@aeolus-fleet/core 0.0.0 → 0.18.0

package/dist/adapters/trpc/trpc.js

@@ -0,0 +1,350 @@
+import { initTRPC, TRPCError } from '@trpc/server';
+import { hasScope, isCrew } from '../../domain/shared/caller.js';
+/** All a caller learns of a server failure, with the request's id; the log keeps the rest under that id. */
+export const INTERNAL_ERROR_MESSAGE = 'Internal error';
+// Never development mode, whatever NODE_ENV says: in it tRPC puts the stack
+// trace into every error it answers. A server failure answers only that it
+// failed and the request's id; a refusal keeps its own code and message.
+/**
+ * What the console reads beside a refusal's code, to say more than "refused":
+ * that the operator signed in somewhere else, or when a rate-limited sign-in
+ * may try again (ISO 8601). Carried as the tRPC error's cause; the error data
+ * holds its fields.
+ */
+export class ConsoleRefusalDetails extends Error {
+    name = 'ConsoleRefusalDetails';
+    details;
+    constructor(details) {
+        super('console refusal details');
+        this.details = details;
+    }
+}
+const t = initTRPC.context().meta().create({
+    isDev: false,
+    errorFormatter: ({ shape, error, ctx }) => {
+        if (error.code === 'INTERNAL_SERVER_ERROR') {
+            return { ...shape, message: INTERNAL_ERROR_MESSAGE, data: { ...shape.data, requestId: ctx?.requestId } };
+        }
+        return error.cause instanceof ConsoleRefusalDetails
+            ? { ...shape, data: { ...shape.data, ...error.cause.details } }
+            : shape;
+    },
+});
+export const router = t.router;
+const ERROR_CODES = {
+    DELIVERY_HELD_BY_ANOTHER_SHIP: 'FORBIDDEN',
+    DELIVERY_NOT_FOUND: 'NOT_FOUND',
+    DELIVERY_NOT_A_PING: 'CONFLICT',
+    ASSIGNEE_NOT_ACTIVE: 'BAD_REQUEST',
+    CREW_REQUEST_ALREADY_ASSIGNED: 'CONFLICT',
+    CREW_REQUEST_NOT_ASSIGNED_TO_CALLER: 'FORBIDDEN',
+    CREW_REQUEST_NOT_FOUND: 'NOT_FOUND',
+    CREW_REQUEST_NOT_RELEASING: 'CONFLICT',
+    CREW_REQUEST_RELEASING: 'CONFLICT',
+    // BAD_REQUEST, as for a payload or report details over their limit.
+    CREW_REQUEST_SETTINGS_TOO_LARGE: 'BAD_REQUEST',
+    DELIVERY_NOT_IN_FLIGHT: 'CONFLICT',
+    DELIVERY_NOT_OPEN: 'CONFLICT',
+    DELIVERY_NOT_UNDELIVERABLE: 'CONFLICT',
+    FLEET_ALREADY_EXISTS: 'CONFLICT',
+    FLEET_LIMIT_REACHED: 'FORBIDDEN',
+    FLEET_NOT_FOUND: 'NOT_FOUND',
+    FLEET_HAS_NO_VIEWER: 'NOT_FOUND',
+    NOTICE_NOT_FOUND: 'NOT_FOUND',
+    NOTICE_NOT_DISMISSIBLE: 'BAD_REQUEST',
+    GUIDE_NOT_FOUND: 'NOT_FOUND',
+    GUIDE_STEP_NOT_FOUND: 'BAD_REQUEST',
+    IDEMPOTENCY_KEY_REUSED: 'CONFLICT',
+    IN_REPLY_TO_NOT_FOUND: 'NOT_FOUND',
+    MESSAGE_LIMIT_REACHED: 'FORBIDDEN',
+    MODEL_REQUIRED: 'BAD_REQUEST',
+    INVALID_HARNESS: 'BAD_REQUEST',
+    MODEL_FROM_ARGO: 'BAD_REQUEST',
+    INVALID_CONTENT_TYPE: 'BAD_REQUEST',
+    INVALID_EMAIL: 'BAD_REQUEST',
+    INVALID_FLEET_NAME: 'BAD_REQUEST',
+    INVALID_FOLLOW_MAX: 'BAD_REQUEST',
+    INVALID_FOLLOW_WAIT: 'BAD_REQUEST',
+    INVALID_IDEMPOTENCY_KEY: 'BAD_REQUEST',
+    INVALID_INBOX_WAIT: 'BAD_REQUEST',
+    INVALID_LIMIT: 'BAD_REQUEST',
+    INVALID_LOCATION: 'BAD_REQUEST',
+    INVALID_PASSWORD: 'BAD_REQUEST',
+    INVALID_RECEIVE_MAX: 'BAD_REQUEST',
+    INVALID_CREW_REQUEST_REASON: 'BAD_REQUEST',
+    INVALID_REPORT_DETAILS: 'BAD_REQUEST',
+    INVALID_REPORT_NOTE: 'BAD_REQUEST',
+    INVALID_REPORT_STATE: 'BAD_REQUEST',
+    INVALID_SHIP_NAME: 'BAD_REQUEST',
+    INVALID_SHIP_NOTE: 'BAD_REQUEST',
+    INVALID_SHIP_TYPE: 'BAD_REQUEST',
+    // The crew token belonged to that lease: it no longer authenticates anyone.
+    LEASE_ENDED: 'UNAUTHORIZED',
+    MESSAGE_NOT_FOUND: 'NOT_FOUND',
+    NOT_THE_OPERATOR_SHIP: 'FORBIDDEN',
+    OPERATOR_EMAIL_TAKEN: 'CONFLICT',
+    OPERATOR_HAS_NO_PASSWORD: 'CONFLICT',
+    OPERATOR_SHIP_GETS_NO_STARTING_PROMPT: 'FORBIDDEN',
+    OPERATOR_SHIP_HAS_NO_SECRET: 'FORBIDDEN',
+    OPERATOR_SHIP_IS_NOT_PINGED: 'FORBIDDEN',
+    OPERATOR_SHIP_IS_PERMANENT: 'FORBIDDEN',
+    // BAD_REQUEST, as when the schema at the door refuses the same payload.
+    PAYLOAD_TOO_LARGE: 'BAD_REQUEST',
+    PING_NOT_RESENT: 'CONFLICT',
+    // BAD_REQUEST, as for a payload over its limit.
+    REPORT_DETAILS_TOO_LARGE: 'BAD_REQUEST',
+    RESERVED_CONTENT_TYPE: 'FORBIDDEN',
+    SHIP_ALREADY_RETIRED: 'CONFLICT',
+    SHIP_NAME_RESERVED: 'CONFLICT',
+    SHIP_NAME_TAKEN: 'CONFLICT',
+    SHIP_NOT_AWAITING_CREW: 'CONFLICT',
+    SHIP_NOT_CREWED: 'CONFLICT',
+    SHIP_LIMIT_REACHED: 'FORBIDDEN',
+    SHIP_NOT_FOUND: 'NOT_FOUND',
+    SIGN_IN_TICKET_INVALID: 'UNAUTHORIZED',
+    UNKNOWN_CREW_TOKEN: 'UNAUTHORIZED',
+    UNRESOLVABLE_SELECTOR: 'NOT_FOUND',
+    WRONG_EMAIL_OR_PASSWORD: 'UNAUTHORIZED',
+    WRONG_SHIP_ID_OR_SECRET: 'UNAUTHORIZED',
+};
+/**
+ * The code a ship reads for a refusal whose tRPC code would hide it: a crew
+ * whose lease has ended reads LEASE_ENDED, not UNAUTHORIZED, so it can tell a
+ * released ship from a wrong crew token. The HTTP status stays the tRPC
+ * code's. The ship doors read it from the tRPC error's cause.
+ */
+export class ShipRefusalCode extends Error {
+    name = 'ShipRefusalCode';
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+    }
+}
+/** A refusal as the matching tRPC error, keeping its message: the one place domain error kinds meet API errors. */
+function apiErrorOf(error) {
+    const { kind, message } = error;
+    const cause = kind === 'LEASE_ENDED' ? new ShipRefusalCode(kind) : undefined;
+    return new TRPCError({ code: ERROR_CODES[kind], message, cause });
+}
+/** The value of a use case's result. A refusal becomes the matching tRPC error. */
+export function okOrThrow(result) {
+    if (!result.isOk) {
+        throw apiErrorOf(result.error);
+    }
+    return result.value;
+}
+/** Where in the input the first text holding U+0000 is; undefined when no text does. */
+function pathToNul(value, path) {
+    if (typeof value === 'string') {
+        return value.includes('\u0000') ? path : undefined;
+    }
+    if (Array.isArray(value)) {
+        for (const [index, item] of value.entries()) {
+            const found = pathToNul(item, [...path, index]);
+            if (found) {
+                return found;
+            }
+        }
+        return undefined;
+    }
+    if (typeof value === 'object' && value !== null) {
+        for (const [key, item] of Object.entries(value)) {
+            const found = pathToNul(item, [...path, key]);
+            if (found) {
+                return found;
+            }
+        }
+    }
+    return undefined;
+}
+/** A field's path as a caller writes it: `location.description`, `items[2].note`. */
+function fieldName(path) {
+    return path.map((part, index) => (typeof part === 'number' ? `[${part}]` : index === 0 ? part : `.${part}`)).join('');
+}
+/**
+ * A procedure that needs no caller: the base of every procedure, of the
+ * console procedures, and of `register`, which takes the ship secret.
+ *
+ * Postgres text can never store the character U+0000, so this one check at
+ * the door refuses it in any text input, as a bad request naming the field,
+ * before anything else reads the input.
+ */
+export const publicProcedure = t.procedure.use(async ({ getRawInput, next }) => {
+    // Input that does not parse is left to the procedure: one without input,
+    // such as sign-out with an empty body, never reads it; one with input
+    // refuses it as before.
+    const input = await getRawInput().catch(() => undefined);
+    const path = pathToNul(input, []);
+    if (path) {
+        const where = path.length === 0 ? 'The input' : `The input field ${fieldName(path)}`;
+        throw new TRPCError({ code: 'BAD_REQUEST', message: `${where} cannot hold the character U+0000 (NUL)` });
+    }
+    return next();
+});
+/**
+ * Refuses a state-changing console call from anywhere but the console's
+ * origin. The session cookie is SameSite, but hosts under one domain are one
+ * site, so a page on a sibling host could make the browser post with it
+ * (cross-site request forgery). A browser sends Origin with every POST, so a
+ * call without it is refused too.
+ */
+function checkConsoleOrigin(ctx) {
+    if (ctx.origin !== ctx.consoleOrigin) {
+        throw new TRPCError({ code: 'FORBIDDEN', message: "A console call that changes state must come from the console's origin" });
+    }
+}
+/** A console procedure, signing in or out: it changes state, so it comes only from the console's origin. */
+export const consoleProcedure = publicProcedure.use(({ ctx, next }) => {
+    checkConsoleOrigin(ctx);
+    return next();
+});
+/**
+ * The crew of a bearer crew token; undefined when it never crewed a ship. One
+ * whose lease has ended is refused as such, so its session learns that the
+ * ship was released rather than that its token is wrong.
+ */
+async function crewOf(ctx, bearer) {
+    const crew = await ctx.useCases.authenticate.byCrewToken(bearer);
+    if (crew.isOk) {
+        return crew.value;
+    }
+    if (crew.error.kind === 'LEASE_ENDED') {
+        throw apiErrorOf(crew.error);
+    }
+    return undefined;
+}
+/**
+ * Resolves the caller from the crew token or the console session. A bearer
+ * crew token wins over the cookie, and a wrong one fails rather than falling
+ * back. The ship secret is no bearer: it works only for `register` (ADR 0015).
+ * Using a console session keeps it, and its cookie, valid for another 30 days.
+ */
+async function resolveCaller(ctx) {
+    const { bearer, sessionToken } = ctx.credentials;
+    if (bearer !== undefined) {
+        return crewOf(ctx, bearer);
+    }
+    if (sessionToken !== undefined) {
+        const use = await ctx.useCases.authenticate.byConsoleSession(sessionToken);
+        if (use) {
+            ctx.sessionCookie.set(sessionToken, use.expiresAt);
+            return use.caller;
+        }
+        // Signing in somewhere else is no failure: the console says so calmly.
+        if ((await ctx.useCases.authenticate.endOfConsoleSession(sessionToken)) === 'takenOver') {
+            throw new TRPCError({
+                code: 'UNAUTHORIZED',
+                message: 'You signed in somewhere else, which ended this console session',
+                cause: new ConsoleRefusalDetails({ refusal: 'SIGNED_IN_ELSEWHERE' }),
+            });
+        }
+    }
+    return undefined;
+}
+/**
+ * Refuses a live subscription whose caller no longer holds: its console
+ * session ended, or its crew's lease did. A subscription outlives the call
+ * that opened it, so it asks again each time it has news.
+ */
+export async function checkCallerStillHolds(ctx) {
+    if (!(await resolveCaller(ctx))) {
+        throw new TRPCError({ code: 'UNAUTHORIZED', message: 'Sign in, or call with the crew token register gave you' });
+    }
+}
+/** What a caller without a valid crew token is told, at a door for ships and for a crew procedure. */
+const CALL_WITH_CREW_TOKEN = 'Call with the crew token register gave you';
+/**
+ * A procedure for any caller, whatever its scopes: the base of every scoped
+ * procedure, and `whoami`, which tells a caller about itself. The caller comes
+ * from the server, never from the request.
+ */
+export const authenticatedProcedure = publicProcedure.use(async ({ ctx, type, next }) => {
+    // A mutation on the console session's cookie changes state: checked before
+    // the session is used, so a forged call does not even renew it. A
+    // subscription is checked too: a browser opens a WebSocket from any page
+    // with the cookie, and no CORS rule keeps that page from reading the
+    // answers. A crew token wins over the cookie, and no browser sends one by
+    // itself.
+    const { bearer, sessionToken } = ctx.credentials;
+    if ((type === 'mutation' || type === 'subscription') && bearer === undefined && sessionToken !== undefined) {
+        checkConsoleOrigin(ctx);
+    }
+    const caller = await resolveCaller(ctx);
+    if (!caller) {
+        const message = ctx.canUseConsoleSession ? 'Sign in, or call with the crew token register gave you' : CALL_WITH_CREW_TOKEN;
+        throw new TRPCError({ code: 'UNAUTHORIZED', message });
+    }
+    return next({ ctx: { caller } });
+});
+/**
+ * A procedure only a crew calls, with the crew token `register` gave it: one
+ * session crewing one ship under one lease. `deregister` needs nothing more,
+ * since a crew ends only its own lease. The console session is no crew token,
+ * so it is refused here.
+ */
+export const crewProcedure = publicProcedure.use(async ({ ctx, next }) => {
+    const { bearer } = ctx.credentials;
+    const crew = bearer === undefined ? undefined : await crewOf(ctx, bearer);
+    if (!crew) {
+        throw new TRPCError({ code: 'UNAUTHORIZED', message: CALL_WITH_CREW_TOKEN });
+    }
+    return next({ ctx: { caller: crew, crew } });
+});
+/**
+ * A crew procedure that also needs the given scope: receiving and
+ * acknowledging deliveries, which a crew claims under its lease. argo's inbox
+ * comes with its own procedures.
+ */
+export function scopedCrewProcedure(scope) {
+    return crewProcedure.use(({ ctx, next }) => {
+        if (!hasScope(ctx.crew, scope)) {
+            throw new TRPCError({ code: 'FORBIDDEN', message: `This call needs the ${scope} scope` });
+        }
+        return next();
+    });
+}
+/**
+ * A procedure that needs the given scope. The caller and its scopes come from
+ * the server, never from the request, and are checked before any use case runs.
+ */
+export function scopedProcedure(scope) {
+    return authenticatedProcedure.use(({ ctx, next }) => {
+        if (!hasScope(ctx.caller, scope)) {
+            throw new TRPCError({ code: 'FORBIDDEN', message: `This call needs the ${scope} scope` });
+        }
+        return next();
+    });
+}
+/**
+ * A procedure that needs any one of the given scopes: the few fleet calls a
+ * trierarch makes with `fleet:crew` beside the scope the console uses
+ * (decision 0002). Checked before any use case runs, as for one scope.
+ */
+export function anyScopeProcedure(...scopes) {
+    return authenticatedProcedure.use(({ ctx, next }) => {
+        if (!scopes.some((scope) => hasScope(ctx.caller, scope))) {
+            throw new TRPCError({ code: 'FORBIDDEN', message: `This call needs the ${scopes.join(' or ')} scope` });
+        }
+        return next();
+    });
+}
+/**
+ * A procedure for a caller that crews its ship under a lease, with every given
+ * scope: argo's inbox, which its console session calls. A console session
+ * crews argo under the lease it holds; the use case refuses any ship but argo.
+ */
+export function scopedCrewCallerProcedure(...scopes) {
+    return authenticatedProcedure.use(({ ctx, next }) => {
+        const missing = scopes.find((scope) => !hasScope(ctx.caller, scope));
+        if (missing !== undefined) {
+            throw new TRPCError({ code: 'FORBIDDEN', message: `This call needs the ${missing} scope` });
+        }
+        const { caller } = ctx;
+        if (!isCrew(caller)) {
+            throw new TRPCError({ code: 'FORBIDDEN', message: 'Only the operator inbox of argo, signed in to the console, calls this' });
+        }
+        return next({ ctx: { crew: caller } });
+    });
+}
+//# sourceMappingURL=trpc.js.map

package/dist/adapters/trpc/trpc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trpc.js","sourceRoot":"","sources":["../../../src/adapters/trpc/trpc.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEnD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAA0B,MAAM,+BAA+B,CAAC;AAKzF,4GAA4G;AAC5G,MAAM,CAAC,MAAM,sBAAsB,GAAG,gBAAgB,CAAC;AAavD,4EAA4E;AAC5E,2EAA2E;AAC3E,yEAAyE;AACzE;;;;;GAKG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,IAAI,GAAG,uBAAuB,CAAC;IAC/B,OAAO,CAAwD;IAExE,YAAY,OAA8D;QACxE,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAW,CAAC,IAAI,EAAiB,CAAC,MAAM,CAAC;IACjE,KAAK,EAAE,KAAK;IACZ,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE;QACxC,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;YAC3C,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC;QAC3G,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,YAAY,qBAAqB;YACjD,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE;YAC/D,CAAC,CAAC,KAAK,CAAC;IACZ,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;AAE/B,MAAM,WAAW,GAA+C;IAC9D,6BAA6B,EAAE,WAAW;IAC1C,kBAAkB,EAAE,WAAW;IAC/B,mBAAmB,EAAE,UAAU;IAC/B,mBAAmB,EAAE,aAAa;IAClC,6BAA6B,EAAE,UAAU;IACzC,mCAAmC,EAAE,WAAW;IAChD,sBAAsB,EAAE,WAAW;IACnC,0BAA0B,EAAE,UAAU;IACtC,sBAAsB,EAAE,UAAU;IAClC,oEAAoE;IACpE,+BAA+B,EAAE,aAAa;IAC9C,sBAAsB,EAAE,UAAU;IAClC,iBAAiB,EAAE,UAAU;IAC7B,0BAA0B,EAAE,UAAU;IACtC,oBAAoB,EAAE,UAAU;IAChC,mBAAmB,EAAE,WAAW;IAChC,eAAe,EAAE,WAAW;IAC5B,mBAAmB,EAAE,WAAW;IAChC,gBAAgB,EAAE,WAAW;IAC7B,sBAAsB,EAAE,aAAa;IACrC,eAAe,EAAE,WAAW;IAC5B,oBAAoB,EAAE,aAAa;IACnC,sBAAsB,EAAE,UAAU;IAClC,qBAAqB,EAAE,WAAW;IAClC,qBAAqB,EAAE,WAAW;IAClC,cAAc,EAAE,aAAa;IAC7B,eAAe,EAAE,aAAa;IAC9B,eAAe,EAAE,aAAa;IAC9B,oBAAoB,EAAE,aAAa;IACnC,aAAa,EAAE,aAAa;IAC5B,kBAAkB,EAAE,aAAa;IACjC,kBAAkB,EAAE,aAAa;IACjC,mBAAmB,EAAE,aAAa;IAClC,uBAAuB,EAAE,aAAa;IACtC,kBAAkB,EAAE,aAAa;IACjC,aAAa,EAAE,aAAa;IAC5B,gBAAgB,EAAE,aAAa;IAC/B,gBAAgB,EAAE,aAAa;IAC/B,mBAAmB,EAAE,aAAa;IAClC,2BAA2B,EAAE,aAAa;IAC1C,sBAAsB,EAAE,aAAa;IACrC,mBAAmB,EAAE,aAAa;IAClC,oBAAoB,EAAE,aAAa;IACnC,iBAAiB,EAAE,aAAa;IAChC,iBAAiB,EAAE,aAAa;IAChC,iBAAiB,EAAE,aAAa;IAChC,4EAA4E;IAC5E,WAAW,EAAE,cAAc;IAC3B,iBAAiB,EAAE,WAAW;IAC9B,qBAAqB,EAAE,WAAW;IAClC,oBAAoB,EAAE,UAAU;IAChC,wBAAwB,EAAE,UAAU;IACpC,qCAAqC,EAAE,WAAW;IAClD,2BAA2B,EAAE,WAAW;IACxC,2BAA2B,EAAE,WAAW;IACxC,0BAA0B,EAAE,WAAW;IACvC,wEAAwE;IACxE,iBAAiB,EAAE,aAAa;IAChC,eAAe,EAAE,UAAU;IAC3B,gDAAgD;IAChD,wBAAwB,EAAE,aAAa;IACvC,qBAAqB,EAAE,WAAW;IAClC,oBAAoB,EAAE,UAAU;IAChC,kBAAkB,EAAE,UAAU;IAC9B,eAAe,EAAE,UAAU;IAC3B,sBAAsB,EAAE,UAAU;IAClC,eAAe,EAAE,UAAU;IAC3B,kBAAkB,EAAE,WAAW;IAC/B,cAAc,EAAE,WAAW;IAC3B,sBAAsB,EAAE,cAAc;IACtC,kBAAkB,EAAE,cAAc;IAClC,qBAAqB,EAAE,WAAW;IAClC,uBAAuB,EAAE,cAAc;IACvC,uBAAuB,EAAE,cAAc;CACxC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,IAAI,GAAG,iBAAiB,CAAC;IACzB,IAAI,CAAgB;IAE7B,YAAY,IAAmB;QAC7B,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,mHAAmH;AACnH,SAAS,UAAU,CAAC,KAAkB;IACpC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,OAAO,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,SAAS,CAAI,MAA8B;IACzD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC;AAID,wFAAwF;AACxF,SAAS,SAAS,CAAC,KAAc,EAAE,IAAe;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YAChD,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;YAC9C,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qFAAqF;AACrF,SAAS,SAAS,CAAC,IAAe;IAChC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE;IAC7E,yEAAyE;IACzE,sEAAsE;IACtE,wBAAwB;IACxB,MAAM,KAAK,GAAY,MAAM,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClC,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,mBAAmB,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,KAAK,yCAAyC,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,GAAY;IACtC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,aAAa,EAAE,CAAC;QACrC,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,uEAAuE,EAAE,CAAC,CAAC;IAC/H,CAAC;AACH,CAAC;AAED,4GAA4G;AAC5G,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;IACpE,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,KAAK,UAAU,MAAM,CAAC,GAAY,EAAE,MAAc;IAChD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACtC,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAAC,GAAY;IACvC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC;IACjD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAC3E,IAAI,GAAG,EAAE,CAAC;YACR,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YACnD,OAAO,GAAG,CAAC,MAAM,CAAC;QACpB,CAAC;QACD,uEAAuE;QACvE,IAAI,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;YACxF,MAAM,IAAI,SAAS,CAAC;gBAClB,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,gEAAgE;gBACzE,KAAK,EAAE,IAAI,qBAAqB,CAAC,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;aACrE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAY;IACtD,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC,CAAC;IACnH,CAAC;AACH,CAAC;AAED,sGAAsG;AACtG,MAAM,oBAAoB,GAAG,4CAA4C,CAAC;AAE1E;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE;IACtF,2EAA2E;IAC3E,kEAAkE;IAClE,yEAAyE;IACzE,qEAAqE;IACrE,0EAA0E;IAC1E,UAAU;IACV,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC;IACjD,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,cAAc,CAAC,IAAI,MAAM,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC3G,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,OAAO,GAAG,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,wDAAwD,CAAC,CAAC,CAAC,oBAAoB,CAAC;QAC3H,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;IACvE,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC1E,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAY;IAC9C,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;QACzC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,KAAK,QAAQ,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAY;IAC1C,OAAO,sBAAsB,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;QAClD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,KAAK,QAAQ,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAG,MAAkC;IACrE,OAAO,sBAAsB,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;QAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAG,MAAe;IAC1D,OAAO,sBAAsB,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;QAClD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QACrE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,OAAO,QAAQ,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,uEAAuE,EAAE,CAAC,CAAC;QAC/H,CAAC;QACD,OAAO,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/app.d.ts

@@ -0,0 +1,31 @@
+import type { FastifyInstance, FastifyServerOptions } from 'fastify';
+import type { RateLimit } from './adapters/http/rate-limiter.js';
+import type { Clock } from './domain/shared/clock.js';
+export interface AppOptions {
+    databaseUrl: string;
+    /** Where ships reach the fleet: every starting prompt carries the fleet MCP URL under it. */
+    publicUrl: string;
+    clock?: Clock;
+    logger?: FastifyServerOptions['logger'];
+    shouldTrustProxy?: boolean;
+    signInRateLimit?: RateLimit;
+    registerRateLimit?: RateLimit;
+    /** The domain the session cookie is set for. Unset: the server's host only. */
+    cookieDomain?: string;
+    /**
+     * The console's origin: state-changing console calls come only from it.
+     * Unset: the public URL's origin, for web and server behind one host.
+     */
+    consoleOrigin?: string;
+    /** How long a receive waits on an empty inbox; about 25 seconds unless a test says otherwise. */
+    receiveWaitMs?: number;
+    /** The installation token that opens the installation procedures; unset, they are off. */
+    installationToken?: string;
+}
+/**
+ * Wires adapters to use cases and returns the HTTP server, not yet listening.
+ * The delivery listener starts at once and wakes waiting receives and live
+ * subscriptions. Closing the
+ * server also stops the listener and disconnects the database.
+ */
+export declare function createApp(options: AppOptions): FastifyInstance;

package/dist/app.js

@@ -0,0 +1,80 @@
+import { buildHttpServer } from './adapters/http/server.js';
+import { checkDatabase, createPrismaClient, latestMigration } from './adapters/prisma/client.js';
+import { listenForPendingDeliveries } from './adapters/prisma/delivery-notices.js';
+import { failureForLog } from './adapters/prisma/failure-log.js';
+import { createFleetEventWakeups, fleetEventWakeupsOf } from './adapters/prisma/fleet-event-wakeups.js';
+import { createReceiverWakeups } from './adapters/prisma/receiver-wakeups.js';
+import { createUseCases, systemClock } from './wiring.js';
+/**
+ * Wires adapters to use cases and returns the HTTP server, not yet listening.
+ * The delivery listener starts at once and wakes waiting receives and live
+ * subscriptions. Closing the
+ * server also stops the listener and disconnects the database.
+ */
+export function createApp(options) {
+    const prisma = createPrismaClient(options.databaseUrl);
+    const clock = options.clock ?? systemClock;
+    const wakeups = createReceiverWakeups();
+    const fleetEvents = createFleetEventWakeups();
+    const server = buildHttpServer({
+        useCases: createUseCases({
+            prisma,
+            clock,
+            wakeups,
+            fleetEventWakeups: fleetEventWakeupsOf(fleetEvents),
+            receiveWaitMs: options.receiveWaitMs,
+        }),
+        fleetUrl: options.publicUrl,
+        installationToken: options.installationToken,
+        fleetEvents,
+        checkDatabase: () => checkDatabase(prisma),
+        latestMigration: () => latestMigration(prisma),
+        clock,
+        logger: options.logger,
+        shouldTrustProxy: options.shouldTrustProxy,
+        signInRateLimit: options.signInRateLimit,
+        registerRateLimit: options.registerRateLimit,
+        cookieDomain: options.cookieDomain,
+        consoleOrigin: options.consoleOrigin ?? new URL(options.publicUrl).origin,
+    });
+    const listener = listenForPendingDeliveries({
+        databaseUrl: options.databaseUrl,
+        onNotice: (notice) => {
+            wakeups.deliveryPending(notice);
+        },
+        onFleetEvent: (notice) => {
+            fleetEvents.eventCommitted(notice);
+        },
+        onListening: () => {
+            wakeups.wakeAll();
+            fleetEvents.wakeAll();
+        },
+        onError: (error) => {
+            server.log.warn(failureForLog(error), 'delivery listener lost its connection: listening again shortly');
+        },
+    });
+    // Before the server stops taking requests and waits for the ones it holds:
+    // a waiting receive answers no deliveries at once instead of holding it up,
+    // and a live subscription ends.
+    // Connections idle at that moment close at once (Fastify's default); one
+    // whose request ends later is told to close with its answer, or it would
+    // stay open, idle, until its keep-alive timeout.
+    let isStopping = false;
+    server.addHook('preClose', (done) => {
+        isStopping = true;
+        wakeups.endAll();
+        fleetEvents.endAll();
+        done();
+    });
+    server.addHook('onSend', async (_request, reply) => {
+        if (isStopping) {
+            void reply.header('connection', 'close');
+        }
+    });
+    server.addHook('onClose', async () => {
+        await listener.close();
+        await prisma.$disconnect();
+    });
+    return server;
+}
+//# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACjG,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACxG,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAE9E,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAwB1D;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,OAAmB;IAC3C,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,WAAW,CAAC;IAC3C,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;IACxC,MAAM,WAAW,GAAG,uBAAuB,EAAE,CAAC;IAE9C,MAAM,MAAM,GAAG,eAAe,CAAC;QAC7B,QAAQ,EAAE,cAAc,CAAC;YACvB,MAAM;YACN,KAAK;YACL,OAAO;YACP,iBAAiB,EAAE,mBAAmB,CAAC,WAAW,CAAC;YACnD,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC,CAAC;QACF,QAAQ,EAAE,OAAO,CAAC,SAAS;QAC3B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,WAAW;QACX,aAAa,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;QAC1C,eAAe,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC;QAC9C,KAAK;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM;KAC1E,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,0BAA0B,CAAC;QAC1C,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;YACnB,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QACD,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE;YACvB,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,WAAW,EAAE,GAAG,EAAE;YAChB,OAAO,CAAC,OAAO,EAAE,CAAC;YAClB,WAAW,CAAC,OAAO,EAAE,CAAC;QACxB,CAAC;QACD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,gEAAgE,CAAC,CAAC;QAC1G,CAAC;KACF,CAAC,CAAC;IAEH,2EAA2E;IAC3E,4EAA4E;IAC5E,gCAAgC;IAChC,yEAAyE;IACzE,yEAAyE;IACzE,iDAAiD;IACjD,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;QAClC,UAAU,GAAG,IAAI,CAAC;QAClB,OAAO,CAAC,MAAM,EAAE,CAAC;QACjB,WAAW,CAAC,MAAM,EAAE,CAAC;QACrB,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;QACjD,IAAI,UAAU,EAAE,CAAC;YACf,KAAK,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QACnC,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/bin/aeolus-core.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin/aeolus-core.js

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+/**
+ * `aeolus-core <command>`: what an operator runs on the server, installed
+ * from npm. Every setting comes from environment variables (see the README).
+ */
+import { fleetInit } from '../adapters/cli/fleet-init.js';
+import { migrate } from '../adapters/cli/migrate.js';
+import { operatorResetPassword } from '../adapters/cli/operator-reset-password.js';
+import { runAtTerminal, runCommand } from '../adapters/cli/run.js';
+import { describeFailure } from '../adapters/prisma/failure-log.js';
+import { migrateDatabase, MigrationError } from '../adapters/prisma/migrate.js';
+import { ConfigError } from '../config.js';
+import { start } from '../start.js';
+const USAGE = 'Usage: aeolus-core start | migrate | fleet:init --name "<fleet name>" | operator:reset-password';
+const [command, ...args] = process.argv.slice(2);
+switch (command) {
+    case 'start':
+        // Serves until a signal ends the process.
+        try {
+            await start();
+        }
+        catch (error) {
+            process.stderr.write(`${error instanceof ConfigError || error instanceof MigrationError ? error.message : describeFailure(error)}\n`);
+            process.exit(1);
+        }
+        break;
+    case 'migrate':
+        await runAtTerminal((io) => migrate({ environment: process.env, migrateDatabase, io }));
+        break;
+    case 'fleet:init':
+        await runCommand(args, ({ useCases, io }) => fleetInit(args, { initialiseFleet: useCases.initialiseFleet, listFleets: useCases.listFleets, io }));
+        break;
+    case 'operator:reset-password':
+        await runCommand(args, ({ useCases, io }) => operatorResetPassword(args, {
+            listFleets: useCases.listFleets,
+            resetOperatorPassword: useCases.resetOperatorPassword,
+            io,
+        }));
+        break;
+    case undefined:
+    default:
+        process.stderr.write(`${USAGE}\n`);
+        process.exit(2);
+}
+//# sourceMappingURL=aeolus-core.js.map

package/dist/bin/aeolus-core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aeolus-core.js","sourceRoot":"","sources":["../../src/bin/aeolus-core.ts"],"names":[],"mappings":";AACA;;;GAGG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpC,MAAM,KAAK,GAAG,iGAAiG,CAAC;AAEhH,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEjD,QAAQ,OAAO,EAAE,CAAC;IAChB,KAAK,OAAO;QACV,0CAA0C;QAC1C,IAAI,CAAC;YACH,MAAM,KAAK,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,KAAK,YAAY,WAAW,IAAI,KAAK,YAAY,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAChH,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM;IACR,KAAK,SAAS;QACZ,MAAM,aAAa,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACxF,MAAM;IACR,KAAK,YAAY;QACf,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAClJ,MAAM;IACR,KAAK,yBAAyB;QAC5B,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,CAC1C,qBAAqB,CAAC,IAAI,EAAE;YAC1B,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;YACrD,EAAE;SACH,CAAC,CACH,CAAC;QACF,MAAM;IACR,KAAK,SAAS,CAAC;IACf;QACE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,35 @@
+export interface Config {
+    databaseUrl: string;
+    /** Where ships reach the fleet: every starting prompt carries the fleet MCP URL under it. */
+    publicUrl: string;
+    host: string;
+    port: number;
+    logLevel: string;
+    /** True behind a reverse proxy: the client address comes from X-Forwarded-For. */
+    shouldTrustProxy: boolean;
+    /** The domain the session cookie is set for, so every host under it receives it. Unset: the server's host only. */
+    cookieDomain: string | undefined;
+    /**
+     * The console's origin: state-changing console calls come only from it, and
+     * a console on another host may call from it with credentials (CORS).
+     * Defaults to the public URL's origin: web and server behind one host.
+     */
+    consoleOrigin: string;
+    /**
+     * The token a hosting service presents to the installation procedures
+     * (docs/architecture.md, "Installation"). Unset: they are off, as on a
+     * self-hosted server.
+     */
+    installationToken: string | undefined;
+}
+export declare class ConfigError extends Error {
+    name: string;
+}
+/** Reads DATABASE_URL alone, for a command that needs nothing else. Throws a ConfigError when it is invalid. */
+export declare function loadDatabaseUrl(environment: Record<string, string | undefined>): string;
+/**
+ * Reads the server configuration from environment variables. Throws a
+ * ConfigError naming every invalid variable. Values are never echoed, because
+ * the database URL carries a password.
+ */
+export declare function loadConfig(environment: Record<string, string | undefined>): Config;

package/dist/config.js

@@ -0,0 +1,74 @@
+import { z } from 'zod';
+/** A domain name alone, such as example.com: no scheme, port, path or leading dot. */
+const DOMAIN_NAME = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/i;
+/** An http or https origin: a URL with no user, path, query or fragment. A trailing slash is allowed. */
+function isOrigin(value) {
+    const url = URL.parse(value);
+    return (url !== null &&
+        url.username === '' &&
+        url.password === '' &&
+        url.pathname === '/' &&
+        url.search === '' &&
+        url.hash === '' &&
+        !value.endsWith('?') &&
+        !value.endsWith('#'));
+}
+/** The shortest installation token the server takes: long enough that guessing it is hopeless. */
+const INSTALLATION_TOKEN_MIN_LENGTH = 32;
+const environmentSchema = z.object({
+    DATABASE_URL: z.url({ protocol: /^postgres(ql)?$/, error: 'must be a postgres:// or postgresql:// URL' }),
+    PUBLIC_URL: z.url({ protocol: /^https?$/, error: 'must be an http:// or https:// URL' }),
+    HOST: z.string().min(1).default('127.0.0.1'),
+    PORT: z.coerce.number().int().min(0).max(65_535).default(4000),
+    LOG_LEVEL: z.enum(['fatal', 'error', 'warn', 'info', 'debug', 'trace', 'silent']).default('info'),
+    TRUST_PROXY: z.enum(['true', 'false'], { error: 'must be true or false' }).default('false'),
+    COOKIE_DOMAIN: z.string().regex(DOMAIN_NAME, 'must be a domain name like example.com').optional(),
+    CONSOLE_ORIGIN: z
+        .url({ protocol: /^https?$/, error: 'must be an http:// or https:// origin' })
+        .refine(isOrigin, 'must be an origin without a path, like https://console.example.com')
+        .transform((origin) => new URL(origin).origin)
+        .optional(),
+    INSTALLATION_TOKEN: z.string().min(INSTALLATION_TOKEN_MIN_LENGTH, `must be at least ${String(INSTALLATION_TOKEN_MIN_LENGTH)} characters`).optional(),
+});
+/** What `aeolus-core migrate` reads: the database alone. */
+const databaseEnvironmentSchema = environmentSchema.pick({ DATABASE_URL: true });
+export class ConfigError extends Error {
+    name = 'ConfigError';
+}
+/** Every invalid variable, one line each, never its value. */
+function configErrorOf(error) {
+    const problems = error.issues.map((issue) => `  ${issue.path.join('.')}: ${issue.message}`);
+    return new ConfigError(`Invalid configuration:\n${problems.join('\n')}`);
+}
+/** Reads DATABASE_URL alone, for a command that needs nothing else. Throws a ConfigError when it is invalid. */
+export function loadDatabaseUrl(environment) {
+    const result = databaseEnvironmentSchema.safeParse(environment);
+    if (!result.success) {
+        throw configErrorOf(result.error);
+    }
+    return result.data.DATABASE_URL;
+}
+/**
+ * Reads the server configuration from environment variables. Throws a
+ * ConfigError naming every invalid variable. Values are never echoed, because
+ * the database URL carries a password.
+ */
+export function loadConfig(environment) {
+    const result = environmentSchema.safeParse(environment);
+    if (!result.success) {
+        throw configErrorOf(result.error);
+    }
+    const { DATABASE_URL, PUBLIC_URL, HOST, PORT, LOG_LEVEL, TRUST_PROXY, COOKIE_DOMAIN, CONSOLE_ORIGIN, INSTALLATION_TOKEN } = result.data;
+    return {
+        databaseUrl: DATABASE_URL,
+        publicUrl: PUBLIC_URL,
+        host: HOST,
+        port: PORT,
+        logLevel: LOG_LEVEL,
+        shouldTrustProxy: TRUST_PROXY === 'true',
+        cookieDomain: COOKIE_DOMAIN,
+        consoleOrigin: CONSOLE_ORIGIN ?? new URL(PUBLIC_URL).origin,
+        installationToken: INSTALLATION_TOKEN,
+    };
+}
+//# sourceMappingURL=config.js.map