAAC,CAAA;YACxF,CAAC;YACD,wEAAwE;YACxE,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAA;YAC/C,SAAQ;QACV,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAC3B,GAAa,EACb,QAAgB,EAChB,eAAe,GAAG,IAAI;IAEtB,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IAClD,IAAI,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,QAAQ,EAAE,CAAC;QAC5C,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,IAAI,mBAAmB,CAAC,GAAG,EAAE,yCAAyC,CAAC,CAAA;QAC/E,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;IACrB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAA;IACpB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAA;IAC/B,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YAC3C,IAAI,IAAI;gBAAE,MAAK;YACf,IAAI,CAAC,KAAK;gBAAE,SAAQ;YACpB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAA;YACzB,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAA;gBACrB,IAAI,eAAe,EAAE,CAAC;oBACpB,MAAM,IAAI,mBAAmB,CAAC,GAAG,EAAE,yCAAyC,CAAC,CAAA;gBAC/E,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAClB,MAAK;YACP,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAA;IACtB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAA;IAC3E,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACrB,MAAM,IAAI,CAAC,CAAC,UAAU,CAAA;IACxB,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;AAC5D,CAAC;AAMD,MAAM,OAAO,uBAAuB;IACjB,gBAAgB,CAAQ;IACzC,qEAAqE;IACpD,UAAU,GAAG,IAAI,GAAG,EAAgD,CAAA;IAErF,YAAY,OAAO,GAAmC,EAAE;QACtD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,kBAAkB,CAAA;IACxE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAgC;QAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,GAAG,CAAC,QAAQ,EACZ,GAAG,CAAC,QAAQ,CAAC,SAAS,EACtB;YACE,KAAK,EAAE,GAAG,CAAC,MAAM;YACjB,SAAS,EAAE,EAAE;SACd,EACD,GAAG,CAAC,aAAa,CAClB,CAAA;QACD,6EAA6E;QAC7E,iEAAiE;QACjE,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IACtD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAA6B;QACxC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACzB,4EAA4E;YAC5E,iCAAiC;YACjC,OAAO;gBACL,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,GAAG,EAAE,GAAG,CAAC,eAAe,CAAC,GAAG,IAAI,IAAI;gBACpC,MAAM,EAAE,OAAO;gBACf,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,GAAG,CAAC,eAAe;aAC5B,CAAA;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,GAAG,CAAC,QAAQ,EACZ,GAAG,CAAC,QAAQ,CAAC,MAAM,EACnB;YACE,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,GAAG,CAAC,eAAe;SAC/B,EACD,GAAG,CAAC,aAAa,CAClB,CAAA;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QAC5D,OAAO,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,EAAE,CAAA;IACvE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAA+B;QAC5C,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,OAAO,CAChB,GAAG,CAAC,QAAQ,EACZ,GAAG,CAAC,QAAQ,CAAC,QAAQ,EACrB;gBACE,KAAK,EAAE,EAAE;gBACT,SAAS,EAAE,GAAG,CAAC,eAAe;aAC/B,EACD,GAAG,CAAC,aAAa,CAClB,CAAA;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IAChC,CAAC;IAED,2EAA2E;IAEnE,KAAK,CAAC,OAAO,CACnB,QAA6B,EAC7B,QAAoC,EACpC,KAA2C,EAC3C,aAA6B;QAE7B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;QAE5D,MAAM,OAAO,GAA2B;YACtC,MAAM,EAAE,kBAAkB;YAC1B,YAAY,EAAE,UAAU;YACxB,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;SAC1D,CAAA;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YACvC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,mBAAmB,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACzE,CAAC;QAED,IAAI,IAAwB,CAAA;QAC5B,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACrE,IAAI,GAAG,iBAAiB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;YAC1E,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;gBAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAA;QAC5E,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,SAAS,CACzB,GAAG,EACH;YACE,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO;YACP,IAAI;YACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC;SACzE,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,CAAC,EAAE,aAAa,CAAC,CACpE,CAAA;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YACpF,MAAM,IAAI,mBAAmB,CAC3B,GAAG,CAAC,MAAM,EACV,wBAAwB,QAAQ,CAAC,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACpF,CAAA;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;QAC1D,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAA;QACpB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;YAC5D,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;IAEO,QAAQ,CACd,OAAe,EACf,QAAoC,EACpC,KAA2C;QAE3C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QACxC,MAAM,IAAI,GAAG,iBAAiB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;QAChF,IAAI,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QAC1E,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;aACjC,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAChD,iBAAiB,CAAC,mBAAmB,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CACtD,EAAE,CACN;aACA,IAAI,CAAC,GAAG,CAAC,CAAA;QACZ,IAAI,KAAK;YAAE,GAAG,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,EAAE,CAAA;QAC5D,OAAO,GAAG,CAAA;IACZ,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,IAA2B,EAC3B,aAA6B;QAE7B,MAAM,MAAM,GAAG,CAAC,GAAW,EAAU,EAAE;YACrC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;YAChC,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,IAAI,mBAAmB,CAAC,GAAG,EAAE,mBAAmB,GAAG,GAAG,CAAC,CAAA;YACtF,OAAO,KAAK,CAAA;QACd,CAAC,CAAA;QACD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,MAAM;gBACT,OAAO,EAAE,CAAA;YACX,KAAK,SAAS;gBACZ,OAAO,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;YACxF,KAAK,QAAQ;gBACX,OAAO,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;YAClE,KAAK,OAAO;gBACV,OAAO;oBACL,aAAa,EAAE,SAAS,IAAI,CAC1B,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAC9E,EAAE;iBACJ,CAAA;YACH,KAAK,2BAA2B;gBAC9B,OAAO,EAAE,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAA;YAC3E,KAAK,gBAAgB,EAAE,CAAC;gBACtB,MAAM,OAAO,GAA2B,EAAE,CAAA;gBAC1C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO;oBAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;gBACvE,OAAO,OAAO,CAAA;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,IAA2E,EAC3E,MAA+B;QAE/B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAA;QACnD,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAA;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC5C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAAE,OAAO,MAAM,CAAC,KAAK,CAAA;QAExE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC;SACtD,CAAC,CAAA;QACF,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7C,IAAI,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;QAEtD,MAAM,GAAG,GAAG,MAAM,SAAS,CACzB,IAAI,CAAC,QAAQ,EACb;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;gBAC1B,YAAY,EAAE,UAAU;aACzB;YACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC;SACnD,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,CAAC,EAAE,iBAAiB,CAAC,CACxE,CAAA;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YACjF,MAAM,IAAI,mBAAmB,CAC3B,GAAG,CAAC,MAAM,EACV,yBAAyB,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC7D,CAAA;QACH,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;QAC/D,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE;YACjB,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAmD,CAAA;YAChF,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;QACJ,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;YACxB,MAAM,IAAI,mBAAmB,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAA;QACjF,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;QAClF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;QAC1F,OAAO,IAAI,CAAC,YAAY,CAAA;IAC1B,CAAC;IAEO,WAAW,CACjB,QAA6B,EAC7B,IAAa,EACb,cAAiC;QAEjC,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAA;QAC3B,MAAM,UAAU,GAAG,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,IAAI,CAAA;QAClF,MAAM,GAAG,GAAG,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAA;QACpE,MAAM,SAAS,GAAG,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,CAAA;QACrE,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;QAClF,MAAM,SAAS,GAAG,CAAC,CAAC,aAAa;YAC/B,CAAC,CAAC,iBAAiB,CAAC,eAAe,CAAC,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC;YAC3F,CAAC,CAAC,IAAI,CAAA;QAER,MAAM,MAAM,GAAoB,EAAE,CAAA;QAClC,IAAI,UAAU;YAAE,MAAM,CAAC,UAAU,GAAG,UAAU,CAAA;QAC9C,IAAI,GAAG;YAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAA;QAEzB,OAAO;YACL,UAAU;YACV,GAAG;YACH,MAAM;YACN,SAAS;YACT,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC;YACtC,MAAM;SACP,CAAA;IACH,CAAC;IAEO,SAAS,CACf,OAA6C,EAC7C,IAAa;QAEb,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAA;QACzB,MAAM,MAAM,GAA4B,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;QAClE,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,CAAC,KAAK,GAAG,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;QACzE,CAAC;aAAM,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACtC,MAAM,CAAC,QAAQ,GAAG,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;YAC7E,MAAM,CAAC,QAAQ,GAAG,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;QAC/E,CAAC;aAAM,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YAC9C,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;YACtC,MAAM,CAAC,WAAW,GAAG,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,CAAC,CAAA;QACrF,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;CACF"}

package/dist/infrastructure/events/InAppNotificationChannel.d.ts

@@ -1,19 +0,0 @@
-import type { ExecutionEventPublisher, Notification, NotificationChannel } from '@cat-factory/kernel';
-/**
- * The in-app notification channel: pushes the `notification` WorkspaceEvent to the
- * board (via the same event publisher that carries execution/board events) so the
- * inbox + per-block badge update live. The canonical row is already persisted by
- * the NotificationService, so this is purely the live push — best-effort, errors
- * swallowed by the publisher.
- *
- * This is the only channel today; future EmailNotificationChannel /
- * SlackNotificationChannel implement the same {@link NotificationChannel} port and
- * are composed alongside it via CompositeNotificationChannel, with no change to the
- * code that raises notifications.
- */
-export declare class InAppNotificationChannel implements NotificationChannel {
-    private readonly publisher;
-    constructor(publisher: ExecutionEventPublisher);
-    deliver(workspaceId: string, notification: Notification): Promise<void>;
-}
-//# sourceMappingURL=InAppNotificationChannel.d.ts.map

package/dist/infrastructure/events/InAppNotificationChannel.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"InAppNotificationChannel.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/events/InAppNotificationChannel.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,YAAY,EACZ,mBAAmB,EACpB,MAAM,qBAAqB,CAAA;AAE5B;;;;;;;;;;;GAWG;AACH,qBAAa,wBAAyB,YAAW,mBAAmB;IACtD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAAtC,YAA6B,SAAS,EAAE,uBAAuB,EAAI;IAE7D,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5E;CACF"}

package/dist/infrastructure/events/InAppNotificationChannel.js

@@ -1,22 +0,0 @@
-/**
- * The in-app notification channel: pushes the `notification` WorkspaceEvent to the
- * board (via the same event publisher that carries execution/board events) so the
- * inbox + per-block badge update live. The canonical row is already persisted by
- * the NotificationService, so this is purely the live push — best-effort, errors
- * swallowed by the publisher.
- *
- * This is the only channel today; future EmailNotificationChannel /
- * SlackNotificationChannel implement the same {@link NotificationChannel} port and
- * are composed alongside it via CompositeNotificationChannel, with no change to the
- * code that raises notifications.
- */
-export class InAppNotificationChannel {
-    publisher;
-    constructor(publisher) {
-        this.publisher = publisher;
-    }
-    async deliver(workspaceId, notification) {
-        await this.publisher.notificationChanged?.(workspaceId, notification);
-    }
-}
-//# sourceMappingURL=InAppNotificationChannel.js.map

package/dist/infrastructure/events/InAppNotificationChannel.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"InAppNotificationChannel.js","sourceRoot":"","sources":["../../../src/infrastructure/events/InAppNotificationChannel.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,wBAAwB;IACN,SAAS;IAAtC,YAA6B,SAAkC;yBAAlC,SAAS;IAA4B,CAAC;IAEnE,KAAK,CAAC,OAAO,CAAC,WAAmB,EAAE,YAA0B;QAC3D,MAAM,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;IACvE,CAAC;CACF"}

package/dist/infrastructure/repositories/D1RepoBlueprintRepository.d.ts

@@ -1,20 +0,0 @@
-import type { RepoBlueprintRecord, RepoBlueprintRepository } from '@cat-factory/kernel';
-import type { D1Database } from '@cloudflare/workers-types';
-/**
- * D1-backed store of repository blueprints (migration 0011). One row per
- * (workspace, repo): `upsert` replaces the existing blueprint in place, keyed by
- * the unique `(workspace_id, repo_owner, repo_name)` index, so the row is always
- * the single current decomposition. The tree is persisted whole as JSON.
- */
-export declare class D1RepoBlueprintRepository implements RepoBlueprintRepository {
-    private readonly db;
-    constructor({ db }: {
-        db: D1Database;
-    });
-    upsert(record: RepoBlueprintRecord): Promise<void>;
-    get(workspaceId: string, id: string): Promise<RepoBlueprintRecord | null>;
-    getByRepo(workspaceId: string, repoOwner: string, repoName: string): Promise<RepoBlueprintRecord | null>;
-    listByWorkspace(workspaceId: string): Promise<RepoBlueprintRecord[]>;
-    delete(workspaceId: string, id: string): Promise<void>;
-}
-//# sourceMappingURL=D1RepoBlueprintRepository.d.ts.map

package/dist/infrastructure/repositories/D1RepoBlueprintRepository.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"D1RepoBlueprintRepository.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1RepoBlueprintRepository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AA0B3D;;;;;GAKG;AACH,qBAAa,yBAA0B,YAAW,uBAAuB;IACvE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAE,EAAE;QAAE,EAAE,EAAE,UAAU,CAAA;KAAE,EAErC;IAEK,MAAM,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBvD;IAEK,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAM9E;IAEK,SAAS,CACb,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAQrC;IAEK,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAMzE;IAEK,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK3D;CACF"}

package/dist/infrastructure/repositories/D1RepoBlueprintRepository.js

@@ -1,64 +0,0 @@
-function rowToRecord(row) {
-    return {
-        id: row.id,
-        workspaceId: row.workspace_id,
-        repoOwner: row.repo_owner,
-        repoName: row.repo_name,
-        source: row.source,
-        service: JSON.parse(row.service_json),
-        createdAt: row.created_at,
-        updatedAt: row.updated_at,
-    };
-}
-/**
- * D1-backed store of repository blueprints (migration 0011). One row per
- * (workspace, repo): `upsert` replaces the existing blueprint in place, keyed by
- * the unique `(workspace_id, repo_owner, repo_name)` index, so the row is always
- * the single current decomposition. The tree is persisted whole as JSON.
- */
-export class D1RepoBlueprintRepository {
-    db;
-    constructor({ db }) {
-        this.db = db;
-    }
-    async upsert(record) {
-        await this.db
-            .prepare(`INSERT INTO repo_blueprints
-          (id, workspace_id, repo_owner, repo_name, source, service_json, created_at, updated_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-         ON CONFLICT (workspace_id, repo_owner, repo_name) DO UPDATE SET
-           source = excluded.source,
-           service_json = excluded.service_json,
-           updated_at = excluded.updated_at`)
-            .bind(record.id, record.workspaceId, record.repoOwner, record.repoName, record.source, JSON.stringify(record.service), record.createdAt, record.updatedAt)
-            .run();
-    }
-    async get(workspaceId, id) {
-        const row = await this.db
-            .prepare('SELECT * FROM repo_blueprints WHERE workspace_id = ? AND id = ?')
-            .bind(workspaceId, id)
-            .first();
-        return row ? rowToRecord(row) : null;
-    }
-    async getByRepo(workspaceId, repoOwner, repoName) {
-        const row = await this.db
-            .prepare('SELECT * FROM repo_blueprints WHERE workspace_id = ? AND repo_owner = ? AND repo_name = ?')
-            .bind(workspaceId, repoOwner, repoName)
-            .first();
-        return row ? rowToRecord(row) : null;
-    }
-    async listByWorkspace(workspaceId) {
-        const { results } = await this.db
-            .prepare('SELECT * FROM repo_blueprints WHERE workspace_id = ? ORDER BY updated_at DESC')
-            .bind(workspaceId)
-            .all();
-        return (results ?? []).map(rowToRecord);
-    }
-    async delete(workspaceId, id) {
-        await this.db
-            .prepare('DELETE FROM repo_blueprints WHERE workspace_id = ? AND id = ?')
-            .bind(workspaceId, id)
-            .run();
-    }
-}
-//# sourceMappingURL=D1RepoBlueprintRepository.js.map

package/dist/infrastructure/repositories/D1RepoBlueprintRepository.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"D1RepoBlueprintRepository.js","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1RepoBlueprintRepository.ts"],"names":[],"mappings":"AAkBA,SAAS,WAAW,CAAC,GAAqB;IACxC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,MAAM,EAAE,GAAG,CAAC,MAAuC;QACnD,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAqB;QACzD,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,yBAAyB;IACnB,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAsB;QACpC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;IACd,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA2B;QACtC,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CACN;;;;;;4CAMoC,CACrC;aACA,IAAI,CACH,MAAM,CAAC,EAAE,EACT,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,MAAM,EACb,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,EAC9B,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,SAAS,CACjB;aACA,GAAG,EAAE,CAAA;IACV,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAmB,EAAE,EAAU;QACvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,OAAO,CAAC,iEAAiE,CAAC;aAC1E,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;aACrB,KAAK,EAAoB,CAAA;QAC5B,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACtC,CAAC;IAED,KAAK,CAAC,SAAS,CACb,WAAmB,EACnB,SAAiB,EACjB,QAAgB;QAEhB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,OAAO,CACN,2FAA2F,CAC5F;aACA,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;aACtC,KAAK,EAAoB,CAAA;QAC5B,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACtC,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,WAAmB;QACvC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CAAC,+EAA+E,CAAC;aACxF,IAAI,CAAC,WAAW,CAAC;aACjB,GAAG,EAAoB,CAAA;QAC1B,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,EAAU;QAC1C,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CAAC,+DAA+D,CAAC;aACxE,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;aACrB,GAAG,EAAE,CAAA;IACV,CAAC;CACF"}

package/dist/infrastructure/tasks/GitHubIssuesProvider.d.ts

@@ -1,50 +0,0 @@
-import { type GitHubClient, type GitHubInstallationRepository, type TaskContent, type TaskCredentials, type TaskSearchResult, type TaskSourceProvider, type NormalizedTaskConnection } from '@cat-factory/kernel';
-export interface GitHubIssuesProviderDependencies {
-    githubClient: GitHubClient;
-    /** Resolves which installation owns a given repo owner (by account login). */
-    installations: GitHubInstallationRepository;
-}
-export declare class GitHubIssuesProvider implements TaskSourceProvider {
-    private readonly deps;
-    readonly kind: 'github';
-    readonly descriptor: {
-        source: "github" | "jira";
-        label: string;
-        icon: string;
-        credentialFields: {
-            key: string;
-            label: string;
-            help?: string | undefined;
-            placeholder?: string | undefined;
-            secret?: boolean | undefined;
-        }[];
-        refLabel: string;
-        refPlaceholder: string;
-        searchable?: boolean | undefined;
-    };
-    constructor(deps: GitHubIssuesProviderDependencies);
-    /**
-     * GitHub issues piggyback on the installed GitHub App, so there is nothing to
-     * validate or persist — the connection is a marker. Any supplied fields are
-     * ignored (the connect form has none).
-     */
-    normalizeConnection(_input: TaskCredentials): NormalizedTaskConnection;
-    parseRef(input: string): string | null;
-    fetchTask(_credentials: TaskCredentials, externalId: string): Promise<TaskContent>;
-    /**
-     * Search issues visible to *this workspace's* GitHub App installation. The
-     * installation token only sees its own account's repos, so scoping to the
-     * workspace's installation keeps results from leaking across tenants — a
-     * deployment may host many installations, but a workspace owns exactly one.
-     * Credentials are unused (the App authenticates), matching `fetchTask`.
-     */
-    search(_credentials: TaskCredentials, query: string, workspaceId: string): Promise<TaskSearchResult[]>;
-    /**
-     * Find the GitHub App installation whose account owns `owner`. The
-     * installation token for that account is what can read the repo's issues,
-     * regardless of which workspace triggered the import (one account → one
-     * installation, shared across that account's workspaces).
-     */
-    private resolveInstallationId;
-}
-//# sourceMappingURL=GitHubIssuesProvider.d.ts.map

package/dist/infrastructure/tasks/GitHubIssuesProvider.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"GitHubIssuesProvider.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/tasks/GitHubIssuesProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,4BAA4B,EACjC,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC9B,MAAM,qBAAqB,CAAA;AAW5B,MAAM,WAAW,gCAAgC;IAC/C,YAAY,EAAE,YAAY,CAAA;IAC1B,8EAA8E;IAC9E,aAAa,EAAE,4BAA4B,CAAA;CAC5C;AAED,qBAAa,oBAAqB,YAAW,kBAAkB;IAIjD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,QAAQ,CAAC,IAAI,EAAG,QAAQ,CAAS;IACjC,QAAQ,CAAC,UAAU;;;;;;;;;;;;;;MAA2B;IAE9C,YAA6B,IAAI,EAAE,gCAAgC,EAAI;IAEvE;;;;OAIG;IACH,mBAAmB,CAAC,MAAM,EAAE,eAAe,GAAG,wBAAwB,CAErE;IAED,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAErC;IAEK,SAAS,CAAC,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA0BvF;IAED;;;;;;OAMG;IACG,MAAM,CACV,YAAY,EAAE,eAAe,EAC7B,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAsB7B;IAED;;;;;OAKG;YACW,qBAAqB;CAUpC"}

package/dist/infrastructure/tasks/GitHubIssuesProvider.js

@@ -1,91 +0,0 @@
-import { ConflictError, ValidationError, } from '@cat-factory/kernel';
-import { GITHUB_ISSUES_DESCRIPTOR, githubIssuesLogic } from '@cat-factory/integrations';
-export class GitHubIssuesProvider {
-    deps;
-    kind = 'github';
-    descriptor = GITHUB_ISSUES_DESCRIPTOR;
-    constructor(deps) {
-        this.deps = deps;
-    }
-    /**
-     * GitHub issues piggyback on the installed GitHub App, so there is nothing to
-     * validate or persist — the connection is a marker. Any supplied fields are
-     * ignored (the connect form has none).
-     */
-    normalizeConnection(_input) {
-        return { credentials: {}, label: 'GitHub' };
-    }
-    parseRef(input) {
-        return githubIssuesLogic.parseGitHubIssueRef(input);
-    }
-    async fetchTask(_credentials, externalId) {
-        const id = githubIssuesLogic.parseGitHubIssueExternalId(externalId);
-        if (!id) {
-            throw new ValidationError(`"${externalId}" is not a valid GitHub issue reference`);
-        }
-        const installationId = await this.resolveInstallationId(id.owner);
-        const detail = await this.deps.githubClient.getIssue(installationId, { owner: id.owner, repo: id.repo }, id.number);
-        return {
-            externalId,
-            url: detail.url || githubIssuesLogic.githubIssueUrl(id),
-            title: detail.title,
-            // GitHub issues have no workflow status or type beyond open/closed; surface
-            // the state as the status and a constant type so the structured prompt
-            // rendering stays uniform across sources.
-            status: detail.state,
-            type: 'Issue',
-            assignee: detail.assignee,
-            priority: null,
-            labels: detail.labels,
-            description: detail.body,
-            comments: detail.comments,
-        };
-    }
-    /**
-     * Search issues visible to *this workspace's* GitHub App installation. The
-     * installation token only sees its own account's repos, so scoping to the
-     * workspace's installation keeps results from leaking across tenants — a
-     * deployment may host many installations, but a workspace owns exactly one.
-     * Credentials are unused (the App authenticates), matching `fetchTask`.
-     */
-    async search(_credentials, query, workspaceId) {
-        const installation = await this.deps.installations.getByWorkspace(workspaceId);
-        if (!installation)
-            return [];
-        const hits = await this.deps.githubClient
-            .searchIssues(installation.installationId, query, 20)
-            .catch(() => []);
-        const out = [];
-        const seen = new Set();
-        for (const hit of hits) {
-            const externalId = githubIssuesLogic.githubIssueExternalId(hit);
-            if (seen.has(externalId))
-                continue;
-            seen.add(externalId);
-            out.push({
-                source: 'github',
-                externalId,
-                title: hit.title,
-                url: hit.url,
-                status: hit.state,
-                excerpt: '',
-            });
-        }
-        return out.slice(0, 20);
-    }
-    /**
-     * Find the GitHub App installation whose account owns `owner`. The
-     * installation token for that account is what can read the repo's issues,
-     * regardless of which workspace triggered the import (one account → one
-     * installation, shared across that account's workspaces).
-     */
-    async resolveInstallationId(owner) {
-        const active = await this.deps.installations.listActive();
-        const match = active.find((i) => i.accountLogin.toLowerCase() === owner.toLowerCase());
-        if (!match) {
-            throw new ConflictError(`No GitHub App installation found for "${owner}". Install the GitHub App on that account to link its issues.`);
-        }
-        return match.installationId;
-    }
-}
-//# sourceMappingURL=GitHubIssuesProvider.js.map

package/dist/infrastructure/tasks/GitHubIssuesProvider.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"GitHubIssuesProvider.js","sourceRoot":"","sources":["../../../src/infrastructure/tasks/GitHubIssuesProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,eAAe,GAQhB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAgBvF,MAAM,OAAO,oBAAoB;IAIF,IAAI;IAHxB,IAAI,GAAG,QAAiB,CAAA;IACxB,UAAU,GAAG,wBAAwB,CAAA;IAE9C,YAA6B,IAAsC;oBAAtC,IAAI;IAAqC,CAAC;IAEvE;;;;OAIG;IACH,mBAAmB,CAAC,MAAuB;QACzC,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;IAC7C,CAAC;IAED,QAAQ,CAAC,KAAa;QACpB,OAAO,iBAAiB,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAA;IACrD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,YAA6B,EAAE,UAAkB;QAC/D,MAAM,EAAE,GAAG,iBAAiB,CAAC,0BAA0B,CAAC,UAAU,CAAC,CAAA;QACnE,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,eAAe,CAAC,IAAI,UAAU,yCAAyC,CAAC,CAAA;QACpF,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC,KAAK,CAAC,CAAA;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAClD,cAAc,EACd,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAClC,EAAE,CAAC,MAAM,CACV,CAAA;QACD,OAAO;YACL,UAAU;YACV,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,iBAAiB,CAAC,cAAc,CAAC,EAAE,CAAC;YACvD,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,4EAA4E;YAC5E,uEAAuE;YACvE,0CAA0C;YAC1C,MAAM,EAAE,MAAM,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,WAAW,EAAE,MAAM,CAAC,IAAI;YACxB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAA;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CACV,YAA6B,EAC7B,KAAa,EACb,WAAmB;QAEnB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QAC9E,IAAI,CAAC,YAAY;YAAE,OAAO,EAAE,CAAA;QAC5B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY;aACtC,YAAY,CAAC,YAAY,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,CAAC;aACpD,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;QAClB,MAAM,GAAG,GAAuB,EAAE,CAAA;QAClC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;QAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,UAAU,GAAG,iBAAiB,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAA;YAC/D,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;gBAAE,SAAQ;YAClC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;YACpB,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM,EAAE,QAAQ;gBAChB,UAAU;gBACV,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,MAAM,EAAE,GAAG,CAAC,KAAK;gBACjB,OAAO,EAAE,EAAE;aACZ,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACzB,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,qBAAqB,CAAC,KAAa;QAC/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAA;QACzD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;QACtF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,aAAa,CACrB,yCAAyC,KAAK,+DAA+D,CAC9G,CAAA;QACH,CAAC;QACD,OAAO,KAAK,CAAC,cAAc,CAAA;IAC7B,CAAC;CACF"}