ankka-console 0.10.0

package/dist/testing/fake-issuer.d.ts

@@ -0,0 +1,66 @@
+/**
+ * An OpenID Connect provider in one process, shaped like the platform's Keycloak realm as far as a
+ * client can tell: discovery under `/realms/ankka`, a login form with `username` and `password`
+ * fields, the authorization code grant with PKCE, refresh tokens that rotate but stay valid until
+ * they expire (Keycloak's default), revocation, RP-initiated logout, and an SSO session in a cookie
+ * so a second sign-in in the same browser needs no form.
+ *
+ * Users are `dev` (a platform administrator), `owner`, `member` and `outsider`; each one's password
+ * is its name and its email is `<name>@example.test`, verified. Tests steer it with
+ * `expireSession()` (the next refresh is refused as Keycloak refuses an ended session),
+ * `failNext()` (the next backchannel call fails as an unreachable issuer would) and `sessions`.
+ */
+import { type Server } from "node:http";
+export interface FakeUser {
+    username: string;
+    name: string;
+    email: string;
+    roles: string[];
+}
+export declare const fakeUsers: Record<string, FakeUser>;
+export interface FakeIssuerOptions {
+    clientId?: string;
+    clientSecret?: string;
+    audience?: string;
+    accessTokenSeconds?: number;
+    sessionIdleSeconds?: number;
+    port?: number;
+    /**
+     * The origin the issuer names in its tokens and discovery document, when it is not the address it
+     * listens on — the cluster's situation, where Keycloak is reached in-cluster and named externally.
+     */
+    publicUrl?: string;
+    /**
+     * Keycloak's own behaviour when it is configured with a host name only: the scheme and port of the
+     * issuer come from each request, from its forwarded headers when it has them and from the address
+     * it was reached on when it does not. Set, discovery and tokens name the issuer of the request.
+     */
+    hostOnly?: string;
+}
+interface Session {
+    id: string;
+    sub: string;
+    ended: boolean;
+}
+export interface FakeIssuer {
+    /** The realm's issuer, e.g. `http://127.0.0.1:1234/realms/ankka`. */
+    issuer: string;
+    url: string;
+    server: Server;
+    /** Verifies an access token as the control plane would, offline. */
+    verifyAccessToken(token: string): Promise<Record<string, unknown> | null>;
+    /** End every SSO session of this user: their next refresh is refused with `invalid_grant`. */
+    expireSession(sub: string): void;
+    /** The next token, revocation or discovery request is answered as an unreachable issuer would be. */
+    failNext(): void;
+    sessions: Map<string, Session>;
+    /** Mints a token pair for a user without a browser, for tests that need a bearer. */
+    mint(username: string): Promise<{
+        accessToken: string;
+        refreshToken: string;
+        idToken: string;
+    }>;
+    close(): Promise<void>;
+}
+export declare function fakeIssuer(options?: FakeIssuerOptions): Promise<FakeIssuer>;
+export {};

package/dist/testing/fake-issuer.js

@@ -0,0 +1,303 @@
+/**
+ * An OpenID Connect provider in one process, shaped like the platform's Keycloak realm as far as a
+ * client can tell: discovery under `/realms/ankka`, a login form with `username` and `password`
+ * fields, the authorization code grant with PKCE, refresh tokens that rotate but stay valid until
+ * they expire (Keycloak's default), revocation, RP-initiated logout, and an SSO session in a cookie
+ * so a second sign-in in the same browser needs no form.
+ *
+ * Users are `dev` (a platform administrator), `owner`, `member` and `outsider`; each one's password
+ * is its name and its email is `<name>@example.test`, verified. Tests steer it with
+ * `expireSession()` (the next refresh is refused as Keycloak refuses an ended session),
+ * `failNext()` (the next backchannel call fails as an unreachable issuer would) and `sessions`.
+ */
+import { createServer } from "node:http";
+import { createHash, randomBytes } from "node:crypto";
+import { exportJWK, generateKeyPair, jwtVerify, SignJWT } from "jose";
+export const fakeUsers = {
+    dev: { username: "dev", name: "Dev User", email: "dev@example.test", roles: ["platform-admin"] },
+    owner: { username: "owner", name: "Olive Owner", email: "owner@example.test", roles: [] },
+    member: { username: "member", name: "Max Member", email: "member@example.test", roles: [] },
+    outsider: { username: "outsider", name: "Otto Outsider", email: "outsider@example.test", roles: [] },
+};
+const sha256b64 = (s) => createHash("sha256").update(s).digest("base64url");
+function html(res, status, body) {
+    res.writeHead(status, { "content-type": "text/html; charset=utf-8" }).end(body);
+}
+function json(res, status, body) {
+    res.writeHead(status, { "content-type": "application/json", "cache-control": "no-store" }).end(JSON.stringify(body));
+}
+async function formBody(req) {
+    const chunks = [];
+    for await (const c of req)
+        chunks.push(c);
+    return new URLSearchParams(Buffer.concat(chunks).toString("utf8"));
+}
+function cookie(req, name) {
+    for (const part of (req.headers.cookie ?? "").split(";")) {
+        const [k, ...v] = part.trim().split("=");
+        if (k === name)
+            return v.join("=");
+    }
+    return undefined;
+}
+const escape = (s) => s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;");
+export async function fakeIssuer(options = {}) {
+    const clientId = options.clientId ?? "ankka-console";
+    const clientSecret = options.clientSecret ?? "dev";
+    const audience = options.audience ?? "ankka-controlplane";
+    const accessSeconds = options.accessTokenSeconds ?? 300;
+    const idleSeconds = options.sessionIdleSeconds ?? 1800;
+    const { publicKey, privateKey } = await generateKeyPair("RS256");
+    const jwk = { ...(await exportJWK(publicKey)), kid: "fake-1", alg: "RS256", use: "sig" };
+    const sessions = new Map();
+    const codes = new Map();
+    const refreshes = new Map();
+    let failures = 0;
+    let issuer = "";
+    let listeningPort = 0;
+    /** The issuer as this request would make Keycloak name it; the configured one unless `hostOnly`. */
+    const issuerOf = (req) => {
+        if (!options.hostOnly)
+            return issuer;
+        const proto = String(req.headers["x-forwarded-proto"] ?? "http");
+        const port = String(req.headers["x-forwarded-port"] ?? listeningPort);
+        const shown = (proto === "https" && port === "443") || (proto === "http" && port === "80") ? "" : `:${port}`;
+        return `${proto}://${options.hostOnly}${shown}/realms/ankka`;
+    };
+    const sign = (claims, seconds, iss = issuer, key = privateKey) => new SignJWT(claims)
+        .setProtectedHeader({ alg: "RS256", kid: "fake-1", typ: "JWT" })
+        .setIssuer(iss)
+        .setIssuedAt()
+        .setExpirationTime(Math.floor(Date.now() / 1000) + seconds)
+        .sign(key);
+    async function tokensFor(sub, sessionId, nonce, iss = issuer) {
+        const user = fakeUsers[sub];
+        const identity = { name: user.name, email: user.email, email_verified: true, preferred_username: user.username };
+        const accessToken = await sign({ ...identity, sub, aud: [audience], azp: clientId, sid: sessionId, realm_access: { roles: user.roles }, typ: "Bearer" }, accessSeconds, iss);
+        const idToken = await sign({ ...identity, sub, aud: clientId, azp: clientId, sid: sessionId, ...(nonce ? { nonce } : {}) }, accessSeconds, iss);
+        // Keycloak's refresh tokens are signed JWTs of several hundred bytes; so are these, so a cookie
+        // that carries one is measured at a realistic size.
+        const refreshToken = await sign({ sub, sid: sessionId, typ: "Refresh", aud: issuer, jti: randomBytes(16).toString("hex") }, idleSeconds, iss);
+        refreshes.set(refreshToken, { sessionId, sub, exp: Date.now() + idleSeconds * 1000, revoked: false });
+        return { accessToken, idToken, refreshToken };
+    }
+    const tokenResponse = (t) => ({
+        access_token: t.accessToken,
+        id_token: t.idToken,
+        refresh_token: t.refreshToken,
+        token_type: "Bearer",
+        expires_in: accessSeconds,
+        refresh_expires_in: idleSeconds,
+        scope: "openid",
+    });
+    function clientAuthenticated(req, form) {
+        const header = req.headers.authorization ?? "";
+        if (header.startsWith("Basic ")) {
+            const [id, secret] = Buffer.from(header.slice(6), "base64").toString("utf8").split(":").map(decodeURIComponent);
+            return id === clientId && secret === clientSecret;
+        }
+        return form.get("client_id") === clientId && form.get("client_secret") === clientSecret;
+    }
+    function loginPage(params, error) {
+        const hidden = [...params.entries()]
+            .map(([k, v]) => `<input type="hidden" name="${escape(k)}" value="${escape(v)}">`)
+            .join("");
+        return `<!doctype html><html lang="en"><head><title>Sign in to ankka</title></head><body>
+<main><h1>Sign in to your account</h1>${error ? `<p id="input-error" role="alert">${escape(error)}</p>` : ""}
+<form id="kc-form-login" method="post" action="${escape(issuer)}/protocol/openid-connect/auth">${hidden}
+<label for="username">Username or email</label><input id="username" name="username" autocomplete="username">
+<label for="password">Password</label><input id="password" name="password" type="password" autocomplete="current-password">
+<button id="kc-login" type="submit">Sign In</button></form></main></body></html>`;
+    }
+    function redirectWithCode(res, params, session) {
+        const code = randomBytes(24).toString("base64url");
+        codes.set(code, {
+            sub: session.sub,
+            sessionId: session.id,
+            redirectUri: params.get("redirect_uri") ?? "",
+            nonce: params.get("nonce") ?? undefined,
+            challenge: params.get("code_challenge") ?? undefined,
+            expires: Date.now() + 60_000,
+        });
+        const target = new URL(params.get("redirect_uri"));
+        target.searchParams.set("code", code);
+        if (params.get("state"))
+            target.searchParams.set("state", params.get("state"));
+        target.searchParams.set("iss", issuer);
+        res
+            .writeHead(302, {
+            location: target.toString(),
+            "set-cookie": `FAKE_SSO=${session.id}; Path=/realms/ankka; HttpOnly; SameSite=Lax`,
+        })
+            .end();
+    }
+    const realm = "/realms/ankka";
+    const server = createServer(async (req, res) => {
+        const url = new URL(req.url ?? "/", "http://fake");
+        const path = url.pathname;
+        try {
+            if (path === `${realm}/.well-known/openid-configuration`) {
+                if (failures > 0)
+                    return (failures--, void req.socket.destroy());
+                return json(res, 200, {
+                    issuer: issuerOf(req),
+                    authorization_endpoint: `${issuerOf(req)}/protocol/openid-connect/auth`,
+                    token_endpoint: `${issuerOf(req)}/protocol/openid-connect/token`,
+                    jwks_uri: `${issuerOf(req)}/protocol/openid-connect/certs`,
+                    revocation_endpoint: `${issuerOf(req)}/protocol/openid-connect/revoke`,
+                    end_session_endpoint: `${issuerOf(req)}/protocol/openid-connect/logout`,
+                    response_types_supported: ["code"],
+                    subject_types_supported: ["public"],
+                    id_token_signing_alg_values_supported: ["RS256"],
+                    code_challenge_methods_supported: ["S256"],
+                    token_endpoint_auth_methods_supported: ["client_secret_basic", "client_secret_post"],
+                    grant_types_supported: ["authorization_code", "refresh_token"],
+                });
+            }
+            if (path === `${realm}/protocol/openid-connect/certs`)
+                return json(res, 200, { keys: [jwk] });
+            if (path === `${realm}/protocol/openid-connect/auth` && req.method === "GET") {
+                const params = url.searchParams;
+                if (params.get("client_id") !== clientId)
+                    return html(res, 400, "<p>Client not found.</p>");
+                if (!params.get("redirect_uri"))
+                    return html(res, 400, "<p>Invalid parameter: redirect_uri</p>");
+                const sso = sessions.get(cookie(req, "FAKE_SSO") ?? "");
+                if (sso && !sso.ended)
+                    return redirectWithCode(res, params, sso);
+                return html(res, 200, loginPage(params));
+            }
+            if (path === `${realm}/protocol/openid-connect/auth` && req.method === "POST") {
+                const form = await formBody(req);
+                const username = form.get("username") ?? "";
+                const user = fakeUsers[username] ?? Object.values(fakeUsers).find((u) => u.email === username);
+                const params = new URLSearchParams([...form.entries()].filter(([k]) => k !== "username" && k !== "password"));
+                if (!user || form.get("password") !== user.username)
+                    return html(res, 200, loginPage(params, "Invalid username or password."));
+                const session = { id: randomBytes(12).toString("hex"), sub: user.username, ended: false };
+                sessions.set(session.id, session);
+                return redirectWithCode(res, params, session);
+            }
+            if (path === `${realm}/protocol/openid-connect/token` && req.method === "POST") {
+                if (failures > 0)
+                    return (failures--, void req.socket.destroy());
+                const form = await formBody(req);
+                if (!clientAuthenticated(req, form))
+                    return json(res, 401, { error: "unauthorized_client", error_description: "Invalid client or Invalid client credentials" });
+                const grant = form.get("grant_type");
+                if (grant === "authorization_code") {
+                    const code = codes.get(form.get("code") ?? "");
+                    codes.delete(form.get("code") ?? "");
+                    if (!code || code.expires < Date.now())
+                        return json(res, 400, { error: "invalid_grant", error_description: "Code not valid" });
+                    if (code.redirectUri !== form.get("redirect_uri"))
+                        return json(res, 400, { error: "invalid_grant", error_description: "Incorrect redirect_uri" });
+                    if (code.challenge && sha256b64(form.get("code_verifier") ?? "") !== code.challenge)
+                        return json(res, 400, { error: "invalid_grant", error_description: "PKCE verification failed" });
+                    const session = sessions.get(code.sessionId);
+                    if (!session || session.ended)
+                        return json(res, 400, { error: "invalid_grant", error_description: "Session not active" });
+                    return json(res, 200, tokenResponse(await tokensFor(code.sub, code.sessionId, code.nonce, issuerOf(req))));
+                }
+                if (grant === "refresh_token") {
+                    const token = form.get("refresh_token") ?? "";
+                    const record = refreshes.get(token);
+                    const session = record ? sessions.get(record.sessionId) : undefined;
+                    if (!record || record.revoked || record.exp < Date.now() || !session || session.ended)
+                        return json(res, 400, { error: "invalid_grant", error_description: "Session not active" });
+                    return json(res, 200, tokenResponse(await tokensFor(record.sub, record.sessionId, undefined, issuerOf(req))));
+                }
+                return json(res, 400, { error: "unsupported_grant_type" });
+            }
+            if (path === `${realm}/protocol/openid-connect/revoke` && req.method === "POST") {
+                if (failures > 0)
+                    return (failures--, void req.socket.destroy());
+                const form = await formBody(req);
+                if (!clientAuthenticated(req, form))
+                    return json(res, 401, { error: "unauthorized_client" });
+                const record = refreshes.get(form.get("token") ?? "");
+                if (record)
+                    record.revoked = true;
+                return void res.writeHead(200).end();
+            }
+            // Keycloak's server-to-server logout: a confidential client posts the session's refresh token
+            // and the user session ends, with no browser and no identity token.
+            if (path === `${realm}/protocol/openid-connect/logout` && req.method === "POST") {
+                if (failures > 0)
+                    return (failures--, void req.socket.destroy());
+                const form = await formBody(req);
+                if (!clientAuthenticated(req, form))
+                    return json(res, 401, { error: "unauthorized_client" });
+                const record = refreshes.get(form.get("refresh_token") ?? "");
+                if (!record)
+                    return json(res, 400, { error: "invalid_grant", error_description: "Invalid refresh token" });
+                const session = sessions.get(record.sessionId);
+                if (session)
+                    session.ended = true;
+                return void res.writeHead(204).end();
+            }
+            if (path === `${realm}/protocol/openid-connect/logout`) {
+                const hint = url.searchParams.get("id_token_hint");
+                let sid = cookie(req, "FAKE_SSO");
+                if (hint) {
+                    try {
+                        const { payload } = await jwtVerify(hint, publicKey, { issuer });
+                        sid = String(payload.sid);
+                    }
+                    catch {
+                        // An expired hint still names the session in Keycloak; decode without verifying time.
+                        sid = String(JSON.parse(Buffer.from(hint.split(".")[1], "base64url").toString()).sid);
+                    }
+                }
+                const session = sessions.get(sid ?? "");
+                if (session)
+                    session.ended = true;
+                const after = url.searchParams.get("post_logout_redirect_uri");
+                res.setHeader("set-cookie", "FAKE_SSO=; Path=/realms/ankka; Max-Age=0");
+                if (after)
+                    return void res.writeHead(302, { location: after }).end();
+                return html(res, 200, "<p>You are logged out.</p>");
+            }
+            html(res, 404, "<p>Not found</p>");
+        }
+        catch (e) {
+            json(res, 500, { error: "server_error", error_description: String(e) });
+        }
+    });
+    await new Promise((resolve) => server.listen(options.port ?? 0, "127.0.0.1", resolve));
+    const base = `http://127.0.0.1:${server.address().port}`;
+    listeningPort = server.address().port;
+    issuer = `${options.publicUrl ?? base}${realm}`;
+    return {
+        issuer,
+        url: base,
+        server,
+        sessions,
+        async verifyAccessToken(token) {
+            try {
+                const { payload } = await jwtVerify(token, publicKey, { issuer, audience });
+                return payload;
+            }
+            catch {
+                return null;
+            }
+        },
+        expireSession(sub) {
+            for (const s of sessions.values())
+                if (s.sub === sub)
+                    s.ended = true;
+        },
+        failNext() {
+            failures += 1;
+        },
+        async mint(username) {
+            const session = { id: randomBytes(12).toString("hex"), sub: username, ended: false };
+            sessions.set(session.id, session);
+            return tokensFor(username, session.id);
+        },
+        close: () => new Promise((resolve) => {
+            server.closeAllConnections();
+            server.close(() => resolve());
+        }),
+    };
+}

package/dist/testing/index.d.ts

@@ -0,0 +1,5 @@
+export { fakeControlPlane } from "./fake-control-plane.ts";
+export type { FakeClaims, FakeControlPlane, FakeControlPlaneOptions, FakeSeed } from "./fake-control-plane.ts";
+export { fakeIssuer, fakeUsers } from "./fake-issuer.ts";
+export type { FakeIssuer, FakeIssuerOptions, FakeUser } from "./fake-issuer.ts";
+export { scenarios } from "./scenarios.ts";

package/dist/testing/index.js

@@ -0,0 +1,3 @@
+export { fakeControlPlane } from "./fake-control-plane.js";
+export { fakeIssuer, fakeUsers } from "./fake-issuer.js";
+export { scenarios } from "./scenarios.js";

package/dist/testing/scenarios.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Every acceptance scenario the browser suite must exercise, by the id the specification gives it.
+ * A Playwright test covers a scenario by starting its title with the id: `test("US1-3 sign-out …")`.
+ * The suite's own scenarios test fails when an id here has no test (SC-011).
+ */
+export declare const scenarios: Record<string, string>;

package/dist/testing/scenarios.js

@@ -0,0 +1,44 @@
+/**
+ * Every acceptance scenario the browser suite must exercise, by the id the specification gives it.
+ * A Playwright test covers a scenario by starting its title with the id: `test("US1-3 sign-out …")`.
+ * The suite's own scenarios test fails when an id here has no test (SC-011).
+ */
+export const scenarios = {
+    "US1-1": "a deep link sends a stranger to sign in and back to the deep link",
+    "US1-2": "no token in any cookie, storage or response body; the cookie is HttpOnly, same-site, small",
+    "US1-3": "sign-out ends the console's session and the identity provider's",
+    "US1-4": "an ended session sends the person to sign in and back",
+    "US1-5": "a callback with a state the console did not issue is refused",
+    "US1-6": "a return-to naming another site lands on the front page",
+    "US1-7": "a session works on every instance and survives an instance restarting",
+    "US1-8": "an unreachable identity provider is explained, and the session is kept",
+    "US2-1": "a member sees their organizations with their role, and nothing else",
+    "US2-2": "a platform administrator sees every organization",
+    "US2-3": "creating an organization lands on it, read by id",
+    "US2-4": "an owner renames an organization; a member is not offered it",
+    "US2-5": "an empty organization is deleted; a non-empty one is refused with the reason",
+    "US2-6": "a deleted id cannot be reused, and the page says so",
+    "US2-7": "projects are created, renamed and deleted; one with services cannot be deleted",
+    "US2-8": "where only administrators create organizations, the refusal names the sign-up address",
+    "US3-1": "a project lists its services with state, instances, image, generation and hostname",
+    "US3-2": "a service shows every status field and its attributed history",
+    "US3-3": "a descriptor is applied, and a refused one shows every problem",
+    "US3-4": "pause, resume, restart, expose and unexpose take effect and show the control plane's state",
+    "US3-4a": "a service page and a listing follow the control plane's changes live",
+    "US3-5": "an exposed service's hostname is a link",
+    "US3-6": "logs with the CLI's choices, followed live",
+    "US3-7": "a deleted service is gone, and applying the name again continues its generation",
+    "US3-8": "a suspended service reads Suspended and its operations are refused, not hidden",
+    "US4-1": "an owner sees members and pending invitations",
+    "US4-2": "an invitation is claimed when the invited person signs in",
+    "US4-3": "roles change and members are removed; the last owner cannot be",
+    "US4-4": "a member sees the list and no controls; a machine is shown as one",
+    "US4-5": "a deploy token's secret is shown once, and not after a reload",
+    "US4-6": "a revoked token is refused",
+    "US4-7": "an administrator disables and enables an organization",
+    "US4-8": "an administrator sets and clears a quota",
+    "US7-1": "every page is rendered before any script runs",
+    "US7-2": "navigation with scripts does not reload the document",
+    "US7-3": "every operation works with scripts disabled",
+    "US7-4": "a second submission while the first is in flight performs nothing",
+};

package/dist/ui/console.d.ts

@@ -0,0 +1,60 @@
+/**
+ * The pieces every page shares: where the package is mounted, who is signed in, the host's
+ * extensions, links and forms that stay under the mount, and a submit button that cannot be pressed
+ * twice while its form is in flight.
+ */
+import { type ReactNode } from "react";
+import { type FormProps, type LinkProps } from "react-router";
+import type { ConsoleExtensions, Operation } from "../extensions/types.ts";
+import type { ConsolePageData } from "../context.ts";
+/**
+ * Hands the host's extensions to the pages. Rendered in the host's layout, around its `<Outlet />`,
+ * with the same `extensions` object given to `consoleMiddleware`, so panels render in the browser as
+ * well as on the server.
+ */
+export declare function ConsoleProvider({ extensions, children }: {
+    extensions?: ConsoleExtensions;
+    children: ReactNode;
+}): import("react").JSX.Element;
+export interface UseConsole extends ConsolePageData {
+    extensions: ConsoleExtensions;
+    href(path?: string): string;
+    shows(operation: Operation): boolean;
+}
+/** The console's page data, from whichever package page is matched; usable in the host's layout too. */
+export declare function useConsole(): UseConsole;
+/** A link under the mount, fetched ahead when the pointer or focus shows intent. */
+export declare function ConsoleLink({ to, ...rest }: Omit<LinkProps, "to"> & {
+    to: string;
+}): import("react").JSX.Element;
+/**
+ * A form posting to a path under the mount (the current page when `to` is absent), carrying the
+ * operation's name as `intent`. It works as plain HTML with scripts off; with scripts on, its submit
+ * control is disabled while it is in flight so a second press sends nothing.
+ */
+export declare function ConsoleForm({ to, intent, children, ...rest }: Omit<FormProps, "action"> & {
+    to?: string;
+    intent?: string;
+    children: ReactNode;
+}): import("react").JSX.Element;
+export declare function Submit({ intent, children, danger }: {
+    intent?: string;
+    children: ReactNode;
+    danger?: boolean;
+}): import("react").JSX.Element;
+/** A labelled field; a refusal about it is announced with it. */
+export declare function Field({ label, name, hint, error, ...input }: {
+    label: string;
+    name: string;
+    hint?: string;
+    error?: string;
+} & React.InputHTMLAttributes<HTMLInputElement>): import("react").JSX.Element;
+export interface Crumb {
+    label: string;
+    to?: string;
+}
+/** Where the page sits in the installation: organization, project, service. */
+export declare function Breadcrumbs({ trail }: {
+    trail: Crumb[];
+}): import("react").JSX.Element;
+export declare function when(date: string | undefined): string;

package/dist/ui/console.js

@@ -0,0 +1,73 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * The pieces every page shares: where the package is mounted, who is signed in, the host's
+ * extensions, links and forms that stay under the mount, and a submit button that cannot be pressed
+ * twice while its form is in flight.
+ */
+import { createContext, useContext } from "react";
+import { Form, Link, useMatches, useNavigation } from "react-router";
+const ExtensionsContext = createContext({});
+/**
+ * Hands the host's extensions to the pages. Rendered in the host's layout, around its `<Outlet />`,
+ * with the same `extensions` object given to `consoleMiddleware`, so panels render in the browser as
+ * well as on the server.
+ */
+export function ConsoleProvider({ extensions, children }) {
+    return _jsx(ExtensionsContext.Provider, { value: extensions ?? {}, children: children });
+}
+/** The console's page data, from whichever package page is matched; usable in the host's layout too. */
+export function useConsole() {
+    const matches = useMatches();
+    const extensions = useContext(ExtensionsContext);
+    let page;
+    for (const m of matches) {
+        const d = m.loaderData;
+        if (d && typeof d === "object" && d.console)
+            page = d.console;
+    }
+    const mount = page?.mount ?? "/";
+    const hidden = new Set([...(page?.hidden ?? []), ...(extensions.hidden ?? [])]);
+    return {
+        mount,
+        principal: page?.principal ?? null,
+        hidden: [...hidden],
+        extensions,
+        href: (path = "") => mount + path.replace(/^\/+/, ""),
+        shows: (operation) => !hidden.has(operation),
+    };
+}
+/** A link under the mount, fetched ahead when the pointer or focus shows intent. */
+export function ConsoleLink({ to, ...rest }) {
+    const { href } = useConsole();
+    return _jsx(Link, { to: href(to), prefetch: "intent", ...rest });
+}
+/**
+ * A form posting to a path under the mount (the current page when `to` is absent), carrying the
+ * operation's name as `intent`. It works as plain HTML with scripts off; with scripts on, its submit
+ * control is disabled while it is in flight so a second press sends nothing.
+ */
+export function ConsoleForm({ to, intent, children, ...rest }) {
+    const { href } = useConsole();
+    return (_jsxs(Form, { method: "post", action: to === undefined ? undefined : href(to), ...rest, children: [intent ? _jsx("input", { type: "hidden", name: "intent", value: intent }) : null, children] }));
+}
+export function Submit({ intent, children, danger }) {
+    const navigation = useNavigation();
+    const busy = navigation.state === "submitting" && (intent === undefined || navigation.formData?.get("intent") === intent);
+    return (_jsx("button", { type: "submit", className: danger ? "ac-button ac-button-danger" : "ac-button", disabled: busy, "aria-busy": busy || undefined, children: children }));
+}
+/** A labelled field; a refusal about it is announced with it. */
+export function Field({ label, name, hint, error, ...input }) {
+    const hintId = hint ? `${name}-hint` : undefined;
+    const errorId = error ? `${name}-error` : undefined;
+    return (_jsxs("div", { className: "ac-field", children: [_jsx("label", { htmlFor: name, children: label }), _jsx("input", { id: name, name: name, "aria-describedby": [hintId, errorId].filter(Boolean).join(" ") || undefined, "aria-invalid": error ? true : undefined, ...input }), hint ? _jsx("p", { className: "ac-hint", id: hintId, children: hint }) : null, error ? _jsx("p", { className: "ac-field-error", id: errorId, children: error }) : null] }));
+}
+/** Where the page sits in the installation: organization, project, service. */
+export function Breadcrumbs({ trail }) {
+    return (_jsx("nav", { "aria-label": "Breadcrumb", className: "ac-crumbs", children: _jsx("ol", { children: trail.map((c, i) => (_jsx("li", { children: c.to && i < trail.length - 1 ? _jsx(ConsoleLink, { to: c.to, children: c.label }) : _jsx("span", { "aria-current": i === trail.length - 1 ? "page" : undefined, children: c.label }) }, i))) }) }));
+}
+export function when(date) {
+    if (!date)
+        return "—";
+    const d = new Date(date);
+    return Number.isNaN(d.getTime()) ? date : d.toLocaleString("en-GB", { dateStyle: "medium", timeStyle: "short", timeZone: "UTC" }) + " UTC";
+}

package/dist/ui/errors.d.ts

@@ -0,0 +1,6 @@
+/** A refusal from the control plane, shown beside the thing refused, in the control plane's words. */
+export declare function Refusal({ reason, problems }: {
+    reason?: string;
+    problems?: string[];
+}): import("react").JSX.Element | null;
+export declare function ConsoleErrorBoundary(): import("react").JSX.Element;

package/dist/ui/errors.js

@@ -0,0 +1,30 @@
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * What a page shows instead of itself when it cannot be shown: access lost, a refusal, something
+ * unavailable. Every package route exports `ErrorBoundary` from here.
+ */
+import { isRouteErrorResponse, useRouteError } from "react-router";
+import { ConsoleLink } from "./console.js";
+/** A refusal from the control plane, shown beside the thing refused, in the control plane's words. */
+export function Refusal({ reason, problems }) {
+    if (!reason && (!problems || problems.length === 0))
+        return null;
+    return (_jsx("div", { className: "ac-refusal", role: "alert", children: problems && problems.length > 1 ? (_jsxs(_Fragment, { children: [_jsx("p", { children: "The control plane refused this:" }), _jsx("ul", { children: problems.map((p) => (_jsx("li", { children: p }, p))) })] })) : (_jsx("p", { children: problems?.[0] ?? reason })) }));
+}
+export function ConsoleErrorBoundary() {
+    const error = useRouteError();
+    if (isRouteErrorResponse(error) && error.data && typeof error.data === "object" && "kind" in error.data) {
+        const failure = error.data;
+        if (failure.kind === "lost") {
+            return (_jsxs("section", { className: "ac-page ac-failure", children: [_jsx("h1", { children: "You no longer have access to this" }), _jsx("p", { children: "It was deleted, or you are no longer a member of the organization it belongs to." }), _jsx("p", { children: _jsx(ConsoleLink, { to: "", children: "Go to your organizations" }) })] }));
+        }
+        if (failure.kind === "unavailable") {
+            return (_jsxs("section", { className: "ac-page ac-failure", children: [_jsxs("h1", { children: ["The ", failure.what, " is not answering"] }), _jsx("p", { children: "Your session is kept. Try again in a few seconds." }), _jsx("p", { className: "ac-hint", children: failure.reason }), _jsx("p", { children: _jsx("a", { className: "ac-button", href: "", children: "Try again" }) })] }));
+        }
+        return (_jsxs("section", { className: "ac-page ac-failure", children: [_jsx("h1", { children: "This was refused" }), _jsx(Refusal, { reason: failure.reason }), _jsx("p", { children: _jsx(ConsoleLink, { to: "", children: "Go to your organizations" }) })] }));
+    }
+    if (isRouteErrorResponse(error) && error.status === 404) {
+        return (_jsxs("section", { className: "ac-page ac-failure", children: [_jsx("h1", { children: "There is no page here" }), _jsx("p", { children: _jsx(ConsoleLink, { to: "", children: "Go to your organizations" }) })] }));
+    }
+    return (_jsxs("section", { className: "ac-page ac-failure", children: [_jsx("h1", { children: "The console could not show this page" }), _jsx("p", { children: "Reload to try again. If it keeps happening, the console's own log says why." })] }));
+}

package/dist/ui/refused.d.ts

@@ -0,0 +1,6 @@
+import type { ActionRefusal } from "../context.ts";
+/** The refusal for this form's intent, if the last action was refused; the page shows it beside the form. */
+export declare function useRefusal(intent: string): ActionRefusal | undefined;
+export declare function Refused({ intent }: {
+    intent: string;
+}): import("react").JSX.Element | null;

package/dist/ui/refused.js

@@ -0,0 +1,12 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { useActionData } from "react-router";
+import { Refusal } from "./errors.js";
+/** The refusal for this form's intent, if the last action was refused; the page shows it beside the form. */
+export function useRefusal(intent) {
+    const result = useActionData();
+    return result && typeof result === "object" && "intent" in result && result.intent === intent && "reason" in result ? result : undefined;
+}
+export function Refused({ intent }) {
+    const refusal = useRefusal(intent);
+    return refusal ? _jsx(Refusal, { reason: refusal.reason, problems: refusal.problems }) : null;
+}

package/dist/ui/status.d.ts

@@ -0,0 +1,5 @@
+export declare function lifecycleWords(lifecycle: string): string;
+export declare function Lifecycle({ lifecycle, confirmed }: {
+    lifecycle: string;
+    confirmed?: boolean;
+}): import("react").JSX.Element;