@cat-factory/worker 0.82.13 → 0.82.14

package/dist/infrastructure/config/github.d.ts

@@ -1,4 +1,4 @@
-import type { GitHubConfig, PrivilegedAppConfig } from '@cat-factory/server';
+import { type GitHubConfig, type PrivilegedAppConfig } from '@cat-factory/server';
 import type { Env } from '../env';
 export type { GitHubConfig, PrivilegedAppConfig };
 export declare function loadGitHubConfig(env: Env): GitHubConfig;

package/dist/infrastructure/config/github.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/config/github.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAC5E,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AAEjC,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAA;AAEjD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,GAAG,GAAG,YAAY,CAcvD"}
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/config/github.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,mBAAmB,EAEzB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AAEjC,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAA;AAEjD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,GAAG,GAAG,YAAY,CAmBvD"}

package/dist/infrastructure/config/github.js

@@ -1,8 +1,15 @@
+import { requireGitHubAppPrivateKey, } from '@cat-factory/server';
 export function loadGitHubConfig(env) {
     // Enabled when the App id and both secrets are present; the integration is
     // entirely opt-in (a default-off convention shared by the optional integrations).
     const appId = env.GITHUB_APP_ID?.trim() ?? '';
     const enabled = appId !== '' && !!env.GITHUB_APP_PRIVATE_KEY && !!env.GITHUB_WEBHOOK_SECRET;
+    // Validate the App private key's SHAPE at boot (present + PKCS#8 PEM + decodable body) whenever
+    // the App is configured, so a malformed key fails on the misconfigured screen with the openssl
+    // conversion remedy rather than opaquely at the first installation-token mint (error-message
+    // coverage A3). Mirrors the Node loader; the shared validator keeps the message identical.
+    if (enabled)
+        requireGitHubAppPrivateKey(env.GITHUB_APP_PRIVATE_KEY);
     return {
         enabled,
         appId,
@@ -20,6 +27,8 @@ function loadPrivilegedApp(env) {
     const appId = env.GITHUB_PRIVILEGED_APP_ID?.trim() ?? '';
     if (appId === '' || !env.GITHUB_PRIVILEGED_APP_PRIVATE_KEY)
         return undefined;
+    // Same boot-time shape validation as the default App key (error-message coverage A3).
+    requireGitHubAppPrivateKey(env.GITHUB_PRIVILEGED_APP_PRIVATE_KEY, 'GITHUB_PRIVILEGED_APP_PRIVATE_KEY');
     return { appId };
 }
 //# sourceMappingURL=github.js.map

package/dist/infrastructure/config/github.js.map

@@ -1 +1 @@
-{"version":3,"file":"github.js","sourceRoot":"","sources":["../../../src/infrastructure/config/github.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,gBAAgB,CAAC,GAAQ;IACvC,2EAA2E;IAC3E,kFAAkF;IAClF,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IAC7C,MAAM,OAAO,GAAG,KAAK,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,sBAAsB,IAAI,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAA;IAC3F,OAAO;QACL,OAAO;QACP,KAAK;QACL,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE;QAC1C,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,wBAAwB;QAChE,gBAAgB,EAAE,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,IAAI,GAAG;QAC9D,aAAa,EAAE,GAAG,CAAC,qBAAqB,IAAI,EAAE;QAC9C,aAAa,EAAE,iBAAiB,CAAC,GAAG,CAAC;KACtC,CAAA;AACH,CAAC;AAED,2EAA2E;AAC3E,2EAA2E;AAC3E,wCAAwC;AACxC,SAAS,iBAAiB,CAAC,GAAQ;IACjC,MAAM,KAAK,GAAG,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IACxD,IAAI,KAAK,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,iCAAiC;QAAE,OAAO,SAAS,CAAA;IAC5E,OAAO,EAAE,KAAK,EAAE,CAAA;AAClB,CAAC"}
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../../src/infrastructure/config/github.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,0BAA0B,GAC3B,MAAM,qBAAqB,CAAA;AAK5B,MAAM,UAAU,gBAAgB,CAAC,GAAQ;IACvC,2EAA2E;IAC3E,kFAAkF;IAClF,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IAC7C,MAAM,OAAO,GAAG,KAAK,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,sBAAsB,IAAI,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAA;IAC3F,gGAAgG;IAChG,+FAA+F;IAC/F,6FAA6F;IAC7F,2FAA2F;IAC3F,IAAI,OAAO;QAAE,0BAA0B,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAA;IACnE,OAAO;QACL,OAAO;QACP,KAAK;QACL,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE;QAC1C,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,wBAAwB;QAChE,gBAAgB,EAAE,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,IAAI,GAAG;QAC9D,aAAa,EAAE,GAAG,CAAC,qBAAqB,IAAI,EAAE;QAC9C,aAAa,EAAE,iBAAiB,CAAC,GAAG,CAAC;KACtC,CAAA;AACH,CAAC;AAED,2EAA2E;AAC3E,2EAA2E;AAC3E,wCAAwC;AACxC,SAAS,iBAAiB,CAAC,GAAQ;IACjC,MAAM,KAAK,GAAG,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IACxD,IAAI,KAAK,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,iCAAiC;QAAE,OAAO,SAAS,CAAA;IAC5E,sFAAsF;IACtF,0BAA0B,CACxB,GAAG,CAAC,iCAAiC,EACrC,mCAAmC,CACpC,CAAA;IACD,OAAO,EAAE,KAAK,EAAE,CAAA;AAClB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/worker",
-  "version": "0.82.13",
+  "version": "0.82.14",
   "description": "Reusable Cloudflare Worker library (Hono + D1) exposing the Agent Architecture Board core: the `createApp()` Hono factory, the default fetch/scheduled/queue handler, and the Durable Object + Workflow classes. Deployments (see deploy/backend) supply the wrangler.toml + config and re-export these.",
   "repository": {
     "type": "git",
@@ -55,7 +55,7 @@
     "@cat-factory/orchestration": "0.106.2",
     "@cat-factory/prompt-fragments": "0.13.13",
     "@cat-factory/provider-cloudflare": "0.7.208",
-    "@cat-factory/server": "0.112.2",
+    "@cat-factory/server": "0.112.3",
     "@cat-factory/spend": "0.12.17"
   },
   "devDependencies": {
@@ -64,7 +64,7 @@
     "typescript": "7.0.1-rc",
     "vitest": "^4.1.9",
     "wrangler": "^4.107.0",
-    "@cat-factory/conformance": "0.10.101"
+    "@cat-factory/conformance": "0.10.102"
   },
   "scripts": {
     "build": "tsc -b tsconfig.build.json",