@manta-eu/react 0.12.0 → 0.13.0

package/dist/worker/proxy.js

@@ -0,0 +1,58 @@
+import { isWebSocket } from "@manta-eu/auth/request-origin";
+import { forwardedOriginHeader } from "@manta-eu/client/shared/constants";
+import { isPresent } from "@manta-eu/lib/present";
+import { equals } from "ramda";
+import { captureUpstreamCookies, clearSessionSetCookies, readSession, sessionSetCookies, upstreamCookieHeader, } from "./session.js";
+function upstreamRequest(args) {
+    const { request, agentsUrl, session, body } = args;
+    const incoming = new URL(request.url);
+    const url = new URL(`${agentsUrl.replace(/\/+$/, "")}${incoming.pathname}${incoming.search}`);
+    const headers = new Headers(request.headers);
+    for (const name of ["host", "cookie", "authorization", "referer", "sec-fetch-site"])
+        headers.delete(name);
+    headers.set("origin", url.origin);
+    headers.set(forwardedOriginHeader, incoming.origin);
+    if (isPresent(session))
+        headers.set("cookie", upstreamCookieHeader(session));
+    const sendsBody = !isWebSocket(request) && request.method !== "GET" && request.method !== "HEAD";
+    const init = {
+        method: request.method,
+        headers,
+        redirect: "manual",
+        ...(sendsBody && { body: body ?? request.body, duplex: "half" }),
+    };
+    return { url, init };
+}
+function withAppCookies(response, written) {
+    const upgraded = response.webSocket;
+    if (!isPresent(written) && !isPresent(response.headers.getSetCookie()))
+        return response;
+    const headers = new Headers(response.headers);
+    headers.delete("set-cookie");
+    for (const cookie of written)
+        headers.append("set-cookie", cookie);
+    if (response.status === 101 || isPresent(upgraded)) {
+        return new Response(null, { status: response.status, headers, webSocket: upgraded });
+    }
+    headers.delete("content-encoding");
+    headers.delete("content-length");
+    return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
+}
+async function cookiesToWrite(args) {
+    const { cookies, request, previous, after, clear } = args;
+    if (!clear && equals(previous, after))
+        return [];
+    return clear || !isPresent(after.upstreamCookies)
+        ? clearSessionSetCookies(cookies, request)
+        : sessionSetCookies({ cookies, state: after, request });
+}
+export async function proxyToAgents(args) {
+    const { request, agentsUrl, agents, cookies, session, body, clearSession = false } = args;
+    const before = session ?? (await readSession(cookies, request));
+    const { url, init } = upstreamRequest({ request, agentsUrl, session: before, body });
+    const response = await (agents?.fetch ?? fetch)(url, init);
+    const previous = before ?? { upstreamCookies: {} };
+    const after = captureUpstreamCookies({ state: previous, response });
+    return withAppCookies(response, await cookiesToWrite({ cookies, request, previous, after, clear: clearSession }));
+}
+//# sourceMappingURL=proxy.js.map

package/dist/worker/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../../src/worker/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAC/B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,WAAW,EACX,iBAAiB,EACjB,oBAAoB,GAGrB,MAAM,WAAW,CAAC;AAoBnB,SAAS,eAAe,CAAC,IAAyB;IAChD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IAEnD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9F,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7C,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,SAAS,EAAE,gBAAgB,CAAC;QAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAE1G,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEpD,IAAI,SAAS,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;IAE7E,MAAM,SAAS,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC;IACjG,MAAM,IAAI,GAAsC;QAC9C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO;QACP,QAAQ,EAAE,QAAQ;QAClB,GAAG,CAAC,SAAS,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAe,EAAE,CAAC;KAC1E,CAAC;IAEF,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,cAAc,CAAC,QAAkB,EAAE,OAAiB;IAC3D,MAAM,QAAQ,GAAI,QAA+C,CAAC,SAAS,CAAC;IAE5E,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QAAE,OAAO,QAAQ,CAAC;IAExF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAE9C,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAE7B,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAEnE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAkB,CAAC,CAAC;IACvG,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACnC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAEjC,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;AAC5G,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAwB;IACpD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAE1D,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEjD,OAAO,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC;QAC/C,CAAC,CAAC,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1C,CAAC,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAe;IACjD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC;IAE1F,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,eAAe,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAErF,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE3D,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,sBAAsB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAEpE,OAAO,cAAc,CAAC,QAAQ,EAAE,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;AACpH,CAAC"}

package/dist/worker/session.d.ts

@@ -0,0 +1,24 @@
+export type SessionState = {
+    upstreamCookies: Record<string, string>;
+};
+export type SessionCookies = {
+    prefix: string;
+    secret: string;
+};
+type SessionSetCookiesArgs = {
+    cookies: SessionCookies;
+    state: SessionState;
+    request: Request;
+};
+type CaptureArgs = {
+    state: SessionState;
+    response: Response;
+};
+export declare function sessionSetCookies(args: SessionSetCookiesArgs): Promise<string[]>;
+export declare function clearSessionSetCookies(cookies: SessionCookies, request: Request): string[];
+export declare function readSession(cookies: SessionCookies, request: Request): Promise<SessionState | undefined>;
+export declare function isSignedIn(state: SessionState | undefined): state is SessionState;
+export declare function upstreamCookieHeader(state: SessionState): string;
+export declare function captureUpstreamCookies(args: CaptureArgs): SessionState;
+export {};
+//# sourceMappingURL=session.d.ts.map

package/dist/worker/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/worker/session.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,YAAY,GAAG;IAAE,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC;AAEvE,MAAM,MAAM,cAAc,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhE,KAAK,qBAAqB,GAAG;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC;AAEhG,KAAK,WAAW,GAAG;IAAE,KAAK,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;AAU/D,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAWtF;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,CAE1F;AAgBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAI9G;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,YAAY,GAAG,SAAS,GAAG,KAAK,IAAI,YAAY,CAEjF;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAIhE;AAeD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,WAAW,GAAG,YAAY,CAoBtE"}

package/dist/worker/session.js

@@ -0,0 +1,72 @@
+import { cookiesOf, expiredChunkCookies, httpOnlyCookie, purposeKey, sealedChunkCookies, sessionMaxAgeSeconds, unsealedChunks, } from "@manta-eu/auth/sealed-cookies";
+import { isPresent } from "@manta-eu/lib/present";
+import { identity, memoizeWith } from "ramda";
+import { match } from "ts-pattern";
+const agentsSessionCookie = "auth";
+function setCookieFor(request) {
+    return httpOnlyCookie(new URL(request.url).protocol === "https:");
+}
+const keyFor = memoizeWith(identity, (secret) => purposeKey(secret, "agents-session"));
+export async function sessionSetCookies(args) {
+    const { cookies, state, request } = args;
+    return sealedChunkCookies({
+        cookies: cookiesOf(request),
+        name: cookies.prefix,
+        setCookie: setCookieFor(request),
+        key: await keyFor(cookies.secret),
+        value: state,
+        maxAge: sessionMaxAgeSeconds,
+    });
+}
+export function clearSessionSetCookies(cookies, request) {
+    return expiredChunkCookies({ cookies: cookiesOf(request), name: cookies.prefix, setCookie: setCookieFor(request) });
+}
+function asSessionState(value) {
+    if (typeof value !== "object" || value === null || !("upstreamCookies" in value))
+        return undefined;
+    const { upstreamCookies } = value;
+    if (typeof upstreamCookies !== "object" || upstreamCookies === null)
+        return undefined;
+    const entries = Object.entries(upstreamCookies).filter((entry) => isPresent(entry[0]) && typeof entry[1] === "string");
+    return isPresent(entries) ? { upstreamCookies: Object.fromEntries(entries) } : undefined;
+}
+export async function readSession(cookies, request) {
+    const key = await keyFor(cookies.secret);
+    return asSessionState(await unsealedChunks({ cookies: cookiesOf(request), name: cookies.prefix, key }));
+}
+export function isSignedIn(state) {
+    return isPresent(state?.upstreamCookies[agentsSessionCookie]);
+}
+export function upstreamCookieHeader(state) {
+    return Object.entries(state.upstreamCookies)
+        .map(([name, value]) => `${name}=${value}`)
+        .join("; ");
+}
+function expires(attributes) {
+    return attributes.some((attribute) => {
+        const [rawName = "", ...rest] = attribute.split("=");
+        const value = rest.join("=").trim();
+        return match(rawName.trim().toLowerCase())
+            .with("max-age", () => isPresent(value) && Number(value) <= 0)
+            .with("expires", () => Date.parse(value) <= Date.now())
+            .otherwise(() => false);
+    });
+}
+export function captureUpstreamCookies(args) {
+    const { state, response } = args;
+    const jar = { ...state.upstreamCookies };
+    for (const header of response.headers.getSetCookie()) {
+        const [pair = "", ...attributes] = header.split(";");
+        const index = pair.indexOf("=");
+        const name = pair.slice(0, Math.max(index, 0)).trim();
+        if (!isPresent(name))
+            continue;
+        const value = pair.slice(index + 1).trim();
+        if (!isPresent(value) || expires(attributes))
+            delete jar[name];
+        else
+            jar[name] = value;
+    }
+    return { upstreamCookies: jar };
+}
+//# sourceMappingURL=session.js.map

package/dist/worker/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/worker/session.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,GAEf,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAUnC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,SAAS,YAAY,CAAC,OAAgB;IACpC,OAAO,cAAc,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,EAAE,CAAC,MAAc,EAAuB,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAEpH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAA2B;IACjE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAEzC,OAAO,kBAAkB,CAAC;QACxB,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC;QAC3B,IAAI,EAAE,OAAO,CAAC,MAAM;QACpB,SAAS,EAAE,YAAY,CAAC,OAAO,CAAC;QAChC,GAAG,EAAE,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QACjC,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,oBAAoB;KAC7B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAuB,EAAE,OAAgB;IAC9E,OAAO,mBAAmB,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AACtH,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,iBAAiB,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEnG,MAAM,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;IAElC,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAEtF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,MAAM,CACpD,CAAC,KAAK,EAA6B,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAC1F,CAAC;IAEF,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAuB,EAAE,OAAgB;IACzE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzC,OAAO,cAAc,CAAC,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAA+B;IACxD,OAAO,SAAS,CAAC,KAAK,EAAE,eAAe,CAAC,mBAAmB,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAmB;IACtD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC;SACzC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;SAC1C,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,OAAO,CAAC,UAAoB;IACnC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QACnC,MAAM,CAAC,OAAO,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAErD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAEpC,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aACvC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aAC7D,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;aACtD,SAAS,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAiB;IACtD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAEjC,MAAM,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC,eAAe,EAAE,CAAC;IAEzC,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;QACrD,MAAM,CAAC,IAAI,GAAG,EAAE,EAAE,GAAG,UAAU,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAErD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAEtD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,SAAS;QAE/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAE3C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;;YAC1D,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IAED,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC;AAClC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@manta-eu/react",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "The Manta design system, knowledge-graph UI and agent components",
   "homepage": "https://developers.manta.eu",
   "keywords": [
@@ -13,6 +13,9 @@
   ],
   "license": "MIT",
   "type": "module",
+  "sideEffects": [
+    "**/*.css"
+  ],
   "exports": {
     ".": {
       "manta-source": "./src/index.ts",
@@ -134,6 +137,16 @@
       "types": "./dist/components/AppErrorBoundary.d.ts",
       "import": "./dist/components/AppErrorBoundary.js"
     },
+    "./components/app-gate": {
+      "manta-source": "./src/components/app-gate/index.ts",
+      "types": "./dist/components/app-gate/index.d.ts",
+      "import": "./dist/components/app-gate/index.js"
+    },
+    "./components/app-shell": {
+      "manta-source": "./src/components/app-shell/index.ts",
+      "types": "./dist/components/app-shell/index.d.ts",
+      "import": "./dist/components/app-shell/index.js"
+    },
     "./components/authenticated-chat": {
       "manta-source": "./src/components/authenticated-chat/index.tsx",
       "types": "./dist/components/authenticated-chat/index.d.ts",
@@ -244,6 +257,11 @@
       "types": "./dist/components/planning/ManualActionCard.d.ts",
       "import": "./dist/components/planning/ManualActionCard.js"
     },
+    "./components/planning/PlanLimitsAction": {
+      "manta-source": "./src/components/planning/PlanLimitsAction.tsx",
+      "types": "./dist/components/planning/PlanLimitsAction.d.ts",
+      "import": "./dist/components/planning/PlanLimitsAction.js"
+    },
     "./components/planning/ManualActionList": {
       "manta-source": "./src/components/planning/ManualActionList.tsx",
       "types": "./dist/components/planning/ManualActionList.d.ts",
@@ -356,6 +374,16 @@
       "types": "./dist/hooks/useActionPlanExecution.d.ts",
       "import": "./dist/hooks/useActionPlanExecution.js"
     },
+    "./hooks/usePlanLimits": {
+      "manta-source": "./src/hooks/usePlanLimits.ts",
+      "types": "./dist/hooks/usePlanLimits.d.ts",
+      "import": "./dist/hooks/usePlanLimits.js"
+    },
+    "./hooks/useExecuteAction": {
+      "manta-source": "./src/hooks/useExecuteAction.ts",
+      "types": "./dist/hooks/useExecuteAction.d.ts",
+      "import": "./dist/hooks/useExecuteAction.js"
+    },
     "./hooks/useResolveManualAction": {
       "manta-source": "./src/hooks/useResolveManualAction.ts",
       "types": "./dist/hooks/useResolveManualAction.d.ts",
@@ -471,6 +499,11 @@
       "types": "./dist/lib/format-date.d.ts",
       "import": "./dist/lib/format-date.js"
     },
+    "./lib/graphql-error": {
+      "manta-source": "./src/lib/graphql-error.ts",
+      "types": "./dist/lib/graphql-error.d.ts",
+      "import": "./dist/lib/graphql-error.js"
+    },
     "./lib/iri-labels": {
       "manta-source": "./src/lib/iri-labels.ts",
       "types": "./dist/lib/iri-labels.d.ts",
@@ -561,6 +594,11 @@
       "types": "./dist/components/pill/index.d.ts",
       "import": "./dist/components/pill/index.js"
     },
+    "./plan-limits": {
+      "manta-source": "./src/components/plan-limits/index.tsx",
+      "types": "./dist/components/plan-limits/index.d.ts",
+      "import": "./dist/components/plan-limits/index.js"
+    },
     "./plan-row": {
       "manta-source": "./src/components/plan-row/index.tsx",
       "types": "./dist/components/plan-row/index.d.ts",
@@ -1075,6 +1113,11 @@
       "manta-source": "./src/lib/use-toggle-set.ts",
       "types": "./dist/lib/use-toggle-set.d.ts",
       "import": "./dist/lib/use-toggle-set.js"
+    },
+    "./worker": {
+      "manta-source": "./src/worker/index.ts",
+      "types": "./dist/worker/index.d.ts",
+      "import": "./dist/worker/index.js"
     }
   },
   "files": [
@@ -1086,6 +1129,7 @@
     "!src/coverage"
   ],
   "dependencies": {
+    "@ai-sdk/react": "^4.0.101",
     "@cloudflare/think": "0.17.0",
     "@dagrejs/dagre": "^1.1.4",
     "@hookform/resolvers": "^5.7.1",
@@ -1125,6 +1169,7 @@
     "entities": "^6.0.1",
     "fuse.js": "^7.1.0",
     "graphology": "^0.26.0",
+    "graphql": "^16.13.1",
     "graphql-request": "^7.3.1",
     "hono": "^4.9.8",
     "input-otp": "^1.4.2",
@@ -1154,12 +1199,12 @@
     "usehooks-ts": "^3.1.1",
     "zod": "^4.6.7",
     "zustand": "^5.0.2",
-    "@manta-eu/auth": "0.12.0",
-    "@manta-eu/client": "0.12.0",
-    "@manta-eu/datalog-parser": "0.12.0",
-    "@manta-eu/ldo": "0.12.0",
-    "@manta-eu/lib": "0.12.0",
-    "@manta-eu/rdf-lib": "0.12.0"
+    "@manta-eu/auth": "0.13.0",
+    "@manta-eu/client": "0.13.0",
+    "@manta-eu/datalog-parser": "0.13.0",
+    "@manta-eu/lib": "0.13.0",
+    "@manta-eu/rdf-lib": "0.13.0",
+    "@manta-eu/ldo": "0.13.0"
   },
   "peerDependencies": {
     "@ulb-darmstadt/shacl-form": "^2.1.1-rc1",

package/src/app-subpaths.json

@@ -13,6 +13,8 @@
   "./components/AppErrorBoundary",
   "./components/ErrorBoundary",
   "./components/ai-elements/conversation",
+  "./components/app-gate",
+  "./components/app-shell",
   "./components/authenticated-chat",
   "./components/chat-view/LoadingView",
   "./components/datastore-management/tree",
@@ -34,6 +36,7 @@
   "./components/planning/ExecutionProgressBar",
   "./components/planning/ManualActionCard",
   "./components/planning/ManualActionList",
+  "./components/planning/PlanLimitsAction",
   "./components/planning/RunHistoryTable",
   "./components/planning/TopBar",
   "./components/planning/actioning-view-utils",
@@ -53,6 +56,8 @@
   "./hooks/useAuth",
   "./hooks/useDatastoreSelection",
   "./hooks/useFittedPagination",
+  "./hooks/usePlanLimits",
+  "./hooks/useExecuteAction",
   "./hooks/useResolveManualAction",
   "./hooks/useSelectedModel",
   "./hooks/useUserMessageScroller",
@@ -64,6 +69,7 @@
   "./lib/find-latest-showcase",
   "./lib/find-latest-staged-rule",
   "./lib/format-date",
+  "./lib/graphql-error",
   "./lib/message-grouping",
   "./lib/streamdown-plugins",
   "./lib/structured-data",
@@ -77,6 +83,7 @@
   "./modal",
   "./pagination",
   "./pill",
+  "./plan-limits",
   "./plan-row",
   "./popover",
   "./progress",
@@ -166,5 +173,6 @@
   "./use-formatted-countdown",
   "./use-platform",
   "./use-recent-commands",
-  "./use-toggle-set"
+  "./use-toggle-set",
+  "./worker"
 ]

package/src/components/AppErrorBoundary.tsx

@@ -2,17 +2,20 @@ import type { ReactNode } from "react";
 import { ErrorBoundary } from "./ErrorBoundary";
 import { StatusScreen } from "./layouts/StatusScreen";
 import { Button } from "#components/button/index";
+import { updateNoticeAppName } from "#lib/update-notice";
 
-const copy = {
-  staleChunk: {
-    title: "A new version of Manta is available",
-    description: "This page is running an older version. Reload when you're ready.",
-  },
-  unexpected: {
-    title: "Something went wrong",
-    description: "Manta hit an unexpected error.",
-  },
-};
+function copyFor(appName: string) {
+  return {
+    staleChunk: {
+      title: `A new version of ${appName} is available`,
+      description: "This page is running an older version. Reload when you're ready.",
+    },
+    unexpected: {
+      title: "Something went wrong",
+      description: `${appName} hit an unexpected error.`,
+    },
+  };
+}
 
 export type AppErrorBoundaryProps = {
   children: ReactNode;
@@ -24,7 +27,7 @@ export function AppErrorBoundary(props: AppErrorBoundaryProps) {
       fullScreen
       fallback={({ staleChunk }) => (
         <div className="h-screen" data-testid={staleChunk ? "update-notice-screen" : "app-error-screen"}>
-          <StatusScreen {...(staleChunk ? copy.staleChunk : copy.unexpected)} role="alert">
+          <StatusScreen {...copyFor(updateNoticeAppName())[staleChunk ? "staleChunk" : "unexpected"]} role="alert">
             <Button variant="secondary" onClick={() => window.location.reload()}>
               Reload
             </Button>

package/src/components/app-gate/AppGate.tsx

@@ -0,0 +1,122 @@
+import type { ReactNode } from "react";
+import { useLocation } from "react-router";
+import { AwaitingDatastoreStatus } from "./AwaitingDatastoreStatus";
+import { ErrorRoute } from "./ErrorRoute";
+import { NoDatastoreAccess } from "./NoDatastoreAccess";
+import { PendingInvitations } from "./PendingInvitations";
+import { ServiceError } from "./ServiceError";
+import { LoadingView } from "#components/chat-view/LoadingView";
+import { useAuth } from "#hooks/useAuth";
+import { buildLoginUrl, useLoginRedirect } from "#hooks/useLoginRedirect";
+import { enableDatastoreManagement } from "#lib/build-config";
+import { useActiveDatastore } from "#providers/ActiveDatastoreProvider";
+import { AuthContext, type AuthContextValue } from "#providers/AuthContext";
+import { useMantaClient } from "#providers/MantaClientProvider";
+import { errorRoutePath } from "@manta-eu/client/shared/constants";
+import { isPresent } from "@manta-eu/lib/present";
+
+export type AppGateProps = {
+  children: ReactNode;
+  context?: Pick<AuthContextValue, "canDisconnectCustomApps" | "hasProfilePage">;
+};
+
+export function AppGate(props: AppGateProps) {
+  const { children, context } = props;
+
+  const { pathname } = useLocation();
+
+  const auth = useAuth();
+
+  const { authError } = useLoginRedirect(auth);
+
+  const { mantaBaseUrl } = useMantaClient();
+
+  const { datastoreId: routeDatastoreId, enterDatastore } = useActiveDatastore();
+
+  const {
+    isLoading,
+    error,
+    user,
+    datastore,
+    datastores,
+    isOperator,
+    inOrganization,
+    logout,
+    contextFailed,
+    datastoreAccessGranted,
+    canManageTeam,
+    canManageCustomApps,
+    orgRoles,
+    canManageIntegrations,
+    canManageStreams,
+    canManageSharedMemories,
+    canSwitchDatastore,
+    allowedModels,
+  } = auth;
+
+  if (pathname === errorRoutePath) return <ErrorRoute />;
+
+  if (isLoading) return <LoadingView />;
+
+  if (isPresent(error)) return <ServiceError message={error} />;
+
+  if (isPresent(authError)) {
+    return (
+      <ServiceError
+        title="Sign-in failed"
+        message={authError}
+        onRetry={() => window.location.replace(buildLoginUrl(mantaBaseUrl))}
+        onSignOut={() => void logout()}
+      />
+    );
+  }
+
+  if (!isPresent(user) || (!isOperator && !isPresent(datastore))) {
+    if (contextFailed) return <ServiceError message="Failed to load your account. Please try again." />;
+
+    if (isPresent(user) && !isOperator) {
+      function onSignOut() {
+        void logout();
+      }
+
+      return inOrganization ? (
+        <AwaitingDatastoreStatus inOrganization onSignOut={onSignOut} />
+      ) : (
+        <PendingInvitations onSignOut={onSignOut} />
+      );
+    }
+
+    return <LoadingView />;
+  }
+
+  if (isPresent(routeDatastoreId) && !datastoreAccessGranted) {
+    return (
+      <NoDatastoreAccess
+        requestedDatastoreId={routeDatastoreId}
+        datastore={datastore}
+        onEnter={() => isPresent(datastore) && enterDatastore(datastore.id, { replace: true })}
+      />
+    );
+  }
+
+  const authContextValue: AuthContextValue = {
+    datastore,
+    datastores,
+    user,
+    logout,
+    isOperator,
+    canManageTeam,
+    canManageDatastores: isOperator && enableDatastoreManagement,
+    canManageCustomApps,
+    inOrganization,
+    orgRoles,
+    canManageIntegrations,
+    canManageStreams,
+    canManageSharedMemories,
+    canSwitchDatastore,
+    allowedModels,
+    ...context,
+  };
+
+  return <AuthContext.Provider value={authContextValue}>{children}</AuthContext.Provider>;
+}

package/src/components/app-gate/AwaitingDatastoreStatus.tsx

@@ -0,0 +1,35 @@
+import { FailureAlert } from "./FailureAlert";
+import { Button } from "#components/button/index";
+import { StatusScreen } from "#components/layouts/StatusScreen";
+
+export type AwaitingDatastoreStatusProps = { inOrganization: boolean; failure?: string; onSignOut: () => void };
+
+const settingUpCopy = {
+  title: "We're setting up Manta for you",
+  description: "Our team is getting your account ready. This can take a little while.",
+  hint: "Still here after a while? Ask your administrator to provision a datastore.",
+};
+
+const noOrganizationCopy = {
+  title: "You're not in an organization yet",
+  description: "Ask your administrator to add you to one. This page picks it up on its own.",
+};
+
+export function AwaitingDatastoreStatus(props: AwaitingDatastoreStatusProps) {
+  const { inOrganization, failure, onSignOut } = props;
+
+  const copy = inOrganization ? settingUpCopy : noOrganizationCopy;
+
+  return (
+    <div className="h-screen w-full">
+      <StatusScreen {...copy} branded>
+        <div className="flex w-88 max-w-full flex-col items-center gap-4">
+          <FailureAlert failure={failure} />
+          <Button variant="tertiary" rounded="sm" data-testid="awaiting-datastore-sign-out" onClick={onSignOut}>
+            Sign out
+          </Button>
+        </div>
+      </StatusScreen>
+    </div>
+  );
+}

package/src/components/app-gate/EnterDatastoreRoute.tsx

@@ -0,0 +1,30 @@
+import { LoadingView } from "#components/chat-view/LoadingView";
+import { datastoreRelativePath } from "@manta-eu/client/shared/datastore-path";
+import { isPresent } from "@manta-eu/lib/present";
+import { useEffect } from "react";
+import { useLocation } from "react-router";
+import { AwaitingDatastoreStatus } from "./AwaitingDatastoreStatus";
+import { useActiveDatastore } from "#providers/ActiveDatastoreProvider";
+import { useAuthContext } from "#providers/AuthContext";
+
+export function EnterDatastoreRoute() {
+  const { datastore, inOrganization, logout } = useAuthContext();
+
+  const { enterDatastore } = useActiveDatastore();
+
+  const { pathname, search, hash } = useLocation();
+
+  const datastoreId = datastore?.id;
+
+  useEffect(() => {
+    if (!isPresent(datastoreId)) return;
+
+    enterDatastore(datastoreId, { path: `${datastoreRelativePath(pathname)}${search}${hash}`, replace: true });
+  }, [datastoreId, enterDatastore, pathname, search, hash]);
+
+  if (!isPresent(datastoreId)) {
+    return <AwaitingDatastoreStatus inOrganization={inOrganization === true} onSignOut={() => void logout()} />;
+  }
+
+  return <LoadingView />;
+}

package/src/components/app-gate/ErrorRoute.tsx

@@ -0,0 +1,43 @@
+import { Button } from "#components/button/index";
+import { StatusScreen } from "#components/layouts/StatusScreen";
+import { Link, useSearchParams } from "react-router";
+import { match } from "ts-pattern";
+
+type ErrorCopy = {
+  title: string;
+  description: string;
+};
+
+const genericErrorCopy: ErrorCopy = {
+  title: "Something went wrong",
+  description: "We couldn't open this link.",
+};
+
+function copyForStatus(status: string | null): ErrorCopy {
+  return match(status)
+    .with("400", () => ({
+      title: "Broken link",
+      description: "This link isn't valid.",
+    }))
+    .with("404", () => ({
+      title: "Nothing to open",
+      description: "We couldn't find anything at this link.",
+    }))
+    .otherwise(() => genericErrorCopy);
+}
+
+export function ErrorRoute() {
+  const [searchParams] = useSearchParams();
+
+  const { title, description } = copyForStatus(searchParams.get("status"));
+
+  return (
+    <div className="h-screen w-full">
+      <StatusScreen title={title} description={description} role="alert">
+        <Button asChild variant="secondary">
+          <Link to="/">Back to Manta</Link>
+        </Button>
+      </StatusScreen>
+    </div>
+  );
+}

package/src/components/app-gate/FailureAlert.tsx

@@ -0,0 +1,15 @@
+import { isPresent } from "@manta-eu/lib/present";
+
+export type FailureAlertProps = { failure?: string };
+
+export function FailureAlert(props: FailureAlertProps) {
+  const { failure } = props;
+
+  if (!isPresent(failure)) return null;
+
+  return (
+    <p role="alert" className="text-center text-balance typography-small text-error-foreground">
+      {failure}
+    </p>
+  );
+}