@aeolus-fleet/core 0.0.0 → 0.18.0

package/dist/adapters/crypto/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../../src/adapters/crypto/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAItD,wFAAwF;AACxF,MAAM,CAAC,MAAM,YAAY,GAAiB;IACxC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;CAC1E,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,kBAAkB,GAAiB;IAC9C,IAAI,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;CAClD,CAAC"}

package/dist/adapters/http/device-label.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The device a console sign-in comes from, in a few words for the operator
+ * ("Mac · Chrome"), from the browser's User-Agent. A label only: never
+ * trusted for anything, so a rough reading is enough. The first match wins:
+ * an iPhone also says "like Mac OS X", Android also says "Linux", Edge also
+ * says "Chrome", and Chrome also says "Safari".
+ */
+export declare const UNKNOWN_DEVICE_LABEL = "Unknown device";
+export declare function deviceLabelOf(userAgent: string | undefined): string;

package/dist/adapters/http/device-label.js

@@ -0,0 +1,39 @@
+/**
+ * The device a console sign-in comes from, in a few words for the operator
+ * ("Mac · Chrome"), from the browser's User-Agent. A label only: never
+ * trusted for anything, so a rough reading is enough. The first match wins:
+ * an iPhone also says "like Mac OS X", Android also says "Linux", Edge also
+ * says "Chrome", and Chrome also says "Safari".
+ */
+const SYSTEMS = [
+    [/iPhone/, 'iPhone'],
+    [/iPad/, 'iPad'],
+    [/Android/, 'Android'],
+    [/CrOS/, 'ChromeOS'],
+    [/Macintosh/, 'Mac'],
+    [/Windows/, 'Windows'],
+    [/Linux/, 'Linux'],
+];
+const BROWSERS = [
+    [/Edg\//, 'Edge'],
+    [/OPR\//, 'Opera'],
+    [/Firefox\//, 'Firefox'],
+    [/Chrome\//, 'Chrome'],
+    [/Version\/[\d.]+.*Safari\//, 'Safari'],
+];
+export const UNKNOWN_DEVICE_LABEL = 'Unknown device';
+function firstMatch(userAgent, table) {
+    return table.find(([pattern]) => pattern.test(userAgent))?.[1];
+}
+export function deviceLabelOf(userAgent) {
+    if (userAgent === undefined) {
+        return UNKNOWN_DEVICE_LABEL;
+    }
+    const system = firstMatch(userAgent, SYSTEMS);
+    if (system === undefined) {
+        return UNKNOWN_DEVICE_LABEL;
+    }
+    const browser = firstMatch(userAgent, BROWSERS);
+    return browser === undefined ? system : `${system} · ${browser}`;
+}
+//# sourceMappingURL=device-label.js.map

package/dist/adapters/http/device-label.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-label.js","sourceRoot":"","sources":["../../../src/adapters/http/device-label.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,OAAO,GAAgC;IAC3C,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,MAAM,EAAE,MAAM,CAAC;IAChB,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,CAAC,MAAM,EAAE,UAAU,CAAC;IACpB,CAAC,WAAW,EAAE,KAAK,CAAC;IACpB,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,CAAC,OAAO,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,QAAQ,GAAgC;IAC5C,CAAC,OAAO,EAAE,MAAM,CAAC;IACjB,CAAC,OAAO,EAAE,OAAO,CAAC;IAClB,CAAC,WAAW,EAAE,SAAS,CAAC;IACxB,CAAC,UAAU,EAAE,QAAQ,CAAC;IACtB,CAAC,2BAA2B,EAAE,QAAQ,CAAC;CACxC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAErD,SAAS,UAAU,CAAC,SAAiB,EAAE,KAAkC;IACvE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAA6B;IACzD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAChD,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,MAAM,OAAO,EAAE,CAAC;AACnE,CAAC"}

package/dist/adapters/http/rate-limiter.d.ts

@@ -0,0 +1,21 @@
+import type { Clock } from '../../domain/shared/clock.js';
+export interface RateLimit {
+    /** Attempts allowed per key in one window. */
+    limit: number;
+    windowMs: number;
+}
+export interface RateLimiter {
+    /** Counts an attempt for the key. False when the key is over its limit in the current window. */
+    take(key: string): boolean;
+    /** True while the key has counted fewer than its limit in the current window. Counts nothing. */
+    hasRoom(key: string): boolean;
+    /** Counts one for the key, for a limit on some outcomes only, such as failures. */
+    count(key: string): void;
+    /** When the key's current window ends, so a key over its limit may try again; now when it has none. */
+    retryAt(key: string): Date;
+}
+/**
+ * A fixed-window counter per key, held in memory. v1 runs one server process
+ * (docs/architecture.md, "Deployment"), so a shared store is not needed yet.
+ */
+export declare function createRateLimiter(limit: RateLimit, clock: Clock): RateLimiter;

package/dist/adapters/http/rate-limiter.js

@@ -0,0 +1,44 @@
+/**
+ * A fixed-window counter per key, held in memory. v1 runs one server process
+ * (docs/architecture.md, "Deployment"), so a shared store is not needed yet.
+ */
+export function createRateLimiter(limit, clock) {
+    const windows = new Map();
+    /** The key's count in the current window, after forgetting finished windows. */
+    const countIn = (key, now) => {
+        const current = windows.get(key);
+        if (!current || now - current.startedAt >= limit.windowMs) {
+            forgetFinishedWindows(windows, { now, windowMs: limit.windowMs });
+            return 0;
+        }
+        return current.count;
+    };
+    const count = (key) => {
+        const now = clock.now().getTime();
+        const counted = countIn(key, now) + 1;
+        const startedAt = counted === 1 ? now : (windows.get(key)?.startedAt ?? now);
+        windows.set(key, { startedAt, count: counted });
+        return counted;
+    };
+    return {
+        take: (key) => count(key) <= limit.limit,
+        hasRoom: (key) => countIn(key, clock.now().getTime()) < limit.limit,
+        count: (key) => {
+            count(key);
+        },
+        retryAt: (key) => {
+            const now = clock.now().getTime();
+            const current = countIn(key, now) === 0 ? undefined : windows.get(key);
+            return new Date(current ? current.startedAt + limit.windowMs : now);
+        },
+    };
+}
+function forgetFinishedWindows(windows, at) {
+    const { now, windowMs } = at;
+    for (const [key, window] of windows) {
+        if (now - window.startedAt >= windowMs) {
+            windows.delete(key);
+        }
+    }
+}
+//# sourceMappingURL=rate-limiter.js.map

package/dist/adapters/http/rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../../src/adapters/http/rate-limiter.ts"],"names":[],"mappings":"AAmBA;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAgB,EAAE,KAAY;IAC9D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAgD,CAAC;IAExE,gFAAgF;IAChF,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,GAAW,EAAU,EAAE;QACnD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC1D,qBAAqB,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YAClE,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC;IACvB,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,GAAW,EAAU,EAAE;QACpC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,SAAS,IAAI,GAAG,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAChD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK;QACxC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK;QACnE,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;YACb,KAAK,CAAC,GAAG,CAAC,CAAC;QACb,CAAC;QACD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACf,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,OAA2C,EAAE,EAAqC;IAC/G,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,IAAI,QAAQ,EAAE,CAAC;YACvC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/adapters/http/request-credentials.d.ts

@@ -0,0 +1,23 @@
+/**
+ * How a request says who it is: a crew token as a bearer token, or the console
+ * session cookie. The ship secret travels only in the body of `register`.
+ *
+ * The console session cookie holds the random session token, never the ship secret.
+ * httpOnly so scripts cannot read it, Secure so it only travels over HTTPS
+ * (browsers accept it on http://localhost for development), SameSite=Strict so
+ * no other site's page can make the browser send it.
+ */
+export declare const SESSION_COOKIE_NAME = "aeolus_session";
+/** The session token from a Cookie request header, if there is one. */
+export declare function readSessionToken(cookieHeader: string | undefined): string | undefined;
+/** A Set-Cookie value that keeps the token until the session expires. */
+export declare function sessionCookie(cookie: {
+    token: string;
+    expiresAt: Date;
+    now: Date;
+    domain?: string;
+}): string;
+/** A Set-Cookie value that removes the cookie, for the same domain it was set for. */
+export declare function clearedSessionCookie(domain?: string): string;
+/** The token from an `Authorization: Bearer <token>` header, if there is one. */
+export declare function readBearer(authorizationHeader: string | undefined): string | undefined;

package/dist/adapters/http/request-credentials.js

@@ -0,0 +1,45 @@
+/**
+ * How a request says who it is: a crew token as a bearer token, or the console
+ * session cookie. The ship secret travels only in the body of `register`.
+ *
+ * The console session cookie holds the random session token, never the ship secret.
+ * httpOnly so scripts cannot read it, Secure so it only travels over HTTPS
+ * (browsers accept it on http://localhost for development), SameSite=Strict so
+ * no other site's page can make the browser send it.
+ */
+export const SESSION_COOKIE_NAME = 'aeolus_session';
+const ATTRIBUTES = 'Path=/; HttpOnly; Secure; SameSite=Strict';
+/**
+ * The cookie's scope: every host under the configured domain, so a console on
+ * another host of that domain sends it too; otherwise the server's host only.
+ */
+function scope(domain) {
+    return domain === undefined ? ATTRIBUTES : `Domain=${domain}; ${ATTRIBUTES}`;
+}
+/** The session token from a Cookie request header, if there is one. */
+export function readSessionToken(cookieHeader) {
+    for (const pair of cookieHeader?.split(';') ?? []) {
+        const separator = pair.indexOf('=');
+        if (separator !== -1 && pair.slice(0, separator).trim() === SESSION_COOKIE_NAME) {
+            const value = pair.slice(separator + 1).trim();
+            return value === '' ? undefined : value;
+        }
+    }
+    return undefined;
+}
+/** A Set-Cookie value that keeps the token until the session expires. */
+export function sessionCookie(cookie) {
+    const { token, expiresAt, now, domain } = cookie;
+    const maxAgeSeconds = Math.max(0, Math.floor((expiresAt.getTime() - now.getTime()) / 1000));
+    return `${SESSION_COOKIE_NAME}=${token}; Max-Age=${maxAgeSeconds}; ${scope(domain)}`;
+}
+/** A Set-Cookie value that removes the cookie, for the same domain it was set for. */
+export function clearedSessionCookie(domain) {
+    return `${SESSION_COOKIE_NAME}=; Max-Age=0; ${scope(domain)}`;
+}
+/** The token from an `Authorization: Bearer <token>` header, if there is one. */
+export function readBearer(authorizationHeader) {
+    const match = /^Bearer\s+(\S+)\s*$/i.exec(authorizationHeader ?? '');
+    return match?.[1];
+}
+//# sourceMappingURL=request-credentials.js.map

package/dist/adapters/http/request-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-credentials.js","sourceRoot":"","sources":["../../../src/adapters/http/request-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAEpD,MAAM,UAAU,GAAG,2CAA2C,CAAC;AAE/D;;;GAGG;AACH,SAAS,KAAK,CAAC,MAA0B;IACvC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,MAAM,KAAK,UAAU,EAAE,CAAC;AAC/E,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,gBAAgB,CAAC,YAAgC;IAC/D,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,mBAAmB,EAAE,CAAC;YAChF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/C,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,aAAa,CAAC,MAAsE;IAClG,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IACjD,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAC5F,OAAO,GAAG,mBAAmB,IAAI,KAAK,aAAa,aAAa,KAAK,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;AACvF,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,oBAAoB,CAAC,MAAe;IAClD,OAAO,GAAG,mBAAmB,iBAAiB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,UAAU,CAAC,mBAAuC;IAChE,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;IACrE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC"}

package/dist/adapters/http/server.d.ts

@@ -0,0 +1,47 @@
+import { type FastifyInstance, type FastifyServerOptions } from 'fastify';
+import type { Clock } from '../../domain/shared/clock.js';
+import type { FleetEventWatches, UseCases } from '../trpc/context.js';
+import { type RateLimit } from './rate-limiter.js';
+/** Ten sign-in attempts per client per minute. */
+export declare const DEFAULT_SIGN_IN_RATE_LIMIT: RateLimit;
+/** Ten failed register attempts per client per minute; successful ones are never counted (ADR 0015). */
+export declare const DEFAULT_REGISTER_RATE_LIMIT: RateLimit;
+export interface HttpServerOptions {
+    useCases: UseCases;
+    /**
+     * Wakes live subscriptions when their fleet commits events. The app feeds
+     * them from the listener; unset, a subscription hears only what it reads
+     * when it starts.
+     */
+    fleetEvents?: FleetEventWatches;
+    /** Throws when the database is unreachable. */
+    checkDatabase: () => Promise<void>;
+    /** The latest migration applied to the database; null before the first. Throws when unreachable. */
+    latestMigration: () => Promise<string | null>;
+    clock: Clock;
+    logger: FastifyServerOptions['logger'];
+    /** Trust X-Forwarded-For from a reverse proxy in front of the server, for the client address. */
+    shouldTrustProxy?: boolean;
+    signInRateLimit?: RateLimit;
+    /** Failed register attempts per client; successful ones are never counted. */
+    registerRateLimit?: RateLimit;
+    /** The domain the session cookie is set for. Unset: the server's host only. */
+    cookieDomain?: string;
+    /** Where ships reach the fleet, the public URL: what starting prompts and crew lines carry. */
+    fleetUrl: string;
+    /** The installation token that opens the installation procedures; unset, they are off. */
+    installationToken?: string;
+    /**
+     * The console's origin: state-changing console calls come only from it, and
+     * a console on another host may call from it with credentials (CORS).
+     */
+    consoleOrigin: string;
+}
+/**
+ * The HTTP host: `/trpc` for the API (its subscriptions over a WebSocket on
+ * the same path), `/api/v1` (REST) and `/mcp` for ships, and `/health` for
+ * monitoring. Every door builds its calls' context the same
+ * way, so the register limit is one budget per client address across all of
+ * them.
+ */
+export declare function buildHttpServer(options: HttpServerOptions): FastifyInstance;

package/dist/adapters/http/server.js

@@ -0,0 +1,216 @@
+import { randomUUID } from 'node:crypto';
+import fastifyWebsocket from '@fastify/websocket';
+import { fastifyTRPCPlugin } from '@trpc/server/adapters/fastify';
+import { getWSConnectionHandler, handleKeepAlive } from '@trpc/server/adapters/ws';
+import Fastify, {} from 'fastify';
+import { registerMcpEndpoint } from '../mcp/mcp-endpoint.js';
+import { createFleetEventWakeups } from '../prisma/fleet-event-wakeups.js';
+import { failureForLog } from '../prisma/failure-log.js';
+import { registerRestApi } from '../rest/rest-api.js';
+import { appRouter } from '../trpc/router.js';
+import { refusalBody, unexpectedFailure } from '../trpc/ship-contract.js';
+import { createRateLimiter } from './rate-limiter.js';
+import { clearedSessionCookie, readBearer, readSessionToken, sessionCookie } from './request-credentials.js';
+import { runningVersions } from './version.js';
+import { INSTALLATION_TOKEN_HEADER } from '../trpc/installation.js';
+/** A header's one value: a header sent twice counts as not sent. */
+function headerValue(value) {
+    return typeof value === 'string' ? value : undefined;
+}
+/** Ten sign-in attempts per client per minute. */
+export const DEFAULT_SIGN_IN_RATE_LIMIT = { limit: 10, windowMs: 60_000 };
+/** Ten failed register attempts per client per minute; successful ones are never counted (ADR 0015). */
+export const DEFAULT_REGISTER_RATE_LIMIT = { limit: 10, windowMs: 60_000 };
+/**
+ * Refusals Fastify raises itself, before any route runs, by its error code:
+ * our code and words, never Fastify's, whose messages may echo the request.
+ */
+const FASTIFY_REFUSALS = {
+    FST_ERR_CTP_INVALID_JSON_BODY: { httpStatus: 400, code: 'BAD_REQUEST', message: 'The request body is not valid JSON' },
+    FST_ERR_CTP_EMPTY_JSON_BODY: { httpStatus: 400, code: 'BAD_REQUEST', message: 'The request body is not valid JSON' },
+    FST_ERR_CTP_BODY_TOO_LARGE: { httpStatus: 413, code: 'PAYLOAD_TOO_LARGE', message: 'The request body is over 1 MiB' },
+    FST_ERR_CTP_INVALID_MEDIA_TYPE: {
+        httpStatus: 415,
+        code: 'UNSUPPORTED_MEDIA_TYPE',
+        message: 'The request body must be JSON',
+    },
+};
+/** Any other request Fastify cannot read. */
+const UNREADABLE_REQUEST = { httpStatus: 400, code: 'BAD_REQUEST', message: 'The request cannot be read' };
+/**
+ * How often the server pings a live subscription's socket, and how long it
+ * waits for the pong before it closes it: a browser that went away without a
+ * word frees its subscription within a minute.
+ */
+const KEEP_ALIVE = { pingMs: 30_000, pongWaitMs: 10_000 };
+/** Fastify's own limit on a request body, which its refusal above names: 1 MiB. */
+const BODY_LIMIT_BYTES = 1024 * 1024;
+/** How long a browser may keep the answer to a preflight, in seconds. */
+const PREFLIGHT_MAX_AGE_S = 600;
+/**
+ * The session cookie at a door for ships: REST and MCP never read the console
+ * session, so they never set or clear its cookie either.
+ */
+const NO_SESSION_COOKIE = { set: () => undefined, clear: () => undefined };
+/**
+ * The HTTP host: `/trpc` for the API (its subscriptions over a WebSocket on
+ * the same path), `/api/v1` (REST) and `/mcp` for ships, and `/health` for
+ * monitoring. Every door builds its calls' context the same
+ * way, so the register limit is one budget per client address across all of
+ * them.
+ */
+export function buildHttpServer(options) {
+    const server = Fastify({
+        logger: options.logger ?? false,
+        trustProxy: options.shouldTrustProxy ?? false,
+        // Unique across restarts, so a caller's request id finds one log line.
+        genReqId: () => randomUUID(),
+        // tRPC batches several procedure paths into one URL segment.
+        routerOptions: { maxParamLength: 5000 },
+        bodyLimit: BODY_LIMIT_BYTES,
+    });
+    // Set first, so every door inherits it. A route's own failures are its own
+    // to answer; what reaches this is an error Fastify raised itself.
+    // eslint-disable-next-line @typescript-eslint/max-params -- Fastify calls its error handler with three arguments.
+    server.setErrorHandler(async (error, request, reply) => {
+        const isRefusal = error.statusCode !== undefined && error.statusCode < 500;
+        const refusal = FASTIFY_REFUSALS[error.code] ?? (isRefusal ? UNREADABLE_REQUEST : undefined);
+        if (refusal !== undefined) {
+            return reply.code(refusal.httpStatus).send({ code: refusal.code, message: refusal.message });
+        }
+        const failure = unexpectedFailure(error, { log: request.log, requestId: request.id });
+        return reply.code(failure.httpStatus).send(refusalBody(failure));
+    });
+    server.setNotFoundHandler(async (_request, reply) => reply.code(404).send({ code: 'NOT_FOUND', message: 'Nothing is served at this path' }));
+    const signInLimiter = createRateLimiter(options.signInRateLimit ?? DEFAULT_SIGN_IN_RATE_LIMIT, options.clock);
+    const registerFailures = createRateLimiter(options.registerRateLimit ?? DEFAULT_REGISTER_RATE_LIMIT, options.clock);
+    const { consoleOrigin, cookieDomain } = options;
+    const fleetEvents = options.fleetEvents ?? createFleetEventWakeups();
+    // The console may run on another host under the cookie's domain (ADR 0012).
+    // Its origin, and no other, may call with credentials and read the answer.
+    // On the server's own origin the browser needs none of this, and ignores it.
+    server.addHook('onRequest', async (request, reply) => {
+        void reply.header('vary', 'Origin');
+        if (request.headers.origin !== consoleOrigin) {
+            return;
+        }
+        void reply.header('access-control-allow-origin', consoleOrigin);
+        void reply.header('access-control-allow-credentials', 'true');
+        if (request.method === 'OPTIONS') {
+            await reply
+                .code(204)
+                .header('access-control-allow-methods', 'GET, POST')
+                .header('access-control-allow-headers', 'content-type')
+                .header('access-control-max-age', String(PREFLIGHT_MAX_AGE_S))
+                .send();
+        }
+    });
+    // The versions this process runs and the database's latest migration, for
+    // whoever operates the installation. No authentication, no fleet data.
+    const versions = runningVersions();
+    server.get('/api/version', async () => {
+        let migration = null;
+        try {
+            migration = await options.latestMigration();
+        }
+        catch (error) {
+            server.log.error(failureForLog(error), 'latest migration unknown');
+        }
+        return { ...versions, migration };
+    });
+    // Server up and database reachable. Nothing about fleets.
+    server.get('/health', async (_request, reply) => {
+        try {
+            await options.checkDatabase();
+            return { server: 'up', database: 'up' };
+        }
+        catch (error) {
+            server.log.error(failureForLog(error), 'health check failed');
+            return reply.code(503).send({ server: 'up', database: 'down' });
+        }
+    });
+    /** A call's context: who it says it is, how it may say so at this door, and where it came from. */
+    const contextFor = (request, caller) => ({
+        useCases: options.useCases,
+        fleetUrl: options.fleetUrl,
+        installation: { configured: options.installationToken, presented: headerValue(request.headers[INSTALLATION_TOKEN_HEADER]) },
+        log: request.log,
+        fleetEvents,
+        ...caller,
+        userAgent: request.headers['user-agent'],
+        origin: request.headers.origin,
+        consoleOrigin,
+        clientKey: request.ip,
+        requestId: request.id,
+        takeSignInAttempt: (clientKey) => signInLimiter.take(clientKey),
+        signInRetryAt: (clientKey) => signInLimiter.retryAt(clientKey),
+        registerFailures,
+    });
+    const trpc = {
+        prefix: '/trpc',
+        trpcOptions: {
+            router: appRouter,
+            createContext: ({ req, res }) => contextFor(req, {
+                credentials: {
+                    bearer: readBearer(req.headers.authorization),
+                    sessionToken: readSessionToken(req.headers.cookie),
+                },
+                canUseConsoleSession: true,
+                sessionCookie: {
+                    set: (token, expiresAt) => {
+                        void res.header('set-cookie', sessionCookie({ token, expiresAt, now: options.clock.now(), domain: cookieDomain }));
+                    },
+                    clear: () => {
+                        void res.header('set-cookie', clearedSessionCookie(cookieDomain));
+                    },
+                },
+            }),
+            // The whole failure goes to the log only, under the request's id (the
+            // label Fastify's own request lines use); the answer carries that id.
+            onError: ({ path, error, ctx }) => {
+                if (error.code === 'INTERNAL_SERVER_ERROR') {
+                    server.log.error({ reqId: ctx?.requestId, path, ...failureForLog(error) }, 'procedure failed');
+                }
+            },
+        },
+    };
+    void server.register(fastifyTRPCPlugin, trpc);
+    // Live subscriptions: one WebSocket per console, opened on /trpc with the
+    // session cookie and the page's Origin, both of which a browser sends on
+    // the upgrade. Nothing can set a cookie on a socket, so the session's
+    // renewal waits for the console's next HTTP call.
+    void server.register(async (scope) => {
+        await scope.register(fastifyWebsocket);
+        const onConnection = getWSConnectionHandler({
+            router: appRouter,
+            wss: scope.websocketServer,
+            createContext: ({ req }) => contextFor({
+                headers: req.headers,
+                ip: req.socket.remoteAddress ?? '',
+                id: randomUUID(),
+                log: server.log,
+            }, {
+                credentials: { sessionToken: readSessionToken(req.headers.cookie) },
+                canUseConsoleSession: true,
+                sessionCookie: NO_SESSION_COOKIE,
+            }),
+            onError: ({ path, error, ctx }) => {
+                if (error.code === 'INTERNAL_SERVER_ERROR') {
+                    server.log.error({ reqId: ctx?.requestId, path, ...failureForLog(error) }, 'subscription failed');
+                }
+            },
+        });
+        scope.get('/trpc', { websocket: true }, (socket, request) => {
+            onConnection(socket, request.raw);
+            handleKeepAlive(socket, KEEP_ALIVE.pingMs, KEEP_ALIVE.pongWaitMs);
+        });
+    });
+    // The doors for ships: the credentials are the ones the call carries, never the console session.
+    const shipDoor = {
+        contextFor: (request, credentials) => contextFor(request, { credentials, canUseConsoleSession: false, sessionCookie: NO_SESSION_COOKIE }),
+    };
+    registerRestApi(server, shipDoor);
+    registerMcpEndpoint(server, shipDoor);
+    return server;
+}
+//# sourceMappingURL=server.js.map

package/dist/adapters/http/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/adapters/http/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,gBAAgB,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAiC,MAAM,+BAA+B,CAAC;AACjG,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,OAAO,EAAE,EAA2F,MAAM,SAAS,CAAC;AAG3H,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,SAAS,EAAkB,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAkB,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC7G,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEpE,oEAAoE;AACpE,SAAS,WAAW,CAAC,KAAoC;IACvD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,kDAAkD;AAClD,MAAM,CAAC,MAAM,0BAA0B,GAAc,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAErF,wGAAwG;AACxG,MAAM,CAAC,MAAM,2BAA2B,GAAc,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAkCtF;;;GAGG;AACH,MAAM,gBAAgB,GAAoF;IACxG,6BAA6B,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,oCAAoC,EAAE;IACtH,2BAA2B,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,oCAAoC,EAAE;IACpH,0BAA0B,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,gCAAgC,EAAE;IACrH,8BAA8B,EAAE;QAC9B,UAAU,EAAE,GAAG;QACf,IAAI,EAAE,wBAAwB;QAC9B,OAAO,EAAE,+BAA+B;KACzC;CACF,CAAC;AAEF,6CAA6C;AAC7C,MAAM,kBAAkB,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;AAE3G;;;;GAIG;AACH,MAAM,UAAU,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAE1D,mFAAmF;AACnF,MAAM,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAAC;AAErC,yEAAyE;AACzE,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC;;;GAGG;AACH,MAAM,iBAAiB,GAAkB,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;AAE1F;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,OAA0B;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC;QACrB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK;QAC/B,UAAU,EAAE,OAAO,CAAC,gBAAgB,IAAI,KAAK;QAC7C,uEAAuE;QACvE,QAAQ,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;QAC5B,6DAA6D;QAC7D,aAAa,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE;QACvC,SAAS,EAAE,gBAAgB;KAC5B,CAAC,CAAC;IAEH,2EAA2E;IAC3E,kEAAkE;IAClE,kHAAkH;IAClH,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,KAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACnE,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;QAC3E,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7F,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACtF,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAClD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CACvF,CAAC;IAEF,MAAM,aAAa,GAAG,iBAAiB,CAAC,OAAO,CAAC,eAAe,IAAI,0BAA0B,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9G,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,IAAI,2BAA2B,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACpH,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IAChD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,uBAAuB,EAAE,CAAC;IAErE,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACnD,KAAK,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,KAAK,KAAK,CAAC,MAAM,CAAC,6BAA6B,EAAE,aAAa,CAAC,CAAC;QAChE,KAAK,KAAK,CAAC,MAAM,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,KAAK;iBACR,IAAI,CAAC,GAAG,CAAC;iBACT,MAAM,CAAC,8BAA8B,EAAE,WAAW,CAAC;iBACnD,MAAM,CAAC,8BAA8B,EAAE,cAAc,CAAC;iBACtD,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;iBAC7D,IAAI,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE;QACpC,IAAI,SAAS,GAAkB,IAAI,CAAC;QACpC,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,0BAA0B,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,0DAA0D;IAC1D,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;QAC9C,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC;YAC9B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC,CAAC;YAC9D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,mGAAmG;IACnG,MAAM,UAAU,GAAG,CACjB,OAA8D,EAC9D,MAAwG,EAC/F,EAAE,CAAC,CAAC;QACb,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,iBAAiB,EAAE,SAAS,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,EAAE;QAC3H,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,WAAW;QACX,GAAG,MAAM;QACT,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;QACxC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;QAC9B,aAAa;QACb,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,iBAAiB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;QAC/D,aAAa,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC;QAC9D,gBAAgB;KACjB,CAAC,CAAC;IAEH,MAAM,IAAI,GAAwC;QAChD,MAAM,EAAE,OAAO;QACf,WAAW,EAAE;YACX,MAAM,EAAE,SAAS;YACjB,aAAa,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAW,EAAE,CACvC,UAAU,CAAC,GAAG,EAAE;gBACd,WAAW,EAAE;oBACX,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;oBAC7C,YAAY,EAAE,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;iBACnD;gBACD,oBAAoB,EAAE,IAAI;gBAC1B,aAAa,EAAE;oBACb,GAAG,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;wBACxB,KAAK,GAAG,CAAC,MAAM,CACb,YAAY,EACZ,aAAa,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CACpF,CAAC;oBACJ,CAAC;oBACD,KAAK,EAAE,GAAG,EAAE;wBACV,KAAK,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC;oBACpE,CAAC;iBACF;aACF,CAAC;YACJ,sEAAsE;YACtE,sEAAsE;YACtE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE;gBAChC,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;oBAC3C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,kBAAkB,CAAC,CAAC;gBACjG,CAAC;YACH,CAAC;SACF;KACF,CAAC;IACF,KAAK,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IAE9C,0EAA0E;IAC1E,yEAAyE;IACzE,sEAAsE;IACtE,kDAAkD;IAClD,KAAK,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACnC,MAAM,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACvC,MAAM,YAAY,GAAG,sBAAsB,CAAY;YACrD,MAAM,EAAE,SAAS;YACjB,GAAG,EAAE,KAAK,CAAC,eAAe;YAC1B,aAAa,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CACzB,UAAU,CACR;gBACE,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE;gBAClC,EAAE,EAAE,UAAU,EAAE;gBAChB,GAAG,EAAE,MAAM,CAAC,GAAG;aAChB,EACD;gBACE,WAAW,EAAE,EAAE,YAAY,EAAE,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;gBACnE,oBAAoB,EAAE,IAAI;gBAC1B,aAAa,EAAE,iBAAiB;aACjC,CACF;YACH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE;gBAChC,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;oBAC3C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,qBAAqB,CAAC,CAAC;gBACpG,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;YAC1D,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAClC,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,iGAAiG;IACjG,MAAM,QAAQ,GAAG;QACf,UAAU,EAAE,CAAC,OAAuB,EAAE,WAA+B,EAAE,EAAE,CACvE,UAAU,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,oBAAoB,EAAE,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,CAAC;KACtG,CAAC;IACF,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClC,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAEtC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/adapters/http/version.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The versions this server process runs: its own package's, and that of the
+ * @aeolus-fleet/common it loaded, which a deploy that failed halfway may
+ * leave different. Read once, when the server starts.
+ */
+export declare function runningVersions(): {
+    server: string;
+    common: string;
+};

package/dist/adapters/http/version.js

@@ -0,0 +1,23 @@
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { z } from 'zod';
+const packageJson = z.object({ version: z.string() });
+/** The version in a package.json, read from disk: what this process runs, not what a deploy meant to ship. */
+function versionAt(file) {
+    return packageJson.parse(JSON.parse(readFileSync(file, 'utf8'))).version;
+}
+/**
+ * The versions this server process runs: its own package's, and that of the
+ * @aeolus-fleet/common it loaded, which a deploy that failed halfway may
+ * leave different. Read once, when the server starts.
+ */
+export function runningVersions() {
+    // This file sits at src/adapters/http, or dist/adapters/http once built:
+    // the package root is three levels up either way.
+    const server = versionAt(new URL('../../../package.json', import.meta.url));
+    const commonEntry = createRequire(import.meta.url).resolve('@aeolus-fleet/common');
+    // Common's entry is src/index.ts or dist/index.js: its package.json is one level up.
+    const common = versionAt(new URL('../package.json', `file://${commonEntry}`));
+    return { server, common };
+}
+//# sourceMappingURL=version.js.map

package/dist/adapters/http/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../../../src/adapters/http/version.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEtD,8GAA8G;AAC9G,SAAS,SAAS,CAAC,IAAkB;IACnC,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe;IAC7B,yEAAyE;IACzE,kDAAkD;IAClD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5E,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACnF,qFAAqF;IACrF,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,UAAU,WAAW,EAAE,CAAC,CAAC,CAAC;IAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC"}

package/dist/adapters/mcp/mcp-endpoint.d.ts

@@ -0,0 +1,8 @@
+import type { FastifyInstance, FastifyRequest } from 'fastify';
+import type { Context, RequestCredentials } from '../trpc/context.js';
+export interface McpEndpointOptions {
+    /** The context of one call, for this request, with the credentials the tool call carries. */
+    contextFor: (request: FastifyRequest, credentials: RequestCredentials) => Context;
+}
+/** Mounts `/mcp` on the HTTP server. */
+export declare function registerMcpEndpoint(server: FastifyInstance, options: McpEndpointOptions): void;