@cyberismo/backend 1.1.2 → 1.3.0

package/dist/middleware/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;EAWE;AAIF,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAUvC,MAAM,SAAS,GAA6B;IAC1C,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACxB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IACpB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IACpB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;CACpB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAsB;IAEtB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEpD,IAAI,IAAI,EAAE,CAAC;YACT,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,+DAA+D;YAC/D,4DAA4D;YAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YACvC,IAAI,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;gBACtC,MAAM,WAAW,GAAG,GAAG,MAAM,2CAA2C,CAAC;gBACzE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE;oBAC5C,kBAAkB,EAAE,6BAA6B,WAAW,GAAG;iBAChE,CAAC,CAAC;YACL,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,OAAO,CAAC,CAAU,EAAE,WAAqB;IACvD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,WAAW,CAAC,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,WAAqB,EACrB,UAAuB;IAEvB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE3B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,CAAU;IACvC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,yCAAyC;AAIzC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAU3C,MAAM,SAAS,GAA6B;IAC1C,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACxB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IACpB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IACpB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;CACpB,CAAC;AAEF,gFAAgF;AAChF,SAAS,aAAa,CAAC,IAAc;IACnC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAsB;IAEtB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEtD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;YAChC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACnE,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,+DAA+D;YAC/D,4DAA4D;YAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YACvC,IAAI,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;gBACtC,MAAM,WAAW,GAAG,GAAG,MAAM,2CAA2C,CAAC;gBACzE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE;oBAC5C,kBAAkB,EAAE,6BAA6B,WAAW,GAAG;iBAChE,CAAC,CAAC;YACL,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,IAAc,EAAE,WAAqB;IACjE,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,WAAW,CAAC,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,OAAO,CAAC,CAAU,EAAE,WAAqB;IACvD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,WAAqB,EACrB,UAAuB;IAEvB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE3B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,CAAU;IACvC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;AAC/B,CAAC"}

package/dist/middleware/commandManager.d.ts

@@ -1,32 +1,29 @@
-/**
-    Cyberismo
-    Copyright © Cyberismo Ltd and contributors 2025
-
-    This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License version 3 as published by the Free Software Foundation.
-
-    This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details.
-
-    You should have received a copy of the GNU Affero General Public
-    License along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
 import type { MiddlewareHandler } from 'hono';
-import type { CommandManager } from '@cyberismo/data-handler';
-import type { ProjectRegistry } from '../project-registry.js';
+import type { ActorRef } from '@cyberismo/model';
+import type { ProjectDirectory, Workspace } from '@cyberismo/data-handler';
+import { type UserInfo } from '../types.js';
+import type { ProjectEvents } from '../domain/events/project-events.js';
+import type { EventsByProject } from '../domain/events/events-by-project.js';
 declare module 'hono' {
     interface ContextVariableMap {
-        commands: CommandManager;
+        ws: Workspace;
+        events: ProjectEvents;
         projectPath: string;
-        registry: ProjectRegistry;
+        directory: ProjectDirectory;
+        eventsByProject: EventsByProject;
     }
 }
-export declare const attachCommandManager: (commands: CommandManager) => MiddlewareHandler;
+/** The actor a user acts as. */
+export declare function actorOf(user: UserInfo): ActorRef;
 /**
- * Middleware that resolves the project from the registry and sets the
- * CommandManager on context.
+ * Middleware that opens the authenticated user's handle over the project
+ * and puts it, with the project's events and the directory, on the context.
+ * An unknown project is refused with ProjectNotFoundError (404).
  *
- * @param registry - Project registry to look up projects.
+ * @param directory - Directory the project is opened from.
+ * @param events - Events of the directory's projects.
  * @param fixedPrefix - When provided, used instead of the `:prefix` route
  *   param. This is needed in export/SSG mode where routes are mounted at
  *   concrete paths (e.g. `/api/projects/decision/...`) with no dynamic param.
  */
-export declare const attachProjectRegistry: (registry: ProjectRegistry, fixedPrefix?: string) => MiddlewareHandler;
+export declare const attachProjectDirectory: (directory: ProjectDirectory, events: EventsByProject, fixedPrefix?: string) => MiddlewareHandler;

package/dist/middleware/commandManager.js

@@ -1,52 +1,44 @@
-/**
-    Cyberismo
-    Copyright © Cyberismo Ltd and contributors 2025
-
-    This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License version 3 as published by the Free Software Foundation.
-
-    This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details.
-
-    You should have received a copy of the GNU Affero General Public
-    License along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
+// SPDX-FileCopyrightText: Cyberismo Ltd and contributors
+// SPDX-License-Identifier: AGPL-3.0-only
 import { getCurrentUser } from './auth.js';
-/**
- * Set CommandManager on context and run the next handler as the authenticated user.
- */
-async function runWithCommands(c, commands, next) {
-    const user = getCurrentUser(c);
-    if (!user) {
-        throw new Error('CommandManager expects a user');
-    }
-    c.set('commands', commands);
-    c.set('projectPath', commands.project.basePath);
-    await commands.runAsAuthor({ name: user.name, email: user.email }, () => next());
+import { UserRole } from '../types.js';
+/** The actor a user acts as. */
+export function actorOf(user) {
+    return {
+        kind: user.role === UserRole.Connector ? 'connector' : 'user',
+        id: user.id,
+        name: user.name,
+    };
 }
-// TODO: Remove once MCP is made project-scoped via attachProjectRegistry
-export const attachCommandManager = (commands) => {
-    return (c, next) => runWithCommands(c, commands, next);
-};
 /**
- * Middleware that resolves the project from the registry and sets the
- * CommandManager on context.
+ * Middleware that opens the authenticated user's handle over the project
+ * and puts it, with the project's events and the directory, on the context.
+ * An unknown project is refused with ProjectNotFoundError (404).
  *
- * @param registry - Project registry to look up projects.
+ * @param directory - Directory the project is opened from.
+ * @param events - Events of the directory's projects.
  * @param fixedPrefix - When provided, used instead of the `:prefix` route
  *   param. This is needed in export/SSG mode where routes are mounted at
  *   concrete paths (e.g. `/api/projects/decision/...`) with no dynamic param.
  */
-export const attachProjectRegistry = (registry, fixedPrefix) => {
+export const attachProjectDirectory = (directory, events, fixedPrefix) => {
     return async (c, next) => {
-        c.set('registry', registry);
         const prefix = c.req.param('prefix') ?? fixedPrefix;
         if (!prefix) {
             return c.json({ error: 'Project prefix is required' }, 400);
         }
-        const commands = registry.get(prefix);
-        if (!commands) {
-            return c.json({ error: `Project '${prefix}' not found` }, 404);
+        const user = getCurrentUser(c);
+        if (!user) {
+            throw new Error('A project handle expects a user');
         }
-        return runWithCommands(c, commands, next);
+        const identity = { name: user.name, email: user.email };
+        const ws = await directory.open(prefix, actorOf(user), identity);
+        c.set('directory', directory);
+        c.set('eventsByProject', events);
+        c.set('events', await events.for(prefix));
+        c.set('ws', ws);
+        c.set('projectPath', ws.path);
+        await next();
     };
 };
 //# sourceMappingURL=commandManager.js.map

package/dist/middleware/commandManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"commandManager.js","sourceRoot":"","sources":["../../src/middleware/commandManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;EAUE;AAIF,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAY3C;;GAEG;AACH,KAAK,UAAU,eAAe,CAC5B,CAAU,EACV,QAAwB,EACxB,IAAyB;IAEzB,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC5B,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CACtE,IAAI,EAAE,CACP,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,QAAwB,EACL,EAAE;IACrB,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AACzD,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,QAAyB,EACzB,WAAoB,EACD,EAAE;IACrB,OAAO,KAAK,EAAE,CAAU,EAAE,IAAI,EAAE,EAAE;QAChC,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,MAAM,aAAa,EAAE,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,eAAe,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"commandManager.js","sourceRoot":"","sources":["../../src/middleware/commandManager.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,yCAAyC;AAKzC,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAiB,MAAM,aAAa,CAAC;AAetD,gCAAgC;AAChC,MAAM,UAAU,OAAO,CAAC,IAAc;IACpC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM;QAC7D,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,SAA2B,EAC3B,MAAuB,EACvB,WAAoB,EACD,EAAE;IACrB,OAAO,KAAK,EAAE,CAAU,EAAE,IAAI,EAAE,EAAE;QAChC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QACxD,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;QACjE,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC9B,CAAC,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1C,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAChB,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC,CAAC"}

package/dist/middleware/tree.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: Cyberismo Ltd and contributors
+// SPDX-License-Identifier: AGPL-3.0-only
 /**
  * Injects tree options into the context for each request
  * @param opts Options to inject

package/dist/middleware/tree.js.map

@@ -1 +1 @@
-{"version":3,"file":"tree.js","sourceRoot":"","sources":["../../src/middleware/tree.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,MAAM,cAAc,GAClB,CAAC,IAAkB,EAAE,EAAE,CAAC,KAAK,EAAE,CAAa,EAAE,IAAU,EAAE,EAAE;IAC1D,IAAI,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC;AAEJ,eAAe,cAAc,CAAC"}
+{"version":3,"file":"tree.js","sourceRoot":"","sources":["../../src/middleware/tree.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,yCAAyC;AAKzC;;;;GAIG;AACH,MAAM,cAAc,GAClB,CAAC,IAAkB,EAAE,EAAE,CAAC,KAAK,EAAE,CAAa,EAAE,IAAU,EAAE,EAAE;IAC1D,IAAI,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC;AAEJ,eAAe,cAAc,CAAC"}

package/dist/middleware/zvalidator.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: Cyberismo Ltd and contributors
+// SPDX-License-Identifier: AGPL-3.0-only
 import { zValidator as zv } from '@hono/zod-validator';
 import { z } from 'zod';
 export const zValidator = (target, schema) => zv(target, schema, (result, c) => {

package/dist/middleware/zvalidator.js.map

@@ -1 +1 @@
-{"version":3,"file":"zvalidator.js","sourceRoot":"","sources":["../../src/middleware/zvalidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,IAAI,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAGvD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,UAAU,GAAG,CAIxB,MAAc,EACd,MAAS,EACT,EAAE,CACF,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;IAC/B,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC,CAAC,CAAC"}
+{"version":3,"file":"zvalidator.js","sourceRoot":"","sources":["../../src/middleware/zvalidator.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,yCAAyC;AAEzC,OAAO,EAAE,UAAU,IAAI,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAGvD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,UAAU,GAAG,CAIxB,MAAc,EACd,MAAS,EACT,EAAE,CACF,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;IAC/B,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/overlay.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Which projects, or the whole instance, are read-only.
+ *
+ * Polled on a timer so no request waits for it, and permissive on every
+ * uncertain path: a freeze arriving late beats an outage. Unset
+ * CYBERISMO_OVERLAY_URL means no policy, which is the standalone default.
+ */
+import { z } from 'zod';
+import { type ProjectDirectory } from '@cyberismo/data-handler';
+declare const policySchema: z.ZodCatch<z.ZodObject<{
+    readOnly: z.ZodCatch<z.ZodBoolean>;
+    projects: z.ZodCatch<z.ZodRecord<z.ZodString, z.ZodObject<{
+        readOnly: z.ZodCatch<z.ZodBoolean>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>>;
+export type Policy = z.infer<typeof policySchema>;
+export declare function getPolicy(): Policy;
+export declare function setPolicy(policy: Policy): void;
+export declare function isProjectReadOnly(prefix: string): boolean;
+/** `/api/projects/<prefix>/…` is the only request shape naming a project. */
+export declare function isReadOnly(path: string): boolean;
+export declare function startPolicyPolling(projects?: () => Promise<{
+    prefix: string;
+}[]>): void;
+/**
+ * Hide read-only projects from MCP.
+ *
+ * MCP takes the project as an argument rather than in the path, so the role cap
+ * cannot see which one a call touches. Making a frozen project unresolvable
+ * fails closed, at the cost of hiding it from reads and from administrators too.
+ */
+export declare function writableProjects(directory: ProjectDirectory): ProjectDirectory;
+export {};

package/dist/overlay.js

@@ -0,0 +1,162 @@
+// SPDX-FileCopyrightText: Cyberismo Ltd and contributors
+// SPDX-License-Identifier: AGPL-3.0-only
+/**
+ * Which projects, or the whole instance, are read-only.
+ *
+ * Polled on a timer so no request waits for it, and permissive on every
+ * uncertain path: a freeze arriving late beats an outage. Unset
+ * CYBERISMO_OVERLAY_URL means no policy, which is the standalone default.
+ */
+import { z } from 'zod';
+import { ProjectNotFoundError, } from '@cyberismo/data-handler';
+const POLL_INTERVAL_MS = 10_000;
+const FETCH_TIMEOUT_MS = 2_000;
+const policySchema = z
+    .object({
+    readOnly: z.boolean().catch(false),
+    projects: z
+        .record(z.string(), z.object({ readOnly: z.boolean().catch(false) }))
+        .catch({}),
+})
+    .catch(() => EMPTY);
+const EMPTY = { readOnly: false, projects: {} };
+let current = EMPTY;
+export function getPolicy() {
+    return current;
+}
+export function setPolicy(policy) {
+    current = policy;
+}
+export function isProjectReadOnly(prefix) {
+    return current.readOnly || current.projects[prefix]?.readOnly === true;
+}
+/** `/api/projects/<prefix>/…` is the only request shape naming a project. */
+export function isReadOnly(path) {
+    if (current.readOnly)
+        return true;
+    const match = /^\/api\/projects\/([^/?#]+)/.exec(path);
+    if (!match)
+        return false;
+    let prefix;
+    try {
+        prefix = decodeURIComponent(match[1]);
+    }
+    catch {
+        prefix = match[1];
+    }
+    return isProjectReadOnly(prefix);
+}
+/**
+ * Temporary: the app is the source of truth for which projects exist, so it
+ * tells overlay. That inverts once projects are created in overlay's admin
+ * views, after which overlay reports them and this goes away.
+ */
+async function reportProjects(base, token, projects) {
+    const response = await fetch(`${base.replace(/\/$/, '')}/projects`, {
+        method: 'PUT',
+        headers: {
+            'Content-Type': 'application/json',
+            ...(token ? { 'X-Overlay-Token': token } : {}),
+        },
+        body: JSON.stringify({ projects }),
+        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+    });
+    if (!response.ok) {
+        throw new Error(`responded ${response.status}`);
+    }
+}
+export function startPolicyPolling(projects = async () => []) {
+    const base = process.env.CYBERISMO_OVERLAY_URL;
+    if (!base)
+        return;
+    const token = process.env.CYBERISMO_OVERLAY_TOKEN;
+    const url = `${base.replace(/\/$/, '')}/tenant`;
+    let lastFailure;
+    const poll = async () => {
+        try {
+            const response = await fetch(url, {
+                headers: token ? { 'X-Overlay-Token': token } : {},
+                signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+            });
+            if (!response.ok) {
+                throw new Error(`responded ${response.status}`);
+            }
+            setPolicy(policySchema.parse(await response.json()));
+            if (lastFailure) {
+                console.error(`overlay: ${url} is reachable again`);
+                lastFailure = undefined;
+            }
+        }
+        catch (error) {
+            const reason = error instanceof Error ? error.message : String(error);
+            if (reason !== lastFailure) {
+                lastFailure = reason;
+                console.error(`overlay: ${url} ${reason}, keeping the previous policy`);
+            }
+        }
+    };
+    // Reported every tick from a fresh list, so a project created after start-up
+    // is registered within one interval.
+    let lastReportFailure;
+    const report = async () => {
+        const current = await projects();
+        if (current.length === 0)
+            return;
+        try {
+            await reportProjects(base, token, current);
+            lastReportFailure = undefined;
+        }
+        catch (error) {
+            const reason = error instanceof Error ? error.message : String(error);
+            if (reason !== lastReportFailure) {
+                lastReportFailure = reason;
+                console.error(`overlay: could not report projects, ${reason}`);
+            }
+        }
+    };
+    // setInterval does not wait for the previous run, so skip a tick rather than
+    // letting two overlap.
+    let running = false;
+    const tick = async () => {
+        if (running)
+            return;
+        running = true;
+        try {
+            await poll();
+            await report();
+        }
+        finally {
+            running = false;
+        }
+    };
+    void tick();
+    setInterval(() => void tick(), POLL_INTERVAL_MS).unref();
+}
+/**
+ * Hide read-only projects from MCP.
+ *
+ * MCP takes the project as an argument rather than in the path, so the role cap
+ * cannot see which one a call touches. Making a frozen project unresolvable
+ * fails closed, at the cost of hiding it from reads and from administrators too.
+ */
+export function writableProjects(directory) {
+    return {
+        open: async (prefix, actor, identity) => {
+            if (isProjectReadOnly(prefix)) {
+                throw new ProjectNotFoundError(prefix);
+            }
+            return directory.open(prefix, actor, identity);
+        },
+        list: async () => (await directory.list()).filter((p) => !isProjectReadOnly(p.prefix)),
+        create: (params, actor, identity) => directory.create(params, actor, identity),
+        clone: (url) => directory.clone(url),
+        rename: async (prefix, newPrefix, actor, identity, options) => {
+            if (isProjectReadOnly(prefix)) {
+                throw new ProjectNotFoundError(prefix);
+            }
+            return directory.rename(prefix, newPrefix, actor, identity, options);
+        },
+        replace: (prefix) => directory.replace(prefix),
+    };
+}
+//# sourceMappingURL=overlay.js.map

package/dist/overlay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"overlay.js","sourceRoot":"","sources":["../src/overlay.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,yCAAyC;AAEzC;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,oBAAoB,GAErB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,MAAM,YAAY,GAAG,CAAC;KACnB,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;IAClC,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;SACpE,KAAK,CAAC,EAAE,CAAC;CACb,CAAC;KACD,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;AAItB,MAAM,KAAK,GAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAExD,IAAI,OAAO,GAAW,KAAK,CAAC;AAE5B,MAAM,UAAU,SAAS;IACvB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,OAAO,GAAG,MAAM,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,KAAK,IAAI,CAAC;AACzE,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAC3B,IAAY,EACZ,KAAyB,EACzB,QAA8B;IAE9B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,EAAE;QAClE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;QAClC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;KAC9C,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,WAAgD,KAAK,IAAI,EAAE,CAAC,EAAE;IAE9D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAC/C,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAClD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC;IAEhD,IAAI,WAA+B,CAAC;IAEpC,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;QACtB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAChC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE;gBAClD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;aAC9C,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAClD,CAAC;YACD,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACrD,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,KAAK,CAAC,YAAY,GAAG,qBAAqB,CAAC,CAAC;gBACpD,WAAW,GAAG,SAAS,CAAC;YAC1B,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC3B,WAAW,GAAG,MAAM,CAAC;gBACrB,OAAO,CAAC,KAAK,CAAC,YAAY,GAAG,IAAI,MAAM,+BAA+B,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,6EAA6E;IAC7E,qCAAqC;IACrC,IAAI,iBAAqC,CAAC;IAC1C,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;QACxB,MAAM,OAAO,GAAG,MAAM,QAAQ,EAAE,CAAC;QACjC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACjC,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YAC3C,iBAAiB,GAAG,SAAS,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,IAAI,MAAM,KAAK,iBAAiB,EAAE,CAAC;gBACjC,iBAAiB,GAAG,MAAM,CAAC;gBAC3B,OAAO,CAAC,KAAK,CAAC,uCAAuC,MAAM,EAAE,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,6EAA6E;IAC7E,uBAAuB;IACvB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;QACtB,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;YACb,MAAM,MAAM,EAAE,CAAC;QACjB,CAAC;gBAAS,CAAC;YACT,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,IAAI,EAAE,CAAC;IACZ,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC,KAAK,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAA2B;IAE3B,OAAO;QACL,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YACtC,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAC;YACzC,CAAC;YACD,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,EAAE,KAAK,IAAI,EAAE,CACf,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACtE,MAAM,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAClC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC;QAC3C,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC;QACpC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;YAC5D,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAC;YACzC,CAAC;YACD,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC;KAC/C,CAAC;AACJ,CAAC"}