@knpkv/alchemy-console 0.4.2 → 0.5.1

package/README.md

@@ -12,23 +12,24 @@ The browser shows stacks grouped by app, with desktop columns and compact phone
 rows. Read again starts a fresh discovery request and clears the previous rows.
 Loading, empty, incomplete discovery and owner sign-in failures are explicit.
 Missing metadata reads Unknown; zero resources remains zero. No polling, cached
-rows, plan, apply or destroy runs. Stage names and known resource counts open the
+rows, local plan, apply or destroy runs. Stage names and known resource counts open the
 stack UI. Resources lists actual returned resource metadata; State groups the
 same resources by their returned construct parent and exact type. Resource rows
 open identity and dependency details. Outputs distinguishes Hidden values, proven
-empty state and unavailable formats. No raw JSON click target, Plan tab or Preview
-changes action is present.
+empty state and unavailable formats. Plan shows the latest plan infrastructure CI already published. No raw JSON or
+Preview changes action is present.
 
 The standalone wrapper shows Alchemy console, the actual local listener address
 and owner session status. It adds no Relay host inventory or shell navigation.
 
 Configuration is read at startup:
 
-| Variable               | Default                                        | Boundary                              |
-| ---------------------- | ---------------------------------------------- | ------------------------------------- |
-| `ALCHEMY_CONSOLE_ROOT` | `Work/dev` under the user's home               | Server-private project discovery path |
-| `AWS_CONFIG_FILE`      | `.aws/config` under the user's home            | Server-private SSO configuration path |
-| `ALCHEMY_CONSOLE_HOME` | `.cache/alchemy-console` under the user's home | Server-private control directory      |
+| Variable                   | Default                                        | Boundary                               |
+| -------------------------- | ---------------------------------------------- | -------------------------------------- |
+| `ALCHEMY_CONSOLE_ROOT`     | `Work/dev` under the user's home               | Server-private project discovery path  |
+| `AWS_CONFIG_FILE`          | `.aws/config` under the user's home            | Server-private SSO configuration path  |
+| `ALCHEMY_CONSOLE_HOME`     | `.cache/alchemy-console` under the user's home | Server-private control directory       |
+| `ALCHEMY_CONSOLE_CI_TOKEN` | Unconfigured                                   | Server-private read-only Actions token |
 
 Login reuse is per port. A reused server keeps its startup configuration. The
 control directory must be owned by the current user with mode `0700`; each
@@ -40,7 +41,7 @@ POSIX ownership and Unix sockets.
 ## Authenticated API
 
 The client-safe contracts are exported from `@knpkv/alchemy-console/api` and may be
-used with Effect's `HttpApiClient`. Both endpoints require the process's owner
+used with Effect's `HttpApiClient`. All endpoints require the process's owner
 cookie, and all responses are private and uncacheable:
 
 The cookie name includes the bound listener port, so sessions on different ports
@@ -49,10 +50,11 @@ Cookies still share the loopback host and travel across ports; the name separate
 sessions and does not provide port confidentiality. The API middleware resolves
 the name at runtime rather than declaring a fixed OpenAPI cookie scheme.
 
-| Route                 | Result                                                 |
-| --------------------- | ------------------------------------------------------ |
-| `GET /api/stacks`     | Stack summaries and explicit local/S3 discovery issues |
-| `GET /api/stacks/:id` | Current normalized resource state for a listed stack   |
+| Route                      | Result                                                   |
+| -------------------------- | -------------------------------------------------------- |
+| `GET /api/stacks`          | Stack summaries and explicit local/S3 discovery issues   |
+| `GET /api/stacks/:id`      | Current normalized resource state for a listed stack     |
+| `GET /api/stacks/:id/plan` | Latest verified CI plan or an explicit unavailable state |
 
 Listing runs discovery on demand, without polling or schedules. IDs are random,
 process-scoped identifiers with no encoded locator. They remain stable across
@@ -78,16 +80,116 @@ remain in the server and HttpOnly cookie. Every unsafe API method is refused,
 including apply and destroy. Reads reject foreign origins and cross-site browser
 requests. Listener and request Host are restricted to the bound loopback address.
 
+## CI plans
+
+The console never imports or executes stack code. It reads the `plan.json`
+publication from infrastructure CI in `knpkv/infra`. Only `site/prod` and
+`aws-org/org` map to that repository's `site` and `aws-org` stacks. Other app/stage
+pairs show Not connected.
+
+Set `ALCHEMY_CONSOLE_CI_TOKEN` on the server to a dedicated fine-grained token with
+Actions read access to that repository. The token is held in redacted server
+configuration; no host `gh` token is discovered. The current main comparison uses
+the newest main push workflow run's SHA, the latest main commit seen by CI.
+It does not query Git references or require Contents access. If no main push run
+is visible, only the age rule applies. This comparison does not prove the current
+Git branch tip.
+
+The reader selects the newest non-expired matching artifact and verifies the
+receipt and provenance inputs listed below. Both archive and expanded
+JSON must be below 1 MB. API metadata has a separate 2 MiB per-response cap to
+accommodate full 100-row pages before schema projection. Metadata pagination stops
+at ten pages and the whole read has a 30-second timeout. ZIP inspection and decompression stay in memory. No
+payload is logged or extracted to disk.
+
+A publication becomes stale after 24 hours or when its base differs from the
+latest main commit seen by CI. A newer failed stack run can retain the verified
+last publication with a stale notice. The latest attempt must have run the selected
+stack’s `Native read-only plan` step. Attempts are ordered by `run_started_at`,
+then run ID and attempt number, descending; `updated_at` does not decide order.
+A successful job that skipped that step, or
+a newer attempt for another stack, does not replace the selected stack’s attempt. Expired, unverified, unconnected and
+unavailable states have no rows. Infra CI not publishing is distinct from a
+stack's first publication. Only a CI transport failure offers Retry, which reads
+again and never executes a plan. Owner-session failures return to the console's
+sign-in/error state instead of pretending CI refused access.
+Fixed repository/workflow discovery returning 404 is treated as refused CI access;
+the response cannot distinguish denied access from a removed configured workflow.
+Missing individual runs/artifacts and HTTP 429/5xx remain retryable transport failures.
+
+### Canonical receipt and identity boundaries
+
+The persisted representation is the UTF-8 JSON receipt in the single regular
+`plan.json` ZIP member of an Actions artifact named `infra-plan-<stack>-<head>`.
+The server reads the artifact from the private `knpkv/infra` repository; that
+repository name also appears in authenticated-client run URLs. Its entire
+downloaded ZIP byte sequence is SHA-256 hashed and compared with the Actions
+artifact's `sha256:<hex>` digest before decompression and exact-key receipt decoding.
+
+Only `native.semantic` uses canonical semantic hashing: recursively sort object
+keys, preserve array order, serialize with compact `JSON.stringify`, encode UTF-8,
+then SHA-256 to lowercase hex and compare with `native.digest`. This is not a hash
+of the whole receipt. The surrounding receipt identities are protected by the ZIP
+digest and the separate provenance checks in this table.
+
+| Input                         | Binding or validation                                                                                                                                                                                                                                                                                                                                               | Boundary                                                                                                                               |
+| ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
+| Repository IDs                | Producer/publisher `repository.id` and `head_repository.id`, artifact `workflow_run.repository_id` and `head_repository_id`, and main-CI repository IDs must equal `1288997422`.                                                                                                                                                                                    | Server-private API coordinates and pins.                                                                                               |
+| Workflow identities           | Active workflow definitions have exact paths `.github/workflows/infra.yml` and `.github/workflows/infra-publish.yml`; run `workflow_id` must match the respective definition ID. Run paths require the exact filename, with an optional validated `@ref`. Publisher refs are main; producer refs may also match its head branch or a recorded PR merge ref.         | Server-private IDs, paths and refs.                                                                                                    |
+| Actor identities              | Both producer/publisher `actor.id` and `triggering_actor.id` must equal `833092`.                                                                                                                                                                                                                                                                                   | Server-private numeric pins; no actor names are projected.                                                                             |
+| Producer run                  | Receipt `producerRunId` retrieves the run; its `id`, event `pull_request`, completed/success state, positive `run_attempt` and `run_started_at` identify the current reported attempt. Start time orders attempts; it is not a semantic-hash input.                                                                                                                 | Run ID can cross only within an allowlisted failed-run URL; attempt/start metadata remains server-private.                             |
+| Producer job and step         | Exactly one `<stack> / native` job must match the run's attempt and complete successfully; exactly one `Native read-only plan` step must have started and completed successfully. Job `id` is a positive API identity, not a receipt-pinned value. Schema 1 persists neither producer job ID nor producer attempt number.                                           | Server-private job/attempt/step metadata.                                                                                              |
+| Publisher run                 | Artifact `workflow_run.id` selects the run lookup; receipt `runId` equals the fetched run ID. Event is `workflow_run`, branch is `main`, state is completed/success, and `head_sha` equals both receipt `base` and artifact `workflow_run.head_sha`.                                                                                                                | Run ID crosses within the allowlisted publication URL; branch/event/status and attempt metadata remain server-private.                 |
+| Publisher job/attempt         | Receipt `publisherJobId` equals a successful completed `<stack> / publish` job's immutable `id`; its `run_attempt` equals the current publisher attempt. Attempt number is API metadata, not a separate persisted receipt field.                                                                                                                                    | Server-private job ID and attempt.                                                                                                     |
+| Publication artifact          | API artifact `id` selects the download; `name` supplies the full head suffix bound to receipt `head`. `workflow_run.head_branch` must be `main`; run ID/SHA bind through the publisher row. Download length equals `size_in_bytes`; SHA-256 equals `digest`. `expired` and `expires_at` govern selection; `created_at` supplies publication age, not attempt order. | Artifact IDs, name, full digest and expiry metadata remain server-private. Only normalized `publishedAt` / `ageDays` cross owner HTTP. |
+| PR/revisions                  | Receipt `pr`, `head`, `base` match the producer's `pull_requests[].number`, `head.sha`, `base.sha`; producer `head_sha` also equals receipt `head`.                                                                                                                                                                                                                 | Authenticated client sees PR number and seven-character head/base SHAs. Full revisions remain server-private.                          |
+| Referenced workflow           | Producer `referenced_workflows` must contain path `knpkv/infra/.github/workflows/_infra-plan.yml@main` or `@refs/heads/main`, ref `refs/heads/main`, and SHA equal to receipt `base`.                                                                                                                                                                               | Server-private path/ref/full SHA; only the short base projection crosses.                                                              |
+| Tools                         | Receipt `toolsSha` equals `base`; `toolsDigest` must be a 64-character lowercase hex hash. The console does not independently recompute `toolsDigest`.                                                                                                                                                                                                              | Server-private tool identity/hash; only the separate short base projection crosses.                                                    |
+| Raw artifact descriptor       | Receipt `rawArtifactId` is positive; `rawArtifactDigest` has `sha256:<64 lowercase hex>` shape. The console does not fetch or rehash this raw artifact. These are not the publication artifact's ID/digest above.                                                                                                                                                   | Server-private descriptor, never an owner HTTP field.                                                                                  |
+| Receipt assurance             | `assurance` equals `untrusted-native-data/trusted-publication`.                                                                                                                                                                                                                                                                                                     | Server-private receipt marker.                                                                                                         |
+| Schemas/stack/stage           | Receipt `schema` and `native.schema` equal `1`. Receipt `stack`, `native.stack` and `native.semantic.stack` equal the selected mapped stack. Native/semantic stages agree: `site/prod` uses semantic schema `alchemy-beta77/ci-native-v1`; `aws-org/org` uses `alchemy-beta81/ci-native-v1`. `native.statePuts` equals `0`.                                         | Schema/assurance markers stay server-private. Selected app/stage already cross as authenticated stack metadata.                        |
+| Semantic impact               | `native.semantic.impact` contains the selected stack, has one or two allowed stack names and no duplicates.                                                                                                                                                                                                                                                         | Server-private semantic-hash input.                                                                                                    |
+| Semantic resource identities  | `native.semantic.rows[].fqn` / `type` exactly match the unique pins: `Site` → `Cloudflare.Worker`; `Platform`, `Sandbox` → `AWS.Organizations.OrganizationalUnit`; `Dev1Placement`, `DevPlacement`, `Dev2Placement`, `InfraPlacement` → `Org.AccountPlacement`. Site has one row; organization has six.                                                             | These semantic-hash inputs cross owner HTTP as normalized `fqn` / `resourceType`.                                                      |
+| Semantic actions              | `native.semantic.rows[].action` is `noop` or `update`; `native.hasChanges` agrees with the presence of an update.                                                                                                                                                                                                                                                   | Action crosses owner HTTP; the receipt boolean remains server-private.                                                                 |
+| Semantic property names       | `native.semantic.rows[].changedKeys` has at most 32 names matching `^[A-Za-z][A-Za-z0-9_.-]{0,63}$`.                                                                                                                                                                                                                                                                | Names cross owner HTTP. Property values do not.                                                                                        |
+| Semantic value hashes/mode    | `native.semantic.rows[].props`, `attr`, `bindings` are lowercase 64-character hex hashes; `mode` is `live`.                                                                                                                                                                                                                                                         | Server-private semantic-hash inputs; no original values are stored in this receipt.                                                    |
+| Semantic content/build/output | `native.semantic.contentDigest`, `output`, site `artifacts["Site/build"]` and `assetHashes.Site` are lowercase 64-character hex hashes. Organization `artifacts` is empty and has no `assetHashes` field. All are included in semantic hashing.                                                                                                                     | Server-private hashes/build keys; never projected or independently recomputed by this reader.                                          |
+| Semantic digest               | `native.digest` equals the recomputed canonical semantic SHA-256.                                                                                                                                                                                                                                                                                                   | Full digest remains server-private; only its first/last four hex characters cross owner HTTP.                                          |
+| Latest main commit seen by CI | The newest main push run must have the pinned repository IDs, `head_branch: main`, `event: push` and a valid `head_sha`. That SHA is compared with receipt `base` only for staleness.                                                                                                                                                                               | Server-private comparison input; only normalized `stale: base` crosses.                                                                |
+
+Every canonical semantic field above, including its schema/stack/stage, participates
+in the semantic hash. Run/job/artifact metadata and surrounding receipt fields do
+not. A valid ZIP digest authenticates receipt bytes against Actions metadata; it
+does not strengthen shape-only fields into independently verified identities.
+Tokens, signed download URLs, raw provider secrets and backend locators are never
+durable receipt fields. Tokens and download URLs stay in the server transport.
+
+The normalized authenticated client-visible projection contains PR number, short
+head/base SHAs, publication time, safe GitHub run link, short semantic digest,
+resource identity/type/action and bounded property names. These fields may cross
+owner HTTP, but must not enter public or unauthenticated routes, browser storage
+or telemetry. The token, signed artifact URLs, artifact/job IDs, full receipt
+hashes, raw ZIP and unprojected semantic hash inputs remain server-private. Property values,
+provider credentials and backend locators never enter this projection.
+
+CI publication authenticates the source of the data, not the behavior of PR code.
+The console does not certify CI's no-write or secret-access policy. No real CI
+artifact is used by this feature's tests; all reader and browser states use
+synthetic fixtures.
+
 ## Browser views
 
-Import `StackListView`, `StackDetailView` and `ResourceDetailView` from `@knpkv/alchemy-console/views` and its stylesheet from
+Import `StackListView`, `StackDetailView`, `PlanView` and `ResourceDetailView` from `@knpkv/alchemy-console/views` and its stylesheet from
 `@knpkv/alchemy-console/views/style.css`. Mount them inside a Rly style/theme boundary.
 Views consumers supply the optional React, React DOM and Rly peers; the standalone
 browser shell already bundles them.
 The application supplies normalized presentation data, a product label, host
 sign-in instruction, read actions and real UI destinations. `StackListView` accepts
 optional `stackHref`; without a destination, stages and counts remain text.
-`StackDetailView` has controlled Resources/Outputs/State tabs and `resourceHref`.
+`StackDetailView` has controlled Resources/Outputs/State/Plan tabs and `resourceHref`. Supply
+`planState` and `onReadPlanAgain` for CI reading; without `planState`, Plan shows
+Not connected. `PlanView` accepts the same controlled state and a read-only
+`onReadAgain` callback.
 `ResourceDetailView` accepts `stackHref` and `resourceHref`. Views fetch nothing,
 read no configuration and persist no data. The standalone detail wrapper adds
 breadcrumbs and Read again outside the referenced module content. Phone list

package/dist/api.d.ts

@@ -1,6 +1,7 @@
 /** Client-safe contracts. IDs and metadata cross only the authenticated owner API, never public telemetry. */
 import { Schema } from "effect";
 import { HttpApi, HttpApiEndpoint, HttpApiGroup, HttpApiMiddleware } from "effect/http-api";
+export { PlanRow, PlanSource, PlanState, PublishedPlan } from "./plan.js";
 /** Random, process-scoped identity; contains no encoded provider locator. Not persisted by the server. */
 export declare const StackId: Schema.String;
 export type StackId = typeof StackId.Type;
@@ -90,21 +91,7 @@ declare const OwnerAuth_base: HttpApiMiddleware.ServiceClass<OwnerAuth, "@knpkv/
 /** The server resolves its listener-specific cookie name at request time. */
 export declare class OwnerAuth extends OwnerAuth_base {
 }
-declare const AlchemyConsoleApi_base: HttpApi.HttpApi<"AlchemyConsoleApi", HttpApiGroup.HttpApiGroup<"stacks", HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/api/stacks", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
-    readonly stacks: Schema.$Array<Schema.Struct<{
-        readonly id: Schema.String;
-        readonly app: Schema.NonEmptyString;
-        readonly stage: Schema.NonEmptyString;
-        readonly backend: Schema.Literals<readonly ["local", "s3"]>;
-        readonly alchemyVersion: Schema.NullOr<Schema.String>;
-        readonly lastDeploy: Schema.NullOr<Schema.String>;
-        readonly resourceCount: Schema.NullOr<Schema.Int>;
-    }>>;
-    readonly issues: Schema.$Array<Schema.Struct<{
-        readonly source: Schema.Literals<readonly ["local", "s3"]>;
-        readonly reason: Schema.Literals<readonly ["io", "invalid-state", "invalid-lockfile", "unsupported-version", "limit", "outside-root", "invalid-config", "authentication", "denied", "not-found", "provider", "invalid-response", "invalid-source"]>;
-    }>>;
-}>>, Schema.toCodecJson<typeof CatalogReadError>, OwnerAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"get", "GET", "/api/stacks/:id", Schema.toCodecStringTree<Schema.Struct<{
+declare const AlchemyConsoleApi_base: HttpApi.HttpApi<"AlchemyConsoleApi", HttpApiGroup.HttpApiGroup<"stacks", HttpApiEndpoint.HttpApiEndpoint<"get", "GET", "/api/stacks/:id", Schema.toCodecStringTree<Schema.Struct<{
     readonly id: Schema.String;
 }>>, never, never, never, Schema.toCodecJson<Schema.Struct<{
     readonly id: Schema.String;
@@ -133,8 +120,92 @@ declare const AlchemyConsoleApi_base: HttpApi.HttpApi<"AlchemyConsoleApi", HttpA
             readonly description: Schema.Null;
         }>>>;
     }>;
+}>>, Schema.toCodecJson<typeof CatalogReadError | typeof StackNotFound>, OwnerAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/api/stacks", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly stacks: Schema.$Array<Schema.Struct<{
+        readonly id: Schema.String;
+        readonly app: Schema.NonEmptyString;
+        readonly stage: Schema.NonEmptyString;
+        readonly backend: Schema.Literals<readonly ["local", "s3"]>;
+        readonly alchemyVersion: Schema.NullOr<Schema.String>;
+        readonly lastDeploy: Schema.NullOr<Schema.String>;
+        readonly resourceCount: Schema.NullOr<Schema.Int>;
+    }>>;
+    readonly issues: Schema.$Array<Schema.Struct<{
+        readonly source: Schema.Literals<readonly ["local", "s3"]>;
+        readonly reason: Schema.Literals<readonly ["io", "invalid-state", "invalid-lockfile", "unsupported-version", "limit", "outside-root", "invalid-config", "authentication", "denied", "not-found", "provider", "invalid-response", "invalid-source"]>;
+    }>>;
+}>>, Schema.toCodecJson<typeof CatalogReadError>, OwnerAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"plan", "GET", "/api/stacks/:id/plan", Schema.toCodecStringTree<Schema.Struct<{
+    readonly id: Schema.String;
+}>>, never, never, never, Schema.toCodecJson<Schema.TaggedUnion<{
+    readonly Expired: Schema.TaggedStruct<"Expired", {
+        readonly source: Schema.NullOr<Schema.Struct<{
+            readonly pr: Schema.NullOr<Schema.Int>;
+            readonly head: Schema.String;
+            readonly base: Schema.NullOr<Schema.String>;
+            readonly publishedAt: Schema.String;
+            readonly ageDays: Schema.Int;
+            readonly runHref: Schema.String;
+        }>>;
+    }>;
+    readonly Failed: Schema.TaggedStruct<"Failed", {
+        readonly runHref: Schema.String;
+        readonly lastPublished: Schema.NullOr<Schema.Struct<{
+            readonly source: Schema.Struct<{
+                readonly pr: Schema.NullOr<Schema.Int>;
+                readonly head: Schema.String;
+                readonly base: Schema.NullOr<Schema.String>;
+                readonly publishedAt: Schema.String;
+                readonly ageDays: Schema.Int;
+                readonly runHref: Schema.String;
+            }>;
+            readonly digest: Schema.String;
+            readonly rows: Schema.$Array<Schema.Struct<{
+                readonly fqn: Schema.NonEmptyString;
+                readonly resourceType: Schema.NonEmptyString;
+                readonly action: Schema.Literals<readonly ["noop", "update"]>;
+                readonly changedKeys: Schema.$Array<Schema.String>;
+            }>>;
+            readonly stale: Schema.NullOr<Schema.Literals<readonly ["age", "base", "failed"]>>;
+        }>>;
+    }>;
+    readonly Loading: Schema.TaggedStruct<"Loading", {}>;
+    readonly NotConnected: Schema.TaggedStruct<"NotConnected", {}>;
+    readonly NotPublished: Schema.TaggedStruct<"NotPublished", {}>;
+    readonly NotPublishing: Schema.TaggedStruct<"NotPublishing", {}>;
+    readonly Ready: Schema.TaggedStruct<"Ready", {
+        readonly plan: Schema.Struct<{
+            readonly source: Schema.Struct<{
+                readonly pr: Schema.NullOr<Schema.Int>;
+                readonly head: Schema.String;
+                readonly base: Schema.NullOr<Schema.String>;
+                readonly publishedAt: Schema.String;
+                readonly ageDays: Schema.Int;
+                readonly runHref: Schema.String;
+            }>;
+            readonly digest: Schema.String;
+            readonly rows: Schema.$Array<Schema.Struct<{
+                readonly fqn: Schema.NonEmptyString;
+                readonly resourceType: Schema.NonEmptyString;
+                readonly action: Schema.Literals<readonly ["noop", "update"]>;
+                readonly changedKeys: Schema.$Array<Schema.String>;
+            }>>;
+            readonly stale: Schema.NullOr<Schema.Literals<readonly ["age", "base", "failed"]>>;
+        }>;
+    }>;
+    readonly Refused: Schema.TaggedStruct<"Refused", {}>;
+    readonly Unreachable: Schema.TaggedStruct<"Unreachable", {}>;
+    readonly Unverified: Schema.TaggedStruct<"Unverified", {
+        readonly reason: Schema.Literals<readonly ["metadata", "provenance", "archive", "digest", "receipt"]>;
+        readonly source: Schema.NullOr<Schema.Struct<{
+            readonly pr: Schema.NullOr<Schema.Int>;
+            readonly head: Schema.String;
+            readonly base: Schema.NullOr<Schema.String>;
+            readonly publishedAt: Schema.String;
+            readonly ageDays: Schema.Int;
+            readonly runHref: Schema.String;
+        }>>;
+    }>;
 }>>, Schema.toCodecJson<typeof CatalogReadError | typeof StackNotFound>, OwnerAuth, never>, false>>;
 export declare class AlchemyConsoleApi extends AlchemyConsoleApi_base {
 }
-export {};
 //# sourceMappingURL=api.d.ts.map

package/dist/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,8GAA8G;AAC9G,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAG3F,0GAA0G;AAC1G,eAAO,MAAM,OAAO,eAAuC,CAAA;AAC3D,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,IAAI,CAAA;AAEzC,eAAO,MAAM,mBAAmB,oOAc9B,CAAA;AAEF,eAAO,MAAM,cAAc;;;EAGzB,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,IAAI,CAAA;AAEvD,eAAO,MAAM,YAAY;;;;;;;;EAQvB,CAAA;AACF,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,IAAI,CAAA;AAEnD,eAAO,MAAM,SAAS;;;;;;;;;;;;;;EAA8F,CAAA;AACpH,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,IAAI,CAAA;AAC7C,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;EAAoD,CAAA;AAC5E,MAAM,MAAM,WAAW,GAAG,OAAO,WAAW,CAAC,IAAI,CAAA;;;;AAEjD,qBAAa,gBAAiB,SAAQ,qBAEZ;CAAG;;AAE7B,qBAAa,aAAc,SAAQ,kBAAgF;CAAG;;AAEtH,qBAAa,YAAa,SAAQ,iBAA8E;CAAG;;AAEnH,qBAAa,SAAU,SAAQ,cAAwE;CAAG;;;;;;;;;AAE1G,6EAA6E;AAC7E,qBAAa,SAAU,SAAQ,cAE7B;CAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWL,qBAAa,iBAAkB,SAAQ,sBAAmE;CAAG"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,8GAA8G;AAC9G,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAI3F,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAEzE,0GAA0G;AAC1G,eAAO,MAAM,OAAO,eAAuC,CAAA;AAC3D,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,IAAI,CAAA;AAEzC,eAAO,MAAM,mBAAmB,oOAc9B,CAAA;AAEF,eAAO,MAAM,cAAc;;;EAGzB,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,IAAI,CAAA;AAEvD,eAAO,MAAM,YAAY;;;;;;;;EAQvB,CAAA;AACF,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,IAAI,CAAA;AAEnD,eAAO,MAAM,SAAS;;;;;;;;;;;;;;EAA8F,CAAA;AACpH,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,IAAI,CAAA;AAC7C,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;EAAoD,CAAA;AAC5E,MAAM,MAAM,WAAW,GAAG,OAAO,WAAW,CAAC,IAAI,CAAA;;;;AAEjD,qBAAa,gBAAiB,SAAQ,qBAEZ;CAAG;;AAE7B,qBAAa,aAAc,SAAQ,kBAAgF;CAAG;;AAEtH,qBAAa,YAAa,SAAQ,iBAA8E;CAAG;;AAEnH,qBAAa,SAAU,SAAQ,cAAwE;CAAG;;;;;;;;;AAE1G,6EAA6E;AAC7E,qBAAa,SAAU,SAAQ,cAE7B;CAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgBL,qBAAa,iBAAkB,SAAQ,sBAAmE;CAAG"}

package/dist/api.js

@@ -1,7 +1,9 @@
 /** Client-safe contracts. IDs and metadata cross only the authenticated owner API, never public telemetry. */
 import { Schema } from "effect";
 import { HttpApi, HttpApiEndpoint, HttpApiGroup, HttpApiMiddleware } from "effect/http-api";
+import { PlanState } from "./plan.js";
 import { StackState } from "./schema.js";
+export { PlanRow, PlanSource, PlanState, PublishedPlan } from "./plan.js";
 /** Random, process-scoped identity; contains no encoded provider locator. Not persisted by the server. */
 export const StackId = Schema.String.check(Schema.isUUID());
 export const SourceFailureReason = Schema.Literals([
@@ -55,6 +57,11 @@ const stacks = HttpApiGroup.make("stacks")
     params: Schema.Struct({ id: StackId }),
     success: StackDetail,
     error: [StackNotFound, CatalogReadError]
+}))
+    .add(HttpApiEndpoint.get("plan", "/stacks/:id/plan", {
+    params: Schema.Struct({ id: StackId }),
+    success: PlanState,
+    error: [StackNotFound, CatalogReadError]
 }))
     .prefix("/api");
 export class AlchemyConsoleApi extends HttpApi.make("AlchemyConsoleApi").add(stacks).middleware(OwnerAuth) {

package/dist/api.js.map

@@ -1 +1 @@
-{"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,8GAA8G;AAC9G,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAC3F,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,0GAA0G;AAC1G,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;AAG3D,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjD,IAAI;IACJ,eAAe;IACf,kBAAkB;IAClB,qBAAqB;IACrB,OAAO;IACP,cAAc;IACd,gBAAgB;IAChB,gBAAgB;IAChB,QAAQ;IACR,WAAW;IACX,UAAU;IACV,kBAAkB;IAClB,gBAAgB;CACjB,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1C,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,EAAE,mBAAmB;CAC5B,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;IACxC,EAAE,EAAE,OAAO;IACX,GAAG,EAAE,MAAM,CAAC,cAAc;IAC1B,KAAK,EAAE,MAAM,CAAC,cAAc;IAC5B,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;IAC5C,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;IACxC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;CACjF,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAA;AAEpH,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAA;AAG5E,MAAM,OAAO,gBAAiB,SAAQ,MAAM,CAAC,WAAW,EAAoB,CAAC,kBAAkB,EAAE;IAC/F,MAAM,EAAE,mBAAmB;CAC5B,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;CAAG;AAE7B,MAAM,OAAO,aAAc,SAAQ,MAAM,CAAC,WAAW,EAAiB,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;CAAG;AAEtH,MAAM,OAAO,YAAa,SAAQ,MAAM,CAAC,WAAW,EAAgB,CAAC,cAAc,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;CAAG;AAEnH,MAAM,OAAO,SAAU,SAAQ,MAAM,CAAC,WAAW,EAAa,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;CAAG;AAE1G,6EAA6E;AAC7E,MAAM,OAAO,SAAU,SAAQ,iBAAiB,CAAC,OAAO,EAAa,CAAC,kCAAkC,EAAE;IACxG,KAAK,EAAE,CAAC,YAAY,EAAE,SAAS,CAAC;CACjC,CAAC;CAAG;AAEL,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;KACvC,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;KAC5F,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE;IAC7C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IACtC,OAAO,EAAE,WAAW;IACpB,KAAK,EAAE,CAAC,aAAa,EAAE,gBAAgB,CAAC;CACzC,CAAC,CAAC;KACF,MAAM,CAAC,MAAM,CAAC,CAAA;AAEjB,MAAM,OAAO,iBAAkB,SAAQ,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;CAAG"}
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,8GAA8G;AAC9G,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAC3F,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAEzE,0GAA0G;AAC1G,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;AAG3D,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjD,IAAI;IACJ,eAAe;IACf,kBAAkB;IAClB,qBAAqB;IACrB,OAAO;IACP,cAAc;IACd,gBAAgB;IAChB,gBAAgB;IAChB,QAAQ;IACR,WAAW;IACX,UAAU;IACV,kBAAkB;IAClB,gBAAgB;CACjB,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1C,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,EAAE,mBAAmB;CAC5B,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;IACxC,EAAE,EAAE,OAAO;IACX,GAAG,EAAE,MAAM,CAAC,cAAc;IAC1B,KAAK,EAAE,MAAM,CAAC,cAAc;IAC5B,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;IAC5C,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;IACxC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;CACjF,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAA;AAEpH,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAA;AAG5E,MAAM,OAAO,gBAAiB,SAAQ,MAAM,CAAC,WAAW,EAAoB,CAAC,kBAAkB,EAAE;IAC/F,MAAM,EAAE,mBAAmB;CAC5B,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;CAAG;AAE7B,MAAM,OAAO,aAAc,SAAQ,MAAM,CAAC,WAAW,EAAiB,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;CAAG;AAEtH,MAAM,OAAO,YAAa,SAAQ,MAAM,CAAC,WAAW,EAAgB,CAAC,cAAc,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;CAAG;AAEnH,MAAM,OAAO,SAAU,SAAQ,MAAM,CAAC,WAAW,EAAa,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;CAAG;AAE1G,6EAA6E;AAC7E,MAAM,OAAO,SAAU,SAAQ,iBAAiB,CAAC,OAAO,EAAa,CAAC,kCAAkC,EAAE;IACxG,KAAK,EAAE,CAAC,YAAY,EAAE,SAAS,CAAC;CACjC,CAAC;CAAG;AAEL,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;KACvC,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;KAC5F,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE;IAC7C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IACtC,OAAO,EAAE,WAAW;IACpB,KAAK,EAAE,CAAC,aAAa,EAAE,gBAAgB,CAAC;CACzC,CAAC,CAAC;KACF,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,EAAE;IACnD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IACtC,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,CAAC,aAAa,EAAE,gBAAgB,CAAC;CACzC,CAAC,CAAC;KACF,MAAM,CAAC,MAAM,CAAC,CAAA;AAEjB,MAAM,OAAO,iBAAkB,SAAQ,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;CAAG"}