@fabrika/provider-zerops 0.3.3 → 0.4.0

package/src/installation/generated/platform-proxy-manifest.ts

@@ -4,13 +4,17 @@
 // Regenerate: bun run --filter @fabrika/platform-artifacts gen
 //
 // The installation-independent half of `FABRIKA_PROXY_MANIFEST_JSON`: which apps the platform proxy
-// fronts, at which private upstream, on which public listener, under which gates. The hosts and the
-// browser-facing scheme belong to ONE installation and are supplied at deploy time —
+// fronts, at which private upstream, on which public listener, under which service table. The hosts and
+// the browser-facing scheme belong to ONE installation and are supplied at deploy time —
 // `resolvePlatformProxyManifest` binds them.
 //
-// The gate rules below are `CONTROL_PROXY_GATES` and `OPERATIONS_PROXY_GATES` as of the last
-// regeneration, copied on purpose: a PUBLISHED deploy command may not import the private package that
-// owns them. `gen:check` in CI is what makes the copy a fact rather than a hope.
+// The tables below are the services' own service contracts as of the last regeneration, copied on
+// purpose: a PUBLISHED deploy command may not import the private packages that own them. `gen:check` in
+// CI is what makes the copy a fact rather than a hope.
+//
+// The console's `oauthResource` is its MCP endpoint, copied the same way. A deploy publishes the console's
+// `table` and registers the resource only on an installation that enables MCP authoring, and its
+// `tableWithoutOAuth` otherwise.
 
 import type { PlatformProxyManifestTemplate } from '../proxy-manifest'
 
@@ -21,10 +25,170 @@ export const PLATFORM_PROXY_MANIFEST_TEMPLATE: PlatformProxyManifestTemplate = {
 			service: 'iam',
 			port: 8080,
 			upstream: 'iam:3000',
-			gates: {
-				rules: [
-					{ path: '/*', kind: 'public' },
+			table: {
+				endpoints: [
+					{
+						id: 'health',
+						kind: 'health',
+						method: '*',
+						path: '/healthz',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'jwks',
+						kind: 'protocol',
+						method: '*',
+						path: '/.well-known/jwks.json',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'oauth-metadata',
+						kind: 'protocol',
+						method: '*',
+						path: '/.well-known/oauth-authorization-server',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'oauth',
+						kind: 'protocol',
+						method: '*',
+						path: '/oauth/*',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'auth-root',
+						kind: 'protocol',
+						method: '*',
+						path: '/auth',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'auth',
+						kind: 'protocol',
+						method: '*',
+						path: '/auth/*',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'mint-session',
+						kind: 'protocol',
+						method: '*',
+						path: '/auth/mint/session',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'mint-key',
+						kind: 'protocol',
+						method: '*',
+						path: '/auth/mint/key',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'mint-exchange',
+						kind: 'protocol',
+						method: '*',
+						path: '/auth/mint/exchange',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'mint-delegation',
+						kind: 'protocol',
+						method: '*',
+						path: '/auth/mint/delegation',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'admin-rpc',
+						kind: 'protocol',
+						method: 'POST',
+						path: '/admin/rpc',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'admin-root',
+						kind: 'protocol',
+						method: '*',
+						path: '/admin',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'admin',
+						kind: 'protocol',
+						method: '*',
+						path: '/admin/*',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'membership',
+						kind: 'protocol',
+						method: '*',
+						path: '/membership/*',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'rpc-root',
+						kind: 'protocol',
+						method: '*',
+						path: '/rpc',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'rpc',
+						kind: 'protocol',
+						method: '*',
+						path: '/rpc/*',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
 				],
+				reservedPrefixes: ['/auth/mint', '/rpc'],
 			},
 		},
 		{
@@ -32,28 +196,345 @@ export const PLATFORM_PROXY_MANIFEST_TEMPLATE: PlatformProxyManifestTemplate = {
 			service: 'control',
 			port: 8082,
 			upstream: 'control:3000',
-			gates: {
-				rules: [
-					{ path: '/healthz', kind: 'public' },
-					{ path: '/.well-known/fabrika-builder', kind: 'public' },
-					{ path: '/builder/connect', kind: 'public' },
-					{ path: '/api/health', kind: 'public' },
-					{ path: '/webhooks/github', kind: 'public' },
-					{ path: '/webhooks/github/*', kind: 'public' },
-					{ path: '/iam/admin', kind: 'service' },
-					{ path: '/iam/admin', kind: 'human' },
-					{ path: '/iam/admin/*', kind: 'service' },
-					{ path: '/iam/admin/*', kind: 'human' },
-					{ path: '/operations/api', kind: 'service' },
-					{ path: '/operations/api', kind: 'human' },
-					{ path: '/operations/api/*', kind: 'service' },
-					{ path: '/operations/api/*', kind: 'human' },
-					{ path: '/api/source/github/manifest/*', kind: 'human' },
-					{ path: '/api/source/github/callback', kind: 'human' },
-					{ path: '/api/*', kind: 'service' },
-					{ path: '/api/*', kind: 'human' },
-					{ path: '/*', kind: 'human' },
+			table: {
+				endpoints: [
+					{
+						id: 'health',
+						kind: 'health',
+						method: '*',
+						path: '/healthz',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'api-health',
+						kind: 'health',
+						method: '*',
+						path: '/api/health',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'builder-discovery',
+						kind: 'protocol',
+						method: '*',
+						path: '/.well-known/fabrika-builder',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'builder-connect',
+						kind: 'protocol',
+						method: '*',
+						path: '/builder/connect',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'github-webhook',
+						kind: 'protocol',
+						method: 'POST',
+						path: '/webhooks/github/:connectionId',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'webhooks-root',
+						kind: 'service',
+						method: '*',
+						path: '/webhooks',
+						callers: ['human'],
+						requirement: { kind: 'authenticated' },
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'github-manifest',
+						kind: 'service',
+						method: 'GET',
+						path: '/api/source/github/manifest/:connectionId',
+						callers: ['human'],
+						requirement: { kind: 'authenticated' },
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'github-callback',
+						kind: 'service',
+						method: 'GET',
+						path: '/api/source/github/callback',
+						callers: ['human'],
+						requirement: { kind: 'authenticated' },
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'rpc',
+						kind: 'service',
+						method: 'POST',
+						path: '/api/rpc',
+						callers: ['human', 'machine'],
+						requirement: { kind: 'authenticated' },
+						admission: { contentTypes: ['application/json'], maxBytes: null },
+						oauth: null,
+					},
+					{
+						id: 'api-root',
+						kind: 'service',
+						method: '*',
+						path: '/api',
+						callers: ['human'],
+						requirement: { kind: 'authenticated' },
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'iam-admin-rpc',
+						kind: 'service',
+						method: 'POST',
+						path: '/iam/admin/rpc',
+						callers: ['human', 'machine'],
+						requirement: { kind: 'authenticated' },
+						admission: { contentTypes: ['application/json'], maxBytes: null },
+						oauth: null,
+					},
+					{
+						id: 'iam-admin-root',
+						kind: 'service',
+						method: '*',
+						path: '/iam/admin',
+						callers: ['human', 'machine'],
+						requirement: { kind: 'authenticated' },
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'operations-rpc',
+						kind: 'service',
+						method: 'POST',
+						path: '/operations/api/rpc',
+						callers: ['human', 'machine'],
+						requirement: { kind: 'authenticated' },
+						admission: { contentTypes: ['application/json'], maxBytes: null },
+						oauth: null,
+					},
+					{
+						id: 'operations-api-root',
+						kind: 'service',
+						method: '*',
+						path: '/operations/api',
+						callers: ['human', 'machine'],
+						requirement: { kind: 'authenticated' },
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'console',
+						kind: 'service',
+						method: 'GET',
+						path: '/*',
+						callers: ['human'],
+						requirement: { kind: 'authenticated' },
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'mcp',
+						kind: 'service',
+						method: '*',
+						path: '/mcp',
+						callers: ['oauth'],
+						requirement: { kind: 'authenticated' },
+						admission: null,
+						oauth: { scopes: ['authoring'] },
+					},
+				],
+				reservedPrefixes: ['/api', '/iam/admin', '/operations/api', '/webhooks', '/mcp'],
+			},
+			oauthResource: {
+				path: '/mcp',
+				scopes: ['authoring'],
+				scopeGrants: [
+					{
+						scope: 'authoring',
+						actions: ['source.workspace.read', 'source.workspace.write', 'source.pull-request.create', 'deploy.trigger', 'deploy.read'],
+					},
+				],
+			},
+			tableWithoutOAuth: {
+				endpoints: [
+					{
+						id: 'health',
+						kind: 'health',
+						method: '*',
+						path: '/healthz',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'api-health',
+						kind: 'health',
+						method: '*',
+						path: '/api/health',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'builder-discovery',
+						kind: 'protocol',
+						method: '*',
+						path: '/.well-known/fabrika-builder',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'builder-connect',
+						kind: 'protocol',
+						method: '*',
+						path: '/builder/connect',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'github-webhook',
+						kind: 'protocol',
+						method: 'POST',
+						path: '/webhooks/github/:connectionId',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'webhooks-root',
+						kind: 'service',
+						method: '*',
+						path: '/webhooks',
+						callers: ['human'],
+						requirement: { kind: 'authenticated' },
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'github-manifest',
+						kind: 'service',
+						method: 'GET',
+						path: '/api/source/github/manifest/:connectionId',
+						callers: ['human'],
+						requirement: { kind: 'authenticated' },
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'github-callback',
+						kind: 'service',
+						method: 'GET',
+						path: '/api/source/github/callback',
+						callers: ['human'],
+						requirement: { kind: 'authenticated' },
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'rpc',
+						kind: 'service',
+						method: 'POST',
+						path: '/api/rpc',
+						callers: ['human', 'machine'],
+						requirement: { kind: 'authenticated' },
+						admission: { contentTypes: ['application/json'], maxBytes: null },
+						oauth: null,
+					},
+					{
+						id: 'api-root',
+						kind: 'service',
+						method: '*',
+						path: '/api',
+						callers: ['human'],
+						requirement: { kind: 'authenticated' },
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'iam-admin-rpc',
+						kind: 'service',
+						method: 'POST',
+						path: '/iam/admin/rpc',
+						callers: ['human', 'machine'],
+						requirement: { kind: 'authenticated' },
+						admission: { contentTypes: ['application/json'], maxBytes: null },
+						oauth: null,
+					},
+					{
+						id: 'iam-admin-root',
+						kind: 'service',
+						method: '*',
+						path: '/iam/admin',
+						callers: ['human', 'machine'],
+						requirement: { kind: 'authenticated' },
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'operations-rpc',
+						kind: 'service',
+						method: 'POST',
+						path: '/operations/api/rpc',
+						callers: ['human', 'machine'],
+						requirement: { kind: 'authenticated' },
+						admission: { contentTypes: ['application/json'], maxBytes: null },
+						oauth: null,
+					},
+					{
+						id: 'operations-api-root',
+						kind: 'service',
+						method: '*',
+						path: '/operations/api',
+						callers: ['human', 'machine'],
+						requirement: { kind: 'authenticated' },
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'console',
+						kind: 'service',
+						method: 'GET',
+						path: '/*',
+						callers: ['human'],
+						requirement: { kind: 'authenticated' },
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'mcp',
+						kind: 'service',
+						method: '*',
+						path: '/mcp',
+						callers: ['human'],
+						requirement: { kind: 'authenticated' },
+						admission: null,
+						oauth: null,
+					},
 				],
+				reservedPrefixes: ['/api', '/iam/admin', '/operations/api', '/webhooks', '/mcp'],
 			},
 		},
 		{
@@ -61,11 +542,30 @@ export const PLATFORM_PROXY_MANIFEST_TEMPLATE: PlatformProxyManifestTemplate = {
 			service: 'operations',
 			port: 8083,
 			upstream: 'operations:3000',
-			gates: {
-				rules: [
-					{ path: '/api/*/envelope/', kind: 'public' },
-					{ path: '/api/artifacts/source-maps/', kind: 'public' },
+			table: {
+				endpoints: [
+					{
+						id: 'ingest',
+						kind: 'protocol',
+						method: '*',
+						path: '/api/:projectId/envelope/',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
+					{
+						id: 'source-map-upload',
+						kind: 'protocol',
+						method: '*',
+						path: '/api/artifacts/source-maps/',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
 				],
+				reservedPrefixes: [],
 			},
 		},
 	],

package/src/installation/index.ts

@@ -28,13 +28,17 @@ import { parsePlatformUpgradeArgs, UPGRADE_DRY_RUN_FLAG } from './upgrade-option
 export { PLATFORM_CONCURRENT_DEPLOY, PLATFORM_DEPLOY_ORDER, PLATFORM_PROXY_SERVICE, PLATFORM_SEQUENTIAL_DEPLOY } from './deploy'
 export { PLATFORM_CONSOLE_APP_SCHEMA } from './generated/platform-console-schema'
 export { PLATFORM_PROXY_MANIFEST_TEMPLATE } from './generated/platform-proxy-manifest'
+export { type IamOAuthConfig, type McpClient, parseMcpClientsJson, platformIamOAuthConfig } from './mcp'
 export {
+	type PlatformOAuthResourceTemplate,
 	type PlatformProxyApp,
 	platformProxyAppFor,
 	type PlatformProxyComposition,
+	type PlatformProxyManifest,
 	type PlatformProxyManifestTemplate,
 	type PlatformProxyPlacement,
 	type PlatformProxyService,
+	platformServiceTableDigest,
 	resolvePlatformProxyManifest,
 } from './proxy-manifest'
 
@@ -201,6 +205,7 @@ Options (a flag beats the environment variable beside it):
   --operations-host=<host>          FABRIKA_PLATFORM_OPERATIONS_HOST
   --scheme=<http|https>             FABRIKA_PLATFORM_SCHEME         default https
   --source-dir=<checkout>           required                       clean full checkout running this CLI
+  --mcp-clients=<json>              FABRIKA_PLATFORM_MCP_CLIENTS_JSON  MCP authoring clients; unset = off
   --dry-run                                                         read everything, change nothing
 
 Naming NO host derives all three from the proxy service's Zerops subdomains and makes this a
@@ -208,6 +213,12 @@ Naming NO host derives all three from the proxy service's Zerops subdomains and
 \`custom-domain\` installation: the domains are bound to the project balancer out of band and no
 subdomain is published.
 
+MCP authoring (ADR-0049) is opt-in. --mcp-clients takes a JSON array of the MCP clients this
+installation trusts: [{"provider":"claude"|"chatgpt","clientId":"<https CIMD URL>","redirectUris":[...],
+"metadataUrl":"<https URL>"?}]. With it, the console's /mcp admits OAuth bearers and IAM gets
+FABRIKA_IAM_OAUTH_CONFIG. Without it, /mcp admits only a signed-in person and FABRIKA_IAM_OAUTH_CONFIG on
+iam is left as it is.
+
 Credentials are read from the ENVIRONMENT ONLY and have no flag, so they cannot reach a CI log or a
 process listing:
 

package/src/installation/install-environment.ts

@@ -75,8 +75,7 @@ export const installationServiceEnv = (input: InstallationEnvInput): ReadonlyMap
 	const control = new Map([
 		['FABRIKA_CONTROL_DATABASE_URL', POSTGRES_URL],
 		['ENVIRONMENT', input.environment],
-		// A bare HOST, not an origin: `controlPublicOrigin` accepts either, and this is also what the
-		// same-origin check on both first-party gateways is decided against.
+		// A bare HOST, not an origin: `controlPublicOrigin` accepts either.
 		['FABRIKA_CONTROL_DOMAIN', input.hosts.control],
 		['FABRIKA_IAM_ISSUER', iamOrigin],
 		['OPERATIONS_ARTIFACT_ORIGIN', operationsOrigin],

package/src/installation/machine-key.ts

@@ -11,8 +11,7 @@
 // The acceptance is a fresh shell holding nothing: paste the block, supply the two keys, mint a key on
 // the first try. So the origin is an `export` — a bare `NAME=value` sets a shell variable the child
 // process never sees — and EVERY other line is a `#` comment. The command line is commented too, and
-// that is not timidity: `--label=<name>` is a shell redirection, and `[--expires-in=<seconds>]` ends in
-// a `>` that would create a file called `]` in whatever directory the operator pasted into.
+// that is not timidity: `--label=<name>` is a shell redirection, and so is every other `<…>` placeholder.
 //
 // HARD RULE: no function here takes a key. The block is composed from an ORIGIN and variable NAMES,
 // so a caller that is holding the real values (both verbs are) cannot leak one through it.
@@ -28,8 +27,8 @@ export interface MachineKeyNextStep {
 /** The boxed hand-off's title. Exported so a test names it once. */
 export const MACHINE_KEY_NEXT_STEP_TITLE = 'NEXT — mint a machine key for `fabrika control`'
 
-/** The command the block leads to, with the two flags `key issue` requires. */
-export const MACHINE_KEY_ISSUE_COMMAND = 'fabrika control key issue --label=<name> --permissions=<a,b,c> [--expires-in=<seconds>]'
+/** The command the block leads to, with the three flags `key issue` requires. */
+export const MACHINE_KEY_ISSUE_COMMAND = 'fabrika control key issue --label=<name> --permissions=<a,b,c> --expires-in=<seconds>'
 
 const WIDEST_NAME = 'FABRIKA_IAM_PROVISIONING_KEY'.length + 1
 

package/src/installation/manifest.ts

@@ -5,7 +5,7 @@
 // On the `light` tier an application shares the platform's project and therefore the platform proxy's
 // single `FABRIKA_PROXY_MANIFEST_JSON`. The live document on `fabrika-test` carries a fourth app —
 // `notes` → `notesapi:3000` on listener 8084 — beside the three platform ones. `platformProxyManifest`
-// deliberately emits only the platform apps (it is generated from the platform's own gate modules and
+// deliberately emits only the platform apps (it is generated from the platform's own service contracts and
 // knows nothing about applications), so writing it alone would DELETE every application entry and take
 // the deployed applications offline at the next proxy build.
 //