@k2b/cloud 0.42.0 → 0.44.0

package/src/app-pwa/transaction.ts

@@ -0,0 +1,338 @@
+import { isPromise } from "node:util/types";
+import type { ReservedSQL, SQL, TransactionSQL } from "bun";
+import * as bun from "bun";
+import { REQUEST_IDLE_TIMEOUT_SECONDS } from "../server/request-timeout";
+import { boundTransaction } from "./authority";
+import { AppPwaError } from "./contracts";
+
+const requestBudget = REQUEST_IDLE_TIMEOUT_SECONDS * 1000;
+
+/** Bun exposes normalized options: timeout values are milliseconds and PostgreSQL
+ * startup parameters are NUL-separated in `query`. Reconstitute constructor input
+ * without losing role, routing or TLS settings. Never log these credential-bearing options.
+ */
+const cancellationPool = (db: SQL) => {
+  const options = db.options;
+  const query: unknown = Reflect.get(options, "query");
+  const sslMode: unknown = Reflect.get(options, "sslMode");
+  const modes = ["disable", "prefer", "require", "verify-ca", "verify-full"];
+  if (options.adapter !== "postgres" || typeof query !== "string" || typeof sslMode !== "number" || !modes[sslMode])
+    throw new AppPwaError("UNAVAILABLE", 503);
+  const parts = query.split("\0");
+  const connection: Record<string, string | number> = {};
+  for (let index = 0; index + 1 < parts.length; index += 2) connection[parts[index]!] = parts[index + 1]!;
+  connection.statement_timeout = requestBudget;
+  return new bun.SQL(`postgres://localhost?sslmode=${modes[sslMode]}`, {
+    ...options,
+    // Bun adds SNI to normalized prefer options. Passing that generated object
+    // back as explicit TLS upgrades prefer to require. Recreate its default SNI
+    // from hostname instead; explicit verification options remain unchanged.
+    tls: sslMode === 1 ? undefined : options.tls,
+    connection,
+    max: 1,
+    connectionTimeout: REQUEST_IDLE_TIMEOUT_SECONDS,
+    idleTimeout: REQUEST_IDLE_TIMEOUT_SECONDS,
+    maxLifetime: REQUEST_IDLE_TIMEOUT_SECONDS,
+    onconnect: undefined,
+    onclose: undefined,
+  });
+};
+
+/** Close application SQL independently of the platform's transaction lifecycle.
+ * Queries are lazy in Bun: guard execution as well as query construction, and
+ * settle started queries before the connection can be committed or reused.
+ */
+export const withAppPwaTransactionLease = async <T>(
+  connection: SQL,
+  signal: AbortSignal,
+  work: (tx: TransactionSQL) => Promise<T>,
+  beforeQuery: () => Promise<void> = async () => {},
+): Promise<T> => {
+  let open = true;
+  let sequence = 0;
+  let queue = Promise.resolve();
+  const queries = new Set<{ cancel(): void; pending?: Promise<unknown> }>();
+  const guardedQueries = new WeakMap<object, object>();
+  const check = () => {
+    if (!open || signal.aborted) throw new AppPwaError("UNAVAILABLE", 503);
+  };
+  const guardResult = (result: unknown, recovery = false): unknown => {
+    if (typeof result !== "object" || result === null || !("cancel" in result) || typeof result.cancel !== "function") return result;
+    const existing = guardedQueries.get(result);
+    if (existing) return existing;
+    // ReservedSQL.close rejects even never-started Query promises. Observe the
+    // native promise without invoking Query.then(), which would execute lazy SQL.
+    if (isPromise(result)) void Promise.prototype.then.call(result, undefined, () => {});
+    const cancel = result.cancel;
+    const query: { cancel(): void; pending?: Promise<unknown> } = { cancel: () => Reflect.apply(cancel, result, []) };
+    queries.add(query);
+    const start = (): Promise<unknown> => {
+      check();
+      if (!query.pending) {
+        query.pending = queue.then(async () => {
+          check();
+          // An aborted savepoint rejects ordinary SQL (including set_config).
+          // ROLLBACK TO must reach PostgreSQL before configuration can resume.
+          if (!recovery) await beforeQuery();
+          check();
+          // Assimilate the original Bun query only after setting its remaining budget.
+          return await result;
+        });
+        queue = query.pending.then(
+          () => {},
+          () => {},
+        );
+        void query.pending.then(
+          () => queries.delete(query),
+          () => queries.delete(query),
+        );
+      }
+      return query.pending;
+    };
+    const guarded = new Proxy(result, {
+      get(target, property) {
+        check();
+        if (property === "then") return (yes: (value: unknown) => unknown, no: (error: unknown) => unknown) => start().then(yes, no);
+        if (property === "catch") return (no: (error: unknown) => unknown) => start().catch(no);
+        if (property === "finally") return (done: () => void) => start().finally(done);
+        if (property === "execute")
+          return () => {
+            void start();
+            return guarded;
+          };
+        const value: unknown = Reflect.get(target, property, target);
+        if (typeof value !== "function") return value;
+        return (...args: unknown[]) => {
+          check();
+          return guardResult(Reflect.apply(value, target, args));
+        };
+      },
+    });
+    guardedQueries.set(result, guarded);
+    return guarded;
+  };
+  function savepoint<T>(nameOrWork: string | SQL.SavepointContextCallback<T>, callback?: SQL.SavepointContextCallback<T>): Promise<T>;
+  async function savepoint(
+    nameOrWork: string | SQL.SavepointContextCallback<unknown>,
+    callback?: SQL.SavepointContextCallback<unknown>,
+  ): Promise<unknown> {
+    check();
+    const callbackWork = typeof nameOrWork === "function" ? nameOrWork : callback;
+    if (!callbackWork) throw new TypeError("A savepoint needs a callback");
+    // Only generated identifiers enter SQL; the optional name is diagnostic in Bun.
+    const name = `app_pwa_${sequence++}`;
+    await tx.unsafe(`SAVEPOINT ${name}`);
+    try {
+      const result = await callbackWork(tx);
+      // Bun starts lazy query arrays returned by a transaction callback. Settle
+      // them before releasing the savepoint, including its rollback on failure.
+      const settled = Array.isArray(result) ? await Promise.all(result) : result;
+      await tx.unsafe(`RELEASE SAVEPOINT ${name}`);
+      return settled;
+    } catch (error) {
+      // A late callback must never roll back a later user's transaction.
+      check();
+      await guardResult(connection.unsafe(`ROLLBACK TO SAVEPOINT ${name}`), true);
+      await tx.unsafe(`RELEASE SAVEPOINT ${name}`);
+      throw error;
+    }
+  }
+  const tx: TransactionSQL = new Proxy(Object.assign(connection, { savepoint }), {
+    apply(target, receiver, args) {
+      check();
+      return guardResult(Reflect.apply(target, receiver, args));
+    },
+    get(target, property) {
+      check();
+      if (property === "file")
+        return async (path: string, args?: unknown[]) => {
+          const text = await Bun.file(path).text();
+          check();
+          return await tx.unsafe(text, args);
+        };
+      const value: unknown = Reflect.get(target, property, target);
+      if (typeof value !== "function") return value;
+      if (!["unsafe", "array", "savepoint"].includes(String(property)))
+        return () => {
+          throw new AppPwaError("FORBIDDEN", 403);
+        };
+      return (...args: unknown[]) => {
+        check();
+        return guardResult(Reflect.apply(value, target, args));
+      };
+    },
+  });
+  const close = () => {
+    if (!open) return;
+    open = false;
+    for (const query of queries) {
+      try {
+        query.cancel();
+      } catch {
+        /* Transaction recovery owns a failed cancellation. */
+      }
+    }
+  };
+  let abort = () => {};
+  const cancelled = new Promise<never>((_resolve, reject) => {
+    abort = () => {
+      close();
+      reject(new AppPwaError("UNAVAILABLE", 503));
+    };
+    signal.addEventListener("abort", abort, { once: true });
+  });
+  try {
+    check();
+    return await Promise.race([work(tx), cancelled]);
+  } finally {
+    close();
+    await Promise.allSettled([...queries].flatMap((query) => (query.pending ? [query.pending] : [])));
+    signal.removeEventListener("abort", abort);
+  }
+};
+
+/** Own BEGIN through COMMIT/rollback, including server-side cancellation.
+ * Reservation cancellation alone stops having an effect once reserve resolves.
+ */
+export const withAppPwaTransaction = async <T>(
+  db: SQL,
+  signal: AbortSignal | undefined,
+  work: (tx: TransactionSQL, signal: AbortSignal) => Promise<T>,
+  authorityDeadline: (time: Date) => Date | undefined = () => undefined,
+): Promise<T> => {
+  const requestEnd = performance.now() + requestBudget;
+  const expiry = new AbortController();
+  const requestSignal = AbortSignal.any([...(signal ? [signal] : []), AbortSignal.timeout(requestBudget), expiry.signal]);
+  const connection = await db.reserve({ signal: requestSignal });
+  let authorityEnd = Infinity;
+  let expiryTimer: ReturnType<typeof setTimeout> | undefined;
+  let recoveryTimer: ReturnType<typeof setTimeout> | undefined;
+  let closing: Promise<void> | undefined;
+  let recovering = false;
+  let backend: { pid: number; started: string } | undefined;
+  let cancellation: Promise<void> | undefined;
+  let control: ReservedSQL | undefined;
+  const failure = () =>
+    expiry.signal.aborted || (authorityEnd <= requestEnd && performance.now() >= authorityEnd)
+      ? new AppPwaError("EXPIRED", 410)
+      : new AppPwaError("UNAVAILABLE", 503);
+  const check = () => {
+    if (requestSignal.aborted || performance.now() >= Math.min(requestEnd, authorityEnd)) throw failure();
+  };
+  const closeConnection = () => {
+    closing ??= connection.close({ timeout: 0 });
+  };
+  const startRecoveryTimer = () => {
+    recoveryTimer ??= setTimeout(() => {
+      closeConnection();
+      void control?.close({ timeout: 0 });
+    }, requestBudget);
+  };
+  const cancelBackend = async () => {
+    let pool: SQL | undefined;
+    try {
+      if (!backend) return closeConnection();
+      pool = cancellationPool(db);
+      // A separate max:1 pool cannot deadlock behind the reserved application pool.
+      control = await pool.reserve({ signal: AbortSignal.timeout(requestBudget) });
+      if (closing) return;
+      // pg_cancel_backend permits the authenticated owner's role. A startup SET
+      // ROLE may have narrowed current_user, so restore this connection's login.
+      await control`RESET ROLE`;
+      if (closing) return;
+      const [row] = await control<{ cancelled: boolean }[]>`SELECT pg_cancel_backend(pid) AS cancelled
+        FROM pg_stat_activity WHERE pid=${backend.pid} AND extract(epoch FROM backend_start)::text=${backend.started}
+          AND datname=current_database() AND usename=session_user`;
+      if (!row?.cancelled) closeConnection();
+    } catch {
+      // Unreachable control connection or denied cancellation: discard, never reuse.
+      closeConnection();
+    } finally {
+      await control?.close({ timeout: 0 });
+      // Pool close(timeout:0) is graceful in this Bun; a positive bound is required.
+      await pool?.close({ timeout: REQUEST_IDLE_TIMEOUT_SECONDS });
+    }
+  };
+  const abort = () => {
+    startRecoveryTimer();
+    // Query.cancel() does not send PostgreSQL cancellation on Bun 744846f84.
+    // Keep this reservation until the independent cancellation has settled.
+    if (!recovering) cancellation ??= cancelBackend().catch(closeConnection);
+  };
+  requestSignal.addEventListener("abort", abort, { once: true });
+  const run = async <R>(query: SQL.Query<R>): Promise<R> => {
+    if (!recovering) check();
+    return await query;
+  };
+  const configure = async () => {
+    check();
+    // PostgreSQL interprets zero as unlimited. Never round a remaining budget up.
+    const remaining = Math.floor(Math.min(requestEnd, authorityEnd) - performance.now());
+    if (remaining < 1) throw failure();
+    await run(boundTransaction(connection, remaining));
+    check();
+  };
+  const checkAuthority = async () => {
+    await configure();
+    const started = performance.now();
+    const [row] = await run(connection<{ time: Date }[]>`SELECT clock_timestamp() AS time`);
+    if (!row) throw new AppPwaError("UNAVAILABLE", 503);
+    const time = row.time;
+    const deadline = authorityDeadline(time);
+    if (deadline) {
+      // Bun Date values truncate PostgreSQL's submillisecond clock precision.
+      // Discount that precision as well as the clock query's round trip.
+      authorityEnd = Math.min(authorityEnd, started + deadline.getTime() - time.getTime() - 1);
+      clearTimeout(expiryTimer);
+      expiryTimer = setTimeout(() => expiry.abort(), Math.max(0, authorityEnd - performance.now()));
+    }
+    check();
+  };
+  try {
+    check();
+    [backend] = await run(connection<{ pid: number; started: string }[]>`SELECT pg_backend_pid() AS pid,
+      extract(epoch FROM backend_start)::text AS started FROM pg_stat_activity WHERE pid=pg_backend_pid()`);
+    if (!backend || !Number.isSafeInteger(backend.pid) || backend.pid <= 0 || !backend.started) throw failure();
+    await run(connection`BEGIN`);
+    const result = await withAppPwaTransactionLease(connection, requestSignal, (tx) => work(tx, requestSignal), configure);
+    await checkAuthority();
+    await configure();
+    await run(connection`SET CONSTRAINTS ALL IMMEDIATE`);
+    // All application callbacks and deferred constraint work precede this fresh clock.
+    await checkAuthority();
+    await configure();
+    await run(connection`COMMIT`);
+    // COMMIT may already be durable when an abort arrives. A known success stays
+    // successful; a lost acknowledgement is reconciled through the stored attempt.
+    return result;
+  } catch (error) {
+    recovering = true;
+    startRecoveryTimer();
+    // A late cancel must not interrupt rollback or a later transaction.
+    await cancellation;
+    try {
+      await run(connection`ROLLBACK`);
+    } catch {
+      closeConnection();
+    }
+    if (requestSignal.aborted || performance.now() >= Math.min(requestEnd, authorityEnd)) throw failure();
+    throw error;
+  } finally {
+    // Never return a connection while COMMIT, cancellation or recovery is pending.
+    // SQL has settled. Stop accepting new cancellation before snapshotting its
+    // promise: an abort during `await undefined` must not escape cleanup.
+    requestSignal.removeEventListener("abort", abort);
+    clearTimeout(expiryTimer);
+    try {
+      await cancellation;
+      if (requestSignal.aborted) closeConnection();
+      if (closing) await closing;
+    } finally {
+      clearTimeout(recoveryTimer);
+      // ReservedSQL.close resolves before its socket-close callback. That
+      // callback releases the reservation after marking the pool slot closed;
+      // explicitly releasing earlier could hand out a closing connection.
+      if (!closing) connection.release();
+    }
+  }
+};

package/src/app-pwa/transport-input.ts

@@ -0,0 +1,57 @@
+import { AppPwaError, pwaFail } from "./contracts";
+
+/** Shared by body reads and the whole transport: stalled cancellation hooks never hold the response open. */
+export const untilAppPwaAbort = async <T>(signal: AbortSignal, work: () => Promise<T>): Promise<T> => {
+  let abort = () => {};
+  const stopped = new Promise<never>((_resolve, reject) => {
+    abort = () => reject(new AppPwaError("UNAVAILABLE", 503));
+    signal.addEventListener("abort", abort, { once: true });
+  });
+  try {
+    if (signal.aborted) return pwaFail("UNAVAILABLE", 503);
+    return await Promise.race([work(), stopped]);
+  } finally {
+    signal.removeEventListener("abort", abort);
+  }
+};
+
+export const readAppPwaJson = async (request: Request, maxBytes: number, signal: AbortSignal): Promise<unknown> => {
+  const reader = request.body?.getReader();
+  if (!reader) return pwaFail("INVALID_INPUT", 400);
+  let finished = false;
+  try {
+    return await untilAppPwaAbort(signal, async () => {
+      const declared = request.headers.get("content-length");
+      if (declared !== null && (!/^\d+$/.test(declared) || !Number.isSafeInteger(Number(declared)))) pwaFail("INVALID_INPUT", 400);
+      if (declared !== null && Number(declared) > maxBytes) pwaFail("TOO_LARGE", 413);
+      const chunks: Uint8Array[] = [];
+      let total = 0;
+      while (true) {
+        const next = await reader.read();
+        if (signal.aborted) pwaFail("UNAVAILABLE", 503);
+        if (next.done) break;
+        total += next.value.byteLength;
+        if (total > maxBytes) pwaFail("TOO_LARGE", 413);
+        chunks.push(next.value);
+      }
+      finished = true;
+      const bytes = new Uint8Array(total);
+      let offset = 0;
+      for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+      }
+      try {
+        return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+      } catch {
+        return pwaFail("INVALID_INPUT", 400);
+      }
+    });
+  } catch (error) {
+    if (error instanceof AppPwaError) throw error;
+    return pwaFail("INVALID_INPUT", 400);
+  } finally {
+    if (!finished) void reader.cancel().catch(() => undefined);
+    reader.releaseLock();
+  }
+};

package/src/app-pwa/transport.ts

@@ -0,0 +1,235 @@
+import { type Context, Hono } from "hono";
+import { setCookie } from "hono/cookie";
+import { z } from "zod";
+import { resolveLocale } from "../server/locale";
+import type { AuthContext } from "../server/middleware/auth";
+import { rateLimit } from "../server/middleware/rate-limit";
+import { REQUEST_IDLE_TIMEOUT_SECONDS } from "../server/request-timeout";
+import { pairingSecret } from "../services/pairing-secret";
+import { session } from "../services/session";
+import { get as getSetting } from "../services/settings";
+import {
+  AppPwaAttempt,
+  AppPwaClaim,
+  AppPwaError,
+  AppPwaId,
+  type AppPwaOptions,
+  AppPwaSecret,
+  type AppPwaWebSignIn,
+  parseAppPwaInput as parse,
+  pwaFail,
+} from "./contracts";
+import { AppPwaCoreQueryError } from "./core-query-error";
+import { type AppPwaService, createAppPwaService } from "./service";
+import { readAppPwaJson, untilAppPwaAbort } from "./transport-input";
+
+/** Cookie paths are not trustworthy in the Cookie header. Reject all ambiguous same-name credentials. */
+export const appPwaCookie = (header: string | null, name: string): string | undefined => {
+  const entries = (header ?? "")
+    .split(";")
+    .map((value) => value.trim())
+    .filter((value) => value.split("=", 1)[0]?.trim() === name);
+  if (entries.length > 1) return pwaFail("DUPLICATE_COOKIE", 400);
+  const entry = entries[0];
+  if (!entry) return undefined;
+  const value = entry.slice(entry.indexOf("=") + 1);
+  if (!value || entry.indexOf("=") < 0) return pwaFail("BROWSER_REQUIRED", 401);
+  return value;
+};
+
+/** Only this surface's browser credential is considered; employee cookies/bearers are irrelevant. */
+export const appPwaCredential = (headers: Headers, service: Pick<AppPwaService, "cookieName" | "csrf">): string => {
+  const cookie = appPwaCookie(headers.get("Cookie"), service.cookieName);
+  if (!cookie || !AppPwaSecret.safeParse(cookie).success) return pwaFail("BROWSER_REQUIRED", 401);
+  const received = headers.get("X-App-Pwa-CSRF");
+  if (!received || !pairingSecret.matches(received, pairingSecret.hash(service.csrf(cookie)))) return pwaFail("CSRF_REQUIRED", 403);
+  return cookie;
+};
+
+const empty = z.strictObject({});
+const deviceIdInput = z.strictObject({ deviceId: AppPwaId });
+const visitIdInput = z.strictObject({ visitId: AppPwaId });
+const queryInput = z.strictObject({ visitId: AppPwaId, input: z.unknown() });
+const commandInput = AppPwaAttempt.extend({ visitId: AppPwaId });
+
+/** Closed HTTP adapter: application code can register only typed query/command/device operations, never middleware. */
+export const createAppPwaRouter = (service: AppPwaService) => {
+  const guestBase = `${service.path}_api`;
+  const staffBase = `/api/${service.appId}/app-pwa`;
+  // AuthContext is used only to reuse platform rateLimit's IP mode. Guest handlers never read its identity slots.
+  const router = new Hono<AuthContext>();
+  const limiter = rateLimit({ keyBy: "ip" });
+  router.onError((error, c) => {
+    if (error instanceof AppPwaCoreQueryError)
+      return Response.json(
+        { code: error.code, ...(error.details ? { details: error.details } : {}) },
+        { status: error.status, headers: c.res.headers },
+      );
+    const safe = error instanceof AppPwaError ? error : new AppPwaError("UNAVAILABLE", 503);
+    return c.json({ code: safe.code }, safe.status);
+  });
+  router.notFound((c) => c.json({ code: "NOT_FOUND" }, 404));
+  router.use("*", async (c, next) => {
+    c.header("Cache-Control", "no-store, no-transform");
+    c.header("Pragma", "no-cache");
+    c.header("Referrer-Policy", "no-referrer");
+    c.header("X-Content-Type-Options", "nosniff");
+    // No CORS middleware and no OPTIONS success. All transport methods are JSON POST, including passive reads.
+    if (c.req.method !== "POST") return c.json({ code: "NOT_FOUND" }, 404);
+    if (c.req.header("Origin") !== service.publicOrigin) return pwaFail("ORIGIN_REQUIRED", 403);
+    if (!/^application\/json(?:\s*;\s*charset=utf-8)?$/i.test(c.req.header("Content-Type") ?? "")) return pwaFail("JSON_REQUIRED", 415);
+    return next();
+  });
+  router.use("*", async (c, next) => {
+    const response = await limiter(c, next);
+    return response instanceof Response && response.status === 429 ? c.json({ code: "RATE_LIMITED" }, 429) : response;
+  });
+  const body = (c: Context) => readAppPwaJson(c.req.raw, service.budgets.requestBytes, c.req.raw.signal);
+  const credential = (c: Context): string => appPwaCredential(c.req.raw.headers, service);
+  const web = async (c: Context): Promise<{ signIn: AppPwaWebSignIn; token: string }> => {
+    if (c.req.header("Authorization")) return pwaFail("WEB_SESSION_REQUIRED", 401);
+    appPwaCookie(c.req.header("Cookie") ?? null, "session_token");
+    const token = session.getWebToken(c);
+    const authenticated = token ? await session.authenticate(token) : null;
+    if (!token || !authenticated || authenticated.data.kind !== "web") return pwaFail("WEB_SESSION_REQUIRED", 401);
+    return { signIn: { userId: authenticated.user.id, sid: authenticated.data.sid }, token };
+  };
+  const staffCsrf = (token: string) => pairingSecret.hash(`cloud-app-pwa:staff:${service.appId}:${token}`);
+  const staff = async (c: Context): Promise<AppPwaWebSignIn> => {
+    const current = await web(c);
+    const received = c.req.header("X-App-Pwa-CSRF");
+    if (!received || !pairingSecret.matches(received, pairingSecret.hash(staffCsrf(current.token)))) return pwaFail("CSRF_REQUIRED", 403);
+    return current.signIn;
+  };
+  router.post(`${guestBase}/bootstrap`, async (c) => {
+    parse(empty, await body(c));
+    const boot = await service.bootstrap(appPwaCookie(c.req.header("Cookie") ?? null, service.cookieName), c.req.raw.signal);
+    setCookie(c, service.cookieName, boot.credential, {
+      secure: true,
+      httpOnly: true,
+      sameSite: "Strict",
+      path: service.path,
+      // Session cookie: the durable browser expiry is authoritative and is never renewed by bootstrap.
+    });
+    return c.json({ csrf: boot.csrf });
+  });
+  router.post(`${guestBase}/device/claim`, async (c) => {
+    const key = credential(c);
+    const input = parse(AppPwaClaim, await body(c));
+    return c.json(await service.claimDevice(key, input.qr, c.req.raw.signal));
+  });
+  router.post(`${guestBase}/visit/claim`, async (c) => {
+    const key = credential(c);
+    const input = parse(AppPwaClaim, await body(c));
+    return c.json(await service.claimVisit(key, input.qr, c.req.raw.signal));
+  });
+  router.post(`${guestBase}/status`, async (c) => {
+    const key = credential(c);
+    parse(empty, await body(c));
+    return c.json(await service.status(key, c.req.raw.signal));
+  });
+  router.post(`${guestBase}/visit/end`, async (c) => {
+    const key = credential(c);
+    const input = parse(visitIdInput, await body(c));
+    return c.json(await service.endVisit(key, input.visitId, c.req.raw.signal));
+  });
+  router.post(`${guestBase}/visit/attempt`, async (c) => {
+    const key = credential(c);
+    const input = parse(z.strictObject({ visitId: AppPwaId, attemptId: AppPwaId }), await body(c));
+    return c.json(await service.attempt(key, input.visitId, input.attemptId, c.req.raw.signal));
+  });
+  router.post(`${guestBase}/core/query/:query`, async (c) => {
+    const key = credential(c);
+    const input = parse(z.strictObject({ visitId: AppPwaId.optional(), input: z.unknown() }), await body(c));
+    return c.json(
+      await service.coreQuery(
+        key,
+        input.visitId,
+        c.req.param("query"),
+        input.input,
+        c.req.raw.signal,
+        resolveLocale(c.req.raw.headers, await getSetting<string>("app.locale")),
+      ),
+    );
+  });
+  router.post(`${guestBase}/query/:route`, async (c) => {
+    const key = credential(c);
+    const input = parse(queryInput, await body(c));
+    return c.json(await service.query(key, input.visitId, c.req.param("route"), input.input, c.req.raw.signal));
+  });
+  router.post(`${guestBase}/command/:route`, async (c) => {
+    const key = credential(c);
+    const input = parse(commandInput, await body(c));
+    return c.json(await service.command(key, input.visitId, c.req.param("route"), input.attemptId, input.input, c.req.raw.signal));
+  });
+  router.post(`${guestBase}/device/:route`, async (c) => {
+    const key = credential(c);
+    const input = parse(z.strictObject({ input: z.unknown() }), await body(c));
+    return c.json(await service.deviceOperation(key, c.req.param("route"), input.input, c.req.raw.signal));
+  });
+  router.post(`${staffBase}/bootstrap`, async (c) => {
+    parse(empty, await body(c));
+    const current = await web(c);
+    // Authorization occurs on every real action, inside its service transaction.
+    return c.json({ csrf: staffCsrf(current.token) });
+  });
+  router.post(`${staffBase}/devices/issue`, async (c) => {
+    const signIn = await staff(c);
+    const input = parse(z.strictObject({ requestId: AppPwaId, name: z.string() }), await body(c));
+    return c.json(await service.issueDevice(signIn, input, c.req.raw.signal));
+  });
+  router.post(`${staffBase}/devices/list`, async (c) => {
+    const signIn = await staff(c);
+    const input = parse(z.strictObject({ after: AppPwaId.optional() }), await body(c));
+    return c.json(await service.listDevices(signIn, input.after, c.req.raw.signal));
+  });
+  router.post(`${staffBase}/devices/status`, async (c) => {
+    const signIn = await staff(c);
+    const input = parse(deviceIdInput, await body(c));
+    return c.json(await service.deviceStatus(signIn, input.deviceId, c.req.raw.signal));
+  });
+  router.post(`${staffBase}/devices/revoke`, async (c) => {
+    const signIn = await staff(c);
+    const input = parse(deviceIdInput, await body(c));
+    return c.json(await service.revokeDevice(signIn, input.deviceId, c.req.raw.signal));
+  });
+  router.post(`${staffBase}/visits/issue`, async (c) => {
+    const signIn = await staff(c);
+    const input = parse(z.strictObject({ requestId: AppPwaId, deviceId: AppPwaId, subject: z.unknown() }), await body(c));
+    return c.json(await service.issueVisit(signIn, input, c.req.raw.signal));
+  });
+  router.post(`${staffBase}/visits/revoke`, async (c) => {
+    const signIn = await staff(c);
+    const input = parse(z.strictObject({ deviceId: AppPwaId, visitId: AppPwaId }), await body(c));
+    return c.json(await service.revokeVisit(signIn, input.deviceId, input.visitId, c.req.raw.signal));
+  });
+  // Exposing only fetch prevents app authors from accidentally appending an unguarded generic guest route.
+  return {
+    guestApiPath: guestBase,
+    staffApiPath: staffBase,
+    fetch: async (request: Request): Promise<Response> => {
+      const signal = AbortSignal.any([request.signal, AbortSignal.timeout(REQUEST_IDLE_TIMEOUT_SECONDS * 1000)]);
+      try {
+        return await untilAppPwaAbort(signal, async () => router.fetch(new Request(request, { signal })));
+      } catch {
+        return Response.json(
+          { code: "UNAVAILABLE" },
+          {
+            status: 503,
+            headers: {
+              "Cache-Control": "no-store, no-transform",
+              Pragma: "no-cache",
+              "Referrer-Policy": "no-referrer",
+              "X-Content-Type-Options": "nosniff",
+            },
+          },
+        );
+      }
+    },
+  };
+};
+
+export const createAppPwa = (options: AppPwaOptions) => {
+  const service = createAppPwaService(options);
+  return { service, router: createAppPwaRouter(service), setup: service.setup };
+};

package/src/approvals/messages.ts

@@ -10,7 +10,7 @@ export const approvalMessages = i18n.define({
       rejectAllTitle: "Reject all open approvals?",
       rejectAllBody: ({ count }: { count: number }) =>
         `${count === 1 ? "The open Action does not run." : `None of the ${count.toLocaleString("en")} open Actions runs.`} Where Cloud asked, it continues with your rejection.`,
-      emptyTitle: "Nothing is waiting for you.",
+      emptyTitle: "You're all set.",
       emptyBody: "When an Action needs your approval, it appears here and in the chat it comes from.",
       loading: "Loading approvals…",
       loadFailed: "Approvals could not be loaded.",
@@ -48,7 +48,7 @@ export const approvalMessages = i18n.define({
       rejectAllTitle: "Alle offenen Freigaben ablehnen?",
       rejectAllBody: ({ count }) =>
         `${count === 1 ? "Die offene Aktion läuft nicht." : `Keine der ${count.toLocaleString("de")} offenen Aktionen läuft.`} Wo Cloud gefragt hat, geht es mit deiner Ablehnung weiter.`,
-      emptyTitle: "Nichts wartet auf dich.",
+      emptyTitle: "Alles erledigt.",
       emptyBody: "Wenn eine Aktion deine Freigabe braucht, erscheint sie hier und im Chat, aus dem sie kommt.",
       loading: "Freigaben werden geladen …",
       loadFailed: "Die Freigaben konnten nicht geladen werden.",