@aeolus-fleet/core 0.0.0 → 0.19.0

package/dist/adapters/cli/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../../src/adapters/cli/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAiB,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA6C;IAC/E,MAAM,EAAE,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAChG,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,EAAE,CAAC,GAAG,CAAC,KAAK,YAAY,WAAW,IAAI,KAAK,YAAY,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;QACjH,IAAI,GAAG,CAAC,CAAC;IACX,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,UAAU,CACxB,IAAc,EACd,OAA0F;IAE1F,OAAO,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAChC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3E,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/adapters/cli/terminal.d.ts

@@ -0,0 +1,20 @@
+import { Writable, type Readable } from 'node:stream';
+import type { CommandIo } from './io.js';
+/** Where a server command reads and writes: standard input, output and error. */
+export interface TerminalStreams {
+    input: Readable & {
+        isTTY?: boolean;
+    };
+    output: Writable;
+    errors: Writable;
+}
+/**
+ * The operator's terminal for a server command. Answers are read a line at a
+ * time from standard input, so they can also be piped in. A hidden answer is
+ * not echoed on a terminal: readline's echo goes through an output that is
+ * muted while it is typed. Each question is readline's prompt, so a line
+ * redrawn after a correction keeps it.
+ */
+export declare function terminalIo(streams: TerminalStreams): CommandIo & {
+    close(): void;
+};

package/dist/adapters/cli/terminal.js

@@ -0,0 +1,68 @@
+import { createInterface } from 'node:readline';
+import { Writable } from 'node:stream';
+/**
+ * The operator's terminal for a server command. Answers are read a line at a
+ * time from standard input, so they can also be piped in. A hidden answer is
+ * not echoed on a terminal: readline's echo goes through an output that is
+ * muted while it is typed. Each question is readline's prompt, so a line
+ * redrawn after a correction keeps it.
+ */
+export function terminalIo(streams) {
+    const { input, output, errors } = streams;
+    const isTerminal = input.isTTY === true;
+    let isMuted = false;
+    let isClosed = false;
+    let reader;
+    const echo = new Writable({
+        writev: (chunks, done) => {
+            for (const { chunk } of chunks) {
+                if (!isMuted && (typeof chunk === 'string' || chunk instanceof Uint8Array)) {
+                    output.write(chunk);
+                }
+            }
+            done();
+        },
+    });
+    // Opened on the first question only: a command that asks nothing leaves the terminal alone.
+    function open() {
+        if (!reader) {
+            const lines = createInterface({ input, output: echo, terminal: isTerminal, historySize: 0 });
+            lines.on('close', () => {
+                isClosed = true;
+            });
+            reader = { lines, answers: lines[Symbol.asyncIterator]() };
+        }
+        return reader;
+    }
+    return {
+        out: (text) => {
+            output.write(`${text}\n`);
+        },
+        err: (text) => {
+            errors.write(`${text}\n`);
+        },
+        ask: async (question, options) => {
+            const { lines, answers } = open();
+            // Once piped input has ended, readline is closed but may still hold answers it read.
+            if (isClosed) {
+                output.write(question);
+            }
+            else {
+                lines.setPrompt(question);
+                lines.prompt();
+            }
+            isMuted = options?.isHidden === true;
+            const answer = await answers.next();
+            // Nothing echoed the end of a hidden or piped answer: end its line here.
+            if (isMuted || !isTerminal) {
+                output.write('\n');
+            }
+            isMuted = false;
+            return answer.done === true ? undefined : answer.value;
+        },
+        close: () => {
+            reader?.lines.close();
+        },
+    };
+}
+//# sourceMappingURL=terminal.js.map

package/dist/adapters/cli/terminal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal.js","sourceRoot":"","sources":["../../../src/adapters/cli/terminal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAkB,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAiB,MAAM,aAAa,CAAC;AAWtD;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,OAAwB;IACjD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC1C,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,MAAwE,CAAC;IAE7E,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC;QACxB,MAAM,EAAE,CAAC,MAAqC,EAAE,IAAI,EAAE,EAAE;YACtD,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,MAAM,EAAE,CAAC;gBAC/B,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,YAAY,UAAU,CAAC,EAAE,CAAC;oBAC3E,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;YACD,IAAI,EAAE,CAAC;QACT,CAAC;KACF,CAAC,CAAC;IAEH,4FAA4F;IAC5F,SAAS,IAAI;QACX,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;YAC7F,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACrB,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC,CAAC,CAAC;YACH,MAAM,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QAC7D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;YACZ,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;YACZ,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;YAC/B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;YAClC,qFAAqF;YACrF,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;gBAC1B,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,CAAC;YACD,OAAO,GAAG,OAAO,EAAE,QAAQ,KAAK,IAAI,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACpC,yEAAyE;YACzE,IAAI,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC3B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC;YACD,OAAO,GAAG,KAAK,CAAC;YAChB,OAAO,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QACzD,CAAC;QACD,KAAK,EAAE,GAAG,EAAE;YACV,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/adapters/crypto/passwords.d.ts

@@ -0,0 +1,2 @@
+import type { PasswordHasher } from '../../domain/shared/secrets.js';
+export declare const argon2idPasswordHasher: PasswordHasher;

package/dist/adapters/crypto/passwords.js

@@ -0,0 +1,59 @@
+import { argon2, randomBytes, timingSafeEqual } from 'node:crypto';
+import { promisify } from 'node:util';
+/**
+ * Argon2id from Node's crypto module, stored in the PHC string format the
+ * reference implementation uses:
+ * `$argon2id$v=19$m=<KiB>,t=<passes>,p=<lanes>$<salt>$<hash>`, base64 without
+ * padding. The parameters travel in the string, so hashes made with other
+ * parameters keep verifying after these change.
+ */
+const deriveKey = promisify(argon2);
+/** OWASP's baseline for Argon2id: 19 MiB of memory, two passes, one lane. */
+const COST = { memory: 19_456, passes: 2, parallelism: 1 };
+const SALT_BYTES = 16;
+const HASH_BYTES = 32;
+const ARGON2_VERSION = 19;
+const PHC_PATTERN = /^\$argon2id\$v=19\$m=(\d+),t=(\d+),p=(\d+)\$([A-Za-z0-9+/]+)\$([A-Za-z0-9+/]+)$/;
+function encode({ cost, salt, hash }) {
+    const unpadded = (bytes) => bytes.toString('base64').replace(/=+$/, '');
+    return `$argon2id$v=${String(ARGON2_VERSION)}$m=${String(cost.memory)},t=${String(cost.passes)},p=${String(cost.parallelism)}$${unpadded(salt)}$${unpadded(hash)}`;
+}
+/** Throws on anything but an Argon2id hash of version 19: a stored hash this adapter did not make is a system failure. */
+function decode(stored) {
+    const match = PHC_PATTERN.exec(stored);
+    const [, memory, passes, parallelism, salt, hash] = match ?? [];
+    if (!memory || !passes || !parallelism || !salt || !hash) {
+        throw new Error('The stored password hash is not an Argon2id hash');
+    }
+    return {
+        cost: { memory: Number(memory), passes: Number(passes), parallelism: Number(parallelism) },
+        salt: Buffer.from(salt, 'base64'),
+        hash: Buffer.from(hash, 'base64'),
+    };
+}
+function derive(password, stored) {
+    const parameters = {
+        message: password,
+        nonce: stored.salt,
+        tagLength: stored.length,
+        ...stored.cost,
+    };
+    return deriveKey('argon2id', parameters);
+}
+export const argon2idPasswordHasher = {
+    hash: async (password) => {
+        const salt = randomBytes(SALT_BYTES);
+        const hash = await derive(password, { cost: COST, salt, length: HASH_BYTES });
+        return encode({ cost: COST, salt, hash });
+    },
+    verify: async (password, passwordHash) => {
+        if (passwordHash === undefined) {
+            await derive(password, { cost: COST, salt: randomBytes(SALT_BYTES), length: HASH_BYTES });
+            return false;
+        }
+        const stored = decode(passwordHash);
+        const attempt = await derive(password, { ...stored, length: stored.hash.length });
+        return timingSafeEqual(attempt, stored.hash);
+    },
+};
+//# sourceMappingURL=passwords.js.map

package/dist/adapters/crypto/passwords.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwords.js","sourceRoot":"","sources":["../../../src/adapters/crypto/passwords.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,EAAyB,MAAM,aAAa,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAItC;;;;;;GAMG;AAEH,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;AAEpC,6EAA6E;AAC7E,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;AAC3D,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,MAAM,WAAW,GAAG,iFAAiF,CAAC;AAUtG,SAAS,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAc;IAC9C,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChF,OAAO,eAAe,MAAM,CAAC,cAAc,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;AACrK,CAAC;AAED,0HAA0H;AAC1H,SAAS,MAAM,CAAC,MAAc;IAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;IAChE,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,OAAO;QACL,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE;QAC1F,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACjC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,QAAgB,EAAE,MAAqD;IACrF,MAAM,UAAU,GAAqB;QACnC,OAAO,EAAE,QAAQ;QACjB,KAAK,EAAE,MAAM,CAAC,IAAI;QAClB,SAAS,EAAE,MAAM,CAAC,MAAM;QACxB,GAAG,MAAM,CAAC,IAAI;KACf,CAAC;IACF,OAAO,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAmB;IACpD,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAC9E,OAAO,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE;QACvC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YAC1F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAClF,OAAO,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;CACF,CAAC"}

package/dist/adapters/crypto/secrets.d.ts

@@ -0,0 +1,5 @@
+import type { RandomTokens, SecretHasher } from '../../domain/shared/secrets.js';
+/** SHA-256 in hex. The inputs are 256-bit random strings, so a plain hash is enough. */
+export declare const sha256Hasher: SecretHasher;
+/** 32 random bytes from the operating system, base64url encoded (43 characters). */
+export declare const cryptoRandomTokens: RandomTokens;

package/dist/adapters/crypto/secrets.js

@@ -0,0 +1,10 @@
+import { createHash, randomBytes } from 'node:crypto';
+/** SHA-256 in hex. The inputs are 256-bit random strings, so a plain hash is enough. */
+export const sha256Hasher = {
+    hash: (value) => createHash('sha256').update(value, 'utf8').digest('hex'),
+};
+/** 32 random bytes from the operating system, base64url encoded (43 characters). */
+export const cryptoRandomTokens = {
+    next: () => randomBytes(32).toString('base64url'),
+};
+//# sourceMappingURL=secrets.js.map

package/dist/adapters/crypto/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../../src/adapters/crypto/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAItD,wFAAwF;AACxF,MAAM,CAAC,MAAM,YAAY,GAAiB;IACxC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;CAC1E,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,kBAAkB,GAAiB;IAC9C,IAAI,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;CAClD,CAAC"}

package/dist/adapters/http/device-label.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The device a console sign-in comes from, in a few words for the operator
+ * ("Mac · Chrome"), from the browser's User-Agent. A label only: never
+ * trusted for anything, so a rough reading is enough. The first match wins:
+ * an iPhone also says "like Mac OS X", Android also says "Linux", Edge also
+ * says "Chrome", and Chrome also says "Safari".
+ */
+export declare const UNKNOWN_DEVICE_LABEL = "Unknown device";
+export declare function deviceLabelOf(userAgent: string | undefined): string;

package/dist/adapters/http/device-label.js

@@ -0,0 +1,39 @@
+/**
+ * The device a console sign-in comes from, in a few words for the operator
+ * ("Mac · Chrome"), from the browser's User-Agent. A label only: never
+ * trusted for anything, so a rough reading is enough. The first match wins:
+ * an iPhone also says "like Mac OS X", Android also says "Linux", Edge also
+ * says "Chrome", and Chrome also says "Safari".
+ */
+const SYSTEMS = [
+    [/iPhone/, 'iPhone'],
+    [/iPad/, 'iPad'],
+    [/Android/, 'Android'],
+    [/CrOS/, 'ChromeOS'],
+    [/Macintosh/, 'Mac'],
+    [/Windows/, 'Windows'],
+    [/Linux/, 'Linux'],
+];
+const BROWSERS = [
+    [/Edg\//, 'Edge'],
+    [/OPR\//, 'Opera'],
+    [/Firefox\//, 'Firefox'],
+    [/Chrome\//, 'Chrome'],
+    [/Version\/[\d.]+.*Safari\//, 'Safari'],
+];
+export const UNKNOWN_DEVICE_LABEL = 'Unknown device';
+function firstMatch(userAgent, table) {
+    return table.find(([pattern]) => pattern.test(userAgent))?.[1];
+}
+export function deviceLabelOf(userAgent) {
+    if (userAgent === undefined) {
+        return UNKNOWN_DEVICE_LABEL;
+    }
+    const system = firstMatch(userAgent, SYSTEMS);
+    if (system === undefined) {
+        return UNKNOWN_DEVICE_LABEL;
+    }
+    const browser = firstMatch(userAgent, BROWSERS);
+    return browser === undefined ? system : `${system} · ${browser}`;
+}
+//# sourceMappingURL=device-label.js.map

package/dist/adapters/http/device-label.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-label.js","sourceRoot":"","sources":["../../../src/adapters/http/device-label.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,OAAO,GAAgC;IAC3C,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,MAAM,EAAE,MAAM,CAAC;IAChB,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,CAAC,MAAM,EAAE,UAAU,CAAC;IACpB,CAAC,WAAW,EAAE,KAAK,CAAC;IACpB,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,CAAC,OAAO,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,QAAQ,GAAgC;IAC5C,CAAC,OAAO,EAAE,MAAM,CAAC;IACjB,CAAC,OAAO,EAAE,OAAO,CAAC;IAClB,CAAC,WAAW,EAAE,SAAS,CAAC;IACxB,CAAC,UAAU,EAAE,QAAQ,CAAC;IACtB,CAAC,2BAA2B,EAAE,QAAQ,CAAC;CACxC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAErD,SAAS,UAAU,CAAC,SAAiB,EAAE,KAAkC;IACvE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAA6B;IACzD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAChD,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,MAAM,OAAO,EAAE,CAAC;AACnE,CAAC"}

package/dist/adapters/http/rate-limiter.d.ts

@@ -0,0 +1,21 @@
+import type { Clock } from '../../domain/shared/clock.js';
+export interface RateLimit {
+    /** Attempts allowed per key in one window. */
+    limit: number;
+    windowMs: number;
+}
+export interface RateLimiter {
+    /** Counts an attempt for the key. False when the key is over its limit in the current window. */
+    take(key: string): boolean;
+    /** True while the key has counted fewer than its limit in the current window. Counts nothing. */
+    hasRoom(key: string): boolean;
+    /** Counts one for the key, for a limit on some outcomes only, such as failures. */
+    count(key: string): void;
+    /** When the key's current window ends, so a key over its limit may try again; now when it has none. */
+    retryAt(key: string): Date;
+}
+/**
+ * A fixed-window counter per key, held in memory. v1 runs one server process
+ * (docs/architecture.md, "Deployment"), so a shared store is not needed yet.
+ */
+export declare function createRateLimiter(limit: RateLimit, clock: Clock): RateLimiter;

package/dist/adapters/http/rate-limiter.js

@@ -0,0 +1,44 @@
+/**
+ * A fixed-window counter per key, held in memory. v1 runs one server process
+ * (docs/architecture.md, "Deployment"), so a shared store is not needed yet.
+ */
+export function createRateLimiter(limit, clock) {
+    const windows = new Map();
+    /** The key's count in the current window, after forgetting finished windows. */
+    const countIn = (key, now) => {
+        const current = windows.get(key);
+        if (!current || now - current.startedAt >= limit.windowMs) {
+            forgetFinishedWindows(windows, { now, windowMs: limit.windowMs });
+            return 0;
+        }
+        return current.count;
+    };
+    const count = (key) => {
+        const now = clock.now().getTime();
+        const counted = countIn(key, now) + 1;
+        const startedAt = counted === 1 ? now : (windows.get(key)?.startedAt ?? now);
+        windows.set(key, { startedAt, count: counted });
+        return counted;
+    };
+    return {
+        take: (key) => count(key) <= limit.limit,
+        hasRoom: (key) => countIn(key, clock.now().getTime()) < limit.limit,
+        count: (key) => {
+            count(key);
+        },
+        retryAt: (key) => {
+            const now = clock.now().getTime();
+            const current = countIn(key, now) === 0 ? undefined : windows.get(key);
+            return new Date(current ? current.startedAt + limit.windowMs : now);
+        },
+    };
+}
+function forgetFinishedWindows(windows, at) {
+    const { now, windowMs } = at;
+    for (const [key, window] of windows) {
+        if (now - window.startedAt >= windowMs) {
+            windows.delete(key);
+        }
+    }
+}
+//# sourceMappingURL=rate-limiter.js.map

package/dist/adapters/http/rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../../src/adapters/http/rate-limiter.ts"],"names":[],"mappings":"AAmBA;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAgB,EAAE,KAAY;IAC9D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAgD,CAAC;IAExE,gFAAgF;IAChF,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,GAAW,EAAU,EAAE;QACnD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC1D,qBAAqB,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YAClE,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC;IACvB,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,GAAW,EAAU,EAAE;QACpC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,SAAS,IAAI,GAAG,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAChD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK;QACxC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK;QACnE,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;YACb,KAAK,CAAC,GAAG,CAAC,CAAC;QACb,CAAC;QACD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACf,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,OAA2C,EAAE,EAAqC;IAC/G,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,IAAI,QAAQ,EAAE,CAAC;YACvC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/adapters/http/request-credentials.d.ts

@@ -0,0 +1,23 @@
+/**
+ * How a request says who it is: a crew token as a bearer token, or the console
+ * session cookie. The ship secret travels only in the body of `register`.
+ *
+ * The console session cookie holds the random session token, never the ship secret.
+ * httpOnly so scripts cannot read it, Secure so it only travels over HTTPS
+ * (browsers accept it on http://localhost for development), SameSite=Strict so
+ * no other site's page can make the browser send it.
+ */
+export declare const SESSION_COOKIE_NAME = "aeolus_session";
+/** The session token from a Cookie request header, if there is one. */
+export declare function readSessionToken(cookieHeader: string | undefined): string | undefined;
+/** A Set-Cookie value that keeps the token until the session expires. */
+export declare function sessionCookie(cookie: {
+    token: string;
+    expiresAt: Date;
+    now: Date;
+    domain?: string;
+}): string;
+/** A Set-Cookie value that removes the cookie, for the same domain it was set for. */
+export declare function clearedSessionCookie(domain?: string): string;
+/** The token from an `Authorization: Bearer <token>` header, if there is one. */
+export declare function readBearer(authorizationHeader: string | undefined): string | undefined;

package/dist/adapters/http/request-credentials.js

@@ -0,0 +1,45 @@
+/**
+ * How a request says who it is: a crew token as a bearer token, or the console
+ * session cookie. The ship secret travels only in the body of `register`.
+ *
+ * The console session cookie holds the random session token, never the ship secret.
+ * httpOnly so scripts cannot read it, Secure so it only travels over HTTPS
+ * (browsers accept it on http://localhost for development), SameSite=Strict so
+ * no other site's page can make the browser send it.
+ */
+export const SESSION_COOKIE_NAME = 'aeolus_session';
+const ATTRIBUTES = 'Path=/; HttpOnly; Secure; SameSite=Strict';
+/**
+ * The cookie's scope: every host under the configured domain, so a console on
+ * another host of that domain sends it too; otherwise the server's host only.
+ */
+function scope(domain) {
+    return domain === undefined ? ATTRIBUTES : `Domain=${domain}; ${ATTRIBUTES}`;
+}
+/** The session token from a Cookie request header, if there is one. */
+export function readSessionToken(cookieHeader) {
+    for (const pair of cookieHeader?.split(';') ?? []) {
+        const separator = pair.indexOf('=');
+        if (separator !== -1 && pair.slice(0, separator).trim() === SESSION_COOKIE_NAME) {
+            const value = pair.slice(separator + 1).trim();
+            return value === '' ? undefined : value;
+        }
+    }
+    return undefined;
+}
+/** A Set-Cookie value that keeps the token until the session expires. */
+export function sessionCookie(cookie) {
+    const { token, expiresAt, now, domain } = cookie;
+    const maxAgeSeconds = Math.max(0, Math.floor((expiresAt.getTime() - now.getTime()) / 1000));
+    return `${SESSION_COOKIE_NAME}=${token}; Max-Age=${maxAgeSeconds}; ${scope(domain)}`;
+}
+/** A Set-Cookie value that removes the cookie, for the same domain it was set for. */
+export function clearedSessionCookie(domain) {
+    return `${SESSION_COOKIE_NAME}=; Max-Age=0; ${scope(domain)}`;
+}
+/** The token from an `Authorization: Bearer <token>` header, if there is one. */
+export function readBearer(authorizationHeader) {
+    const match = /^Bearer\s+(\S+)\s*$/i.exec(authorizationHeader ?? '');
+    return match?.[1];
+}
+//# sourceMappingURL=request-credentials.js.map

package/dist/adapters/http/request-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-credentials.js","sourceRoot":"","sources":["../../../src/adapters/http/request-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAEpD,MAAM,UAAU,GAAG,2CAA2C,CAAC;AAE/D;;;GAGG;AACH,SAAS,KAAK,CAAC,MAA0B;IACvC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,MAAM,KAAK,UAAU,EAAE,CAAC;AAC/E,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,gBAAgB,CAAC,YAAgC;IAC/D,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,mBAAmB,EAAE,CAAC;YAChF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/C,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,aAAa,CAAC,MAAsE;IAClG,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IACjD,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAC5F,OAAO,GAAG,mBAAmB,IAAI,KAAK,aAAa,aAAa,KAAK,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;AACvF,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,oBAAoB,CAAC,MAAe;IAClD,OAAO,GAAG,mBAAmB,iBAAiB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,UAAU,CAAC,mBAAuC;IAChE,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;IACrE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC"}

package/dist/adapters/http/server.d.ts

@@ -0,0 +1,47 @@
+import { type FastifyInstance, type FastifyServerOptions } from 'fastify';
+import type { Clock } from '../../domain/shared/clock.js';
+import type { FleetEventWatches, UseCases } from '../trpc/context.js';
+import { type RateLimit } from './rate-limiter.js';
+/** Ten sign-in attempts per client per minute. */
+export declare const DEFAULT_SIGN_IN_RATE_LIMIT: RateLimit;
+/** Ten failed register attempts per client per minute; successful ones are never counted (ADR 0015). */
+export declare const DEFAULT_REGISTER_RATE_LIMIT: RateLimit;
+export interface HttpServerOptions {
+    useCases: UseCases;
+    /**
+     * Wakes live subscriptions when their fleet commits events. The app feeds
+     * them from the listener; unset, a subscription hears only what it reads
+     * when it starts.
+     */
+    fleetEvents?: FleetEventWatches;
+    /** Throws when the database is unreachable. */
+    checkDatabase: () => Promise<void>;
+    /** The latest migration applied to the database; null before the first. Throws when unreachable. */
+    latestMigration: () => Promise<string | null>;
+    clock: Clock;
+    logger: FastifyServerOptions['logger'];
+    /** Trust X-Forwarded-For from a reverse proxy in front of the server, for the client address. */
+    shouldTrustProxy?: boolean;
+    signInRateLimit?: RateLimit;
+    /** Failed register attempts per client; successful ones are never counted. */
+    registerRateLimit?: RateLimit;
+    /** The domain the session cookie is set for. Unset: the server's host only. */
+    cookieDomain?: string;
+    /** Where ships reach the fleet, the public URL: what starting prompts and crew lines carry. */
+    fleetUrl: string;
+    /** The installation token that opens the installation procedures; unset, they are off. */
+    installationToken?: string;
+    /**
+     * The console's origin: state-changing console calls come only from it, and
+     * a console on another host may call from it with credentials (CORS).
+     */
+    consoleOrigin: string;
+}
+/**
+ * The HTTP host: `/trpc` for the API (its subscriptions over a WebSocket on
+ * the same path), `/api/v1` (REST) and `/mcp` for ships, and `/health` for
+ * monitoring. Every door builds its calls' context the same
+ * way, so the register limit is one budget per client address across all of
+ * them.
+ */
+export declare function buildHttpServer(options: HttpServerOptions): FastifyInstance;