@aeolus-fleet/core 0.0.0 → 0.19.0

package/dist/adapters/http/server.js

@@ -0,0 +1,216 @@
+import { randomUUID } from 'node:crypto';
+import fastifyWebsocket from '@fastify/websocket';
+import { fastifyTRPCPlugin } from '@trpc/server/adapters/fastify';
+import { getWSConnectionHandler, handleKeepAlive } from '@trpc/server/adapters/ws';
+import Fastify, {} from 'fastify';
+import { registerMcpEndpoint } from '../mcp/mcp-endpoint.js';
+import { createFleetEventWakeups } from '../prisma/fleet-event-wakeups.js';
+import { failureForLog } from '../prisma/failure-log.js';
+import { registerRestApi } from '../rest/rest-api.js';
+import { appRouter } from '../trpc/router.js';
+import { refusalBody, unexpectedFailure } from '../trpc/ship-contract.js';
+import { createRateLimiter } from './rate-limiter.js';
+import { clearedSessionCookie, readBearer, readSessionToken, sessionCookie } from './request-credentials.js';
+import { runningVersions } from './version.js';
+import { INSTALLATION_TOKEN_HEADER } from '../trpc/installation.js';
+/** A header's one value: a header sent twice counts as not sent. */
+function headerValue(value) {
+    return typeof value === 'string' ? value : undefined;
+}
+/** Ten sign-in attempts per client per minute. */
+export const DEFAULT_SIGN_IN_RATE_LIMIT = { limit: 10, windowMs: 60_000 };
+/** Ten failed register attempts per client per minute; successful ones are never counted (ADR 0015). */
+export const DEFAULT_REGISTER_RATE_LIMIT = { limit: 10, windowMs: 60_000 };
+/**
+ * Refusals Fastify raises itself, before any route runs, by its error code:
+ * our code and words, never Fastify's, whose messages may echo the request.
+ */
+const FASTIFY_REFUSALS = {
+    FST_ERR_CTP_INVALID_JSON_BODY: { httpStatus: 400, code: 'BAD_REQUEST', message: 'The request body is not valid JSON' },
+    FST_ERR_CTP_EMPTY_JSON_BODY: { httpStatus: 400, code: 'BAD_REQUEST', message: 'The request body is not valid JSON' },
+    FST_ERR_CTP_BODY_TOO_LARGE: { httpStatus: 413, code: 'PAYLOAD_TOO_LARGE', message: 'The request body is over 1 MiB' },
+    FST_ERR_CTP_INVALID_MEDIA_TYPE: {
+        httpStatus: 415,
+        code: 'UNSUPPORTED_MEDIA_TYPE',
+        message: 'The request body must be JSON',
+    },
+};
+/** Any other request Fastify cannot read. */
+const UNREADABLE_REQUEST = { httpStatus: 400, code: 'BAD_REQUEST', message: 'The request cannot be read' };
+/**
+ * How often the server pings a live subscription's socket, and how long it
+ * waits for the pong before it closes it: a browser that went away without a
+ * word frees its subscription within a minute.
+ */
+const KEEP_ALIVE = { pingMs: 30_000, pongWaitMs: 10_000 };
+/** Fastify's own limit on a request body, which its refusal above names: 1 MiB. */
+const BODY_LIMIT_BYTES = 1024 * 1024;
+/** How long a browser may keep the answer to a preflight, in seconds. */
+const PREFLIGHT_MAX_AGE_S = 600;
+/**
+ * The session cookie at a door for ships: REST and MCP never read the console
+ * session, so they never set or clear its cookie either.
+ */
+const NO_SESSION_COOKIE = { set: () => undefined, clear: () => undefined };
+/**
+ * The HTTP host: `/trpc` for the API (its subscriptions over a WebSocket on
+ * the same path), `/api/v1` (REST) and `/mcp` for ships, and `/health` for
+ * monitoring. Every door builds its calls' context the same
+ * way, so the register limit is one budget per client address across all of
+ * them.
+ */
+export function buildHttpServer(options) {
+    const server = Fastify({
+        logger: options.logger ?? false,
+        trustProxy: options.shouldTrustProxy ?? false,
+        // Unique across restarts, so a caller's request id finds one log line.
+        genReqId: () => randomUUID(),
+        // tRPC batches several procedure paths into one URL segment.
+        routerOptions: { maxParamLength: 5000 },
+        bodyLimit: BODY_LIMIT_BYTES,
+    });
+    // Set first, so every door inherits it. A route's own failures are its own
+    // to answer; what reaches this is an error Fastify raised itself.
+    // eslint-disable-next-line @typescript-eslint/max-params -- Fastify calls its error handler with three arguments.
+    server.setErrorHandler(async (error, request, reply) => {
+        const isRefusal = error.statusCode !== undefined && error.statusCode < 500;
+        const refusal = FASTIFY_REFUSALS[error.code] ?? (isRefusal ? UNREADABLE_REQUEST : undefined);
+        if (refusal !== undefined) {
+            return reply.code(refusal.httpStatus).send({ code: refusal.code, message: refusal.message });
+        }
+        const failure = unexpectedFailure(error, { log: request.log, requestId: request.id });
+        return reply.code(failure.httpStatus).send(refusalBody(failure));
+    });
+    server.setNotFoundHandler(async (_request, reply) => reply.code(404).send({ code: 'NOT_FOUND', message: 'Nothing is served at this path' }));
+    const signInLimiter = createRateLimiter(options.signInRateLimit ?? DEFAULT_SIGN_IN_RATE_LIMIT, options.clock);
+    const registerFailures = createRateLimiter(options.registerRateLimit ?? DEFAULT_REGISTER_RATE_LIMIT, options.clock);
+    const { consoleOrigin, cookieDomain } = options;
+    const fleetEvents = options.fleetEvents ?? createFleetEventWakeups();
+    // The console may run on another host under the cookie's domain (ADR 0012).
+    // Its origin, and no other, may call with credentials and read the answer.
+    // On the server's own origin the browser needs none of this, and ignores it.
+    server.addHook('onRequest', async (request, reply) => {
+        void reply.header('vary', 'Origin');
+        if (request.headers.origin !== consoleOrigin) {
+            return;
+        }
+        void reply.header('access-control-allow-origin', consoleOrigin);
+        void reply.header('access-control-allow-credentials', 'true');
+        if (request.method === 'OPTIONS') {
+            await reply
+                .code(204)
+                .header('access-control-allow-methods', 'GET, POST')
+                .header('access-control-allow-headers', 'content-type')
+                .header('access-control-max-age', String(PREFLIGHT_MAX_AGE_S))
+                .send();
+        }
+    });
+    // The versions this process runs and the database's latest migration, for
+    // whoever operates the installation. No authentication, no fleet data.
+    const versions = runningVersions();
+    server.get('/api/version', async () => {
+        let migration = null;
+        try {
+            migration = await options.latestMigration();
+        }
+        catch (error) {
+            server.log.error(failureForLog(error), 'latest migration unknown');
+        }
+        return { ...versions, migration };
+    });
+    // Server up and database reachable. Nothing about fleets.
+    server.get('/health', async (_request, reply) => {
+        try {
+            await options.checkDatabase();
+            return { server: 'up', database: 'up' };
+        }
+        catch (error) {
+            server.log.error(failureForLog(error), 'health check failed');
+            return reply.code(503).send({ server: 'up', database: 'down' });
+        }
+    });
+    /** A call's context: who it says it is, how it may say so at this door, and where it came from. */
+    const contextFor = (request, caller) => ({
+        useCases: options.useCases,
+        fleetUrl: options.fleetUrl,
+        installation: { configured: options.installationToken, presented: headerValue(request.headers[INSTALLATION_TOKEN_HEADER]) },
+        log: request.log,
+        fleetEvents,
+        ...caller,
+        userAgent: request.headers['user-agent'],
+        origin: request.headers.origin,
+        consoleOrigin,
+        clientKey: request.ip,
+        requestId: request.id,
+        takeSignInAttempt: (clientKey) => signInLimiter.take(clientKey),
+        signInRetryAt: (clientKey) => signInLimiter.retryAt(clientKey),
+        registerFailures,
+    });
+    const trpc = {
+        prefix: '/trpc',
+        trpcOptions: {
+            router: appRouter,
+            createContext: ({ req, res }) => contextFor(req, {
+                credentials: {
+                    bearer: readBearer(req.headers.authorization),
+                    sessionToken: readSessionToken(req.headers.cookie),
+                },
+                canUseConsoleSession: true,
+                sessionCookie: {
+                    set: (token, expiresAt) => {
+                        void res.header('set-cookie', sessionCookie({ token, expiresAt, now: options.clock.now(), domain: cookieDomain }));
+                    },
+                    clear: () => {
+                        void res.header('set-cookie', clearedSessionCookie(cookieDomain));
+                    },
+                },
+            }),
+            // The whole failure goes to the log only, under the request's id (the
+            // label Fastify's own request lines use); the answer carries that id.
+            onError: ({ path, error, ctx }) => {
+                if (error.code === 'INTERNAL_SERVER_ERROR') {
+                    server.log.error({ reqId: ctx?.requestId, path, ...failureForLog(error) }, 'procedure failed');
+                }
+            },
+        },
+    };
+    void server.register(fastifyTRPCPlugin, trpc);
+    // Live subscriptions: one WebSocket per console, opened on /trpc with the
+    // session cookie and the page's Origin, both of which a browser sends on
+    // the upgrade. Nothing can set a cookie on a socket, so the session's
+    // renewal waits for the console's next HTTP call.
+    void server.register(async (scope) => {
+        await scope.register(fastifyWebsocket);
+        const onConnection = getWSConnectionHandler({
+            router: appRouter,
+            wss: scope.websocketServer,
+            createContext: ({ req }) => contextFor({
+                headers: req.headers,
+                ip: req.socket.remoteAddress ?? '',
+                id: randomUUID(),
+                log: server.log,
+            }, {
+                credentials: { sessionToken: readSessionToken(req.headers.cookie) },
+                canUseConsoleSession: true,
+                sessionCookie: NO_SESSION_COOKIE,
+            }),
+            onError: ({ path, error, ctx }) => {
+                if (error.code === 'INTERNAL_SERVER_ERROR') {
+                    server.log.error({ reqId: ctx?.requestId, path, ...failureForLog(error) }, 'subscription failed');
+                }
+            },
+        });
+        scope.get('/trpc', { websocket: true }, (socket, request) => {
+            onConnection(socket, request.raw);
+            handleKeepAlive(socket, KEEP_ALIVE.pingMs, KEEP_ALIVE.pongWaitMs);
+        });
+    });
+    // The doors for ships: the credentials are the ones the call carries, never the console session.
+    const shipDoor = {
+        contextFor: (request, credentials) => contextFor(request, { credentials, canUseConsoleSession: false, sessionCookie: NO_SESSION_COOKIE }),
+    };
+    registerRestApi(server, shipDoor);
+    registerMcpEndpoint(server, shipDoor);
+    return server;
+}
+//# sourceMappingURL=server.js.map

package/dist/adapters/http/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/adapters/http/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,gBAAgB,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAiC,MAAM,+BAA+B,CAAC;AACjG,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,OAAO,EAAE,EAA2F,MAAM,SAAS,CAAC;AAG3H,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,SAAS,EAAkB,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAkB,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC7G,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEpE,oEAAoE;AACpE,SAAS,WAAW,CAAC,KAAoC;IACvD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,kDAAkD;AAClD,MAAM,CAAC,MAAM,0BAA0B,GAAc,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAErF,wGAAwG;AACxG,MAAM,CAAC,MAAM,2BAA2B,GAAc,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAkCtF;;;GAGG;AACH,MAAM,gBAAgB,GAAoF;IACxG,6BAA6B,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,oCAAoC,EAAE;IACtH,2BAA2B,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,oCAAoC,EAAE;IACpH,0BAA0B,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,gCAAgC,EAAE;IACrH,8BAA8B,EAAE;QAC9B,UAAU,EAAE,GAAG;QACf,IAAI,EAAE,wBAAwB;QAC9B,OAAO,EAAE,+BAA+B;KACzC;CACF,CAAC;AAEF,6CAA6C;AAC7C,MAAM,kBAAkB,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;AAE3G;;;;GAIG;AACH,MAAM,UAAU,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAE1D,mFAAmF;AACnF,MAAM,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAAC;AAErC,yEAAyE;AACzE,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC;;;GAGG;AACH,MAAM,iBAAiB,GAAkB,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;AAE1F;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,OAA0B;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC;QACrB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK;QAC/B,UAAU,EAAE,OAAO,CAAC,gBAAgB,IAAI,KAAK;QAC7C,uEAAuE;QACvE,QAAQ,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;QAC5B,6DAA6D;QAC7D,aAAa,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE;QACvC,SAAS,EAAE,gBAAgB;KAC5B,CAAC,CAAC;IAEH,2EAA2E;IAC3E,kEAAkE;IAClE,kHAAkH;IAClH,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,KAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACnE,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;QAC3E,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7F,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACtF,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAClD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CACvF,CAAC;IAEF,MAAM,aAAa,GAAG,iBAAiB,CAAC,OAAO,CAAC,eAAe,IAAI,0BAA0B,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9G,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,IAAI,2BAA2B,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACpH,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IAChD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,uBAAuB,EAAE,CAAC;IAErE,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACnD,KAAK,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,KAAK,KAAK,CAAC,MAAM,CAAC,6BAA6B,EAAE,aAAa,CAAC,CAAC;QAChE,KAAK,KAAK,CAAC,MAAM,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,KAAK;iBACR,IAAI,CAAC,GAAG,CAAC;iBACT,MAAM,CAAC,8BAA8B,EAAE,WAAW,CAAC;iBACnD,MAAM,CAAC,8BAA8B,EAAE,cAAc,CAAC;iBACtD,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;iBAC7D,IAAI,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE;QACpC,IAAI,SAAS,GAAkB,IAAI,CAAC;QACpC,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,0BAA0B,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,0DAA0D;IAC1D,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;QAC9C,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC;YAC9B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC,CAAC;YAC9D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,mGAAmG;IACnG,MAAM,UAAU,GAAG,CACjB,OAA8D,EAC9D,MAAwG,EAC/F,EAAE,CAAC,CAAC;QACb,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,iBAAiB,EAAE,SAAS,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,EAAE;QAC3H,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,WAAW;QACX,GAAG,MAAM;QACT,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;QACxC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;QAC9B,aAAa;QACb,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,iBAAiB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;QAC/D,aAAa,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC;QAC9D,gBAAgB;KACjB,CAAC,CAAC;IAEH,MAAM,IAAI,GAAwC;QAChD,MAAM,EAAE,OAAO;QACf,WAAW,EAAE;YACX,MAAM,EAAE,SAAS;YACjB,aAAa,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAW,EAAE,CACvC,UAAU,CAAC,GAAG,EAAE;gBACd,WAAW,EAAE;oBACX,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;oBAC7C,YAAY,EAAE,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;iBACnD;gBACD,oBAAoB,EAAE,IAAI;gBAC1B,aAAa,EAAE;oBACb,GAAG,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;wBACxB,KAAK,GAAG,CAAC,MAAM,CACb,YAAY,EACZ,aAAa,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CACpF,CAAC;oBACJ,CAAC;oBACD,KAAK,EAAE,GAAG,EAAE;wBACV,KAAK,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC;oBACpE,CAAC;iBACF;aACF,CAAC;YACJ,sEAAsE;YACtE,sEAAsE;YACtE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE;gBAChC,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;oBAC3C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,kBAAkB,CAAC,CAAC;gBACjG,CAAC;YACH,CAAC;SACF;KACF,CAAC;IACF,KAAK,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IAE9C,0EAA0E;IAC1E,yEAAyE;IACzE,sEAAsE;IACtE,kDAAkD;IAClD,KAAK,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACnC,MAAM,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACvC,MAAM,YAAY,GAAG,sBAAsB,CAAY;YACrD,MAAM,EAAE,SAAS;YACjB,GAAG,EAAE,KAAK,CAAC,eAAe;YAC1B,aAAa,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CACzB,UAAU,CACR;gBACE,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE;gBAClC,EAAE,EAAE,UAAU,EAAE;gBAChB,GAAG,EAAE,MAAM,CAAC,GAAG;aAChB,EACD;gBACE,WAAW,EAAE,EAAE,YAAY,EAAE,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;gBACnE,oBAAoB,EAAE,IAAI;gBAC1B,aAAa,EAAE,iBAAiB;aACjC,CACF;YACH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE;gBAChC,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;oBAC3C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,qBAAqB,CAAC,CAAC;gBACpG,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;YAC1D,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAClC,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,iGAAiG;IACjG,MAAM,QAAQ,GAAG;QACf,UAAU,EAAE,CAAC,OAAuB,EAAE,WAA+B,EAAE,EAAE,CACvE,UAAU,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,oBAAoB,EAAE,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,CAAC;KACtG,CAAC;IACF,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClC,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAEtC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/adapters/http/version.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The versions this server process runs: its own package's, and that of the
+ * @aeolus-fleet/common it loaded, which a deploy that failed halfway may
+ * leave different. Read once, when the server starts.
+ */
+export declare function runningVersions(): {
+    server: string;
+    common: string;
+};

package/dist/adapters/http/version.js

@@ -0,0 +1,23 @@
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { z } from 'zod';
+const packageJson = z.object({ version: z.string() });
+/** The version in a package.json, read from disk: what this process runs, not what a deploy meant to ship. */
+function versionAt(file) {
+    return packageJson.parse(JSON.parse(readFileSync(file, 'utf8'))).version;
+}
+/**
+ * The versions this server process runs: its own package's, and that of the
+ * @aeolus-fleet/common it loaded, which a deploy that failed halfway may
+ * leave different. Read once, when the server starts.
+ */
+export function runningVersions() {
+    // This file sits at src/adapters/http, or dist/adapters/http once built:
+    // the package root is three levels up either way.
+    const server = versionAt(new URL('../../../package.json', import.meta.url));
+    const commonEntry = createRequire(import.meta.url).resolve('@aeolus-fleet/common');
+    // Common's entry is src/index.ts or dist/index.js: its package.json is one level up.
+    const common = versionAt(new URL('../package.json', `file://${commonEntry}`));
+    return { server, common };
+}
+//# sourceMappingURL=version.js.map

package/dist/adapters/http/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../../../src/adapters/http/version.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEtD,8GAA8G;AAC9G,SAAS,SAAS,CAAC,IAAkB;IACnC,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe;IAC7B,yEAAyE;IACzE,kDAAkD;IAClD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5E,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACnF,qFAAqF;IACrF,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,UAAU,WAAW,EAAE,CAAC,CAAC,CAAC;IAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC"}

package/dist/adapters/mcp/mcp-endpoint.d.ts

@@ -0,0 +1,8 @@
+import type { FastifyInstance, FastifyRequest } from 'fastify';
+import type { Context, RequestCredentials } from '../trpc/context.js';
+export interface McpEndpointOptions {
+    /** The context of one call, for this request, with the credentials the tool call carries. */
+    contextFor: (request: FastifyRequest, credentials: RequestCredentials) => Context;
+}
+/** Mounts `/mcp` on the HTTP server. */
+export declare function registerMcpEndpoint(server: FastifyInstance, options: McpEndpointOptions): void;

package/dist/adapters/mcp/mcp-endpoint.js

@@ -0,0 +1,127 @@
+/**
+ * `/mcp`: the ship contract as a remote MCP server, over streamable HTTP with
+ * the official SDK (ADR 0004). One tool per ship procedure, listed and called
+ * through the router (see trpc/ship-contract.ts); nothing here decides
+ * anything about a ship.
+ *
+ * The connection carries no ship (ADR 0015): many conversations share one
+ * MCP connection, each crewing its own ship. So every tool but `register`
+ * takes the crew token as its `crewToken` argument, and no header of the
+ * connection is ever read as a credential. The endpoint is stateless: a fresh
+ * server answers each HTTP request, and nothing is kept between them.
+ */
+import { MCP_PATH } from '@aeolus-fleet/common';
+import { createMcpHandler, McpServer, } from '@modelcontextprotocol/server';
+import { z } from 'zod';
+import { callShip, refusalBody, SHIP_CALLS, unexpectedFailure, } from '../trpc/ship-contract.js';
+import { SHIP_PROTOCOL } from '../trpc/ship-protocol.js';
+/** How the server names itself to MCP clients. Its version is the ship contract's, as in `/api/v1`. */
+const SERVER_INFO = { name: 'aeolus-fleet', version: '1' };
+const CREW_TOKEN_PROPERTY = {
+    type: 'string',
+    description: 'The crew token register gave you (aeolus_ct_v1_...): it says which ship you crew.',
+};
+/** The one credential a tool takes as an argument. Whether it is a valid one is for the router to judge. */
+const crewTokenArgument = z.string();
+const objectOutput = z.looseObject({ type: z.literal('object') });
+/** A ship call as an MCP tool: every one but `register` asks for the crew token first. */
+function toolOf(call) {
+    const input = call.input?.schema ?? { type: 'object', properties: {}, required: [] };
+    const inputSchema = call.credential === 'crewToken'
+        ? {
+            ...input,
+            properties: { crewToken: CREW_TOKEN_PROPERTY, ...input.properties },
+            required: ['crewToken', ...input.required],
+        }
+        : input;
+    // MCP takes an output schema only for an object; fleet_list answers a list, as text.
+    return {
+        name: call.name,
+        description: call.description,
+        inputSchema,
+        ...(call.output.type === 'object' && { outputSchema: objectOutput.parse(call.output) }),
+    };
+}
+const TOOLS = SHIP_CALLS.map(toolOf);
+/** A tool error the model reads: the code first, so it can tell a refusal from a failure. */
+function refusalResult(refusal) {
+    const { code, message, requestId } = refusal;
+    const text = requestId === undefined ? `${code}: ${message}` : `${code}: ${message} (request id ${requestId})`;
+    return { content: [{ type: 'text', text }], isError: true };
+}
+/** One tool call, as a call through the router with the crew token its arguments carry. */
+async function callTool(params, at) {
+    const { request, options } = at;
+    const call = SHIP_CALLS.find((candidate) => candidate.name === params.name);
+    if (!call) {
+        const names = SHIP_CALLS.map((known) => known.name).join(', ');
+        return refusalResult({
+            code: 'NOT_FOUND',
+            message: `There is no tool named ${params.name}. The tools are ${names}.`,
+        });
+    }
+    const args = params.arguments ?? {};
+    const { crewToken, ...input } = args;
+    const result = await callShip(call, call.credential === 'crewToken'
+        ? { ctx: options.contextFor(request, { bearer: crewTokenArgument.safeParse(crewToken).data }), input, log: request.log }
+        : { ctx: options.contextFor(request, {}), input: args, log: request.log });
+    if (!result.isOk) {
+        return refusalResult(result.refusal);
+    }
+    const text = JSON.stringify(result.output);
+    const structuredContent = z.record(z.string(), z.unknown()).safeParse(result.output);
+    return structuredContent.success
+        ? { content: [{ type: 'text', text }], structuredContent: structuredContent.data }
+        : { content: [{ type: 'text', text }] };
+}
+/**
+ * The MCP server answering one HTTP request: the ship tools, each a call
+ * through the router, and the ship protocol as its instructions, which a
+ * client reads when it connects. It answers `tools/list` and `tools/call`
+ * itself, at the protocol level, rather than registering each tool: a
+ * registered tool's arguments are validated by the SDK before its handler
+ * runs, and the router must be the one to judge them, so a refusal reads with
+ * its own code.
+ */
+function shipToolServer(request, options) {
+    const mcp = new McpServer(SERVER_INFO, { capabilities: { tools: {} }, instructions: SHIP_PROTOCOL });
+    mcp.server.setRequestHandler('tools/list', () => ({ tools: TOOLS }));
+    // A failure here would otherwise reach the client as a protocol error in its own words.
+    mcp.server.setRequestHandler('tools/call', async ({ params }) => {
+        try {
+            return await callTool(params, { request, options });
+        }
+        catch (thrown) {
+            return refusalResult(unexpectedFailure(thrown, { log: request.log, requestId: request.id }));
+        }
+    });
+    return mcp;
+}
+/** The request as the SDK's web-standard handler takes it. Fastify has read the JSON body already. */
+function webRequestOf(request) {
+    const headers = new Headers();
+    for (const [name, value] of Object.entries(request.headers)) {
+        for (const each of Array.isArray(value) ? value : [value]) {
+            if (each !== undefined) {
+                headers.append(name, each);
+            }
+        }
+    }
+    return new Request(new URL(request.url, `${request.protocol}://${request.host}`), { method: request.method, headers });
+}
+/** Mounts `/mcp` on the HTTP server. */
+export function registerMcpEndpoint(server, options) {
+    server.all(MCP_PATH, async (request, reply) => {
+        try {
+            // A handler per request, so each tool call knows the request it came
+            // with: its client address for the register limit, its id for the log.
+            const handler = createMcpHandler(() => shipToolServer(request, options));
+            return await handler.fetch(webRequestOf(request), { parsedBody: request.body });
+        }
+        catch (thrown) {
+            const refusal = unexpectedFailure(thrown, { log: request.log, requestId: request.id });
+            return await reply.code(refusal.httpStatus).send(refusalBody(refusal));
+        }
+    });
+}
+//# sourceMappingURL=mcp-endpoint.js.map

package/dist/adapters/mcp/mcp-endpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-endpoint.js","sourceRoot":"","sources":["../../../src/adapters/mcp/mcp-endpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EACL,gBAAgB,EAChB,SAAS,GAIV,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EACL,QAAQ,EACR,WAAW,EACX,UAAU,EACV,iBAAiB,GAGlB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD,uGAAuG;AACvG,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAE3D,MAAM,mBAAmB,GAAG;IAC1B,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,mFAAmF;CACjG,CAAC;AAEF,4GAA4G;AAC5G,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;AAErC,MAAM,YAAY,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAElE,0FAA0F;AAC1F,SAAS,MAAM,CAAC,IAAc;IAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACrF,MAAM,WAAW,GACf,IAAI,CAAC,UAAU,KAAK,WAAW;QAC7B,CAAC,CAAC;YACE,GAAG,KAAK;YACR,UAAU,EAAE,EAAE,SAAS,EAAE,mBAAmB,EAAE,GAAG,KAAK,CAAC,UAAU,EAAE;YACnE,QAAQ,EAAE,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC;SAC3C;QACH,CAAC,CAAC,KAAK,CAAC;IACZ,qFAAqF;IACrF,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW;QACX,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,EAAE,YAAY,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;KACxF,CAAC;AACJ,CAAC;AAED,MAAM,KAAK,GAAW,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAE7C,6FAA6F;AAC7F,SAAS,aAAa,CAAC,OAAgE;IACrF,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,IAAI,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,OAAO,gBAAgB,SAAS,GAAG,CAAC;IAC/G,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC9D,CAAC;AAOD,2FAA2F;AAC3F,KAAK,UAAU,QAAQ,CACrB,MAA6B,EAC7B,EAA4D;IAE5D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5E,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/D,OAAO,aAAa,CAAC;YACnB,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,0BAA0B,MAAM,CAAC,IAAI,mBAAmB,KAAK,GAAG;SAC1E,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;IACpC,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAC3B,IAAI,EACJ,IAAI,CAAC,UAAU,KAAK,WAAW;QAC7B,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,iBAAiB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;QACxH,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAC5E,CAAC;IAEF,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrF,OAAO,iBAAiB,CAAC,OAAO;QAC9B,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,IAAI,EAAE;QAClF,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,OAAuB,EAAE,OAA2B;IAC1E,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,CAAC;IAErG,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAErE,wFAAwF;IACxF,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,YAAY,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC9D,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,OAAO,aAAa,CAAC,iBAAiB,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sGAAsG;AACtG,SAAS,YAAY,CAAC,OAAuB;IAC3C,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,QAAQ,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AACzH,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,mBAAmB,CAAC,MAAuB,EAAE,OAA2B;IACtF,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC5C,IAAI,CAAC;YACH,qEAAqE;YACrE,uEAAuE;YACvE,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YACzE,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YACvF,OAAO,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/adapters/prisma/client.d.ts

@@ -0,0 +1,10 @@
+import { PrismaClient, type Prisma } from './generated/client.js';
+export type { PrismaClient } from './generated/client.js';
+/** The client itself, or the client of one interactive transaction. Repositories take either. */
+export type Db = PrismaClient | Prisma.TransactionClient;
+/** Creates a Prisma client on a pg connection pool for the given database. */
+export declare function createPrismaClient(databaseUrl: string): PrismaClient;
+/** Throws when the database cannot answer a trivial query. */
+export declare function checkDatabase(prisma: PrismaClient): Promise<void>;
+/** The latest migration applied to the database, by name; null before the first. */
+export declare function latestMigration(db: PrismaClient): Promise<string | null>;

package/dist/adapters/prisma/client.js

@@ -0,0 +1,20 @@
+import { PrismaPg } from '@prisma/adapter-pg';
+import { PrismaClient } from './generated/client.js';
+/** Creates a Prisma client on a pg connection pool for the given database. */
+export function createPrismaClient(databaseUrl) {
+    return new PrismaClient({ adapter: new PrismaPg({ connectionString: databaseUrl }) });
+}
+/** Throws when the database cannot answer a trivial query. */
+export async function checkDatabase(prisma) {
+    await prisma.$queryRaw `SELECT 1`;
+}
+/** The latest migration applied to the database, by name; null before the first. */
+export async function latestMigration(db) {
+    const [row] = await db.$queryRaw `
+    SELECT migration_name FROM _prisma_migrations
+    WHERE finished_at IS NOT NULL AND rolled_back_at IS NULL
+    ORDER BY migration_name DESC
+    LIMIT 1`;
+    return row?.migration_name ?? null;
+}
+//# sourceMappingURL=client.js.map

package/dist/adapters/prisma/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/adapters/prisma/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAe,MAAM,uBAAuB,CAAC;AAOlE,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACpD,OAAO,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,QAAQ,CAAC,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAoB;IACtD,MAAM,MAAM,CAAC,SAAS,CAAA,UAAU,CAAC;AACnC,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAgB;IACpD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,SAAS,CAA8B;;;;YAIpD,CAAC;IACX,OAAO,GAAG,EAAE,cAAc,IAAI,IAAI,CAAC;AACrC,CAAC"}

package/dist/adapters/prisma/delivery-notices.d.ts

@@ -0,0 +1,34 @@
+import type { FleetEventNotice } from '../../domain/shared/events.js';
+import type { DeliveryNotice, Notifier } from '../../domain/shared/notifier.js';
+import type { Db } from './client.js';
+/** The one channel every pending delivery is announced on. */
+export declare const DELIVERY_PENDING_CHANNEL = "aeolus_delivery_pending";
+export declare function createPrismaNotifier(db: Db): Notifier;
+/** How the listener names its connection in Postgres (`application_name`), so it can be found there. */
+export declare const LISTENER_APPLICATION_NAME = "aeolus-delivery-listener";
+export interface DeliveryListener {
+    /** Settles once the listener first listens: notices of later commits reach it. */
+    listening: Promise<void>;
+    close(): Promise<void>;
+}
+/**
+ * Listens for pending deliveries on a connection of its own: LISTEN needs one
+ * that no pool hands to another query, and it must be direct, not through a
+ * transaction pooler. Waiting receives and live subscriptions are woken
+ * through it. Returns at once.
+ *
+ * It never throws: a failed connect or a lost connection goes to `onError`,
+ * and it tries again after a delay that doubles with each failure, up to 30
+ * seconds. Notices sent while it did not listen are gone, so `onListening`
+ * runs each time it starts listening, for the waiting receives to look again.
+ */
+export declare function listenForPendingDeliveries(options: {
+    databaseUrl: string;
+    onNotice: (notice: DeliveryNotice) => void;
+    /** Hears that a fleet's events up to a number have committed (event-log.ts), for live subscriptions. */
+    onFleetEvent?: (notice: FleetEventNotice) => void;
+    onListening?: () => void;
+    onError?: (error: Error) => void;
+    /** The first wait before trying again; 1 second unless a test says otherwise. */
+    reconnectDelayMs?: number;
+}): DeliveryListener;

package/dist/adapters/prisma/delivery-notices.js

@@ -0,0 +1,113 @@
+/**
+ * Wakes receivers with Postgres LISTEN/NOTIFY (ADR 0003). A send notifies on
+ * one channel inside its transaction; Postgres hands the notice to listeners
+ * only when that transaction commits, and drops it when it rolls back. The
+ * payload says which delivery is pending and for whom, never the message's
+ * payload. The same connection hears committed events (event-log.ts) for the
+ * live subscriptions.
+ */
+import pg from 'pg';
+import { FLEET_EVENT_CHANNEL } from './event-log.js';
+import { toDeliveryNotice, toFleetEventNotice } from './rows.js';
+/** The one channel every pending delivery is announced on. */
+export const DELIVERY_PENDING_CHANNEL = 'aeolus_delivery_pending';
+export function createPrismaNotifier(db) {
+    return {
+        deliveryPending: async (notice) => {
+            await db.$executeRaw `SELECT pg_notify(${DELIVERY_PENDING_CHANNEL}, ${JSON.stringify(notice)})`;
+        },
+    };
+}
+/** How the listener names its connection in Postgres (`application_name`), so it can be found there. */
+export const LISTENER_APPLICATION_NAME = 'aeolus-delivery-listener';
+/** The first wait before the listener tries again after losing its connection; each failure doubles it. */
+const RECONNECT_DELAY_MS = 1_000;
+/** The longest wait between two tries. */
+const RECONNECT_DELAY_MAX_MS = 30_000;
+/**
+ * Listens for pending deliveries on a connection of its own: LISTEN needs one
+ * that no pool hands to another query, and it must be direct, not through a
+ * transaction pooler. Waiting receives and live subscriptions are woken
+ * through it. Returns at once.
+ *
+ * It never throws: a failed connect or a lost connection goes to `onError`,
+ * and it tries again after a delay that doubles with each failure, up to 30
+ * seconds. Notices sent while it did not listen are gone, so `onListening`
+ * runs each time it starts listening, for the waiting receives to look again.
+ */
+export function listenForPendingDeliveries(options) {
+    const firstDelayMs = options.reconnectDelayMs ?? RECONNECT_DELAY_MS;
+    const listening = Promise.withResolvers();
+    const report = (error) => {
+        options.onError?.(error instanceof Error ? error : new Error(String(error)));
+    };
+    let current;
+    let retry;
+    let delayMs = firstDelayMs;
+    let isClosed = false;
+    /** Gives up a client that failed and tries again later: once per client, and never after close. */
+    const tryAgainLater = (failed) => {
+        if (isClosed || failed !== current) {
+            return;
+        }
+        current = undefined;
+        failed.end().catch(() => undefined);
+        retry = setTimeout(connect, delayMs);
+        delayMs = Math.min(delayMs * 2, RECONNECT_DELAY_MAX_MS);
+    };
+    const connect = () => {
+        retry = undefined;
+        const client = new pg.Client({ connectionString: options.databaseUrl, application_name: LISTENER_APPLICATION_NAME });
+        current = client;
+        client.on('error', (error) => {
+            report(error);
+            tryAgainLater(client);
+        });
+        client.on('end', () => {
+            tryAgainLater(client);
+        });
+        client.on('notification', ({ channel, payload }) => {
+            if (payload === undefined) {
+                return;
+            }
+            try {
+                if (channel === DELIVERY_PENDING_CHANNEL) {
+                    options.onNotice(toDeliveryNotice(JSON.parse(payload)));
+                }
+                else if (channel === FLEET_EVENT_CHANNEL) {
+                    options.onFleetEvent?.(toFleetEventNotice(JSON.parse(payload)));
+                }
+            }
+            catch (error) {
+                report(error);
+            }
+        });
+        client
+            .connect()
+            // The channels are constants, never outside input.
+            .then(() => client.query(`LISTEN ${DELIVERY_PENDING_CHANNEL}; LISTEN ${FLEET_EVENT_CHANNEL}`))
+            .then(() => {
+            if (client !== current) {
+                return;
+            }
+            delayMs = firstDelayMs;
+            listening.resolve(undefined);
+            options.onListening?.();
+        }, (error) => {
+            report(error);
+            tryAgainLater(client);
+        });
+    };
+    connect();
+    return {
+        listening: listening.promise,
+        close: async () => {
+            isClosed = true;
+            clearTimeout(retry);
+            const client = current;
+            current = undefined;
+            await client?.end().catch(() => undefined);
+        },
+    };
+}
+//# sourceMappingURL=delivery-notices.js.map

package/dist/adapters/prisma/delivery-notices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery-notices.js","sourceRoot":"","sources":["../../../src/adapters/prisma/delivery-notices.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,MAAM,IAAI,CAAC;AAKpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAEjE,8DAA8D;AAC9D,MAAM,CAAC,MAAM,wBAAwB,GAAG,yBAAyB,CAAC;AAElE,MAAM,UAAU,oBAAoB,CAAC,EAAM;IACzC,OAAO;QACL,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAChC,MAAM,EAAE,CAAC,WAAW,CAAA,oBAAoB,wBAAwB,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC;QACjG,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,MAAM,CAAC,MAAM,yBAAyB,GAAG,0BAA0B,CAAC;AAEpE,2GAA2G;AAC3G,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAEjC,0CAA0C;AAC1C,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAQtC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAS1C;IACC,MAAM,YAAY,GAAG,OAAO,CAAC,gBAAgB,IAAI,kBAAkB,CAAC;IACpE,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,EAAa,CAAC;IACrD,MAAM,MAAM,GAAG,CAAC,KAAc,EAAE,EAAE;QAChC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/E,CAAC,CAAC;IAEF,IAAI,OAA8B,CAAC;IACnC,IAAI,KAAiC,CAAC;IACtC,IAAI,OAAO,GAAG,YAAY,CAAC;IAC3B,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,mGAAmG;IACnG,MAAM,aAAa,GAAG,CAAC,MAAiB,EAAE,EAAE;QAC1C,IAAI,QAAQ,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACnC,OAAO;QACT,CAAC;QACD,OAAO,GAAG,SAAS,CAAC;QACpB,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpC,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACrC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC1D,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,KAAK,GAAG,SAAS,CAAC;QAClB,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,WAAW,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACrH,OAAO,GAAG,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC3B,MAAM,CAAC,KAAK,CAAC,CAAC;YACd,aAAa,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACpB,aAAa,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;YACjD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,OAAO,KAAK,wBAAwB,EAAE,CAAC;oBACzC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBAC1D,CAAC;qBAAM,IAAI,OAAO,KAAK,mBAAmB,EAAE,CAAC;oBAC3C,OAAO,CAAC,YAAY,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM;aACH,OAAO,EAAE;YACV,mDAAmD;aAClD,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,wBAAwB,YAAY,mBAAmB,EAAE,CAAC,CAAC;aAC7F,IAAI,CACH,GAAG,EAAE;YACH,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvB,OAAO;YACT,CAAC;YACD,OAAO,GAAG,YAAY,CAAC;YACvB,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC7B,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QAC1B,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YACjB,MAAM,CAAC,KAAK,CAAC,CAAC;YACd,aAAa,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC,CACF,CAAC;IACN,CAAC,CAAC;IAEF,OAAO,EAAE,CAAC;IACV,OAAO;QACL,SAAS,EAAE,SAAS,CAAC,OAAO;QAC5B,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,QAAQ,GAAG,IAAI,CAAC;YAChB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,MAAM,GAAG,OAAO,CAAC;YACvB,OAAO,GAAG,SAAS,CAAC;YACpB,MAAM,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/adapters/prisma/event-log.d.ts

@@ -0,0 +1,11 @@
+import type { EventLog, FleetEventFeed } from '../../domain/shared/events.js';
+import type { Db } from './client.js';
+/** The one channel every committed event is announced on, with its fleet and the last number. */
+export declare const FLEET_EVENT_CHANNEL = "aeolus_event";
+export interface BufferedEventLog extends EventLog {
+    /** Numbers and writes the held events and announces them. The unit of work's last step before commit. */
+    flush(): Promise<void>;
+}
+export declare function createPrismaEventLog(db: Db): BufferedEventLog;
+/** Reads committed events by number. Each read is one statement, outside a unit of work. */
+export declare function createPrismaFleetEventFeed(db: Db): FleetEventFeed;