@aeolus-fleet/gateway 0.28.0 → 0.29.0

package/web/.next/types/routes.d.ts

@@ -0,0 +1,85 @@
+// This file is generated automatically by Next.js
+// Do not edit this file manually
+
+type AppRoutes = "/authorize/failed" | "/authorize/pick" | "/authorize/waiting/approval" | "/outside-parties" | "/outside-parties/[name]" | "/outside-parties/[name]/change" | "/outside-parties/[name]/retire" | "/outside-parties/add" | "/overview" | "/overview/requests/[requestId]" | "/parties" | "/sign-in/failed"
+type AppRouteHandlerRoutes = "/overview/changes"
+type PageRoutes = never
+type LayoutRoutes = "/"
+type RedirectRoutes = never
+type RewriteRoutes = never
+type Routes = AppRoutes | PageRoutes | LayoutRoutes | RedirectRoutes | RewriteRoutes | AppRouteHandlerRoutes
+
+
+interface ParamMap {
+  "/": {}
+  "/authorize/failed": {}
+  "/authorize/pick": {}
+  "/authorize/waiting/approval": {}
+  "/outside-parties": {}
+  "/outside-parties/[name]": { "name": string; }
+  "/outside-parties/[name]/change": { "name": string; }
+  "/outside-parties/[name]/retire": { "name": string; }
+  "/outside-parties/add": {}
+  "/overview": {}
+  "/overview/changes": {}
+  "/overview/requests/[requestId]": { "requestId": string; }
+  "/parties": {}
+  "/sign-in/failed": {}
+}
+
+
+export type ParamsOf<Route extends Routes> = ParamMap[Route]
+
+interface LayoutSlotMap {
+  "/": never
+}
+
+
+export type { AppRoutes, PageRoutes, LayoutRoutes, RedirectRoutes, RewriteRoutes, ParamMap, AppRouteHandlerRoutes }
+
+declare global {
+  /**
+   * Props for Next.js App Router page components
+   * @example
+   * ```tsx
+   * export default function Page(props: PageProps<'/blog/[slug]'>) {
+   *   const { slug } = await props.params
+   *   return <div>Blog post: {slug}</div>
+   * }
+   * ```
+   */
+  interface PageProps<AppRoute extends AppRoutes> {
+    params: Promise<ParamMap[AppRoute]>
+    searchParams: Promise<Record<string, string | string[] | undefined>>
+  }
+
+  /**
+   * Props for Next.js App Router layout components
+   * @example
+   * ```tsx
+   * export default function Layout(props: LayoutProps<'/dashboard'>) {
+   *   return <div>{props.children}</div>
+   * }
+   * ```
+   */
+  type LayoutProps<LayoutRoute extends LayoutRoutes> = {
+    params: Promise<ParamMap[LayoutRoute]>
+    children: React.ReactNode
+  } & {
+    [K in LayoutSlotMap[LayoutRoute]]: React.ReactNode
+  }
+
+  /**
+   * Context for Next.js App Router route handlers
+   * @example
+   * ```tsx
+   * export async function GET(request: NextRequest, context: RouteContext<'/api/users/[id]'>) {
+   *   const { id } = await context.params
+   *   return Response.json({ id })
+   * }
+   * ```
+   */
+  interface RouteContext<AppRouteHandlerRoute extends AppRouteHandlerRoutes> {
+    params: Promise<ParamMap[AppRouteHandlerRoute]>
+  }
+}

package/web/.next/types/validator.ts

@@ -0,0 +1,288 @@
+// This file is generated automatically by Next.js
+// Do not edit this file manually
+// This file validates that all pages and layouts export the correct types
+
+import type { AppRoutes, LayoutRoutes, ParamMap, AppRouteHandlerRoutes } from "./routes.js"
+import type { ResolvingMetadata, ResolvingViewport } from "next/types.js"
+import type { NextRequest } from 'next/server.js'
+
+type ParamMatchFragment<Route extends keyof ParamMap> = Partial<Record<keyof ParamMap[Route], string>>
+type ParamMatchingExports<Route extends keyof ParamMap> =
+  | { unstable_paramMatching?: ParamMatchFragment<Route>; unstable_generateParamMatching?: never }
+  | { unstable_paramMatching?: never; unstable_generateParamMatching?: () => Promise<ParamMatchFragment<Route>> | ParamMatchFragment<Route> }
+
+type AppPageConfig<Route extends AppRoutes = AppRoutes> = {
+  default: React.ComponentType<{ params: Promise<ParamMap[Route]> } & any> | ((props: { params: Promise<ParamMap[Route]> } & any) => React.ReactNode | Promise<React.ReactNode> | never | void | Promise<void>)
+  generateStaticParams?: (props: { params: ParamMap[Route] }) => Promise<any[]> | any[]
+  generateMetadata?: (
+    props: { params: Promise<ParamMap[Route]> } & any,
+    parent: ResolvingMetadata
+  ) => Promise<any> | any
+  generateViewport?: (
+    props: { params: Promise<ParamMap[Route]> } & any,
+    parent: ResolvingViewport
+  ) => Promise<any> | any
+  metadata?: any
+  viewport?: any
+} & ParamMatchingExports<Route>
+
+type LayoutConfig<Route extends LayoutRoutes = LayoutRoutes> = {
+  default: React.ComponentType<LayoutProps<Route>> | ((props: LayoutProps<Route>) => React.ReactNode | Promise<React.ReactNode> | never | void | Promise<void>)
+  generateStaticParams?: (props: { params: ParamMap[Route] }) => Promise<any[]> | any[]
+  generateMetadata?: (
+    props: { params: Promise<ParamMap[Route]> } & any,
+    parent: ResolvingMetadata
+  ) => Promise<any> | any
+  generateViewport?: (
+    props: { params: Promise<ParamMap[Route]> } & any,
+    parent: ResolvingViewport
+  ) => Promise<any> | any
+  metadata?: any
+  viewport?: any
+} & ParamMatchingExports<Route>
+
+type RouteHandlerConfig<Route extends AppRouteHandlerRoutes = AppRouteHandlerRoutes> = {
+  GET?: (request: NextRequest, context: { params: Promise<ParamMap[Route]> }) => Promise<Response | void> | Response | void
+  POST?: (request: NextRequest, context: { params: Promise<ParamMap[Route]> }) => Promise<Response | void> | Response | void
+  PUT?: (request: NextRequest, context: { params: Promise<ParamMap[Route]> }) => Promise<Response | void> | Response | void
+  PATCH?: (request: NextRequest, context: { params: Promise<ParamMap[Route]> }) => Promise<Response | void> | Response | void
+  DELETE?: (request: NextRequest, context: { params: Promise<ParamMap[Route]> }) => Promise<Response | void> | Response | void
+  HEAD?: (request: NextRequest, context: { params: Promise<ParamMap[Route]> }) => Promise<Response | void> | Response | void
+  OPTIONS?: (request: NextRequest, context: { params: Promise<ParamMap[Route]> }) => Promise<Response | void> | Response | void
+}
+
+
+// Validate ../../app/authorize/failed/page.tsx
+{
+  type __IsExpected<Specific extends AppPageConfig<"/authorize/failed">> = Specific
+  const handler = {} as typeof import("../../app/authorize/failed/page.js")
+  type __Check = __IsExpected<typeof handler>
+  
+  type __ParamMatchingValue =
+    typeof handler extends { unstable_paramMatching: infer Matcher } ? Matcher :
+    typeof handler extends { unstable_generateParamMatching: (...args: any[]) => infer Matcher } ? Awaited<Matcher> : {}
+  type __InvalidParamMatchingKeys = Exclude<keyof __ParamMatchingValue, keyof ParamMap["/authorize/failed"]>
+  type __AssertNoInvalidParamMatchingKeys<Invalid extends never> = Invalid
+  const __paramMatchingKeyCheck: __AssertNoInvalidParamMatchingKeys<__InvalidParamMatchingKeys> | undefined = undefined
+  void __paramMatchingKeyCheck
+  // @ts-ignore
+  type __Unused = __Check
+}
+
+// Validate ../../app/authorize/pick/page.tsx
+{
+  type __IsExpected<Specific extends AppPageConfig<"/authorize/pick">> = Specific
+  const handler = {} as typeof import("../../app/authorize/pick/page.js")
+  type __Check = __IsExpected<typeof handler>
+  
+  type __ParamMatchingValue =
+    typeof handler extends { unstable_paramMatching: infer Matcher } ? Matcher :
+    typeof handler extends { unstable_generateParamMatching: (...args: any[]) => infer Matcher } ? Awaited<Matcher> : {}
+  type __InvalidParamMatchingKeys = Exclude<keyof __ParamMatchingValue, keyof ParamMap["/authorize/pick"]>
+  type __AssertNoInvalidParamMatchingKeys<Invalid extends never> = Invalid
+  const __paramMatchingKeyCheck: __AssertNoInvalidParamMatchingKeys<__InvalidParamMatchingKeys> | undefined = undefined
+  void __paramMatchingKeyCheck
+  // @ts-ignore
+  type __Unused = __Check
+}
+
+// Validate ../../app/authorize/waiting/approval/page.tsx
+{
+  type __IsExpected<Specific extends AppPageConfig<"/authorize/waiting/approval">> = Specific
+  const handler = {} as typeof import("../../app/authorize/waiting/approval/page.js")
+  type __Check = __IsExpected<typeof handler>
+  
+  type __ParamMatchingValue =
+    typeof handler extends { unstable_paramMatching: infer Matcher } ? Matcher :
+    typeof handler extends { unstable_generateParamMatching: (...args: any[]) => infer Matcher } ? Awaited<Matcher> : {}
+  type __InvalidParamMatchingKeys = Exclude<keyof __ParamMatchingValue, keyof ParamMap["/authorize/waiting/approval"]>
+  type __AssertNoInvalidParamMatchingKeys<Invalid extends never> = Invalid
+  const __paramMatchingKeyCheck: __AssertNoInvalidParamMatchingKeys<__InvalidParamMatchingKeys> | undefined = undefined
+  void __paramMatchingKeyCheck
+  // @ts-ignore
+  type __Unused = __Check
+}
+
+// Validate ../../app/outside-parties/[name]/change/page.tsx
+{
+  type __IsExpected<Specific extends AppPageConfig<"/outside-parties/[name]/change">> = Specific
+  const handler = {} as typeof import("../../app/outside-parties/[name]/change/page.js")
+  type __Check = __IsExpected<typeof handler>
+  
+  type __ParamMatchingValue =
+    typeof handler extends { unstable_paramMatching: infer Matcher } ? Matcher :
+    typeof handler extends { unstable_generateParamMatching: (...args: any[]) => infer Matcher } ? Awaited<Matcher> : {}
+  type __InvalidParamMatchingKeys = Exclude<keyof __ParamMatchingValue, keyof ParamMap["/outside-parties/[name]/change"]>
+  type __AssertNoInvalidParamMatchingKeys<Invalid extends never> = Invalid
+  const __paramMatchingKeyCheck: __AssertNoInvalidParamMatchingKeys<__InvalidParamMatchingKeys> | undefined = undefined
+  void __paramMatchingKeyCheck
+  // @ts-ignore
+  type __Unused = __Check
+}
+
+// Validate ../../app/outside-parties/[name]/page.tsx
+{
+  type __IsExpected<Specific extends AppPageConfig<"/outside-parties/[name]">> = Specific
+  const handler = {} as typeof import("../../app/outside-parties/[name]/page.js")
+  type __Check = __IsExpected<typeof handler>
+  
+  type __ParamMatchingValue =
+    typeof handler extends { unstable_paramMatching: infer Matcher } ? Matcher :
+    typeof handler extends { unstable_generateParamMatching: (...args: any[]) => infer Matcher } ? Awaited<Matcher> : {}
+  type __InvalidParamMatchingKeys = Exclude<keyof __ParamMatchingValue, keyof ParamMap["/outside-parties/[name]"]>
+  type __AssertNoInvalidParamMatchingKeys<Invalid extends never> = Invalid
+  const __paramMatchingKeyCheck: __AssertNoInvalidParamMatchingKeys<__InvalidParamMatchingKeys> | undefined = undefined
+  void __paramMatchingKeyCheck
+  // @ts-ignore
+  type __Unused = __Check
+}
+
+// Validate ../../app/outside-parties/[name]/retire/page.tsx
+{
+  type __IsExpected<Specific extends AppPageConfig<"/outside-parties/[name]/retire">> = Specific
+  const handler = {} as typeof import("../../app/outside-parties/[name]/retire/page.js")
+  type __Check = __IsExpected<typeof handler>
+  
+  type __ParamMatchingValue =
+    typeof handler extends { unstable_paramMatching: infer Matcher } ? Matcher :
+    typeof handler extends { unstable_generateParamMatching: (...args: any[]) => infer Matcher } ? Awaited<Matcher> : {}
+  type __InvalidParamMatchingKeys = Exclude<keyof __ParamMatchingValue, keyof ParamMap["/outside-parties/[name]/retire"]>
+  type __AssertNoInvalidParamMatchingKeys<Invalid extends never> = Invalid
+  const __paramMatchingKeyCheck: __AssertNoInvalidParamMatchingKeys<__InvalidParamMatchingKeys> | undefined = undefined
+  void __paramMatchingKeyCheck
+  // @ts-ignore
+  type __Unused = __Check
+}
+
+// Validate ../../app/outside-parties/add/page.tsx
+{
+  type __IsExpected<Specific extends AppPageConfig<"/outside-parties/add">> = Specific
+  const handler = {} as typeof import("../../app/outside-parties/add/page.js")
+  type __Check = __IsExpected<typeof handler>
+  
+  type __ParamMatchingValue =
+    typeof handler extends { unstable_paramMatching: infer Matcher } ? Matcher :
+    typeof handler extends { unstable_generateParamMatching: (...args: any[]) => infer Matcher } ? Awaited<Matcher> : {}
+  type __InvalidParamMatchingKeys = Exclude<keyof __ParamMatchingValue, keyof ParamMap["/outside-parties/add"]>
+  type __AssertNoInvalidParamMatchingKeys<Invalid extends never> = Invalid
+  const __paramMatchingKeyCheck: __AssertNoInvalidParamMatchingKeys<__InvalidParamMatchingKeys> | undefined = undefined
+  void __paramMatchingKeyCheck
+  // @ts-ignore
+  type __Unused = __Check
+}
+
+// Validate ../../app/outside-parties/page.tsx
+{
+  type __IsExpected<Specific extends AppPageConfig<"/outside-parties">> = Specific
+  const handler = {} as typeof import("../../app/outside-parties/page.js")
+  type __Check = __IsExpected<typeof handler>
+  
+  type __ParamMatchingValue =
+    typeof handler extends { unstable_paramMatching: infer Matcher } ? Matcher :
+    typeof handler extends { unstable_generateParamMatching: (...args: any[]) => infer Matcher } ? Awaited<Matcher> : {}
+  type __InvalidParamMatchingKeys = Exclude<keyof __ParamMatchingValue, keyof ParamMap["/outside-parties"]>
+  type __AssertNoInvalidParamMatchingKeys<Invalid extends never> = Invalid
+  const __paramMatchingKeyCheck: __AssertNoInvalidParamMatchingKeys<__InvalidParamMatchingKeys> | undefined = undefined
+  void __paramMatchingKeyCheck
+  // @ts-ignore
+  type __Unused = __Check
+}
+
+// Validate ../../app/overview/page.tsx
+{
+  type __IsExpected<Specific extends AppPageConfig<"/overview">> = Specific
+  const handler = {} as typeof import("../../app/overview/page.js")
+  type __Check = __IsExpected<typeof handler>
+  
+  type __ParamMatchingValue =
+    typeof handler extends { unstable_paramMatching: infer Matcher } ? Matcher :
+    typeof handler extends { unstable_generateParamMatching: (...args: any[]) => infer Matcher } ? Awaited<Matcher> : {}
+  type __InvalidParamMatchingKeys = Exclude<keyof __ParamMatchingValue, keyof ParamMap["/overview"]>
+  type __AssertNoInvalidParamMatchingKeys<Invalid extends never> = Invalid
+  const __paramMatchingKeyCheck: __AssertNoInvalidParamMatchingKeys<__InvalidParamMatchingKeys> | undefined = undefined
+  void __paramMatchingKeyCheck
+  // @ts-ignore
+  type __Unused = __Check
+}
+
+// Validate ../../app/overview/requests/[requestId]/page.tsx
+{
+  type __IsExpected<Specific extends AppPageConfig<"/overview/requests/[requestId]">> = Specific
+  const handler = {} as typeof import("../../app/overview/requests/[requestId]/page.js")
+  type __Check = __IsExpected<typeof handler>
+  
+  type __ParamMatchingValue =
+    typeof handler extends { unstable_paramMatching: infer Matcher } ? Matcher :
+    typeof handler extends { unstable_generateParamMatching: (...args: any[]) => infer Matcher } ? Awaited<Matcher> : {}
+  type __InvalidParamMatchingKeys = Exclude<keyof __ParamMatchingValue, keyof ParamMap["/overview/requests/[requestId]"]>
+  type __AssertNoInvalidParamMatchingKeys<Invalid extends never> = Invalid
+  const __paramMatchingKeyCheck: __AssertNoInvalidParamMatchingKeys<__InvalidParamMatchingKeys> | undefined = undefined
+  void __paramMatchingKeyCheck
+  // @ts-ignore
+  type __Unused = __Check
+}
+
+// Validate ../../app/parties/page.tsx
+{
+  type __IsExpected<Specific extends AppPageConfig<"/parties">> = Specific
+  const handler = {} as typeof import("../../app/parties/page.js")
+  type __Check = __IsExpected<typeof handler>
+  
+  type __ParamMatchingValue =
+    typeof handler extends { unstable_paramMatching: infer Matcher } ? Matcher :
+    typeof handler extends { unstable_generateParamMatching: (...args: any[]) => infer Matcher } ? Awaited<Matcher> : {}
+  type __InvalidParamMatchingKeys = Exclude<keyof __ParamMatchingValue, keyof ParamMap["/parties"]>
+  type __AssertNoInvalidParamMatchingKeys<Invalid extends never> = Invalid
+  const __paramMatchingKeyCheck: __AssertNoInvalidParamMatchingKeys<__InvalidParamMatchingKeys> | undefined = undefined
+  void __paramMatchingKeyCheck
+  // @ts-ignore
+  type __Unused = __Check
+}
+
+// Validate ../../app/sign-in/failed/page.tsx
+{
+  type __IsExpected<Specific extends AppPageConfig<"/sign-in/failed">> = Specific
+  const handler = {} as typeof import("../../app/sign-in/failed/page.js")
+  type __Check = __IsExpected<typeof handler>
+  
+  type __ParamMatchingValue =
+    typeof handler extends { unstable_paramMatching: infer Matcher } ? Matcher :
+    typeof handler extends { unstable_generateParamMatching: (...args: any[]) => infer Matcher } ? Awaited<Matcher> : {}
+  type __InvalidParamMatchingKeys = Exclude<keyof __ParamMatchingValue, keyof ParamMap["/sign-in/failed"]>
+  type __AssertNoInvalidParamMatchingKeys<Invalid extends never> = Invalid
+  const __paramMatchingKeyCheck: __AssertNoInvalidParamMatchingKeys<__InvalidParamMatchingKeys> | undefined = undefined
+  void __paramMatchingKeyCheck
+  // @ts-ignore
+  type __Unused = __Check
+}
+
+// Validate ../../app/overview/changes/route.ts
+{
+  type __IsExpected<Specific extends RouteHandlerConfig<"/overview/changes">> = Specific
+  const handler = {} as typeof import("../../app/overview/changes/route.js")
+  type __Check = __IsExpected<typeof handler>
+  
+  // @ts-ignore
+  type __Unused = __Check
+}
+
+
+
+
+
+// Validate ../../app/layout.tsx
+{
+  type __IsExpected<Specific extends LayoutConfig<"/">> = Specific
+  const handler = {} as typeof import("../../app/layout.js")
+  type __Check = __IsExpected<typeof handler>
+  
+  type __ParamMatchingValue =
+    typeof handler extends { unstable_paramMatching: infer Matcher } ? Matcher :
+    typeof handler extends { unstable_generateParamMatching: (...args: any[]) => infer Matcher } ? Awaited<Matcher> : {}
+  type __InvalidParamMatchingKeys = Exclude<keyof __ParamMatchingValue, keyof ParamMap["/"]>
+  type __AssertNoInvalidParamMatchingKeys<Invalid extends never> = Invalid
+  const __paramMatchingKeyCheck: __AssertNoInvalidParamMatchingKeys<__InvalidParamMatchingKeys> | undefined = undefined
+  void __paramMatchingKeyCheck
+  // @ts-ignore
+  type __Unused = __Check
+}

package/web/next.config.ts

@@ -0,0 +1,9 @@
+import type { NextConfig } from 'next';
+
+const config: NextConfig = {
+  poweredByHeader: false,
+  // The repository has its own guidance; Next writes no AGENTS.md or CLAUDE.md.
+  agentRules: false,
+};
+
+export default config;

package/dist/adapters/crypto/page-sessions.d.ts

@@ -1,15 +0,0 @@
-import type { PageSessions } from '../../core/sign-in/ports.js';
-/** The cookie a browser signed in to the gateway's pages holds; not the console's aeolus_session, which the fleet reads. */
-export declare const PAGE_SESSION_COOKIE = "aeolus_gateway_session";
-/**
- * The page session's own pair in a Cookie header, and nothing else: the
- * pages are accounts only (Thomas, 20 Oct), so no other cookie the browser
- * sends, such as the console's, reaches them.
- */
-export declare function pageCookieOf(header: string | undefined): string | undefined;
-/**
- * Seals a page session into the gateway's own cookie under a key derived
- * from the gateway's secret, and finds it in a Cookie header. A value
- * changed on the way, or sealed under another secret or label, is none.
- */
-export declare function createPageSessions(secret: string): PageSessions;

package/dist/adapters/crypto/page-sessions.js

@@ -1,40 +0,0 @@
-import { idSchema } from '@aeolus-fleet/common';
-import { z } from 'zod';
-import { createSealer } from './sealer.js';
-/** The cookie a browser signed in to the gateway's pages holds; not the console's aeolus_session, which the fleet reads. */
-export const PAGE_SESSION_COOKIE = 'aeolus_gateway_session';
-const PREFIX = `${PAGE_SESSION_COOKIE}=`;
-/**
- * The page session's own pair in a Cookie header, and nothing else: the
- * pages are accounts only (Thomas, 20 Oct), so no other cookie the browser
- * sends, such as the console's, reaches them.
- */
-export function pageCookieOf(header) {
-    return header
-        ?.split(';')
-        .map((pair) => pair.trim())
-        .find((pair) => pair.startsWith(PREFIX) && pair.length > PREFIX.length);
-}
-/** Its own label, so the sealing key is never also a key the gateway derives elsewhere. */
-const SEAL_LABEL = 'page-session';
-const sealedSchema = z.object({ fleetId: idSchema('fleet'), grantId: z.string().min(1) });
-/**
- * Seals a page session into the gateway's own cookie under a key derived
- * from the gateway's secret, and finds it in a Cookie header. A value
- * changed on the way, or sealed under another secret or label, is none.
- */
-export function createPageSessions(secret) {
-    const sealer = createSealer(secret, SEAL_LABEL);
-    return {
-        seal: ({ fleetId, grantId }) => sealer.seal({ fleetId, grantId }),
-        inCookie: (cookie) => {
-            const sealed = pageCookieOf(cookie)?.slice(PREFIX.length);
-            if (sealed === undefined) {
-                return undefined;
-            }
-            const session = sealedSchema.safeParse(sealer.open(sealed));
-            return session.success ? session.data : undefined;
-        },
-    };
-}
-//# sourceMappingURL=page-sessions.js.map

package/dist/adapters/crypto/page-sessions.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"page-sessions.js","sourceRoot":"","sources":["../../../src/adapters/crypto/page-sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,4HAA4H;AAC5H,MAAM,CAAC,MAAM,mBAAmB,GAAG,wBAAwB,CAAC;AAE5D,MAAM,MAAM,GAAG,GAAG,mBAAmB,GAAG,CAAC;AAEzC;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,MAA0B;IACrD,OAAO,MAAM;QACX,EAAE,KAAK,CAAC,GAAG,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;AAC5E,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,GAAG,cAAc,CAAC;AAElC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAE1F;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAChD,OAAO;QACL,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QACjE,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;YACnB,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC1D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5D,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACpD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/adapters/http/add-server-page.d.ts

@@ -1,7 +0,0 @@
-import type { FastifyInstance } from 'fastify';
-import { type Context } from '../trpc/router.js';
-import { type SignInWay } from './signal.js';
-export declare function registerAddServerPage(server: FastifyInstance, deps: {
-    contextFor: (cookie: string | undefined) => Context;
-    signIn: SignInWay;
-}): void;

package/dist/adapters/http/add-server-page.js

@@ -1,175 +0,0 @@
-/**
- * Adding an outside MCP server (design B, Signal, screen 7; flow F10), for
- * an actor holding fleet:manage, in three steps: its address and
- * credential, the gateway's check of the tools it answers with, then its
- * owner, when it is approved. The check keeps nothing, so the owner step
- * carries the address and credential on in its form, on a page no cache
- * keeps. Each step calls the gateway's own API as the caller, so the pages
- * check nothing the API does not; they refuse a form sent from another
- * origin.
- */
-import { randomUUID } from 'node:crypto';
-import { idSchema } from '@aeolus-fleet/common';
-import { TRPCError } from '@trpc/server';
-import { getHTTPStatusCodeFromError } from '@trpc/server/http';
-import { z } from 'zod';
-import { gatewayRouter } from '../trpc/router.js';
-import { acceptForms, escaped, isSameOrigin } from './html.js';
-import { icon, ring, signalPage, signInPrompt, statusBadge } from './signal.js';
-const HTTP_FORBIDDEN = 403;
-const HTTP_SEE_OTHER = 303;
-const HTTP_INTERNAL_ERROR = 500;
-const LIST = '/outside-parties';
-const PAGE = `${LIST}/add`;
-const TITLE = 'Add MCP server';
-const CONCURRENCY_LIMIT_DEFAULT = 4;
-const formSchema = z.record(z.string(), z.string());
-/** The credential fields a form sends, in the order the address step asks for them. */
-const CREDENTIAL_FIELDS = ['credentialKind', 'token', 'clientId', 'clientSecret', 'issuer', 'scope'];
-/** The steps of adding a server, as the design numbers them. */
-const STEPS = ['Address', 'Check', 'Owner'];
-function field(form, name) {
-    return form[name] ?? '';
-}
-function steps(current) {
-    const at = STEPS.indexOf(current);
-    const items = STEPS.map((step, index) => `<li class="${index <= at ? 'done' : ''}"${index === at ? ' aria-current="step"' : ''}>${String(index + 1)} ${step}</li>`).join('');
-    return `<ol class="steps">${items}</ol>`;
-}
-function head(current) {
-    return `<a class="back" href="${LIST}">${icon('arrowLeft', 14)}Outside parties</a><div class="lead"><h1>${TITLE}</h1></div>${steps(current)}`;
-}
-function alert(message) {
-    return message === undefined ? '' : `<section class="card alert tone-attention" role="alert"><p>${escaped(message)}</p></section>`;
-}
-function credentialOf(form) {
-    if (field(form, 'credentialKind') === 'clientCredentials') {
-        const scope = field(form, 'scope');
-        return { kind: 'clientCredentials', clientId: field(form, 'clientId'), clientSecret: field(form, 'clientSecret'), issuer: field(form, 'issuer'), ...(scope === '' ? {} : { scope }) };
-    }
-    return { kind: 'bearer', token: field(form, 'token') };
-}
-function addressBody(form, refusal) {
-    const isClient = field(form, 'credentialKind') === 'clientCredentials';
-    return `${head('Address')}${alert(refusal)}<section class="card"><form method="post" action="${PAGE}/check" style="display:grid;gap:12px">
-<label class="field"><span>Streamable HTTP address</span><input type="url" name="url" value="${escaped(field(form, 'url'))}" placeholder="https://mcp.example.com/mcp" required></label>
-<fieldset><legend>The server's credential</legend>
-<label class="field"><span>Credential</span><select name="credentialKind"><option value="bearer">Bearer token</option><option value="clientCredentials"${isClient ? ' selected' : ''}>OAuth client credentials</option></select></label>
-<label class="field"><span>Bearer token</span><input type="password" name="token"></label>
-<label class="field"><span>Client id</span><input type="text" name="clientId" value="${escaped(field(form, 'clientId'))}"></label>
-<label class="field"><span>Client secret</span><input type="password" name="clientSecret"></label>
-<label class="field"><span>Issuer</span><input type="url" name="issuer" value="${escaped(field(form, 'issuer'))}"></label>
-<label class="field"><span>Scope</span><input type="text" name="scope" value="${escaped(field(form, 'scope'))}"></label>
-</fieldset>
-<div class="actions"><button class="primary">${icon('check', 14)}Check the server</button></div></form></section>`;
-}
-/** A proxy ship's name offered from the server's address: its host's first name that says whose it is. */
-function suggestedName(url) {
-    try {
-        const labels = new URL(url).hostname.split('.').filter((label) => label !== 'mcp' && label !== 'www');
-        return (labels[0] ?? '').toLowerCase().replaceAll(/[^a-z0-9]+/g, '-').replaceAll(/^-+|-+$/g, '');
-    }
-    catch {
-        return '';
-    }
-}
-/** The address and credential, carried on in the owner step's form. */
-function carried(form) {
-    return ['url', ...CREDENTIAL_FIELDS].map((name) => `<input type="hidden" name="${name}" value="${escaped(field(form, name))}">`).join('');
-}
-function toolsCard(tools) {
-    const count = tools.length;
-    const rows = tools.map((tool) => `<li><span class="mono">${escaped(tool.name)}</span>${tool.description === undefined ? '' : `<span class="muted">${escaped(tool.description)}</span>`}</li>`).join('');
-    return `<section class="card" style="justify-items:center;text-align:center">${ring({ tone: 'ok', center: { count }, label: `${String(count)} ${count === 1 ? 'tool' : 'tools'}` })}${statusBadge({ tone: 'ok', icon: 'check', label: 'Server answers' })}<ul class="tool-rows">${rows}</ul></section>`;
-}
-function ownerBody(form, shown) {
-    const requestId = field(form, 'requestId') === '' ? randomUUID() : field(form, 'requestId');
-    const name = field(form, 'name') === '' ? suggestedName(field(form, 'url')) : field(form, 'name');
-    const limit = field(form, 'concurrencyLimit') === '' ? String(CONCURRENCY_LIMIT_DEFAULT) : field(form, 'concurrencyLimit');
-    return `${head(shown.tools === undefined ? 'Owner' : 'Check')}${alert(shown.refusal)}${shown.tools === undefined ? '' : toolsCard(shown.tools)}<section class="card"><h2>Its owner</h2>
-<form method="post" action="${PAGE}" style="display:grid;gap:12px"><input type="hidden" name="requestId" value="${escaped(requestId)}">${carried(form)}
-<p class="muted mono">${escaped(field(form, 'url'))}</p>
-<label class="field"><span>Proxy ship's name</span><input type="text" name="name" value="${escaped(name)}" required></label>
-<label class="field"><span>Owner</span><input type="text" name="ownerShipId" value="${escaped(field(form, 'ownerShipId'))}" placeholder="shp_..." required><span class="muted">A person ship. It answers for this server.</span></label>
-<label class="field"><span>Calls at once</span><input type="number" name="concurrencyLimit" min="1" max="10" value="${escaped(limit)}"></label>
-<div class="actions"><button class="primary">${icon('check', 14)}Add ${escaped(name === '' ? 'server' : name)}</button><a class="button" href="${PAGE}">Back to the address</a></div></form></section>`;
-}
-function html(reply, page) {
-    return reply
-        .code(page.status)
-        .type('text/html; charset=utf-8')
-        .header('cache-control', 'no-store')
-        .send(signalPage({ title: TITLE, tab: 'outsideParties', body: page.body, isSignedIn: page.isSignedIn }));
-}
-export function registerAddServerPage(server, deps) {
-    acceptForms(server);
-    /** Renders a step as the caller; a refusal shows the step it came from again, with why, or asks to sign in. */
-    const answer = async (exchange, step) => {
-        const { request, reply } = exchange;
-        const context = deps.contextFor(request.headers.cookie);
-        const actor = await context.authenticateActor({ cookie: context.cookie, crewToken: context.crewToken });
-        const isSignedIn = actor.isOk && actor.value.kind === 'account';
-        try {
-            if (!actor.isOk) {
-                throw new TRPCError({ code: 'UNAUTHORIZED', message: actor.error.message });
-            }
-            return await step.render(gatewayRouter.createCaller(context));
-        }
-        catch (error) {
-            if (!(error instanceof TRPCError)) {
-                throw error;
-            }
-            if (error.code === 'UNAUTHORIZED') {
-                return reply.code(getHTTPStatusCodeFromError(error)).type('text/html; charset=utf-8').send(signalPage({ title: TITLE, body: signInPrompt({ message: error.message, way: deps.signIn, returnTo: PAGE }) }));
-            }
-            const isInternal = error.code === 'INTERNAL_SERVER_ERROR';
-            return html(reply, { status: isInternal ? HTTP_INTERNAL_ERROR : getHTTPStatusCodeFromError(error), body: step.refused(isInternal ? 'Internal error' : error.message), isSignedIn });
-        }
-    };
-    const formOf = (request) => {
-        const form = formSchema.safeParse(request.body);
-        return form.success ? form.data : {};
-    };
-    server.get(PAGE, (request, reply) => answer({ request, reply }, {
-        render: () => html(reply, { status: 200, body: addressBody({}), isSignedIn: true }),
-        refused: (message) => addressBody({}, message),
-    }));
-    server.post(`${PAGE}/check`, (request, reply) => {
-        if (!isSameOrigin(request)) {
-            return reply.code(HTTP_FORBIDDEN).type('text/plain; charset=utf-8').send('A form for this page is sent only from this page.');
-        }
-        const form = formOf(request);
-        return answer({ request, reply }, {
-            render: async (caller) => {
-                const { tools } = await caller.parties.check({ url: field(form, 'url'), credential: credentialOf(form) });
-                return html(reply, { status: 200, body: ownerBody(form, { tools }), isSignedIn: true });
-            },
-            refused: (message) => addressBody(form, message),
-        });
-    });
-    server.post(PAGE, (request, reply) => {
-        if (!isSameOrigin(request)) {
-            return reply.code(HTTP_FORBIDDEN).type('text/plain; charset=utf-8').send('A form for this page is sent only from this page.');
-        }
-        const form = formOf(request);
-        return answer({ request, reply }, {
-            render: async (caller) => {
-                const ownerShipId = idSchema('ship').safeParse(field(form, 'ownerShipId').trim());
-                if (!ownerShipId.success) {
-                    throw new TRPCError({ code: 'BAD_REQUEST', message: "The owner's ship id is not a ship id (shp_...)" });
-                }
-                const approved = await caller.parties.approve({
-                    requestId: field(form, 'requestId'),
-                    name: field(form, 'name'),
-                    url: field(form, 'url'),
-                    credential: credentialOf(form),
-                    ownerShipId: ownerShipId.data,
-                    concurrencyLimit: Number(field(form, 'concurrencyLimit')),
-                });
-                return reply.code(HTTP_SEE_OTHER).header('location', `${LIST}/${encodeURIComponent(approved.name)}`).send();
-            },
-            refused: (message) => ownerBody(form, { refusal: message }),
-        });
-    });
-}
-//# sourceMappingURL=add-server-page.js.map