@noodleseed/one 0.172.1 → 0.174.0

package/node_modules/@noodle-borg/service/dist/business-information/business-page.js

@@ -0,0 +1,81 @@
+import { BusinessPageContentSchema, BusinessPagePublicationSchema, BusinessPagePublishRequestSchema, BusinessPageSaveRequestSchema, } from '@noodle-borg/wire-contracts';
+export class BusinessPageError extends Error {
+    code;
+    constructor(code) {
+        super({
+            business_page_forbidden: 'An active business administrator is required.',
+            business_page_conflict: 'The page changed. Reload before trying again.',
+            business_page_not_ready: 'Complete the business details and enable the public assistant before publishing.',
+        }[code]);
+        this.code = code;
+        this.name = 'BusinessPageError';
+    }
+}
+export async function nextBusinessPage(current, input, now, notice, assertReady) {
+    const { operation, ...request } = input.change;
+    if (!['save', 'publish', 'unpublish'].includes(operation))
+        throw new Error('Invalid page operation.');
+    const save = operation === 'save' ? BusinessPageSaveRequestSchema.parse(request) : undefined;
+    const expectedRevision = save?.expectedRevision ?? BusinessPagePublishRequestSchema.parse(request).expectedRevision;
+    if ((current?.revision ?? 0) !== expectedRevision || expectedRevision === 2_147_483_647)
+        throw new BusinessPageError('business_page_conflict');
+    if (operation !== 'save' && !current)
+        throw new BusinessPageError('business_page_conflict');
+    const draft = save?.content ?? current?.draft;
+    if (!draft)
+        throw new BusinessPageError('business_page_conflict');
+    let published = current?.published ?? null;
+    if (operation === 'publish') {
+        if (!notice || !assertReady)
+            throw new BusinessPageError('business_page_not_ready');
+        const ready = await assertReady();
+        published = BusinessPagePublicationSchema.parse({
+            content: draft,
+            notice: notice.notice,
+            noticeRevision: notice.revision,
+            sourceRevision: expectedRevision,
+            deploymentId: ready.deploymentId,
+            publishedAt: now,
+        });
+    }
+    else if (operation === 'unpublish')
+        published = null;
+    return structuredClone({
+        revision: expectedRevision + 1,
+        draft,
+        published,
+        updatedAt: now,
+        updatedBySubject: input.actorSubject,
+    });
+}
+/** Validate decrypted storage without surfacing parser excerpts or business text in errors. */
+export function decodeBusinessPage(value, expectedRevision) {
+    try {
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            throw new Error();
+        const input = value;
+        if (Object.keys(input).sort().join(',') !==
+            'draft,published,revision,updatedAt,updatedBySubject' ||
+            input.revision !== expectedRevision ||
+            !Number.isInteger(expectedRevision) ||
+            expectedRevision < 1 ||
+            expectedRevision > 2_147_483_647 ||
+            typeof input.updatedAt !== 'string' ||
+            !Number.isFinite(Date.parse(input.updatedAt)) ||
+            typeof input.updatedBySubject !== 'string' ||
+            !input.updatedBySubject ||
+            input.updatedBySubject.length > 500)
+            throw new Error();
+        return {
+            revision: expectedRevision,
+            draft: BusinessPageContentSchema.parse(input.draft),
+            published: input.published === null ? null : BusinessPagePublicationSchema.parse(input.published),
+            updatedAt: input.updatedAt,
+            updatedBySubject: input.updatedBySubject,
+        };
+    }
+    catch {
+        throw new Error('Business page storage is unavailable.');
+    }
+}
+//# sourceMappingURL=business-page.js.map

package/node_modules/@noodle-borg/service/dist/business-information/contracts.d.ts

@@ -1,6 +1,7 @@
 import type { ArtifactVariableDeclaration, ManagedCollectionControls } from '@noodle-borg/compiler';
 import type { ManagedRecordQuery } from '@noodle-borg/wire-contracts';
 import type { BusinessNoticeStore } from './business-notice.js';
+import type { BusinessPageStore } from './business-page.js';
 import type { BusinessPrincipalProvider } from './principal-authority.js';
 export type JsonPrimitive = string | number | boolean | null;
 export type JsonValue = JsonPrimitive | JsonObject | readonly JsonValue[];
@@ -433,6 +434,7 @@ export interface ManagedRequestStore {
     }): Promise<number>;
 }
 export interface BusinessInformationStore extends SolutionInstallationStore, BusinessNoticeStore, BusinessGrantStore, ManagedRequestStore {
+    readonly pages: BusinessPageStore;
     configurePrincipalAuthority(provider: BusinessPrincipalProvider | undefined): void;
     listEligibleAssignees(scope: InstallationScope): Promise<readonly BusinessGrant[]>;
 }

package/node_modules/@noodle-borg/service/dist/business-information/in-memory-business-pages.js

@@ -0,0 +1,37 @@
+import { BusinessPageError, nextBusinessPage, } from './business-page.js';
+import { scopeKey } from './pagination.js';
+import { validateScalar, validateScope } from './validation.js';
+/** Process-local test/development adapter; shares installation grant authority and its locks. */
+export class InMemoryBusinessPages {
+    business;
+    locks;
+    principals;
+    now;
+    #records = new Map();
+    constructor(business, locks, principals, now) {
+        this.business = business;
+        this.locks = locks;
+        this.principals = principals;
+        this.now = now;
+    }
+    async get(scope) {
+        return structuredClone(this.#records.get(scopeKey(validateScope(scope))));
+    }
+    async update(input, assertReady) {
+        const scope = validateScope(input.scope);
+        const actorSubject = validateScalar('page actor', input.actorSubject, 500);
+        const key = scopeKey(scope);
+        return this.locks.run(`grants:${key}`, () => this.locks.run(`intake:${key}`, async () => {
+            const grant = await this.business.getGrant(scope, actorSubject);
+            if (!(await this.business.getInstallation(scope)) ||
+                grant?.role !== 'administrator' ||
+                grant.revokedAt ||
+                !(await this.principals.allows(actorSubject)))
+                throw new BusinessPageError('business_page_forbidden');
+            const next = await nextBusinessPage(this.#records.get(key), { ...input, scope, actorSubject }, this.now().toISOString(), await this.business.getBusinessNotice(scope), assertReady);
+            this.#records.set(key, structuredClone(next));
+            return next;
+        }));
+    }
+}
+//# sourceMappingURL=in-memory-business-pages.js.map

package/node_modules/@noodle-borg/service/dist/business-information/in-memory-store.js

@@ -1,6 +1,7 @@
 import { randomUUID } from 'node:crypto';
 import { memoryActivityPage } from './activity-pagination.js';
 import { collectionControlEnabled } from './collection-controls.js';
+import { InMemoryBusinessPages } from './in-memory-business-pages.js';
 import { InMemoryInstallationLifecycle, } from './in-memory-installation-lifecycle.js';
 import { InMemoryBusinessInvitations } from './in-memory-invitations.js';
 import { BusinessMemoryLocks } from './in-memory-locks.js';
@@ -14,6 +15,7 @@ import { BusinessPrincipalAuthority, } from './principal-authority.js';
 import { boundedExportPageSize, boundedPageSize, validateEmail, validateScalar, validateScope, } from './validation.js';
 /** Process-local development/test adapter. Hosted services must use the PostgreSQL adapter. */
 export class InMemoryBusinessInformationStore {
+    pages;
     #installations = new Map();
     #installationIds = new Map();
     #publicIds = new Map();
@@ -36,6 +38,7 @@ export class InMemoryBusinessInformationStore {
         this.#id = options.id ?? randomUUID;
         this.#publicId = options.publicId ?? (() => `sol_${randomUUID().replaceAll('-', '')}`);
         this.#managedDefinition = options.managedDefinition;
+        this.pages = new InMemoryBusinessPages(this, this.#locks, this.#principals, this.#now);
         this.#lifecycle = new InMemoryInstallationLifecycle({
             installations: this.#installations,
             getGrant: (scope, subject) => this.#grants.get(grantKey(scope, subject)),

package/node_modules/@noodle-borg/service/dist/business-information/managed-solution-executable.js

@@ -2,7 +2,15 @@ import { projectManagedCollectionControls, RECORD_OPERATION_SIGNATURES, } from '
 import { collectionToPublicWire } from '../routes/business-information-wire.js';
 import { managedSolutionBlueprint } from './managed-solution-blueprints.js';
 /** System-owned manifest data for an explicitly curated solution, admitted by the ordinary compiler. */
-export function managedSolutionManifest(definition) {
+export function managedSolutionManifest(definition, hostedPageOrigin) {
+    if (hostedPageOrigin !== undefined) {
+        const url = new URL(hostedPageOrigin);
+        if (url.origin !== hostedPageOrigin ||
+            !(url.protocol === 'https:' ||
+                (url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname))))
+            throw new Error('Invalid hosted page origin');
+    }
+    const origins = ['${env.WEBSITE_ORIGIN}', ...(hostedPageOrigin ? [hostedPageOrigin] : [])];
     const ref = definition.reference;
     const blueprint = ref.kind === 'managed' ? managedSolutionBlueprint(ref.definitionId, ref.release) : undefined;
     if (blueprint === undefined)
@@ -40,11 +48,11 @@ export function managedSolutionManifest(definition) {
             })),
             assistant: {
                 model: { kind: 'noodle-managed' },
-                allowedOrigins: ['${env.WEBSITE_ORIGIN}'],
+                allowedOrigins: origins,
                 surfaces: [
                     {
                         mode: 'public',
-                        origins: ['${env.WEBSITE_ORIGIN}'],
+                        origins,
                         capabilities: [{ kind: 'tool', name: blueprint.tool }],
                     },
                 ],

package/node_modules/@noodle-borg/service/dist/business-workspaces/contracts.js

@@ -0,0 +1,52 @@
+import { SLUG_PATTERN, validateSlug } from '@noodle-borg/control-plane/portable';
+import { BusinessWorkspaceRoleSchema } from '@noodle-borg/wire-contracts';
+import { z } from 'zod';
+export const WorkspaceSubjectSchema = z.string().min(1).max(500);
+export const WorkspaceOrgSchema = z
+    .string()
+    .regex(SLUG_PATTERN)
+    .refine((value) => {
+    try {
+        validateSlug('org', value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+});
+export const WorkspaceRevisionSchema = z.number().int().positive().max(2147483647);
+export const WorkspaceMemberSchema = z.strictObject({
+    subject: WorkspaceSubjectSchema,
+    role: BusinessWorkspaceRoleSchema,
+    joinedAt: z.iso.datetime(),
+});
+const invitation = z.strictObject({
+    id: z.string().uuid(),
+    email: z.email().max(254),
+    role: BusinessWorkspaceRoleSchema,
+    tokenDigest: z.string().regex(/^[a-f0-9]{64}$/),
+    createdBy: WorkspaceSubjectSchema,
+    createdAt: z.iso.datetime(),
+    expiresAt: z.iso.datetime(),
+});
+/** Internal encrypted state. Never serialize pending invitation material into a staff response. */
+export const WorkspaceStateSchema = z.strictObject({
+    org: WorkspaceOrgSchema,
+    authorityVersion: z.literal(1),
+    revision: WorkspaceRevisionSchema,
+    initializedBy: WorkspaceSubjectSchema,
+    activatedAt: z.iso.datetime(),
+    members: z.array(WorkspaceMemberSchema).min(1).max(1000),
+    invitations: z.array(invitation).max(100),
+});
+export class BusinessWorkspaceError extends Error {
+    code;
+    currentRevision;
+    constructor(code, currentRevision) {
+        super(code);
+        this.code = code;
+        this.currentRevision = currentRevision;
+        this.name = 'BusinessWorkspaceError';
+    }
+}
+//# sourceMappingURL=contracts.js.map

package/node_modules/@noodle-borg/service/dist/business-workspaces/paths.js

@@ -0,0 +1,17 @@
+const root = /^\/v1\/orgs\/([a-z0-9][a-z0-9-]{0,62})\/business-workspace(?:\/(members|accept|invitations)(?:\/([a-f0-9-]{36}))?)?$/;
+export function parseBusinessWorkspacePath(path) {
+    const match = root.exec(path);
+    if (!match?.[1] || (match[3] && match[2] !== 'invitations'))
+        return undefined;
+    return { org: match[1], action: match[2], id: match[3] };
+}
+export function businessWorkspaceMethod(ref) {
+    if (!ref.action)
+        return 'GET';
+    if (ref.action === 'members')
+        return 'PATCH';
+    if (ref.action === 'invitations' && ref.id)
+        return 'DELETE';
+    return 'POST';
+}
+//# sourceMappingURL=paths.js.map

package/node_modules/@noodle-borg/service/dist/routes/application-drafts.js

@@ -0,0 +1,162 @@
+import { readJsonBody, sendJson } from '@noodle-borg/transport-http';
+import { APPLICATION_DRAFT_LIMITS, ApplicationDraftCreateRequestSchema, ApplicationDraftDiffRequestSchema, ApplicationDraftDiffResponseSchema, ApplicationDraftEditRequestSchema, ApplicationDraftHistoryResponseSchema, ApplicationDraftListResponseSchema, ApplicationDraftResponseSchema, ApplicationDraftRevisionRequestSchema, ApplicationDraftUndoRequestSchema, } from '@noodle-borg/wire-contracts';
+import { ApplicationDraftError } from '../application-drafts/contracts.js';
+import { applicationDraftMethods, parseApplicationDraftPath } from '../application-drafts/paths.js';
+import { admitBusinessTarget, authorizeBusinessApi } from '../business-api-admission.js';
+import { requestIdempotencyKey } from './business-information-request.js';
+/** This bounded authoring surface never forwards a Portal token to general deployment/secrets APIs. */
+export async function handleApplicationDraftRoute(req, res, url, deps) {
+    res.setHeader('cache-control', 'private, no-store');
+    try {
+        await handle(req, res, url, deps);
+    }
+    catch (error) {
+        if (error instanceof ApplicationDraftError) {
+            const status = error.code === 'forbidden'
+                ? 403
+                : error.code === 'not_found'
+                    ? 404
+                    : error.code === 'draft_deleted'
+                        ? 410
+                        : error.code === 'invalid_draft'
+                            ? 400
+                            : 409;
+            return sendJson(res, status, {
+                error: error.code.replaceAll('_', ' '),
+                code: error.code,
+                ...(error.currentRevision === undefined ? {} : { currentRevision: error.currentRevision }),
+            });
+        }
+        // Do not reflect compiler/source/cipher errors or log their customer-controlled messages.
+        return sendJson(res, 503, {
+            error: 'Draft storage is temporarily unavailable.',
+            code: 'drafts_unavailable',
+        });
+    }
+}
+async function handle(req, res, url, deps) {
+    const ref = parseApplicationDraftPath(url.pathname);
+    if (!ref)
+        return sendJson(res, 404, { error: 'draft route not found' });
+    const { org, app, id, action } = ref;
+    const identity = await authorizeBusinessApi(req, res, deps);
+    if (!identity)
+        return;
+    const permission = req.method === 'GET' ? 'drafts:read' : 'drafts:edit';
+    if ((await deps.workspaces.authorize(org, identity.subject, permission)) !== 'allowed') {
+        return sendJson(res, 403, { error: 'Workspace draft permission required.', code: 'forbidden' });
+    }
+    if (!(await admitBusinessTarget(res, { org })))
+        return;
+    const scope = { org, app }, actorSubject = identity.subject;
+    if (id && req.method === 'GET' && action === 'history') {
+        if ([...url.searchParams].length)
+            return invalid(res);
+        const revisions = await deps.drafts.history(scope, id, actorSubject);
+        return sendJson(res, 200, ApplicationDraftHistoryResponseSchema.parse({ ok: true, data: { revisions } }));
+    }
+    if (id && req.method === 'GET' && action === 'diff') {
+        if ([...url.searchParams].length !== 2 ||
+            [...url.searchParams].some(([key, value]) => !['from', 'to'].includes(key) || !/^[1-9]\d{0,9}$/.test(value)))
+            return invalid(res);
+        const parsed = ApplicationDraftDiffRequestSchema.safeParse({
+            from: Number(url.searchParams.get('from')),
+            to: Number(url.searchParams.get('to')),
+        });
+        if (!parsed.success)
+            return invalid(res);
+        const diff = await deps.drafts.diff(scope, id, actorSubject, parsed.data.from, parsed.data.to);
+        return sendJson(res, 200, ApplicationDraftDiffResponseSchema.parse({ ok: true, data: { diff } }));
+    }
+    if (req.method === 'GET' && action === undefined) {
+        if (id === undefined) {
+            if ([...url.searchParams].length)
+                return invalid(res);
+            const drafts = await deps.drafts.list(scope, actorSubject);
+            return sendJson(res, 200, ApplicationDraftListResponseSchema.parse({ ok: true, data: { drafts } }));
+        }
+        const queries = [...url.searchParams];
+        const value = url.searchParams.get('revision');
+        if (queries.length > 1 ||
+            queries.some(([key]) => key !== 'revision') ||
+            (value !== null && (!/^[1-9]\d{0,9}$/.test(value) || Number(value) > 2147483647)))
+            return invalid(res);
+        const draft = await deps.drafts.get(scope, id, actorSubject, value === null ? undefined : Number(value));
+        return sendJson(res, 200, ApplicationDraftResponseSchema.parse({ ok: true, data: { draft } }));
+    }
+    const allowed = applicationDraftMethods(ref);
+    if (!allowed.includes(req.method ?? '')) {
+        res.setHeader('allow', allowed.join(', '));
+        return sendJson(res, 405, { error: 'method not allowed' });
+    }
+    if ([...url.searchParams].length)
+        return invalid(res);
+    const body = await readJsonBody(req, Math.min(deps.maxBody, APPLICATION_DRAFT_LIMITS.totalBytes * 6 + 32_768));
+    if (!body.ok)
+        return sendJson(res, body.status, { error: body.error });
+    if (id !== undefined && req.method === 'DELETE') {
+        const parsed = ApplicationDraftRevisionRequestSchema.safeParse(body.value);
+        if (!parsed.success)
+            return invalid(res);
+        await deps.drafts.remove({
+            scope,
+            id,
+            actorSubject,
+            expectedRevision: parsed.data.expectedRevision,
+        });
+        res.writeHead(204);
+        res.end();
+        return;
+    }
+    const idempotencyKey = requestIdempotencyKey(req);
+    if (!idempotencyKey)
+        return invalid(res);
+    if (id === undefined && req.method === 'POST') {
+        const parsed = ApplicationDraftCreateRequestSchema.safeParse(body.value);
+        if (!parsed.success)
+            return invalid(res);
+        const draft = await deps.drafts.create({
+            scope,
+            actorSubject,
+            idempotencyKey,
+            environment: parsed.data.environment,
+            source: parsed.data.source,
+            ...(parsed.data.baseRelease === undefined ? {} : { baseRelease: parsed.data.baseRelease }),
+        });
+        return sendJson(res, 201, ApplicationDraftResponseSchema.parse({ ok: true, data: { draft } }));
+    }
+    if (id && req.method === 'PATCH') {
+        const parsed = ApplicationDraftEditRequestSchema.safeParse(body.value);
+        if (!parsed.success)
+            return invalid(res);
+        const draft = await deps.drafts.edit({
+            scope,
+            id,
+            actorSubject,
+            idempotencyKey,
+            ...parsed.data,
+        });
+        return sendJson(res, 200, ApplicationDraftResponseSchema.parse({ ok: true, data: { draft } }));
+    }
+    if (id && action === 'undo' && req.method === 'POST') {
+        const parsed = ApplicationDraftUndoRequestSchema.safeParse(body.value);
+        if (!parsed.success)
+            return invalid(res);
+        const draft = await deps.drafts.undo({
+            scope,
+            id,
+            actorSubject,
+            idempotencyKey,
+            ...parsed.data,
+        });
+        return sendJson(res, 200, ApplicationDraftResponseSchema.parse({ ok: true, data: { draft } }));
+    }
+    return invalid(res);
+}
+function invalid(res) {
+    sendJson(res, 400, {
+        error: 'Invalid draft request. Review the source, revision and retry key.',
+        code: 'invalid_draft',
+    });
+}
+//# sourceMappingURL=application-drafts.js.map

package/node_modules/@noodle-borg/service/dist/routes/business-authoring-dispatch.js

@@ -0,0 +1,23 @@
+import { applySecurityHeaders, enforceHttps } from '@noodle-borg/transport-http';
+import { parseApplicationDraftPath } from '../application-drafts/paths.js';
+import { parseBusinessWorkspacePath } from '../business-workspaces/paths.js';
+import { handleApplicationDraftRoute, } from './application-drafts.js';
+import { handleBusinessWorkspaceRoute } from './business-workspaces.js';
+/** Explicit versioned authority, independent of the managed-record switch. */
+export function dispatchBusinessAuthoringRoutes(req, res, url, authoring, deps) {
+    if (!authoring)
+        return false;
+    const workspace = parseBusinessWorkspacePath(url.pathname);
+    if (!workspace && !parseApplicationDraftPath(url.pathname))
+        return false;
+    applySecurityHeaders(res, deps.tls);
+    if (!enforceHttps(req, res, deps.tls)) {
+        const merged = { ...deps, ...authoring };
+        if (workspace)
+            void handleBusinessWorkspaceRoute(req, res, url, merged);
+        else
+            void handleApplicationDraftRoute(req, res, url, merged);
+    }
+    return true;
+}
+//# sourceMappingURL=business-authoring-dispatch.js.map

package/node_modules/@noodle-borg/service/dist/routes/business-information-channels.js

@@ -64,6 +64,9 @@ export async function projectBusinessChannels(installation, canEdit, base, deps)
         revision: installation.revision,
         active: installation.intakeActive,
         canEdit,
+        ...(deps.pageOrigin
+            ? { businessPageUrl: `${deps.pageOrigin}/b/${installation.publicId}` }
+            : {}),
         ...(whatsapp
             ? {
                 whatsapp: {

package/node_modules/@noodle-borg/service/dist/routes/business-information-dispatch.js

@@ -1,6 +1,7 @@
 import { OrganizationAgreementError } from '@noodle-borg/control-plane/portable';
 import { sendJson } from '@noodle-borg/transport-http';
 import { BusinessNoticeError } from '../business-information/business-notice.js';
+import { parseBusinessPagePath } from '../business-information/business-page-paths.js';
 import { InstallationCapacityError } from '../business-information/installation-capacity.js';
 import { NativeStorageLimitError } from '../business-information/native-storage-budget.js';
 import { SourceCredentialError } from '../business-information/source-credential-fence.js';
@@ -12,6 +13,7 @@ import { handleBusinessChannels, } from './business-information-channels.js';
 import { handleApplicationConnectionCallback, handleApplicationConnections, } from './business-information-connections.js';
 import { handleBusinessNotice, handleOrganizationAgreement, } from './business-information-notice.js';
 import { handleSolutionInstallationOptions } from './business-information-onboarding.js';
+import { handleBusinessPage, handlePublicBusinessPage } from './business-information-pages.js';
 import { parsePublicSolutionIntakePath, parseSolutionInstallationPath, parseSolutionInvitationAcceptPath, } from './business-information-paths.js';
 import { handlePublicSolutionIntake } from './business-information-public.js';
 import { handleBusinessInformationReaderFloor } from './business-information-reader-floor.js';
@@ -19,6 +21,20 @@ import { handleBusinessSettings } from './business-information-settings.js';
 import { handleCollectionSource } from './business-information-source.js';
 import { handleBusinessInvitationAccept, handleBusinessInvitations, handleEligibleBusinessAssignees, handleMySolutionInstallations, } from './business-information-staff.js';
 export function dispatchBusinessInformationRoutes(req, res, url, deps) {
+    const pageRef = parseBusinessPagePath(url.pathname);
+    const publicPage = /^\/v1\/business-pages\/(sol_[a-f0-9]{32})$/.exec(url.pathname);
+    if (pageRef || publicPage) {
+        if (!deps.pageOrigin || !deps.pageServiceUrl || !deps.registry || !deps.resolveEndpointBase)
+            return run(req, res, deps, () => Promise.resolve(sendJson(res, 404, { error: 'not found' })));
+        const pageDeps = {
+            ...deps,
+            registry: deps.registry,
+            resolveEndpointBase: deps.resolveEndpointBase,
+        };
+        return run(req, res, deps, () => pageRef
+            ? handleBusinessPage(req, res, pageRef, pageDeps)
+            : handlePublicBusinessPage(req, res, publicPage[1], pageDeps));
+    }
     const agreement = /^\/v1\/orgs\/([a-z0-9][a-z0-9-]{0,62})\/agreement$/.exec(url.pathname);
     if (agreement?.[1])
         return run(req, res, deps, () => handleOrganizationAgreement(req, res, agreement[1], deps));

package/node_modules/@noodle-borg/service/dist/routes/business-information-pages.js

@@ -0,0 +1,158 @@
+import { readJsonBody, sendJson } from '@noodle-borg/transport-http';
+import { BusinessPagePublishRequestSchema, BusinessPageResponseSchema, BusinessPageSaveRequestSchema, PublicBusinessPageResponseSchema, } from '@noodle-borg/wire-contracts';
+import { BusinessPageError, } from '../business-information/business-page.js';
+import { businessPageMethods, } from '../business-information/business-page-paths.js';
+import { requireIdentity, requireInstallationPermission } from './business-information.js';
+import { projectBusinessChannels, } from './business-information-channels.js';
+/** Publication custody remains valid independently of temporary assistant availability. */
+async function pageContext(scope, deps) {
+    const installation = await deps.store.getInstallation(scope);
+    const generation = await deps.registry.getAppGeneration(scope.org, scope.app);
+    if (!installation ||
+        !generation ||
+        installation.applicationGeneration !== generation ||
+        (await deps.registry.getAppArchivedAt(scope.org, scope.app)) !== undefined ||
+        !deps.pageOrigin ||
+        !deps.pageServiceUrl ||
+        (deps.businessOnboarding && !(await deps.businessOnboarding.ready(installation))))
+        throw new BusinessPageError('business_page_not_ready');
+    const origin = new URL(deps.pageOrigin);
+    if (origin.origin !== deps.pageOrigin ||
+        !(origin.protocol === 'https:' ||
+            (origin.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(origin.hostname))))
+        throw new BusinessPageError('business_page_not_ready');
+    return { installation, origin: origin.origin, serviceUrl: deps.pageServiceUrl };
+}
+/** Only a current, explicitly configured public assistant can be attached to a hosted page. */
+async function pageReadiness(scope, deps) {
+    const { installation, origin, serviceUrl } = await pageContext(scope, deps);
+    if (!installation.intakeActive || deps.publicIntakeEnabled === false)
+        throw new BusinessPageError('business_page_not_ready');
+    const channels = await projectBusinessChannels(installation, false, serviceUrl, deps);
+    const assistant = channels.assistant;
+    if (assistant.status !== 'ready' ||
+        !assistant.origins.includes(origin) ||
+        !channels.deploymentId ||
+        !assistant.embedId ||
+        !assistant.serviceUrl ||
+        !assistant.scriptUrl)
+        throw new BusinessPageError('business_page_not_ready');
+    return {
+        deploymentId: channels.deploymentId,
+        assistant: {
+            embedId: assistant.embedId,
+            serviceUrl: assistant.serviceUrl,
+            scriptUrl: assistant.scriptUrl,
+        },
+    };
+}
+export async function handleBusinessPage(req, res, ref, deps) {
+    res.setHeader('cache-control', 'private, no-store');
+    if (!businessPageMethods(ref).includes(req.method ?? '')) {
+        res.setHeader('allow', businessPageMethods(ref).join(', '));
+        return sendJson(res, 405, { error: 'method not allowed' });
+    }
+    const identity = await requireIdentity(req, res, deps);
+    if (identity === false)
+        return;
+    const authorized = await requireInstallationPermission(res, ref, identity, 'installation:administer', deps);
+    if (!authorized)
+        return;
+    try {
+        let record = await deps.store.pages.get(authorized.scope);
+        if (req.method !== 'GET') {
+            const body = await readJsonBody(req, Math.min(deps.maxBody, 256 * 1024));
+            if (!body.ok)
+                return sendJson(res, body.status, { error: body.error });
+            let change;
+            if (ref.operation) {
+                const parsed = BusinessPagePublishRequestSchema.safeParse(body.value);
+                if (!parsed.success)
+                    return invalidPage(res);
+                change = { operation: ref.operation, ...parsed.data };
+            }
+            else {
+                const parsed = BusinessPageSaveRequestSchema.safeParse(body.value);
+                if (!parsed.success)
+                    return invalidPage(res);
+                change = { operation: 'save', ...parsed.data };
+            }
+            record = await deps.store.pages.update({ scope: authorized.scope, actorSubject: identity.subject, change }, () => pageReadiness(authorized.scope, deps));
+        }
+        return sendJson(res, 200, BusinessPageResponseSchema.parse({
+            ok: true,
+            data: {
+                revision: record?.revision ?? 0,
+                draft: record?.draft ?? null,
+                published: record?.published ?? null,
+                canEdit: true,
+            },
+        }));
+    }
+    catch (error) {
+        return pageFailure(res, error);
+    }
+}
+export async function handlePublicBusinessPage(req, res, publicId, deps) {
+    res.setHeader('cache-control', 'no-store');
+    res.setHeader('x-robots-tag', 'noindex');
+    if (req.method !== 'GET') {
+        res.setHeader('allow', 'GET');
+        return sendJson(res, 405, { error: 'method not allowed' });
+    }
+    try {
+        const installation = await deps.store.resolveInstallationByPublicId(publicId);
+        if (!installation)
+            return unavailablePage(res);
+        const record = await deps.store.pages.get(installation.scope);
+        if (!record?.published)
+            return unavailablePage(res);
+        await pageContext(installation.scope, deps);
+        const notice = await deps.store.getBusinessNotice(installation.scope);
+        if (notice?.revision !== record.published.noticeRevision)
+            return unavailablePage(res);
+        const ready = await pageReadiness(installation.scope, deps).catch((error) => {
+            if (error instanceof BusinessPageError)
+                return undefined;
+            throw error;
+        });
+        return sendJson(res, 200, PublicBusinessPageResponseSchema.parse({
+            ok: true,
+            data: {
+                publicId,
+                content: record.published.content,
+                notice: record.published.notice,
+                assistant: ready?.deploymentId === record.published.deploymentId ? ready.assistant : null,
+            },
+        }));
+    }
+    catch (error) {
+        if (error instanceof BusinessPageError)
+            return unavailablePage(res);
+        return pageFailure(res, error);
+    }
+}
+function unavailablePage(res) {
+    sendJson(res, 404, { code: 'page_unavailable', error: 'This page is not available.' });
+}
+function invalidPage(res) {
+    sendJson(res, 400, {
+        code: 'business_page_invalid',
+        error: 'Check the page content and revision.',
+    });
+}
+function pageFailure(res, error) {
+    if (error instanceof BusinessPageError) {
+        sendJson(res, error.code === 'business_page_forbidden' ? 403 : 409, {
+            code: error.code,
+            error: error.message,
+        });
+        return;
+    }
+    // Neither decrypted content nor provider/parser exceptions may escape via generic route logging.
+    sendJson(res, 503, {
+        code: 'page_unavailable',
+        error: 'The page service is temporarily unavailable.',
+    });
+}
+//# sourceMappingURL=business-information-pages.js.map