@cat-factory/worker 0.6.0

package/dist/infrastructure/environments/HttpEnvironmentProvider.js

@@ -0,0 +1,314 @@
+import {} from '@cat-factory/kernel';
+import { environmentsLogic } from '@cat-factory/integrations';
+// The single generic adapter that interprets ANY environment manifest. There are
+// no per-provider presets: an org's self-rolled management API is described as
+// HTTP request templates with `{{var}}` interpolation, an auth scheme, and a
+// dot-path mapping from its (arbitrary) response onto the canonical handle.
+//
+// Security: every URL is SSRF-guarded before it is fetched; the per-tenant
+// secrets are resolved in-memory via the injected resolver and only ever placed
+// in request headers — never logged or echoed in errors (error bodies are
+// length-capped and carry no request headers).
+const DEFAULT_TIMEOUT_MS = 15_000;
+const MAX_RESPONSE_CHARS = 200_000;
+/** Hard cap on the bytes read off any response body (mirrors MAX_RESPONSE_CHARS). */
+const MAX_RESPONSE_BYTES = MAX_RESPONSE_CHARS;
+/** Bound the redirect chain so a permitted first hop can't walk us anywhere. */
+const MAX_REDIRECTS = 5;
+const USER_AGENT = 'cat-factory';
+/** Carries the HTTP status so the API can surface a meaningful (redacted) error. */
+export class EnvironmentApiError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.name = 'EnvironmentApiError';
+    }
+}
+/**
+ * `fetch` with redirects followed by hand so the SSRF guard runs against EVERY
+ * hop, not just the first URL. With the default `redirect: 'follow'` a permitted
+ * host can 302 to an internal target (e.g. 169.254.169.254) — or downgrade
+ * https→http — and the runtime would follow it unchecked. We force
+ * `redirect: 'manual'`, re-resolve the `Location` against the current URL, and
+ * re-run the same `assertSafe` guard (which also enforces https-only) before
+ * following. A redirect target that fails the guard throws exactly as an invalid
+ * initial URL would.
+ */
+async function safeFetch(url, init, assertSafe) {
+    let current = url;
+    for (let hop = 0;; hop++) {
+        assertSafe(current);
+        const res = await fetch(current, { ...init, redirect: 'manual' });
+        if (res.status >= 300 && res.status < 400) {
+            const location = res.headers.get('location');
+            if (!location)
+                return res;
+            if (hop >= MAX_REDIRECTS) {
+                throw new EnvironmentApiError(502, 'Environment provider returned too many redirects');
+            }
+            // Resolve relative redirects against the current URL, then re-validate.
+            current = new URL(location, current).toString();
+            continue;
+        }
+        return res;
+    }
+}
+/**
+ * Read a response body with a running byte cap so a hostile/huge response can't
+ * OOM the isolate. Checks the declared Content-Length first, then enforces the
+ * cap while streaming. When `throwOnOverflow` is false (error snippets) the body
+ * is truncated instead of throwing.
+ */
+async function readCappedText(res, maxBytes, throwOnOverflow = true) {
+    const declared = res.headers.get('content-length');
+    if (declared && Number(declared) > maxBytes) {
+        if (throwOnOverflow) {
+            throw new EnvironmentApiError(502, 'Environment provider response too large');
+        }
+    }
+    const body = res.body;
+    if (!body)
+        return '';
+    const reader = body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (!value)
+                continue;
+            total += value.byteLength;
+            if (total > maxBytes) {
+                await reader.cancel();
+                if (throwOnOverflow) {
+                    throw new EnvironmentApiError(502, 'Environment provider response too large');
+                }
+                chunks.push(value);
+                break;
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const merged = new Uint8Array(chunks.reduce((n, c) => n + c.byteLength, 0));
+    let offset = 0;
+    for (const c of chunks) {
+        merged.set(c, offset);
+        offset += c.byteLength;
+    }
+    return new TextDecoder().decode(merged).slice(0, maxBytes);
+}
+export class HttpEnvironmentProvider {
+    defaultTimeoutMs;
+    /** Per-isolate OAuth token cache, keyed by token URL + client id. */
+    oauthCache = new Map();
+    constructor(options = {}) {
+        this.defaultTimeoutMs = options.defaultTimeoutMs ?? DEFAULT_TIMEOUT_MS;
+    }
+    async provision(req) {
+        const json = await this.execute(req.manifest, req.manifest.provision, {
+            input: req.inputs,
+            provision: {},
+        }, req.resolveSecret);
+        // A successful provision call defaults to 'ready' unless the manifest maps a
+        // status string (e.g. an async provisioner returning 'pending').
+        return this.mapResponse(req.manifest, json, 'ready');
+    }
+    async status(req) {
+        if (!req.manifest.status) {
+            // No status endpoint declared: treat the environment as ready and echo what
+            // we captured at provision time.
+            return {
+                externalId: req.externalId,
+                url: req.provisionFields.url ?? null,
+                status: 'ready',
+                expiresAt: null,
+                access: null,
+                fields: req.provisionFields,
+            };
+        }
+        const json = await this.execute(req.manifest, req.manifest.status, {
+            input: {},
+            provision: req.provisionFields,
+        }, req.resolveSecret);
+        const mapped = this.mapResponse(req.manifest, json, 'ready');
+        return { ...mapped, externalId: mapped.externalId ?? req.externalId };
+    }
+    async teardown(req) {
+        if (req.manifest.teardown) {
+            await this.execute(req.manifest, req.manifest.teardown, {
+                input: {},
+                provision: req.provisionFields,
+            }, req.resolveSecret);
+        }
+        return { status: 'torn_down' };
+    }
+    // --- internals ----------------------------------------------------------
+    async execute(manifest, template, scope, resolveSecret) {
+        const url = this.buildUrl(manifest.baseUrl, template, scope);
+        const headers = {
+            accept: 'application/json',
+            'user-agent': USER_AGENT,
+            ...(await this.authHeaders(manifest.auth, resolveSecret)),
+        };
+        for (const h of template.headers ?? []) {
+            headers[h.name] = environmentsLogic.interpolateTemplate(h.value, scope);
+        }
+        let body;
+        if (template.bodyTemplate !== undefined && template.method !== 'GET') {
+            body = environmentsLogic.interpolateTemplate(template.bodyTemplate, scope);
+            if (!headers['content-type'])
+                headers['content-type'] = 'application/json';
+        }
+        const res = await safeFetch(url, {
+            method: template.method,
+            headers,
+            body,
+            signal: AbortSignal.timeout(template.timeoutMs ?? this.defaultTimeoutMs),
+        }, (u) => environmentsLogic.assertSafeEnvironmentUrl(u, 'request URL'));
+        if (!res.ok) {
+            const errText = await readCappedText(res, MAX_RESPONSE_BYTES, false).catch(() => '');
+            throw new EnvironmentApiError(res.status, `Environment provider ${template.method} → ${res.status}: ${errText.slice(0, 300)}`);
+        }
+        const text = await readCappedText(res, MAX_RESPONSE_BYTES);
+        if (!text)
+            return {};
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            // Non-JSON responses leave the mapping to resolve to nulls.
+            return {};
+        }
+    }
+    buildUrl(baseUrl, template, scope) {
+        const base = baseUrl.replace(/\/+$/, '');
+        const path = environmentsLogic.interpolateTemplate(template.pathTemplate, scope);
+        let url = path ? `${base}${path.startsWith('/') ? '' : '/'}${path}` : base;
+        const query = (template.query ?? [])
+            .map((q) => `${encodeURIComponent(q.key)}=${encodeURIComponent(environmentsLogic.interpolateTemplate(q.value, scope))}`)
+            .join('&');
+        if (query)
+            url += `${url.includes('?') ? '&' : '?'}${query}`;
+        return url;
+    }
+    async authHeaders(auth, resolveSecret) {
+        const secret = (key) => {
+            const value = resolveSecret(key);
+            if (value === undefined)
+                throw new EnvironmentApiError(500, `Missing secret '${key}'`);
+            return value;
+        };
+        switch (auth.type) {
+            case 'none':
+                return {};
+            case 'api_key':
+                return { [auth.headerName]: `${auth.valuePrefix ?? ''}${secret(auth.secretRef.key)}` };
+            case 'bearer':
+                return { authorization: `Bearer ${secret(auth.secretRef.key)}` };
+            case 'basic':
+                return {
+                    authorization: `Basic ${btoa(`${secret(auth.usernameSecretRef.key)}:${secret(auth.passwordSecretRef.key)}`)}`,
+                };
+            case 'oauth2_client_credentials':
+                return { authorization: `Bearer ${await this.oauthToken(auth, secret)}` };
+            case 'custom_headers': {
+                const headers = {};
+                for (const h of auth.headers)
+                    headers[h.name] = secret(h.secretRef.key);
+                return headers;
+            }
+        }
+    }
+    async oauthToken(auth, secret) {
+        const clientId = secret(auth.clientIdSecretRef.key);
+        const cacheKey = `${auth.tokenUrl}::${clientId}`;
+        const cached = this.oauthCache.get(cacheKey);
+        if (cached && cached.expiresAt > Date.now() + 5_000)
+            return cached.token;
+        const form = new URLSearchParams({
+            grant_type: 'client_credentials',
+            client_id: clientId,
+            client_secret: secret(auth.clientSecretSecretRef.key),
+        });
+        if (auth.scope)
+            form.set('scope', auth.scope);
+        if (auth.audience)
+            form.set('audience', auth.audience);
+        const res = await safeFetch(auth.tokenUrl, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/x-www-form-urlencoded',
+                accept: 'application/json',
+                'user-agent': USER_AGENT,
+            },
+            body: form.toString(),
+            signal: AbortSignal.timeout(this.defaultTimeoutMs),
+        }, (u) => environmentsLogic.assertSafeEnvironmentUrl(u, 'OAuth token URL'));
+        if (!res.ok) {
+            const text = await readCappedText(res, MAX_RESPONSE_BYTES, false).catch(() => '');
+            throw new EnvironmentApiError(res.status, `OAuth token request → ${res.status}: ${text.slice(0, 200)}`);
+        }
+        const tokenText = await readCappedText(res, MAX_RESPONSE_BYTES);
+        const json = (() => {
+            try {
+                return JSON.parse(tokenText);
+            }
+            catch {
+                return null;
+            }
+        })();
+        if (!json?.access_token) {
+            throw new EnvironmentApiError(502, 'OAuth token response missing access_token');
+        }
+        const ttlMs = (typeof json.expires_in === 'number' ? json.expires_in : 300) * 1000;
+        this.oauthCache.set(cacheKey, { token: json.access_token, expiresAt: Date.now() + ttlMs });
+        return json.access_token;
+    }
+    mapResponse(manifest, json, fallbackStatus) {
+        const r = manifest.response;
+        const externalId = environmentsLogic.extractString(json, r.externalIdPath) ?? null;
+        const url = environmentsLogic.extractString(json, r.urlPath) ?? null;
+        const rawStatus = environmentsLogic.extractString(json, r.statusPath);
+        const status = environmentsLogic.mapStatus(rawStatus, r.statusMap, fallbackStatus);
+        const expiresAt = r.expiresAtPath
+            ? environmentsLogic.coerceExpiresAt(environmentsLogic.extractByPath(json, r.expiresAtPath))
+            : null;
+        const fields = {};
+        if (externalId)
+            fields.externalId = externalId;
+        if (url)
+            fields.url = url;
+        return {
+            externalId,
+            url,
+            status,
+            expiresAt,
+            access: this.mapAccess(r.access, json),
+            fields,
+        };
+    }
+    mapAccess(mapping, json) {
+        if (!mapping)
+            return null;
+        const access = { scheme: mapping.scheme };
+        if (mapping.scheme === 'bearer') {
+            access.token = environmentsLogic.extractString(json, mapping.tokenPath);
+        }
+        else if (mapping.scheme === 'basic') {
+            access.username = environmentsLogic.extractString(json, mapping.usernamePath);
+            access.password = environmentsLogic.extractString(json, mapping.passwordPath);
+        }
+        else if (mapping.scheme === 'custom_header') {
+            access.headerName = mapping.headerName;
+            access.headerValue = environmentsLogic.extractString(json, mapping.headerValuePath);
+        }
+        return access;
+    }
+}
+//# sourceMappingURL=HttpEnvironmentProvider.js.map

package/dist/infrastructure/environments/HttpEnvironmentProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HttpEnvironmentProvider.js","sourceRoot":"","sources":["../../../src/infrastructure/environments/HttpEnvironmentProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAcN,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAE7D,iFAAiF;AACjF,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,EAAE;AACF,2EAA2E;AAC3E,gFAAgF;AAChF,0EAA0E;AAC1E,+CAA+C;AAE/C,MAAM,kBAAkB,GAAG,MAAM,CAAA;AACjC,MAAM,kBAAkB,GAAG,OAAO,CAAA;AAClC,qFAAqF;AACrF,MAAM,kBAAkB,GAAG,kBAAkB,CAAA;AAC7C,gFAAgF;AAChF,MAAM,aAAa,GAAG,CAAC,CAAA;AACvB,MAAM,UAAU,GAAG,aAAa,CAAA;AAEhC,oFAAoF;AACpF,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAEjC,MAAM;IADjB,YACW,MAAc,EACvB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAA;sBAHL,MAAM;QAIf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,SAAS,CACtB,GAAW,EACX,IAAiB,EACjB,UAA+B;IAE/B,IAAI,OAAO,GAAG,GAAG,CAAA;IACjB,KAAK,IAAI,GAAG,GAAG,CAAC,GAAI,GAAG,EAAE,EAAE,CAAC;QAC1B,UAAU,CAAC,OAAO,CAAC,CAAA;QACnB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;QACjE,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;YAC5C,IAAI,CAAC,QAAQ;gBAAE,OAAO,GAAG,CAAA;YACzB,IAAI,GAAG,IAAI,aAAa,EAAE,CAAC;gBACzB,MAAM,IAAI,mBAAmB,CAAC,GAAG,EAAE,kDAAkD,CAAC,CAAA;YACxF,CAAC;YACD,wEAAwE;YACxE,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAA;YAC/C,SAAQ;QACV,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAC3B,GAAa,EACb,QAAgB,EAChB,eAAe,GAAG,IAAI;IAEtB,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IAClD,IAAI,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,QAAQ,EAAE,CAAC;QAC5C,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,IAAI,mBAAmB,CAAC,GAAG,EAAE,yCAAyC,CAAC,CAAA;QAC/E,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;IACrB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAA;IACpB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAA;IAC/B,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YAC3C,IAAI,IAAI;gBAAE,MAAK;YACf,IAAI,CAAC,KAAK;gBAAE,SAAQ;YACpB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAA;YACzB,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAA;gBACrB,IAAI,eAAe,EAAE,CAAC;oBACpB,MAAM,IAAI,mBAAmB,CAAC,GAAG,EAAE,yCAAyC,CAAC,CAAA;gBAC/E,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAClB,MAAK;YACP,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAA;IACtB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAA;IAC3E,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACrB,MAAM,IAAI,CAAC,CAAC,UAAU,CAAA;IACxB,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;AAC5D,CAAC;AAMD,MAAM,OAAO,uBAAuB;IACjB,gBAAgB,CAAQ;IACzC,qEAAqE;IACpD,UAAU,GAAG,IAAI,GAAG,EAAgD,CAAA;IAErF,YAAY,OAAO,GAAmC,EAAE;QACtD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,kBAAkB,CAAA;IACxE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAgC;QAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,GAAG,CAAC,QAAQ,EACZ,GAAG,CAAC,QAAQ,CAAC,SAAS,EACtB;YACE,KAAK,EAAE,GAAG,CAAC,MAAM;YACjB,SAAS,EAAE,EAAE;SACd,EACD,GAAG,CAAC,aAAa,CAClB,CAAA;QACD,6EAA6E;QAC7E,iEAAiE;QACjE,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IACtD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAA6B;QACxC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACzB,4EAA4E;YAC5E,iCAAiC;YACjC,OAAO;gBACL,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,GAAG,EAAE,GAAG,CAAC,eAAe,CAAC,GAAG,IAAI,IAAI;gBACpC,MAAM,EAAE,OAAO;gBACf,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,GAAG,CAAC,eAAe;aAC5B,CAAA;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,GAAG,CAAC,QAAQ,EACZ,GAAG,CAAC,QAAQ,CAAC,MAAM,EACnB;YACE,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,GAAG,CAAC,eAAe;SAC/B,EACD,GAAG,CAAC,aAAa,CAClB,CAAA;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QAC5D,OAAO,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,EAAE,CAAA;IACvE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAA+B;QAC5C,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,OAAO,CAChB,GAAG,CAAC,QAAQ,EACZ,GAAG,CAAC,QAAQ,CAAC,QAAQ,EACrB;gBACE,KAAK,EAAE,EAAE;gBACT,SAAS,EAAE,GAAG,CAAC,eAAe;aAC/B,EACD,GAAG,CAAC,aAAa,CAClB,CAAA;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IAChC,CAAC;IAED,2EAA2E;IAEnE,KAAK,CAAC,OAAO,CACnB,QAA6B,EAC7B,QAAoC,EACpC,KAA2C,EAC3C,aAA6B;QAE7B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;QAE5D,MAAM,OAAO,GAA2B;YACtC,MAAM,EAAE,kBAAkB;YAC1B,YAAY,EAAE,UAAU;YACxB,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;SAC1D,CAAA;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YACvC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,mBAAmB,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACzE,CAAC;QAED,IAAI,IAAwB,CAAA;QAC5B,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACrE,IAAI,GAAG,iBAAiB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;YAC1E,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;gBAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAA;QAC5E,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,SAAS,CACzB,GAAG,EACH;YACE,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO;YACP,IAAI;YACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC;SACzE,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,CAAC,EAAE,aAAa,CAAC,CACpE,CAAA;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YACpF,MAAM,IAAI,mBAAmB,CAC3B,GAAG,CAAC,MAAM,EACV,wBAAwB,QAAQ,CAAC,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACpF,CAAA;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;QAC1D,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAA;QACpB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;YAC5D,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;IAEO,QAAQ,CACd,OAAe,EACf,QAAoC,EACpC,KAA2C;QAE3C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QACxC,MAAM,IAAI,GAAG,iBAAiB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;QAChF,IAAI,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QAC1E,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;aACjC,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAChD,iBAAiB,CAAC,mBAAmB,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CACtD,EAAE,CACN;aACA,IAAI,CAAC,GAAG,CAAC,CAAA;QACZ,IAAI,KAAK;YAAE,GAAG,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,EAAE,CAAA;QAC5D,OAAO,GAAG,CAAA;IACZ,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,IAA2B,EAC3B,aAA6B;QAE7B,MAAM,MAAM,GAAG,CAAC,GAAW,EAAU,EAAE;YACrC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;YAChC,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,IAAI,mBAAmB,CAAC,GAAG,EAAE,mBAAmB,GAAG,GAAG,CAAC,CAAA;YACtF,OAAO,KAAK,CAAA;QACd,CAAC,CAAA;QACD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,MAAM;gBACT,OAAO,EAAE,CAAA;YACX,KAAK,SAAS;gBACZ,OAAO,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;YACxF,KAAK,QAAQ;gBACX,OAAO,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;YAClE,KAAK,OAAO;gBACV,OAAO;oBACL,aAAa,EAAE,SAAS,IAAI,CAC1B,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAC9E,EAAE;iBACJ,CAAA;YACH,KAAK,2BAA2B;gBAC9B,OAAO,EAAE,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAA;YAC3E,KAAK,gBAAgB,EAAE,CAAC;gBACtB,MAAM,OAAO,GAA2B,EAAE,CAAA;gBAC1C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO;oBAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;gBACvE,OAAO,OAAO,CAAA;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,IAA2E,EAC3E,MAA+B;QAE/B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAA;QACnD,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAA;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC5C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAAE,OAAO,MAAM,CAAC,KAAK,CAAA;QAExE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC;SACtD,CAAC,CAAA;QACF,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7C,IAAI,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;QAEtD,MAAM,GAAG,GAAG,MAAM,SAAS,CACzB,IAAI,CAAC,QAAQ,EACb;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;gBAC1B,YAAY,EAAE,UAAU;aACzB;YACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC;SACnD,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,CAAC,EAAE,iBAAiB,CAAC,CACxE,CAAA;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YACjF,MAAM,IAAI,mBAAmB,CAC3B,GAAG,CAAC,MAAM,EACV,yBAAyB,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC7D,CAAA;QACH,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;QAC/D,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE;YACjB,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAmD,CAAA;YAChF,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;QACJ,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;YACxB,MAAM,IAAI,mBAAmB,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAA;QACjF,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;QAClF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;QAC1F,OAAO,IAAI,CAAC,YAAY,CAAA;IAC1B,CAAC;IAEO,WAAW,CACjB,QAA6B,EAC7B,IAAa,EACb,cAAiC;QAEjC,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAA;QAC3B,MAAM,UAAU,GAAG,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,IAAI,CAAA;QAClF,MAAM,GAAG,GAAG,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAA;QACpE,MAAM,SAAS,GAAG,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,CAAA;QACrE,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;QAClF,MAAM,SAAS,GAAG,CAAC,CAAC,aAAa;YAC/B,CAAC,CAAC,iBAAiB,CAAC,eAAe,CAAC,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC;YAC3F,CAAC,CAAC,IAAI,CAAA;QAER,MAAM,MAAM,GAAoB,EAAE,CAAA;QAClC,IAAI,UAAU;YAAE,MAAM,CAAC,UAAU,GAAG,UAAU,CAAA;QAC9C,IAAI,GAAG;YAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAA;QAEzB,OAAO;YACL,UAAU;YACV,GAAG;YACH,MAAM;YACN,SAAS;YACT,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC;YACtC,MAAM;SACP,CAAA;IACH,CAAC;IAEO,SAAS,CACf,OAA6C,EAC7C,IAAa;QAEb,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAA;QACzB,MAAM,MAAM,GAA4B,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;QAClE,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,CAAC,KAAK,GAAG,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;QACzE,CAAC;aAAM,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACtC,MAAM,CAAC,QAAQ,GAAG,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;YAC7E,MAAM,CAAC,QAAQ,GAAG,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;QAC/E,CAAC;aAAM,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YAC9C,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;YACtC,MAAM,CAAC,WAAW,GAAG,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,CAAC,CAAA;QACrF,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;CACF"}

package/dist/infrastructure/environments/WebCryptoSecretCipher.d.ts

@@ -0,0 +1,2 @@
+export { WebCryptoSecretCipher, type WebCryptoSecretCipherOptions } from '@cat-factory/server';
+//# sourceMappingURL=WebCryptoSecretCipher.d.ts.map

package/dist/infrastructure/environments/WebCryptoSecretCipher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebCryptoSecretCipher.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/environments/WebCryptoSecretCipher.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,qBAAqB,EAAE,KAAK,4BAA4B,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/environments/WebCryptoSecretCipher.js

@@ -0,0 +1,5 @@
+// Moved to the runtime-neutral @cat-factory/server package (Web Crypto runs under
+// Node too, so the Node service encrypts its runner-pool secrets the same way);
+// re-exported here for existing Worker imports.
+export { WebCryptoSecretCipher } from '@cat-factory/server';
+//# sourceMappingURL=WebCryptoSecretCipher.js.map

package/dist/infrastructure/environments/WebCryptoSecretCipher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebCryptoSecretCipher.js","sourceRoot":"","sources":["../../../src/infrastructure/environments/WebCryptoSecretCipher.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,gFAAgF;AAChF,gDAAgD;AAChD,OAAO,EAAE,qBAAqB,EAAqC,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/environments/sweep.d.ts

@@ -0,0 +1,5 @@
+import type { Clock } from '@cat-factory/kernel';
+import type { CoreDependencies } from '@cat-factory/orchestration';
+import type { Env } from '../env';
+export declare function sweepExpiredEnvironments(env: Env, clock: Clock, overrides?: Partial<CoreDependencies>): Promise<number>;
+//# sourceMappingURL=sweep.d.ts.map

package/dist/infrastructure/environments/sweep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sweep.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/environments/sweep.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAClE,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AAWjC,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,KAAK,EACZ,SAAS,GAAE,OAAO,CAAC,gBAAgB,CAAM,GACxC,OAAO,CAAC,MAAM,CAAC,CAIjB"}

package/dist/infrastructure/environments/sweep.js

@@ -0,0 +1,16 @@
+import { buildContainer } from '../container';
+// Cron-driven TTL teardown: destroy environments whose expiry has elapsed. A
+// no-op unless the integration is configured (the assembled container then has
+// no `environments` module), mirroring `reconcileStaleRepos`. Runs on the
+// frequent (2-min) pass so TTLs are honoured promptly.
+//
+// `overrides` exists only so tests can inject a fake agent executor: building
+// the container otherwise trips the sandbox-prerequisite guard (the test bindings
+// opt into a sandbox but supply no GitHub App). Production calls this with none.
+export async function sweepExpiredEnvironments(env, clock, overrides = {}) {
+    const container = buildContainer(env, overrides);
+    if (!container.environments)
+        return 0;
+    return container.environments.teardownService.sweepExpired(clock.now());
+}
+//# sourceMappingURL=sweep.js.map

package/dist/infrastructure/environments/sweep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sweep.js","sourceRoot":"","sources":["../../../src/infrastructure/environments/sweep.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE7C,6EAA6E;AAC7E,+EAA+E;AAC/E,0EAA0E;AAC1E,uDAAuD;AACvD,EAAE;AACF,8EAA8E;AAC9E,kFAAkF;AAClF,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAQ,EACR,KAAY,EACZ,SAAS,GAA8B,EAAE;IAEzC,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;IAChD,IAAI,CAAC,SAAS,CAAC,YAAY;QAAE,OAAO,CAAC,CAAA;IACrC,OAAO,SAAS,CAAC,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;AACzE,CAAC"}

package/dist/infrastructure/events/DurableObjectEventPublisher.d.ts

@@ -0,0 +1,25 @@
+import type { Block, BootstrapJob, ConsensusSession, ClarityReview, ExecutionInstance, LlmCallActivity, Notification, RequirementReview } from '@cat-factory/contracts';
+import type { ExecutionEventPublisher } from '@cat-factory/kernel';
+import type { DurableObjectNamespace } from '@cloudflare/workers-types';
+import type { WorkspaceEventsHub } from '../durable-objects/WorkspaceEventsHub';
+/**
+ * Publishes execution/board events to the per-workspace {@link WorkspaceEventsHub}
+ * Durable Object, which fans them out to subscribed browsers. Best-effort: a
+ * failure here (no live hub, transient DO error) must never break a state
+ * transition, so every publish swallows its own errors — the persisted run remains
+ * the source of truth, and a client reconciles missed events on reconnect.
+ */
+export declare class DurableObjectEventPublisher implements ExecutionEventPublisher {
+    private readonly namespace;
+    constructor(namespace: DurableObjectNamespace<WorkspaceEventsHub>);
+    executionChanged(workspaceId: string, instance: ExecutionInstance, block?: Block | null): Promise<void>;
+    boardChanged(workspaceId: string, reason: string, _blockId?: string | null): Promise<void>;
+    bootstrapChanged(workspaceId: string, job: BootstrapJob, block?: Block | null): Promise<void>;
+    notificationChanged(workspaceId: string, notification: Notification): Promise<void>;
+    llmCallObserved(workspaceId: string, activity: LlmCallActivity): Promise<void>;
+    requirementReviewChanged(workspaceId: string, review: RequirementReview): Promise<void>;
+    consensusSessionChanged(workspaceId: string, session: ConsensusSession): Promise<void>;
+    clarityReviewChanged(workspaceId: string, review: ClarityReview): Promise<void>;
+    private publish;
+}
+//# sourceMappingURL=DurableObjectEventPublisher.d.ts.map

package/dist/infrastructure/events/DurableObjectEventPublisher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DurableObjectEventPublisher.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/events/DurableObjectEventPublisher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EACL,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,iBAAiB,EAElB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAClE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAA;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAA;AAE/E;;;;;;GAMG;AACH,qBAAa,2BAA4B,YAAW,uBAAuB;IAC7D,OAAO,CAAC,QAAQ,CAAC,SAAS;IAAtC,YAA6B,SAAS,EAAE,sBAAsB,CAAC,kBAAkB,CAAC,EAAI;IAEhF,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,iBAAiB,EAC3B,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,GACnB,OAAO,CAAC,IAAI,CAAC,CAOf;IAEK,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAI/F;IAEK,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,YAAY,EACjB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,GACnB,OAAO,CAAC,IAAI,CAAC,CAOf;IAEK,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAExF;IAEK,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnF;IAEK,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5F;IAEK,uBAAuB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3F;IAEK,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpF;YAEa,OAAO;CAatB"}

package/dist/infrastructure/events/DurableObjectEventPublisher.js

@@ -0,0 +1,64 @@
+/**
+ * Publishes execution/board events to the per-workspace {@link WorkspaceEventsHub}
+ * Durable Object, which fans them out to subscribed browsers. Best-effort: a
+ * failure here (no live hub, transient DO error) must never break a state
+ * transition, so every publish swallows its own errors — the persisted run remains
+ * the source of truth, and a client reconciles missed events on reconnect.
+ */
+export class DurableObjectEventPublisher {
+    namespace;
+    constructor(namespace) {
+        this.namespace = namespace;
+    }
+    async executionChanged(workspaceId, instance, block) {
+        await this.publish(workspaceId, {
+            type: 'execution',
+            instance,
+            block: block ?? null,
+            at: Date.now(),
+        });
+    }
+    async boardChanged(workspaceId, reason, _blockId) {
+        // `_blockId` is used by the FanOutEventPublisher decorator to resolve which workspaces a
+        // shared service's change reaches; the per-workspace publish itself is block-agnostic.
+        await this.publish(workspaceId, { type: 'board', reason, at: Date.now() });
+    }
+    async bootstrapChanged(workspaceId, job, block) {
+        await this.publish(workspaceId, {
+            type: 'bootstrap',
+            job,
+            block: block ?? null,
+            at: Date.now(),
+        });
+    }
+    async notificationChanged(workspaceId, notification) {
+        await this.publish(workspaceId, { type: 'notification', notification, at: Date.now() });
+    }
+    async llmCallObserved(workspaceId, activity) {
+        await this.publish(workspaceId, { type: 'llmCall', call: activity, at: Date.now() });
+    }
+    async requirementReviewChanged(workspaceId, review) {
+        await this.publish(workspaceId, { type: 'requirements', review, at: Date.now() });
+    }
+    async consensusSessionChanged(workspaceId, session) {
+        await this.publish(workspaceId, { type: 'consensus', session, at: Date.now() });
+    }
+    async clarityReviewChanged(workspaceId, review) {
+        await this.publish(workspaceId, { type: 'clarity', review, at: Date.now() });
+    }
+    async publish(workspaceId, event) {
+        try {
+            const stub = this.namespace.get(this.namespace.idFromName(workspaceId));
+            await stub.fetch('http://hub/publish', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(event),
+            });
+        }
+        catch {
+            // No subscribers / transient DO error — the DB write is authoritative and
+            // the client's reconnect-resync covers any missed event.
+        }
+    }
+}
+//# sourceMappingURL=DurableObjectEventPublisher.js.map

package/dist/infrastructure/events/DurableObjectEventPublisher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DurableObjectEventPublisher.js","sourceRoot":"","sources":["../../../src/infrastructure/events/DurableObjectEventPublisher.ts"],"names":[],"mappings":"AAeA;;;;;;GAMG;AACH,MAAM,OAAO,2BAA2B;IACT,SAAS;IAAtC,YAA6B,SAAqD;yBAArD,SAAS;IAA+C,CAAC;IAEtF,KAAK,CAAC,gBAAgB,CACpB,WAAmB,EACnB,QAA2B,EAC3B,KAAoB;QAEpB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE;YAC9B,IAAI,EAAE,WAAW;YACjB,QAAQ;YACR,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;SACf,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,WAAmB,EAAE,MAAc,EAAE,QAAwB;QAC9E,yFAAyF;QACzF,uFAAuF;QACvF,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC5E,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,WAAmB,EACnB,GAAiB,EACjB,KAAoB;QAEpB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE;YAC9B,IAAI,EAAE,WAAW;YACjB,GAAG;YACH,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;SACf,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,WAAmB,EAAE,YAA0B;QACvE,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IACzF,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,QAAyB;QAClE,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IACtF,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,WAAmB,EAAE,MAAyB;QAC3E,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IACnF,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,WAAmB,EAAE,OAAyB;QAC1E,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IACjF,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,WAAmB,EAAE,MAAqB;QACnE,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC9E,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,WAAmB,EAAE,KAAqB;QAC9D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAA;YACvE,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE;gBACrC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;aAC5B,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,yDAAyD;QAC3D,CAAC;IACH,CAAC;CACF"}

package/dist/infrastructure/events/InAppNotificationChannel.d.ts

@@ -0,0 +1,19 @@
+import type { ExecutionEventPublisher, Notification, NotificationChannel } from '@cat-factory/kernel';
+/**
+ * The in-app notification channel: pushes the `notification` WorkspaceEvent to the
+ * board (via the same event publisher that carries execution/board events) so the
+ * inbox + per-block badge update live. The canonical row is already persisted by
+ * the NotificationService, so this is purely the live push — best-effort, errors
+ * swallowed by the publisher.
+ *
+ * This is the only channel today; future EmailNotificationChannel /
+ * SlackNotificationChannel implement the same {@link NotificationChannel} port and
+ * are composed alongside it via CompositeNotificationChannel, with no change to the
+ * code that raises notifications.
+ */
+export declare class InAppNotificationChannel implements NotificationChannel {
+    private readonly publisher;
+    constructor(publisher: ExecutionEventPublisher);
+    deliver(workspaceId: string, notification: Notification): Promise<void>;
+}
+//# sourceMappingURL=InAppNotificationChannel.d.ts.map

package/dist/infrastructure/events/InAppNotificationChannel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"InAppNotificationChannel.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/events/InAppNotificationChannel.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,YAAY,EACZ,mBAAmB,EACpB,MAAM,qBAAqB,CAAA;AAE5B;;;;;;;;;;;GAWG;AACH,qBAAa,wBAAyB,YAAW,mBAAmB;IACtD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAAtC,YAA6B,SAAS,EAAE,uBAAuB,EAAI;IAE7D,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5E;CACF"}

package/dist/infrastructure/events/InAppNotificationChannel.js

@@ -0,0 +1,22 @@
+/**
+ * The in-app notification channel: pushes the `notification` WorkspaceEvent to the
+ * board (via the same event publisher that carries execution/board events) so the
+ * inbox + per-block badge update live. The canonical row is already persisted by
+ * the NotificationService, so this is purely the live push — best-effort, errors
+ * swallowed by the publisher.
+ *
+ * This is the only channel today; future EmailNotificationChannel /
+ * SlackNotificationChannel implement the same {@link NotificationChannel} port and
+ * are composed alongside it via CompositeNotificationChannel, with no change to the
+ * code that raises notifications.
+ */
+export class InAppNotificationChannel {
+    publisher;
+    constructor(publisher) {
+        this.publisher = publisher;
+    }
+    async deliver(workspaceId, notification) {
+        await this.publisher.notificationChanged?.(workspaceId, notification);
+    }
+}
+//# sourceMappingURL=InAppNotificationChannel.js.map

package/dist/infrastructure/events/InAppNotificationChannel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"InAppNotificationChannel.js","sourceRoot":"","sources":["../../../src/infrastructure/events/InAppNotificationChannel.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,wBAAwB;IACN,SAAS;IAAtC,YAA6B,SAAkC;yBAAlC,SAAS;IAA4B,CAAC;IAEnE,KAAK,CAAC,OAAO,CAAC,WAAmB,EAAE,YAA0B;QAC3D,MAAM,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;IACvE,CAAC;CACF"}

package/dist/infrastructure/gateways/DoRealtimeGateway.d.ts

@@ -0,0 +1,15 @@
+import type { RealtimeGateway } from '@cat-factory/server';
+import type { DurableObjectNamespace } from '@cloudflare/workers-types';
+import type { WorkspaceEventsHub } from '../durable-objects/WorkspaceEventsHub';
+/**
+ * Worker implementation of the realtime gateway: forwards a WebSocket upgrade to the
+ * per-workspace {@link WorkspaceEventsHub} Durable Object, which holds the socket
+ * (hibernatable) and broadcasts the events the engine publishes. Returns null when
+ * no `WORKSPACE_EVENTS` namespace is bound, so the controller replies 501.
+ */
+export declare class DoRealtimeGateway implements RealtimeGateway {
+    private readonly namespace?;
+    constructor(namespace?: DurableObjectNamespace<WorkspaceEventsHub> | undefined);
+    upgrade(workspaceId: string, request: Request): Promise<Response | null>;
+}
+//# sourceMappingURL=DoRealtimeGateway.d.ts.map

package/dist/infrastructure/gateways/DoRealtimeGateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DoRealtimeGateway.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/gateways/DoRealtimeGateway.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAA;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAA;AAE/E;;;;;GAKG;AACH,qBAAa,iBAAkB,YAAW,eAAe;IAC3C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAAvC,YAA6B,SAAS,CAAC,EAAE,sBAAsB,CAAC,kBAAkB,CAAC,YAAA,EAAI;IAEjF,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAK7E;CACF"}

package/dist/infrastructure/gateways/DoRealtimeGateway.js

@@ -0,0 +1,20 @@
+/**
+ * Worker implementation of the realtime gateway: forwards a WebSocket upgrade to the
+ * per-workspace {@link WorkspaceEventsHub} Durable Object, which holds the socket
+ * (hibernatable) and broadcasts the events the engine publishes. Returns null when
+ * no `WORKSPACE_EVENTS` namespace is bound, so the controller replies 501.
+ */
+export class DoRealtimeGateway {
+    namespace;
+    constructor(namespace) {
+        this.namespace = namespace;
+    }
+    async upgrade(workspaceId, request) {
+        if (!this.namespace)
+            return null;
+        const stub = this.namespace.get(this.namespace.idFromName(workspaceId));
+        // Forward the original request so the 101 + live `webSocket` flows back out.
+        return stub.fetch(request);
+    }
+}
+//# sourceMappingURL=DoRealtimeGateway.js.map

package/dist/infrastructure/gateways/DoRealtimeGateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DoRealtimeGateway.js","sourceRoot":"","sources":["../../../src/infrastructure/gateways/DoRealtimeGateway.ts"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,MAAM,OAAO,iBAAiB;IACC,SAAS;IAAtC,YAA6B,SAAsD;yBAAtD,SAAS;IAAgD,CAAC;IAEvF,KAAK,CAAC,OAAO,CAAC,WAAmB,EAAE,OAAgB;QACjD,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAA;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAA;QACvE,6EAA6E;QAC7E,OAAO,IAAI,CAAC,KAAK,CAAC,OAAsD,CAAwB,CAAA;IAClG,CAAC;CACF"}

package/dist/infrastructure/gateways/GitHubGateways.d.ts

@@ -0,0 +1,27 @@
+import type { GitHubBackfillScheduler, GitHubWebhookIngest } from '@cat-factory/server';
+import type { Queue, Workflow } from '@cloudflare/workers-types';
+import type { GitHubSyncMessage } from '../env';
+/**
+ * Worker implementation of the GitHub backfill scheduler: creates a Cloudflare
+ * Workflows instance to durably drive a full-installation backfill. When no
+ * `GITHUB_BACKFILL_WORKFLOW` binding is present, returns false so the caller runs
+ * the backfill inline.
+ */
+export declare class WorkflowsBackfillScheduler implements GitHubBackfillScheduler {
+    private readonly workflow?;
+    constructor(workflow?: Workflow | undefined);
+    scheduleBackfill(installationId: number): Promise<boolean>;
+}
+/**
+ * Worker implementation of GitHub webhook ingest: enqueues verified deliveries and
+ * incremental repo resyncs onto the `GITHUB_SYNC_QUEUE` so the request acks fast and
+ * the consumer applies projections asynchronously. Returns false when no queue is
+ * bound, so the caller handles the work inline (local/dev).
+ */
+export declare class CfGitHubWebhookIngest implements GitHubWebhookIngest {
+    private readonly queue?;
+    constructor(queue?: Queue<GitHubSyncMessage> | undefined);
+    enqueueWebhook(eventName: string, payload: unknown): Promise<boolean>;
+    queueRepoResync(workspaceId: string, repoGithubId: number): Promise<boolean>;
+}
+//# sourceMappingURL=GitHubGateways.d.ts.map

package/dist/infrastructure/gateways/GitHubGateways.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubGateways.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/gateways/GitHubGateways.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACvF,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAA;AAE/C;;;;;GAKG;AACH,qBAAa,0BAA2B,YAAW,uBAAuB;IAC5D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAAtC,YAA6B,QAAQ,CAAC,EAAE,QAAQ,YAAA,EAAI;IAE9C,gBAAgB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAS/D;CACF;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,YAAW,mBAAmB;IACnD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAAnC,YAA6B,KAAK,CAAC,EAAE,KAAK,CAAC,iBAAiB,CAAC,YAAA,EAAI;IAE3D,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAI1E;IAEK,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAIjF;CACF"}