create-windy 0.2.34 → 0.3.0

package/template/apps/agent-server/tests/test_adk_adapter.py

@@ -0,0 +1,305 @@
+from __future__ import annotations
+
+import asyncio
+import json
+import tempfile
+from collections.abc import Callable, Coroutine
+
+import httpx
+import pytest
+
+from southwind_agent_server.adk_adapter import AdkEngineAdapter
+from southwind_agent_server.config import (
+    EnvironmentSecretResolver,
+    OpenAiCompatibleConfig,
+    SecretRef,
+)
+from southwind_agent_server.contracts import (
+    ProviderDataPolicy,
+    ProviderEgress,
+    ProviderFieldPolicy,
+    ProviderInputFieldPolicy,
+    RuntimeLimits,
+    RuntimeToolDefinition,
+    ToolNetworkPolicy,
+)
+from southwind_agent_server.engine import (
+    EngineCompleted,
+    EngineRunRequest,
+    OutputDelta,
+    SafeEngineError,
+    ToolCompleted,
+    ToolRequested,
+    UsageReported,
+)
+from southwind_agent_server.openai_provider import OpenAiCompatibleProvider
+from southwind_agent_server.provider_audit import ProviderAuditStore
+from southwind_agent_server.provider_governance import ProviderRequestGovernance
+from southwind_agent_server.tool_host import ToolHostClient
+
+
+async def test_adk_runner_maps_text_usage_and_terminal() -> None:
+    async def provider_handler(_request: httpx.Request) -> httpx.Response:
+        return sse_response(
+            [
+                {"choices": [{"delta": {"content": "你"}}]},
+                {
+                    "choices": [{"delta": {"content": "好"}}],
+                    "usage": {
+                        "prompt_tokens": 2,
+                        "completion_tokens": 2,
+                        "total_tokens": 4,
+                    },
+                },
+            ]
+        )
+
+    signals = [
+        signal async for signal in engine(provider_handler).execute(runtime_request())
+    ]
+
+    assert [signal.text for signal in signals if isinstance(signal, OutputDelta)] == [
+        "你",
+        "好",
+    ]
+    usage = [signal.usage for signal in signals if isinstance(signal, UsageReported)]
+    assert usage == [
+        {
+            "source": "provider-reported",
+            "inputTokens": 2,
+            "outputTokens": 2,
+            "totalTokens": 4,
+        }
+    ]
+    assert isinstance(signals[-1], EngineCompleted)
+    assert signals[-1].output == {"text": "你好"}
+
+
+async def test_adk_tool_events_execute_only_through_tool_host() -> None:
+    provider_calls = 0
+    tool_requests: list[dict[str, object]] = []
+
+    async def provider_handler(_request: httpx.Request) -> httpx.Response:
+        nonlocal provider_calls
+        provider_calls += 1
+        if provider_calls == 1:
+            return tool_call_response("business.records.list")
+        return sse_response([{"choices": [{"delta": {"content": "完成"}}]}])
+
+    async def tool_handler(request: httpx.Request) -> httpx.Response:
+        tool_requests.append(json.loads(request.content))
+        return httpx.Response(200, json={"value": {"total": 1}})
+
+    signals = [
+        signal
+        async for signal in engine(provider_handler, tool_handler).execute(
+            runtime_request("business.records.list")
+        )
+    ]
+
+    assert any(isinstance(signal, ToolRequested) for signal in signals)
+    assert any(isinstance(signal, ToolCompleted) for signal in signals)
+    assert tool_requests == [
+        {
+            "executionGrant": "grant_1",
+            "runId": "run_1",
+            "toolCallId": "call_1",
+            "toolKey": "business.records.list",
+            "arguments": {"page": 2},
+        }
+    ]
+    assert signals[-1].output == {"text": "完成"}  # type: ignore[union-attr]
+
+
+async def test_adk_denies_unknown_tool_before_host_callback() -> None:
+    host_called = False
+
+    async def provider_handler(_request: httpx.Request) -> httpx.Response:
+        return tool_call_response("business.admin.delete")
+
+    async def tool_handler(_request: httpx.Request) -> httpx.Response:
+        nonlocal host_called
+        host_called = True
+        return httpx.Response(200, json={"value": None})
+
+    with pytest.raises(SafeEngineError) as captured:
+        async for _ in engine(provider_handler, tool_handler).execute(
+            runtime_request("business.records.list")
+        ):
+            pass
+
+    assert captured.value.code == "TOOL_DENIED"
+    assert host_called is False
+
+
+async def test_adk_governance_rejects_before_provider_network() -> None:
+    provider_called = False
+
+    async def provider_handler(_request: httpx.Request) -> httpx.Response:
+        nonlocal provider_called
+        provider_called = True
+        return sse_response([])
+
+    request = runtime_request()
+    request = EngineRunRequest(
+        **{
+            **request.__dict__,
+            "instructions": "password=server-secret-value",
+        }
+    )
+
+    with pytest.raises(SafeEngineError) as captured:
+        async for _ in engine(provider_handler).execute(request):
+            pass
+
+    assert captured.value.code == "FORBIDDEN"
+    assert provider_called is False
+
+
+async def test_adk_cancel_and_provider_error_map_to_safe_errors() -> None:
+    started = asyncio.Event()
+
+    async def slow_provider(_request: httpx.Request) -> httpx.Response:
+        started.set()
+        await asyncio.sleep(0.03)
+        return sse_response([{"choices": [{"delta": {"content": "late"}}]}])
+
+    adapter = engine(slow_provider)
+
+    async def consume() -> None:
+        async for _ in adapter.execute(runtime_request()):
+            pass
+
+    task = asyncio.create_task(consume())
+    await started.wait()
+    await adapter.cancel("run_1")
+    with pytest.raises(SafeEngineError) as cancelled:
+        await task
+    assert cancelled.value.code == "RUN_CANCELLED"
+
+    async def failed_provider(_request: httpx.Request) -> httpx.Response:
+        return httpx.Response(500, text="provider-secret-body")
+
+    with pytest.raises(SafeEngineError) as failed:
+        async for _ in engine(failed_provider).execute(runtime_request()):
+            pass
+    assert failed.value.code == "PROVIDER_UNAVAILABLE"
+    assert "provider-secret-body" not in str(failed.value)
+
+
+def engine(
+    provider_handler: Callable[[httpx.Request], Coroutine[None, None, httpx.Response]],
+    tool_handler: Callable[[httpx.Request], Coroutine[None, None, httpx.Response]]
+    | None = None,
+) -> AdkEngineAdapter:
+    async def unused_tool(_request: httpx.Request) -> httpx.Response:
+        return httpx.Response(500, json={"error": "unused"})
+
+    provider = OpenAiCompatibleProvider(
+        OpenAiCompatibleConfig(
+            base_url="https://provider.test/v1",
+            model="qwen-compatible",
+            api_key_ref=SecretRef("env", "QWEN_API_KEY"),
+            https_host_allowlist=("provider.test",),
+        ),
+        EnvironmentSecretResolver({"QWEN_API_KEY": "server-secret"}),
+        transport=httpx.MockTransport(provider_handler),
+    )
+    audit_path = tempfile.NamedTemporaryFile(suffix=".sqlite3", delete=False).name
+    return AdkEngineAdapter(
+        provider,
+        ToolHostClient(
+            "internal-token",
+            transport=httpx.MockTransport(tool_handler or unused_tool),
+        ),
+        ProviderRequestGovernance(ProviderAuditStore(audit_path, retention_days=90)),
+    )
+
+
+def runtime_request(tool_key: str | None = None) -> EngineRunRequest:
+    tools = (
+        (
+            RuntimeToolDefinition(
+                key=tool_key,
+                label="查询记录",
+                description="查询当前数据范围内的记录。",
+            ),
+        )
+        if tool_key
+        else ()
+    )
+    return EngineRunRequest(
+        run_id="run_1",
+        operation_key="business.answer",
+        input={"question": "记录"},
+        instructions="回答业务问题。",
+        user_prompt="有多少记录？",
+        allowed_tools=tools,
+        limits=RuntimeLimits(max_duration_seconds=60, max_output_bytes=4096),
+        provider_egress=ProviderEgress(
+            mode="configured-endpoint",
+            deployment_key="ai.openai-compatible",
+        ),
+        provider_data_policy=ProviderDataPolicy(
+            input_fields=[
+                ProviderInputFieldPolicy(
+                    json_pointer="/question",
+                    classification="internal",
+                    dlp_action="redact",
+                )
+            ],
+            envelope_fields=[
+                ProviderFieldPolicy(
+                    field=field,
+                    classification="internal",
+                    dlp_action="reject" if field == "instructions" else "redact",
+                )
+                for field in (
+                    "instructions",
+                    "user-prompt",
+                    "tool-definitions",
+                    "provider-output",
+                    "tool-results",
+                )
+            ],
+        ),
+        tool_network_policy=ToolNetworkPolicy(mode="forbidden"),
+        execution_grant="grant_1",
+        tool_host_url="http://server:9747",
+    )
+
+
+def tool_call_response(name: str) -> httpx.Response:
+    return sse_response(
+        [
+            {
+                "choices": [
+                    {
+                        "delta": {
+                            "tool_calls": [
+                                {
+                                    "index": 0,
+                                    "id": "call_1",
+                                    "function": {
+                                        "name": name,
+                                        "arguments": '{"page":2}',
+                                    },
+                                }
+                            ]
+                        }
+                    }
+                ]
+            }
+        ]
+    )
+
+
+def sse_response(chunks: list[object]) -> httpx.Response:
+    body = "".join(
+        f"data: {json.dumps(chunk, ensure_ascii=False)}\n\n" for chunk in chunks
+    )
+    return httpx.Response(
+        200,
+        content=body.encode(),
+        headers={"content-type": "text/event-stream"},
+    )

package/template/apps/agent-server/tests/test_adk_web_agent.py

@@ -0,0 +1,12 @@
+from __future__ import annotations
+
+from google.adk.models.base_llm import BaseLlm
+
+from adk_web_agents.safe_debug.agent import root_agent
+
+
+def test_adk_web_agent_has_no_business_tools_or_provider_model() -> None:
+    assert root_agent.name == "safe_debug"
+    assert root_agent.tools == []
+    assert isinstance(root_agent.model, BaseLlm)
+    assert root_agent.model.model == "windy-safe-debug"

package/template/apps/server/package.json

@@ -26,9 +26,12 @@
     "drizzle-orm": "^0.45.2",
     "elysia": "^1.4.29",
     "mysql2": "^3.22.6",
+    "nodemailer": "^9.0.3",
     "pg": "^8.22.0",
     "pino": "^10.3.1",
     "zod": "^4.4.3"
   },
-  "devDependencies": {}
+  "devDependencies": {
+    "@types/nodemailer": "^8.0.1"
+  }
 }

package/template/apps/server/src/agent/run-facade.ts

@@ -12,7 +12,7 @@ import type {
   ModuleAiOperationHandlerRegistration,
 } from "@southwind-ai/server-sdk";
 import { evaluateAccessGuards } from "../access-guards.js";
-import type { RequestGuardContext } from "../guards.js";
+import { auditActor, type RequestGuardContext } from "../guards.js";
 import type { InitializedModuleHosts } from "../module-host.js";
 import { toModuleActor } from "../module-host.js";
 import type { createServerRuntime } from "../runtime.js";
@@ -154,12 +154,7 @@ export class AgentRunFacade {
         id: randomUUIDv7(),
         action: operation.definition.auditAction,
         outcome: "success",
-        actor: {
-          id: context.actor.id,
-          type:
-            context.actor.type === "anonymous" ? "user" : context.actor.type,
-          name: context.actor.name,
-        },
+        actor: auditActor(context),
         target: {
           type: "agent-run",
           id: created.runId,

package/template/apps/server/src/agent/tool-registry.ts

@@ -11,7 +11,7 @@ import type { AuditEvent, FeatureFlagDefinition } from "@southwind-ai/shared";
 import Ajv, { type ValidateFunction } from "ajv";
 import { evaluateAccessGuards } from "../access-guards.js";
 import { isServerScopeContext } from "../data-access/context.js";
-import type { RequestGuardContext } from "../guards.js";
+import { auditActor, type RequestGuardContext } from "../guards.js";
 import { findFeature } from "../route-guards.js";
 import type { createServerRuntime } from "../runtime.js";
 
@@ -292,11 +292,7 @@ function toolEvent(
     id: crypto.randomUUID(),
     action: tool.auditAction,
     outcome: "success",
-    actor: {
-      id: context.actor.id,
-      type: context.actor.type === "anonymous" ? "user" : context.actor.type,
-      name: context.actor.name,
-    },
+    actor: auditActor(context),
     target: { type: "agent-tool", id: tool.key, label: tool.label },
     module: tool.module,
     requestId: context.requestId,

package/template/apps/server/src/application-services.ts

@@ -20,6 +20,7 @@ import { DrizzleSchedulerRepository } from "./scheduler/drizzle-repository.js";
 import { InMemorySchedulerRepository } from "./scheduler/repository.js";
 import type { ScheduledTaskDefinition } from "./scheduler/types.js";
 import type { createStorageRuntime } from "./storage/runtime.js";
+import type { PlatformConfig } from "@southwind-ai/config";
 import type { DurableHandlerRegistry } from "@southwind-ai/jobs";
 import { collectActiveBlobRefs } from "./storage/blob-reference-registry.js";
 import type { createSystemRepositories } from "./system/seed.js";
@@ -33,6 +34,17 @@ import {
 } from "./workflow/effects.js";
 import { InMemoryWorkflowRepository } from "./workflow/repository.js";
 import { WorkflowService } from "./workflow/service.js";
+import { NotificationChannelRegistry } from "./notification/channel-adapter.js";
+import { DrizzleNotificationDeliveryRepository } from "./notification/delivery-repository.js";
+import { NotificationDeliveryWorker } from "./notification/delivery-worker.js";
+import { InMemoryNotificationDeliveryRepository } from "./notification/memory-delivery-repository.js";
+import {
+  DrizzleNotificationPreferenceRepository,
+  InMemoryNotificationPreferenceRepository,
+} from "./notification/preference-repository.js";
+import { SystemNotificationRecipientDirectory } from "./notification/recipient-directory.js";
+import { NotificationService } from "./notification/service.js";
+import { SmtpNotificationChannelAdapter } from "./notification/smtp-adapter.js";
 
 interface ApplicationServicesInput {
   persistence: ReturnType<typeof createServerPersistence>;
@@ -42,6 +54,7 @@ interface ApplicationServicesInput {
   storage: ReturnType<typeof createStorageRuntime>;
   moduleTasks: ScheduledTaskDefinition[];
   bulkRetentionDays: number;
+  mailConfig?: PlatformConfig["mail"];
   installModuleDurableHandlers?: (registry: DurableHandlerRegistry) => void;
 }
 
@@ -52,6 +65,32 @@ export async function createApplicationServices(
   const notifications = persistence
     ? new DrizzleNotificationRepository(persistence.db)
     : new InMemoryNotificationRepository();
+  const notificationPreferences = persistence
+    ? new DrizzleNotificationPreferenceRepository(persistence.db)
+    : new InMemoryNotificationPreferenceRepository();
+  const notificationDeliveries = persistence
+    ? new DrizzleNotificationDeliveryRepository(persistence.db)
+    : new InMemoryNotificationDeliveryRepository();
+  const notificationRecipients = new SystemNotificationRecipientDirectory(
+    input.systemRepositories,
+  );
+  const notificationChannels = new NotificationChannelRegistry(
+    input.mailConfig?.enabled
+      ? [new SmtpNotificationChannelAdapter(input.mailConfig)]
+      : [],
+  );
+  const notificationService = new NotificationService(
+    notifications,
+    notificationPreferences,
+    notificationDeliveries,
+    notificationRecipients,
+    { mandatoryCategories: ["安全"] },
+  );
+  const notificationDeliveryWorker = new NotificationDeliveryWorker(
+    notificationDeliveries,
+    notificationRecipients,
+    notificationChannels,
+  );
   const deferredTimeout = new DeferredWorkflowTimeoutScheduler();
   const workflow = new WorkflowService(
     persistence
@@ -89,6 +128,15 @@ export async function createApplicationServices(
         const result = await governedExportDispatch.runNext?.();
         return { claimed: Boolean(result && result.status !== "idle") };
       },
+      notificationDispatch: async () => {
+        const scheduled = await notificationService.dispatchScheduled();
+        const delivery = await notificationDeliveryWorker.runNext();
+        return {
+          claimed: scheduled.claimed + delivery.claimed > 0,
+          scheduled,
+          delivery,
+        };
+      },
     }),
     ...input.moduleTasks,
   ];
@@ -149,6 +197,8 @@ export async function createApplicationServices(
   return {
     ...services,
     notifications,
+    notificationService,
+    notificationDeliveryWorker,
     workflow,
     governedExports,
     governedExportService,

package/template/apps/server/src/audit/drizzle-log-store.ts

@@ -74,6 +74,7 @@ export class DrizzleAuditLogReader {
 
 function auditWhere(query: AuditEventListQuery): SQL | undefined {
   const clauses = [
+    query.q ? keywordClause(query.q) : undefined,
     query.includeScheduler
       ? undefined
       : ne(auditLogs.actorId, "system_scheduler"),
@@ -91,6 +92,30 @@ function auditWhere(query: AuditEventListQuery): SQL | undefined {
   return clauses.length ? and(...clauses) : undefined;
 }
 
+function keywordClause(query: string): SQL {
+  const pattern = `%${escapeLike(query.toLowerCase())}%`;
+  return sql`lower(concat_ws(' ',
+    ${auditLogs.action},
+    ${auditLogs.actorId},
+    ${auditLogs.resource},
+    ${auditLogs.resourceId},
+    ${auditLogs.ip},
+    coalesce(${auditLogs.metadata} ->> 'actorName', ''),
+    coalesce(${auditLogs.metadata} ->> 'targetLabel', ''),
+    coalesce(${auditLogs.metadata} ->> 'message', ''),
+    coalesce(${auditLogs.metadata} ->> 'module', ''),
+    coalesce(${auditLogs.metadata} ->> 'requestId', ''),
+    coalesce(${auditLogs.metadata}::text, '')
+  )) like ${pattern} escape '\\'`;
+}
+
+function escapeLike(value: string): string {
+  return value
+    .replaceAll("\\", "\\\\")
+    .replaceAll("%", "\\%")
+    .replaceAll("_", "\\_");
+}
+
 function rowToAuditEvent(row: typeof auditLogs.$inferSelect): AuditEvent {
   const metadata = readMetadata(row.metadata);
   const outcome = readString(metadata.outcome, "success") as AuditOutcome;

package/template/apps/server/src/audit/search-summary.ts

@@ -1,6 +1,6 @@
 import type { AuditEvent } from "@southwind-ai/shared";
 import { randomUUIDv7 } from "bun";
-import type { RequestGuardContext } from "../guards.js";
+import { auditActor, type RequestGuardContext } from "../guards.js";
 
 export function searchAuditMetadata(
   query: string,
@@ -26,11 +26,7 @@ export function searchAuditEvent(
     id: randomUUIDv7(),
     action: "data.search",
     outcome: "success",
-    actor: {
-      id: context.actor.id,
-      type: context.actor.type === "anonymous" ? "user" : context.actor.type,
-      name: context.actor.name,
-    },
+    actor: auditActor(context),
     target: { type: resourceName },
     requestId: context.requestId,
     metadata: searchAuditMetadata(query, matched),

package/template/apps/server/src/auth/credential-restriction.ts

@@ -2,6 +2,7 @@ import type { RequestGuardContext } from "../guards.js";
 
 const PASSWORD_CHANGE_ALLOWLIST = new Set([
   "GET /api/auth/session",
+  "GET /api/auth/password/policy",
   "POST /api/auth/password/change",
   "POST /api/auth/logout",
 ]);

package/template/apps/server/src/auth/password.ts

@@ -1,5 +1,5 @@
 import argon2, { argon2id } from "argon2";
-import { PASSWORD_POLICY } from "@southwind-ai/shared";
+import { PASSWORD_POLICY, type PasswordPolicy } from "@southwind-ai/shared";
 
 export { PASSWORD_POLICY } from "@southwind-ai/shared";
 
@@ -15,30 +15,39 @@ export interface PasswordHasher {
   verify(hash: string, password: string): Promise<boolean>;
 }
 
-export const argon2PasswordHasher: PasswordHasher = {
-  async hash(password) {
-    assertPasswordPolicy(password);
-    return argon2.hash(password, ARGON2_OPTIONS);
-  },
-  async verify(hash, password) {
-    if (!password || password.length > PASSWORD_POLICY.maxLength) {
-      return false;
-    }
-    try {
-      return await argon2.verify(hash, password);
-    } catch {
-      return false;
-    }
-  },
-};
+export const argon2PasswordHasher = createArgon2PasswordHasher();
 
-export function assertPasswordPolicy(password: string): void {
+export function createArgon2PasswordHasher(
+  policyProvider: () => PasswordPolicy = () => PASSWORD_POLICY,
+): PasswordHasher {
+  return {
+    async hash(password) {
+      assertPasswordPolicy(password, policyProvider());
+      return argon2.hash(password, ARGON2_OPTIONS);
+    },
+    async verify(hash, password) {
+      if (!password || password.length > 512) {
+        return false;
+      }
+      try {
+        return await argon2.verify(hash, password);
+      } catch {
+        return false;
+      }
+    },
+  };
+}
+
+export function assertPasswordPolicy(
+  password: string,
+  policy: PasswordPolicy = PASSWORD_POLICY,
+): void {
   if (
-    password.length < PASSWORD_POLICY.minLength ||
-    password.length > PASSWORD_POLICY.maxLength
+    password.length < policy.minLength ||
+    password.length > policy.maxLength
   ) {
     throw new Error(
-      `密码长度必须为 ${PASSWORD_POLICY.minLength}-${PASSWORD_POLICY.maxLength} 个字符`,
+      `密码长度必须为 ${policy.minLength}-${policy.maxLength} 个字符`,
     );
   }
 }

package/template/apps/server/src/auth/routes.test.ts

@@ -1,5 +1,5 @@
 import { beforeAll, describe, expect, test } from "bun:test";
-import type { AuditEvent } from "@southwind-ai/shared";
+import type { AuditEvent, PasswordPolicy } from "@southwind-ai/shared";
 import { Elysia } from "elysia";
 import { createServerRuntime } from "../runtime.js";
 import { RepositoryActorResolver } from "./actor-resolver.js";
@@ -15,6 +15,37 @@ beforeAll(async () => {
 });
 
 describe("platform auth API", () => {
+  test("密码策略端点返回当前运行时策略且禁止缓存", async () => {
+    let policy: PasswordPolicy = { minLength: 16, maxLength: 64 };
+    const fixture = authFixture([activeUser()], () => policy);
+
+    const first = await fixture.app.handle(
+      new Request("http://localhost/api/auth/password/policy"),
+    );
+    expect(first.headers.get("cache-control")).toBe("no-store");
+    await expect(first.json()).resolves.toEqual(policy);
+
+    policy = { minLength: 20, maxLength: 80 };
+    const second = await fixture.app.handle(
+      new Request("http://localhost/api/auth/password/policy"),
+    );
+    await expect(second.json()).resolves.toEqual(policy);
+  });
+
+  test("会话有效期配置即时影响后续签发会话", async () => {
+    let ttlSeconds = 60;
+    const fixture = authFixture([activeUser()], undefined, () => ttlSeconds);
+    const first = await login(fixture.app, "admin");
+
+    ttlSeconds = 120;
+    const second = await login(fixture.app, "admin");
+
+    expect(
+      new Date(second.expiresAt).getTime() -
+        new Date(first.expiresAt).getTime(),
+    ).toBeGreaterThan(59_000);
+  });
+
   test("会话探测只返回当前 Actor，不暴露 Token", async () => {
     const fixture = authFixture([activeUser()]);
     const anonymous = await fixture.app.handle(
@@ -278,7 +309,11 @@ describe("platform auth API", () => {
   });
 });
 
-function authFixture(users: AuthUserRecord[]) {
+function authFixture(
+  users: AuthUserRecord[],
+  passwordPolicy?: () => PasswordPolicy,
+  sessionTtlSeconds?: () => number,
+) {
   const repository = new InMemoryAuthRepository(users);
   const resolver = new RepositoryActorResolver(repository, {
     sessionCookieName: "windy.sid",
@@ -286,6 +321,8 @@ function authFixture(users: AuthUserRecord[]) {
   const events: AuditEvent[] = [];
   const runtime = createServerRuntime({}, { actorResolver: resolver });
   const service = new AuthService(repository, {
+    passwordPolicy,
+    sessionTtlSeconds,
     auditWriter: {
       write(event) {
         events.push(event);
@@ -326,7 +363,11 @@ async function login(
     }),
   );
   expect(response.status).toBe(200);
-  return (await response.json()) as { token: string; sessionId: string };
+  return (await response.json()) as {
+    token: string;
+    sessionId: string;
+    expiresAt: string;
+  };
 }
 
 function readCookieValue(header: string, name: string): string {