portal-mojo 0.2.19 → 0.2.21

package/src/client/operational-fleet-mock.ts

@@ -0,0 +1,279 @@
+/** Mock-only dashboard/capacity contract. Runtime modules never import this file. */
+import { backendGlobalCan, FLEET_DASHBOARD_GRANTS, type BackendGlobalUser } from '../admin/fleet/access';
+import type { CapacityAction, CapacityBatch, CapacityPlan, CapacityReport, CapacityStep, FleetDashboard, FleetFacts } from '../admin/fleet/types';
+export const mockOperationalFleetScenarios = ['healthy', 'down', 'external', 'partial', 'restricted', 'missing-evidence', 'aged-observations', 'inventory-unavailable', 'transitional', 'drained', 'unknown-price', 'stale-plan', 'expired-plan', 'duplicate', 'failed', 'stalled', 'uncertain-apply', 'status-unavailable', 'reauth'] as const;
+export type MockOperationalFleetScenario = typeof mockOperationalFleetScenarios[number];
+export interface MockFleetActor extends BackendGlobalUser {
+    id: number;
+    credential_kind?: string;
+}
+let scenario: MockOperationalFleetScenario = 'healthy', sequence = 0, version = 0;
+const plans = new Map<string, {
+    plan: CapacityPlan;
+    version: number;
+}>(), batches = new Map<string, {
+    batch: CapacityBatch;
+    reads: number;
+    applied: boolean;
+}>(), claimed = new Map<string, string>();
+const copy = <T,>(v: T): T => JSON.parse(JSON.stringify(v)) as T;
+const timestamp = () => new Date().toISOString();
+const fail = (error_code: string, code: number, error = error_code, data?: unknown) => ({ status: false, code, error_code, error, ...(data ? { data } : {}) });
+const ok = (data: unknown) => ({ status: true, data: copy(data) });
+let state: CapacityReport;
+export function setMockOperationalFleetScenario(value: MockOperationalFleetScenario) { if (!mockOperationalFleetScenarios.includes(value))
+    throw new Error('Unknown operational fleet scenario.'); scenario = value; version++; plans.clear(); batches.clear(); claimed.clear(); state = fixture(); }
+export const getMockOperationalFleetScenario = () => scenario;
+function fixture(): CapacityReport {
+    const instances = ['i-mocka', 'i-mockb', 'i-mockc'].map((id, i) => ({ id, name: `app-${i + 1}`, state: 'healthy', instance_state: 'running', lifecycle_state: 'available', instance_type: 'm6i.large', zone: 'us-east-1a', subnet_id: 'subnet-0abc', public_ip: `203.0.113.${10 + i}`, healthy: true, registered: true, can_drain: true, self: i === 0, primary: i === 0, added_by_capacity: i !== 0, stable_ip: true, groups: ['targetgroup/mock-api'] }));
+    if (scenario === 'drained') {
+        Object.assign(instances[2]!, { healthy: false, registered: false, can_drain: false, state: 'unregistered', groups: [] });
+    }
+    if (scenario === 'transitional') {
+        Object.assign(instances[2]!, { healthy: false, can_drain: false, state: 'draining', lifecycle_state: 'deleting' });
+    }
+    const classes = { 'db-reader-a': 'db.t4g.medium', 'db-reader-b': 'db.r6g.xlarge' };
+    const database = { identifier: 'mock-database', kind: 'aurora' as const, engine: 'aurora-postgresql', status: 'available', writer: 'db-writer', readers: ['db-reader-a', 'db-reader-b'], instance_class: null, writer_instance_class: 'db.r6g.large', reader_instance_classes: classes, blocked_reason: scenario === 'transitional' ? 'resource_transitioning' : null, members: [{ id: 'db-writer', role: 'writer', status: 'available', lifecycle_state: 'available', instance_class: 'db.r6g.large', can_resize: true, can_remove: false }, ...Object.entries(classes).map(([id, instance_class], i) => ({ id, instance_class, role: 'reader', status: scenario === 'transitional' && i === 1 ? 'creating' : 'available', lifecycle_state: scenario === 'transitional' && i === 1 ? 'creating' : 'available', can_resize: scenario !== 'transitional', can_remove: scenario !== 'transitional' }))] };
+    const actions = Object.fromEntries(['add_node', 'drain_node', 'terminate_node', 'add_reader', 'remove_reader', 'set_cache_replicas', 'resize_cache', 'resize_database'].map(a => [a, { offered: scenario !== 'external' && scenario !== 'partial', blocked_reason: scenario === 'external' ? 'infrastructure_external' : scenario === 'partial' ? 'identity_unavailable' : null }]));
+    return { schema_version: 2, mode: scenario === 'external' ? 'external' : 'managed', region: 'us-east-1', generated_at: timestamp(), identity_available: scenario !== 'partial', identity: scenario === 'partial' ? null : { project: 'mock', environment: 'production' }, node_id_pinned: false, nodes: { self: 'i-mocka', self_check: 'matched', serving_available: true, inventory_available: scenario !== 'partial', instances }, databases_available: scenario !== 'partial', caches_available: true, databases: scenario === 'partial' ? [] : [database], caches: [{ identifier: 'mock-redis', status: 'available', node_type: 'cache.t4g.micro', replica_count: 1, min_replicas: 1, resize_impact: 'rolling', blocked_reason: null, members: [{ id: 'redis-primary', role: 'primary', status: 'available', lifecycle_state: 'available' }, { id: 'redis-replica', role: 'replica', status: 'available', lifecycle_state: 'available' }] }], sizes: { database: [{ size: 'small', label: 'Small', type: 'db.t4g.medium', monthly_usd: 50 }, { size: 'medium', label: 'Medium', type: 'db.r6g.large', monthly_usd: 175 }, { size: 'large', label: 'Large', type: 'db.r6g.xlarge', monthly_usd: 350 }], cache: [{ size: 'small', label: 'Small', type: 'cache.t4g.micro', monthly_usd: 12 }, { size: 'medium', label: 'Medium', type: 'cache.t4g.medium', monthly_usd: scenario === 'unknown-price' ? null : 50 }, { size: 'large', label: 'Large', type: 'cache.r7g.large', monthly_usd: 120 }] }, actions, warnings: scenario === 'partial' ? [{ code: 'databases', iam_action: 'rds:DescribeDBClusters', message: 'Database inventory unavailable; do not infer an empty estate.' }] : [], reader_routing: { database: { active: true, host: 'mock-reader.example', skip_reason: null, matches_reader_endpoint: true }, redis: { active: false } }, egress: { available: scenario !== 'partial', fleet_available: true, addresses_available: scenario !== 'partial', policy_available: scenario !== 'partial', enabled: true, addresses: scenario === 'partial' ? [] : ['203.0.113.10', '203.0.113.11'], attached: scenario === 'partial' ? [] : [{ instance: 'i-mocka', public_ip: '203.0.113.10', managed: true }], fallback_attached: [], reserved: [{ public_ip: '203.0.113.20' }], pending_nodes: [] } };
+}
+setMockOperationalFleetScenario('healthy');
+function dashboard(actor: MockFleetActor): FleetDashboard {
+    const observed_at = timestamp();
+    const source = (data: FleetFacts, status = 'healthy') => ({ status, observed_at, stale_after: new Date(Date.now() + 120000).toISOString(), reason: null, data });
+    const sources: FleetDashboard['sources'] = { load_balancer: source({ configured: true, registered: state.nodes.instances.filter(n=>n.registered).length, healthy: scenario === 'down' ? 0 : state.nodes.instances.filter(n=>n.healthy).length, balancer: { name: 'mock-api-nlb', type: 'network', scheme: 'internet-facing', state: 'active', elastic_ips: ['198.51.100.10'], addresses: [{ ip: '198.51.100.10' }] }, elastic_ip_missing: false }, scenario === 'down' ? 'unhealthy' : 'healthy'), compute: source({ total: state.nodes.instances.length, up: state.nodes.instances.filter(n=>n.healthy).length, source: 'target_group', instances: state.nodes.instances.map(n => ({ id: n.id, name: n.name, healthy: n.healthy })) }), database: source({ reachable: true, engine: 'PostgreSQL', version: '16.4', vendor: 'postgresql', drift: null }), cache: source({ reachable: true, engine: 'Redis', version: '7.1', memory_used: '42M' }), certificates: source({ total: 4, active: 4, failing: 0, expiring_within_30_days: 1, soonest_renew: observed_at, soonest_expiry: new Date(Date.now() + 25 * 86400000).toISOString() }), public_api: source({ configured: true, node_version: '2026.10.21', probe: { ok: true, http_status: 200, version: '2026.10.21' } }), framework: source({ installed: '1.2.100', latest: '1.2.101', update_available: true, pin: { mode: 'automatic' } }), last_deployment: source({ items: [{ id: 'mock-deployment', sha: '6bc254abcdef0123456789', status: 'converged', created: observed_at, finished: observed_at, actor: 'github-actions' }] }), jobs: source(scenario === 'missing-evidence' ? {} : { scheduler_active: true, jobs: { pending: 2, running: 1, failed: 3 }, failed_recent: 1 }, 'degraded'), sanity: source(scenario === 'missing-evidence' ? {} : { checks: [{ name: 'Database', ok: true }, { name: 'Redis', ok: true }] }), incidents: source({ open: 2, oldest_created: observed_at, oldest_age_days: 2 }, 'degraded'), tickets: source({ open: 0, oldest_created: null, oldest_age_days: null }), sms: source({ configured: false }, 'unconfigured'), email: source({ configured: true, domains: 2, sendable_domains: 2, default_sender: 'hello@example.com' }) };
+    for (const [key, row] of Object.entries(sources)) {
+        const grants = key === 'email' ? ['manage_aws', 'comms', 'admin'] : ['incidents', 'tickets'].includes(key) ? ['view_security', 'manage_security', 'security', 'admin'] : ['view_platform', 'manage_platform', 'admin'];
+        if (scenario === 'restricted' || !backendGlobalCan(actor, grants))
+            sources[key] = { ...row, status: 'permission_denied', observed_at: null, stale_after: null, reason: 'permission_required', data: {} };
+    }
+    if (scenario === 'partial')
+        sources.compute = { ...sources.compute!, status: 'unknown', reason: 'provider_denied', data: {} };
+    if (scenario === 'aged-observations')
+        for (const row of Object.values(sources)) {
+            if (row.observed_at) row.observed_at = new Date(Date.now() - 15 * 60_000).toISOString();
+            if (row.stale_after) row.stale_after = new Date(Date.now() - 13 * 60_000).toISOString();
+        }
+    return { schema_version: 2, observed_at, availability: { state: scenario === 'down' ? 'down' : scenario === 'restricted' || scenario === 'partial' ? 'unknown' : 'ok', message: scenario === 'down' ? 'Load balancer has no healthy targets' : scenario === 'restricted' || scenario === 'partial' ? 'Availability cannot be confirmed' : 'The serving fleet is available', down: scenario === 'down' ? ['load_balancer'] : [] }, attention: { message: 'Recent job failures and open incidents need review.' }, sources };
+}
+function validateSteps(steps: unknown): CapacityStep[] {
+    if (!Array.isArray(steps) || !steps.length || steps.length > 20)
+        throw new Error('A plan requires 1–20 steps.');
+    const normalized: CapacityStep[] = [];
+    const healthy = state.nodes.instances.filter(n => n.healthy);
+    const drained = new Set<string>();
+    for (const raw of steps) {
+        if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+            throw new Error('Invalid step.');
+        const s = raw as CapacityStep;
+        if (!state.actions[s.action]?.offered)
+            throw new Error('Action not offered.');
+        if (s.action !== 'add_node' && (typeof s.resource !== 'string' || !s.resource))
+            throw new Error('Resource required.');
+        if (s.action !== 'add_node' && (s.source_instance != null || s.subnet_id != null))
+            throw new Error('Placement only belongs to Add Node.');
+        if (s.action === 'add_node') {
+            if (s.source_instance && !state.nodes.instances.some(n => n.id === s.source_instance && n.healthy))
+                throw new Error('Source must be healthy.');
+            if (s.subnet_id && !/^subnet-[A-Za-z0-9]+$/.test(s.subnet_id))
+                throw new Error('Subnet identifier invalid.');
+        }
+        if (s.action === 'drain_node' || s.action === 'terminate_node') {
+            const n = state.nodes.instances.find(n => n.id === s.resource);
+            if (!n || n.self)
+                throw new Error('Node cannot be removed.');
+            if (s.action === 'drain_node') {
+                if (!n.can_drain)
+                    throw new Error('Node cannot drain.');
+                drained.add(n.id);
+                if (healthy.filter(n => !drained.has(n.id)).length < 1)
+                    throw new Error('Keep one healthy target.');
+            }
+            else if (!drained.has(n.id) && (n.registered || n.healthy || n.state !== 'unregistered'))
+                throw new Error('Drain completion required.');
+        }
+        if (s.action === 'resize_database' || s.action === 'resize_cache') {
+            const ladder = state.sizes[s.action === 'resize_cache' ? 'cache' : 'database'];
+            if (s.apply_immediately !== true || !ladder.some(r => r.size === s.size))
+                throw new Error('Curated size and apply_immediately required.');
+            if (s.action === 'resize_database' && !state.databases.some(d => !d.blocked_reason && d.members.some(m => m.id === s.resource && m.can_resize)))
+                throw new Error('Database member cannot resize.');
+        }
+        if (s.action === 'set_cache_replicas') {
+            const c = state.caches.find(c => c.identifier === s.resource);
+            if (!c || !Number.isSafeInteger(s.count) || s.count! < c.min_replicas || s.apply_immediately !== true)
+                throw new Error('Invalid replica count.');
+        }
+        if (s.action === 'add_reader' && !state.databases.some(d => d.identifier === s.resource && !d.blocked_reason))
+            throw new Error('Reader source unavailable.');
+        if (s.action === 'remove_reader' && !state.databases.some(d => !d.blocked_reason && d.members.some(m => m.id === s.resource && m.role === 'reader' && m.can_remove)))
+            throw new Error('Reader removal unavailable.');
+        if (normalized.some(p => p.action === s.action && p.resource === s.resource) && !['add_node', 'add_reader'].includes(s.action))
+            throw new Error('Duplicate step.');
+        normalized.push(copy(s));
+    }
+    return normalized;
+}
+function serverPlan(actor: MockFleetActor, raw: unknown): CapacityPlan {
+    const submitted = validateSteps(raw);
+    const rank: Record<CapacityAction, number> = { add_node: 0, add_reader: 1, set_cache_replicas: 2, resize_cache: 3, resize_database: 4, drain_node: 7, terminate_node: 8, remove_reader: 6 };
+    const steps = submitted.map(s => { const { action, resource = '', ...params } = s; return { index: 0, action, resource, params, kind: ['drain_node', 'terminate_node', 'remove_reader'].includes(action) || (action === 'set_cache_replicas' && Number(params.count) < (state.caches.find(c => c.identifier === resource)?.replica_count ?? 0)) ? 'remove' : 'add', description: action === 'add_node' ? 'Add and prove a new app node' : `${action.replaceAll('_', ' ')} ${resource}`, warnings: action === 'resize_database' ? ['Writer resize can cause minutes offline; reader resize pauses that reader.'] : action === 'add_reader' ? ['New readers inherit the current source class; refresh concrete IDs before resizing.'] : action === 'resize_cache' ? ['Group-wide resize interrupts the primary briefly; downsizing may evict data.'] : action === 'terminate_node' ? ['Node termination cannot be undone.'] : [], monthly_delta_usd: scenario === 'unknown-price' ? null : action === 'add_node' ? 70 : action === 'add_reader' ? 175 : action === 'terminate_node' ? -70 : 10 }; }).sort((a, b) => (a.action === 'set_cache_replicas' && a.kind === 'remove' ? 5 : rank[a.action]) - (b.action === 'set_cache_replicas' && b.kind === 'remove' ? 5 : rank[b.action]));
+    // Keep each termination immediately after its own drain, as the service does.
+    for (let i = 0; i < steps.length; i++) {
+        const s = steps[i]!;
+        if (s.action !== 'drain_node')
+            continue;
+        const pos = steps.findIndex(t => t.action === 'terminate_node' && t.resource === s.resource);
+        if (pos >= 0) {
+            const [term] = steps.splice(pos, 1);
+            steps.splice(i + 1, 0, term!);
+            i++;
+        }
+    }
+    steps.forEach((s, i) => s.index = i);
+    return { schema_version: 2, id: `mock-plan-${++sequence}`, actor: actor.id, created: timestamp(), expires_at: new Date(Date.now() + (scenario === 'expired-plan' ? -1 : 300000)).toISOString(), expires_in: 300, steps, total_monthly_delta_usd: scenario === 'unknown-price' ? null : steps.reduce((n, s) => n + (s.monthly_delta_usd ?? 0), 0), estimate_complete: scenario !== 'unknown-price', order_note: 'Add and prove capacity before removing it; each node drains before termination.' };
+}
+function applyInventory(batch: CapacityBatch) { for (const s of batch.steps.filter(s => s.state === 'done')) {
+    const p = plans.get(batch.plan_id)?.plan.steps.find(p => p.index === s.index)?.params ?? {};
+    if (s.action === 'drain_node') {
+        const n = state.nodes.instances.find(n => n.id === s.resource);
+        if (n)
+            Object.assign(n, { state: 'unregistered', healthy: false, registered: false, can_drain: false, groups: [] });
+    }
+    if (s.action === 'terminate_node')
+        state.nodes.instances = state.nodes.instances.filter(n => n.id !== s.resource);
+    if (s.action === 'add_node') {
+        const source = state.nodes.instances.find(n => n.id === p.source_instance) ?? state.nodes.instances[0];
+        if (source)
+            state.nodes.instances.push({ ...copy(source), id: `i-added-${++sequence}`, name: 'New app node', self: false, primary: false, added_by_capacity: true });
+    }
+    if (s.action === 'add_reader') {
+        const d = state.databases.find(d => d.identifier === s.resource);
+        if (d) {
+            const id = `db-added-${++sequence}`, instance_class = d.writer_instance_class ?? d.instance_class ?? 'unknown';
+            d.readers.push(id);
+            d.reader_instance_classes[id] = instance_class;
+            d.members.push({ id, role: 'reader', status: 'available', lifecycle_state: 'available', instance_class, can_remove: true, can_resize: true });
+        }
+    }
+    if (s.action === 'remove_reader') {
+        for (const d of state.databases) {
+            d.readers = d.readers.filter(id => id !== s.resource);
+            d.members = d.members.filter(m => m.id !== s.resource);
+            delete d.reader_instance_classes[s.resource];
+        }
+    }
+    if (s.action === 'resize_database') {
+        const size = state.sizes.database.find(r => r.size === p.size);
+        if (size)
+            for (const d of state.databases) {
+                const m = d.members.find(m => m.id === s.resource);
+                if (m) {
+                    m.instance_class = size.type;
+                    if (m.role === 'writer')
+                        d.writer_instance_class = size.type;
+                    else
+                        d.reader_instance_classes[m.id] = size.type;
+                }
+            }
+    }
+    if (s.action === 'resize_cache' || s.action === 'set_cache_replicas') {
+        const c = state.caches.find(c => c.identifier === s.resource);
+        if (c) {
+            if (s.action === 'set_cache_replicas')
+                c.replica_count = Number(p.count);
+            else
+                c.node_type = state.sizes.cache.find(r => r.size === p.size)?.type ?? c.node_type;
+        }
+    }
+} state.generated_at = timestamp(); version++; }
+/** Return undefined for unowned paths. Actor and auth_time must come from the central mock's validated bearer. */
+export function handleOperationalFleetMock(path: string, method: string, body: Record<string, unknown> | undefined, params: Record<string, unknown> | undefined, actor: MockFleetActor | null | undefined, authTime?: number): unknown | undefined {
+    if (path !== '/api/account/admin/dashboard' && !path.startsWith('/api/aws/capacity'))
+        return undefined;
+    if (!actor)
+        return fail('authentication_required', 401);
+    if (actor.credential_kind && ['api_key', 'group_scoped_token'].includes(actor.credential_kind))
+        return fail('permission_denied', 403);
+    if (path === '/api/account/admin/dashboard')
+        return method === 'GET' ? (backendGlobalCan(actor, FLEET_DASHBOARD_GRANTS) ? ok(dashboard(actor)) : fail('permission_denied', 403)) : fail('not_found', 404);
+    if (!backendGlobalCan(actor, 'manage_aws'))
+        return fail('permission_denied', 403, 'Global manage_aws required.');
+    if (method === 'GET' && path === '/api/aws/capacity') {
+        if (scenario === 'inventory-unavailable')
+            return fail('provider_unavailable', 503, 'Capacity inventory is temporarily unavailable.');
+        state.generated_at = timestamp();
+        return ok(state);
+    }
+    if (method === 'GET' && path === '/api/aws/capacity/status') {
+        if (scenario === 'status-unavailable')
+            return fail('provider_unavailable', 503);
+        const row = batches.get(String(params?.batch ?? ''));
+        if (!row)
+            return fail('batch_not_found', 404);
+        if (row.batch.actor !== actor.id)
+            return fail('permission_denied', 403);
+        row.reads++;
+        if (scenario === 'stalled') {
+            row.batch.stalled = true;
+            row.batch.message = 'Batch stalled: inspect the jobs runner and cleanup channel.';
+        }
+        else if (row.reads >= 3 && !row.applied) {
+            row.batch.state = scenario === 'failed' ? 'failed' : 'done';
+            row.batch.message = scenario === 'failed' ? 'A step failed; completed changes remain applied.' : 'Every capacity step completed and was observed.';
+            row.batch.error_code = scenario === 'failed' ? 'terminate_failed' : null;
+            row.batch.steps.forEach((s, i) => { s.state = scenario === 'failed' ? (i === 0 ? 'done' : i === 1 ? 'failed' : 'not_attempted') : 'done'; s.phase = s.state === 'done' ? 'observed' : null; s.error_code = s.state === 'failed' ? 'terminate_failed' : null; s.operation = `mock-operation-${row.batch.id}-${i}`; });
+            applyInventory(row.batch);
+            row.applied = true;
+        }
+        else if (row.batch.state === 'running') {
+            row.batch.steps[0]!.state = 'running';
+            row.batch.steps[0]!.phase = 'settling';
+            row.batch.steps[0]!.operation = `mock-operation-${row.batch.id}-0`;
+        }
+        return ok(row.batch);
+    }
+    if (method !== 'POST')
+        return fail('not_found', 404);
+    if (state.mode === 'external')
+        return fail('infrastructure_external', 403);
+    if (actor.is_superuser !== true)
+        return fail('superuser_required', 403);
+    if (scenario === 'reauth' || typeof authTime !== 'number' || Date.now() / 1000 - authTime > 600)
+        return fail('reauth_required', 440, 'reauth_required');
+    if (path === '/api/aws/capacity/plan') {
+        try {
+            const plan = serverPlan(actor, body?.steps);
+            plans.set(plan.id, { plan, version });
+            return ok(plan);
+        }
+        catch (e) {
+            return fail('invalid_request', 400, e instanceof Error ? e.message : 'Invalid plan.');
+        }
+    }
+    if (path === '/api/aws/capacity/plan/apply') {
+        if (!body || Object.keys(body).length !== 1 || typeof body.plan_id !== 'string')
+            return fail('invalid_request', 400, 'Submit only plan_id.');
+        const stored = plans.get(body.plan_id);
+        if (!stored || Date.parse(stored.plan.expires_at) <= Date.now())
+            return fail('plan_not_found', 404);
+        if (stored.plan.actor !== actor.id)
+            return fail('permission_denied', 403);
+        if (scenario === 'stale-plan' || stored.version !== version)
+            return fail('plan_stale', 409);
+        const prior = claimed.get(body.plan_id);
+        if (prior)
+            return fail('plan_already_applied', 409, 'Plan already applied.', { batch: prior });
+        const batch: CapacityBatch = { schema_version: 2, id: `mock-batch-${++sequence}`, plan_id: body.plan_id, actor: actor.id, state: 'running', started: timestamp(), current_index: 0, message: 'Requested; waiting for provider observation.', error_code: null, stalled: false, steps: stored.plan.steps.map(s => ({ index: s.index, action: s.action, resource: s.resource, description: s.description, state: 'pending', operation: null, phase: null, message: null, error_code: null })) };
+        claimed.set(body.plan_id, batch.id);
+        batches.set(batch.id, { batch, reads: 0, applied: false });
+        if (scenario === 'duplicate')
+            return fail('plan_already_applied', 409, 'Plan already applied.', { batch: batch.id });
+        if (scenario === 'uncertain-apply')
+            throw new TypeError('Mock response lost after batch submission. Inspect mock server batch records.');
+        return ok(batch);
+    }
+    return fail('not_found', 404);
+}
+/** Test/debug observation only: IDs, never an alternate apply path. */
+export const getMockOperationalFleetBatchIds = () => [...batches.keys()];

package/src/client/operations-mock.ts

@@ -0,0 +1,85 @@
+/** Lazy central bridge for the operations contracts; never imported by runtime entrypoints. */
+import { backendGlobalCan, FLEET_DASHBOARD_GRANTS } from '../admin/fleet/access';
+import type { User } from './types';
+interface OperationsMockContext {
+    user?: User;
+    credentialKind?: unknown;
+    authTime?: number;
+    origin?: string;
+}
+interface OperationsMockOptions { method?: string; body?: Record<string, unknown>; params?: Record<string, unknown>; headers?: Record<string, string> }
+const denied = (code = 403) => ({ status: false, error: 'permission denied', error_code: code });
+const confined = (kind: unknown) => typeof kind === 'string' && ['api_key', 'group_token', 'group_scoped_token'].includes(kind);
+
+export async function operationsMock(path: string, options: OperationsMockOptions, context: OperationsMockContext): Promise<unknown | undefined> {
+    const method = (options.method ?? 'GET').toUpperCase(), user = context.user;
+    const deploymentOwned = path === '/api/account/admin/platform' && options.params?.sections === 'deployments,api'
+        || path.startsWith('/api/account/admin/platform/deploy/') || path.startsWith('/api/edge/webapp/onboarding/')
+        || ['/api/edge/webapp/summaries', '/api/edge/webapp/summary', '/api/edge/webapp/key_status', '/api/edge/webapp/link_key', '/api/edge/webapp/revoke_key', '/api/edge/webapp/rollback', '/api/edge/webapp/health'].includes(path)
+        || /^\/api\/edge\/webapp\/\d+$/.test(path) || /^\/api\/edge\/release\/deployment\/\d+$/.test(path)
+        || path === '/api/edge/release' && (method === 'POST' || options.params?.webapp !== undefined)
+        || path === '/api/edge/release/complete' || path === '/api/edge/deployment' && options.params?.webapp !== undefined;
+    const maintenanceOwned = path === '/api/account/admin/advanced/settings' && Object.hasOwn(options.body ?? {}, 'framework_pin') || path === '/api/account/admin/platform' && options.params?.sections === 'deployments';
+    const owned = maintenanceOwned || deploymentOwned || ['/api/account/admin/bootstrap', '/api/account/admin/settings', '/api/account/admin/dashboard', '/api/account/admin/setup/readiness', '/api/aws/capacity', '/api/aws/capacity/status', '/api/aws/capacity/plan', '/api/aws/capacity/plan/apply', '/api/aws/maintenance/versions', '/api/aws/maintenance/status', '/api/aws/maintenance/apply', '/api/account/admin/platform/framework', '/api/account/admin/platform/framework/update'].includes(path);
+    if (!owned) return undefined;
+    if (!user || user.is_active !== true) return denied(401);
+    // Mock attribution comes from the validated mock bearer. Per-user UserAPIKey
+    // is deliberately allowed by these ordinary operator decorators.
+    const keyBacked = confined(context.credentialKind);
+    if (keyBacked) return denied();
+    if (path === '/api/account/admin/bootstrap') {
+        if (method !== 'GET') return { status: false, error: 'Method not allowed', error_code: 405 };
+        if (!backendGlobalCan(user, FLEET_DASHBOARD_GRANTS)) return denied();
+        const { getMockOperationalFleetScenario } = await import('./operational-fleet-mock');
+        const { readMaintenanceBootstrapFacts } = await import('./maintenance-mock');
+        const maintenance = readMaintenanceBootstrapFacts();
+        if (maintenance.bootstrap === 'denied') return denied();
+        const malformed = maintenance.bootstrap === 'malformed';
+        const { readDeploymentBootstrapFacts } = await import('./deployments-mock');
+        const deployment = readDeploymentBootstrapFacts(user);
+        const { readServingBootstrapFacts, recordServingBootstrap } = await import('./serving-mock');
+        const serving = readServingBootstrapFacts();
+        if (serving.bootstrap === 'denied') return denied();
+        recordServingBootstrap(user.id, context.authTime);
+        const mode = maintenance.mode === 'external' || getMockOperationalFleetScenario() === 'external' ? 'external' : 'managed';
+        // One composer owns this response. Later domain facts are assigned by
+        // explicit nested field ownership rather than whole-object overwrites.
+        return { status: true, data: {
+            admin_path: '/admin/', user: { id: serving.mismatch ? user.id + 1 : user.id, is_superuser: user.is_superuser === true },
+            capabilities: { setup: user.is_superuser === true, manage_webapps: deployment.capabilities.manage_webapps }, webapp_groups: deployment.webapp_groups, can_create_webapp_group: deployment.can_create_webapp_group, ...(serving.edge !== undefined ? { edge: serving.edge } : {}), infrastructure: malformed ? {} : { mode },
+            features: {
+                platform: { enabled: true, capabilities: { setup: user.is_superuser === true, view: backendGlobalCan(user, ['view_platform', 'manage_platform', 'admin']), capacity: backendGlobalCan(user, 'manage_aws'), ...(!malformed ? { infrastructure_managed: mode === 'managed' } : {}) } },
+                webapps: { enabled: deployment.features.webapps.enabled },
+                settings: { enabled: true, capabilities: { owner_edit: user.is_superuser === true } },
+            },
+        } };
+    }
+    if (path === '/api/account/admin/setup/readiness') {
+        const { servingReadinessMock } = await import('./serving-mock');
+        return servingReadinessMock(method, options.params, user.id, user.is_superuser === true && backendGlobalCan(user, FLEET_DASHBOARD_GRANTS), context.authTime);
+    }
+    if (path === '/api/account/admin/settings') {
+        if (user.is_superuser !== true) return denied();
+        if (method === 'POST') {
+            if (context.origin && context.origin !== globalThis.location?.origin) return denied();
+            if (typeof context.authTime !== 'number' || !Number.isFinite(context.authTime) || context.authTime > Date.now() / 1000 || Date.now() / 1000 - context.authTime > 600) return { status: false, error: 'reauth_required', error_code: 440 };
+        }
+        const { geoProviderMock } = await import('./geo-provider-mock');
+        return geoProviderMock(path, method, options.body, true) ?? { status: false, error: 'Unsupported provider topic', error_code: 400 };
+    }
+    if (maintenanceOwned || path.startsWith('/api/aws/maintenance/') || path === '/api/account/admin/platform/framework' || path === '/api/account/admin/platform/framework/update') {
+        const { maintenanceMock } = await import('./maintenance-mock');
+        const age = typeof context.authTime === 'number' ? Date.now() / 1000 - context.authTime : NaN;
+        return maintenanceMock(path, method, options.body, options.params, { user, keyBacked, fresh: Number.isFinite(age) && age >= 0 && age <= 600 });
+    }
+    if (path === '/api/account/admin/dashboard' || path.startsWith('/api/aws/capacity')) {
+        const { handleOperationalFleetMock } = await import('./operational-fleet-mock');
+        return handleOperationalFleetMock(path, method, options.body, options.params, user, context.authTime);
+    }
+    if (path === '/api/account/admin/platform' || path.startsWith('/api/account/admin/platform/deploy/') || path.startsWith('/api/edge/webapp') || path.startsWith('/api/edge/release') || path === '/api/edge/deployment') {
+        const { deploymentsMock } = await import('./deployments-mock');
+        const group = options.params?.group ?? options.body?.group;
+        return deploymentsMock(path, options, { user, keyBacked, authTime: context.authTime ?? null, group: typeof group === 'number' ? group : typeof group === 'string' && /^\d+$/.test(group) ? Number(group) : null, interactive: !context.origin || context.origin === globalThis.location?.origin });
+    }
+    return undefined;
+}

package/src/client/serving-mock.ts

@@ -0,0 +1,22 @@
+/** Read-only Serving fixtures. Controls import this module directly, never through runtime. */
+export const SERVING_SCENARIOS = ['ready', 'http-disabled', 'unavailable', 'missing-edge', 'unexpected-issuance', 'bootstrap-denied', 'bootstrap-identity', 'bootstrap-malformed', 'old-backend', 'readiness-denied', 'readiness-malformed', 'reordered', 'missing-section', 'truncated', 'stale-refresh'] as const;
+export type ServingMockScenario = typeof SERVING_SCENARIOS[number];
+let scenario: ServingMockScenario = 'ready', reads = 0;
+const admitted = new Set<string>();
+export function setMockServingScenario(value: ServingMockScenario): void { scenario = value; reads = 0; admitted.clear(); }
+const identity = (id: number, authTime?: number) => `${id}:${authTime ?? 'no-interactive-time'}`;
+export function readServingBootstrapFacts() {
+    return { bootstrap: scenario === 'bootstrap-denied' ? 'denied' : 'ok', mismatch: scenario === 'bootstrap-identity', edge: scenario === 'missing-edge' ? undefined : scenario === 'bootstrap-malformed' ? { available: 'unknown' } : scenario === 'unavailable' ? { available: false, http_enabled: null, dnsman_issuance: null } : { available: true, http_enabled: scenario !== 'http-disabled', dnsman_issuance: scenario === 'unexpected-issuance' ? 'other' : 'dns-01' } };
+}
+export function recordServingBootstrap(id: number, authTime?: number): void { if (!['bootstrap-denied', 'bootstrap-identity', 'bootstrap-malformed', 'missing-edge'].includes(scenario)) admitted.add(identity(id, authTime)); }
+export function servingReadinessMock(method: string, params: Record<string, unknown> | undefined, id: number, superuser: boolean, authTime?: number): unknown {
+    const fail = (error: string, error_code: number) => ({ status: false, error, error_code });
+    if (method !== 'GET') return fail('Method not allowed', 405);
+    if (!superuser || !admitted.has(identity(id, authTime)) || scenario === 'readiness-denied') return fail('permission denied', 403);
+    if (params?.section !== 'hosting_vhosts' || scenario === 'old-backend') return fail('Not found', 404);
+    if (scenario === 'stale-refresh' && reads++ > 0) return fail('Latest hosting observation unavailable', 503);
+    const coverage = (total: number, returned = total) => ({ total, returned, omitted: total - returned });
+    const checks = [{ code: 'hosting.vhost.1', status: 'pass', explanation: 'Enabled hostname has active domain and certificate configuration.', remediation: 'Inspect Serving for configuration changes.', details: { configuration_only: true } }];
+    const section = { code: 'hosting_vhosts', label: 'Hosting readiness', status: 'pass', checks, coverage: coverage(scenario === 'truncated' ? 3 : 1, 1) };
+    return { status: true, data: { schema_version: scenario === 'readiness-malformed' ? 99 : 1, generated_at: new Date().toISOString(), overall: 'pass', summary: { pass: 1, warn: 0, fail: 0, pending: 0 }, sections: scenario === 'missing-section' ? [] : scenario === 'reordered' ? [{ code: 'unrelated', label: 'Unrelated readiness', status: 'pending', checks: [], coverage: coverage(0) }, section] : [section], coverage: { sections: coverage(1), checks: coverage(scenario === 'truncated' ? 3 : 1, 1) }, truncated: scenario === 'truncated' } };
+}

package/src/styles/components/admin-deployments.css

@@ -0,0 +1,35 @@
+.admin-deployments{min-width:0;container-type:inline-size}.deployment-toolbar{display:flex;align-items:center;gap:.65rem;flex-wrap:wrap;justify-content:space-between;margin-block:1rem}.deployment-record{width:100%;display:flex;justify-content:space-between;align-items:center;gap:1rem;padding:1rem;text-align:left;background:var(--surface);color:var(--ink);border:1px solid var(--line);border-radius:var(--radius,.5rem);margin-block:.5rem;cursor:pointer}.deployment-record small{display:block;margin-top:.35rem;color:var(--mute);overflow-wrap:anywhere}.deployment-record:hover{border-color:var(--accent)}.deployment-status{white-space:nowrap}.deployment-facts{display:grid;gap:.7rem;margin-block:1rem}.deployment-facts>div{display:grid;grid-template-columns:11rem minmax(0,1fr);gap:1rem}.deployment-facts dt{color:var(--mute)}.deployment-facts dd{margin:0;overflow-wrap:anywhere}.deployment-form{display:grid;gap:1rem;grid-template-columns:repeat(2,minmax(0,1fr));margin-block:1rem}.admin-deployments label{display:grid;gap:.4rem;margin-block:.75rem}.admin-deployments input,.admin-deployments select{max-width:100%;min-width:0}.deployment-code{max-height:18rem;overflow:auto;white-space:pre-wrap;overflow-wrap:anywhere;padding:1rem;background:var(--surface2);border:1px solid var(--line)}.deployment-confirm{padding:1rem;border:1px solid var(--line);margin-block:1rem}.deployment-confirm button+button{margin-left:.5rem}@container(max-width:480px){.deployment-form{grid-template-columns:minmax(0,1fr)}.deployment-facts>div{grid-template-columns:minmax(0,1fr);gap:.2rem}.deployment-record{align-items:flex-start;flex-direction:column}.admin-deployments .modal-actions{flex-wrap:wrap}}
+
+.admin-deployments input:not([type="file"]),.admin-deployments select{padding:.55rem .7rem;border:1px solid var(--field-line);border-radius:6px;background:var(--field-bg);color:var(--ink);font:inherit;width:100%;box-sizing:border-box}.admin-deployments .page-header{display:flex;justify-content:space-between;align-items:start;gap:1rem;flex-wrap:wrap}
+.admin-deployments h1{font-size:26px;font-weight:750;line-height:1.2;letter-spacing:-.025em;color:var(--ink-strong);margin:0 0 .5rem}.admin-deployments h2{font-size:19px;font-weight:700;line-height:1.35;color:var(--ink-strong)}.admin-deployments h3{font-size:16px;font-weight:650;color:var(--ink-strong);margin-block:1rem .5rem}.admin-deployments .page-header{margin-bottom:1.25rem}.admin-deployments .page-header p{max-width:60ch}
+
+.deployment-current { padding: 20px; border: 1px solid var(--line); border-radius: 10px; background: var(--surface); }
+.deployment-current > strong { display: block; margin-top: 8px; overflow-wrap: anywhere; font-size: 18px; }
+.deployment-current > p { margin: 6px 0; }
+.admin-deployments { max-width: 1120px; margin-inline: auto; }
+.admin-deployments .deployment-record { padding: 16px 20px; }
+
+.deployment-attempt-summary { flex-shrink: 0; text-align: right; }
+
+/* Deployment tasks share compact, native dialogs; secondary evidence stays on request. */
+.deployment-dialog-header{display:flex;justify-content:space-between;align-items:flex-start;gap:1rem;margin-bottom:1.25rem;min-width:0}
+.deployment-dialog-heading{min-width:0}.deployment-dialog-header .modal-title{margin:0}.deployment-dialog-header p{margin:.4rem 0 0;overflow-wrap:anywhere}
+.deployment-actions,.deployment-row-actions{display:flex;align-items:center;gap:.65rem;flex-wrap:wrap}
+.deployment-stack,.deployment-tab-content{display:grid;gap:1rem;min-width:0}.deployment-tab-content{padding-top:1rem}
+.deployment-dialog .deployment-toolbar{margin-block:.75rem}.deployment-dialog .deployment-facts{margin-block:.5rem}
+.deployment-dialog .panel-title{font-size:19px;line-height:1.35;letter-spacing:normal;margin:0}
+.deployment-summary-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:1rem;margin-block:1rem}
+.deployment-summary-grid>div,.deployment-summary-grid>section,.deployment-evidence{padding:1rem;border:1px solid var(--line);border-radius:8px;background:var(--surface);min-width:0;overflow-wrap:anywhere}
+.deployment-evidence>strong{margin-right:.75rem}.deployment-evidence p{margin-block:.5rem 0}.deployment-empty{padding:1.25rem;color:var(--mute)}
+.deployment-fields{border:0;padding:0;margin:0;min-width:0}.deployment-fields legend{padding:0;font-weight:650}.deployment-instructions{padding-left:1.4rem;display:grid;gap:.75rem;list-style:decimal}
+.deployment-key-setup{border-top:1px solid var(--line);padding-top:1rem;margin-top:1rem}.deployment-key-setup p{margin-block:.5rem 1rem}
+.deployment-setup-progress{display:flex;gap:.5rem;flex-wrap:wrap;padding:0;list-style:none;margin:1rem 0 1.5rem}.deployment-setup-progress li{display:flex;align-items:center;gap:.35rem;color:var(--mute);padding:.5rem .65rem;border-radius:6px;border:1px solid var(--line)}.deployment-setup-progress [aria-current="step"]{color:var(--accent);border-color:var(--accent);font-weight:650}
+.deployment-pagination{display:flex;align-items:center;justify-content:space-between;gap:.75rem;flex-wrap:wrap;margin-block:1rem}
+.admin-deployments input[type="checkbox"],.admin-deployments input[type="radio"]{width:auto;padding:0;accent-color:var(--accent)}.admin-deployments label:has(>input[type="checkbox"]),.admin-deployments label:has(>input[type="radio"]){display:flex;align-items:flex-start;gap:.65rem}
+@container(max-width:560px){.deployment-dialog-header{flex-direction:column}.deployment-summary-grid{grid-template-columns:minmax(0,1fr)}.deployment-attempt-summary{text-align:left}.deployment-dialog .modal-actions{display:flex;flex-wrap:wrap;gap:.65rem}.deployment-dialog .modal-actions>*{margin:0}.deployment-dialog .deployment-facts>div{grid-template-columns:minmax(0,1fr);gap:.25rem}}
+
+.admin-deployments .deployment-form>label{margin:0}
+.deployment-dialog-header:has(>.modal-title){flex-direction:row}.deployment-dialog-header>.btn-icon{flex-shrink:0}
+@container(max-width:480px){.deployment-dialog [role="tablist"][aria-label="WebApp tasks"]{flex-wrap:wrap;overflow:visible}}
+
+@container(max-width:480px){.deployment-release-history th:nth-child(3),.deployment-release-history td:nth-child(3){display:none}.deployment-release-history th,.deployment-release-history td{padding-inline:.5rem}.deployment-release-history td .btn{white-space:nowrap;padding-inline:.65rem;font-size:12px}.deployment-release-history th,.deployment-release-history th button{font-size:10px;letter-spacing:.04em}.deployment-release-history table{table-layout:fixed;width:100%}.deployment-release-history th:first-child{width:25%}.deployment-release-history th:nth-child(2){width:42%}.deployment-release-history th:last-child{width:33%}}

package/src/styles/components/admin-dns-certificates.css

@@ -26,3 +26,36 @@
     .dns-cert-card .badge { align-self: flex-start; }
 }
 @media (prefers-reduced-motion: reduce) { .dns-cert-readiness .spin { animation: none; } }
+
+.dns-shared-dialog, .dns-shared-facts, .dns-shared-panel, .dns-shared-showcase { display: grid; gap: 14px; min-width: 0; }
+.dns-shared-dialog code, .dns-shared-facts code, .dns-shared-confirm code, .dns-shared-request code, .dns-shared-showcase code { overflow-wrap: anywhere; white-space: normal; }
+.dns-shared-showcase { grid-template-columns: minmax(0, 1fr); }
+.dns-shared-showcase > * { min-width: 0; max-width: 100%; }
+.dns-shared-actions, .dns-shared-demo-controls { display: flex; flex-wrap: wrap; gap: 10px; align-items: end; }
+.dns-shared-actions .btn { white-space: normal; }
+.dns-shared-request { display: grid; gap: 10px; border: 1px solid var(--line); border-radius: 8px; padding: 14px; min-width: 0; overflow-wrap: anywhere; }
+.dns-shared-request dl { margin: 0; display: grid; gap: 8px; }
+.dns-shared-request dt { color: var(--mute); font-size: 12px; }
+.dns-shared-request dd { margin: 0; }
+.dns-shared-dialog .seg { flex-wrap: wrap; }
+.dns-shared-dialog .field { min-width: 0; }
+.dns-shared-dialog .modal-actions { position: static; }
+.dns-shared-dialog .dns-shared-facts { border-top: 1px solid var(--line); padding-top: 14px; }
+
+.dns-shared-allocations { min-width: 0; border: 1px solid var(--line); border-radius: 8px; padding: 14px; display: grid; gap: 12px; }
+.dns-shared-allocation { display: flex; align-items: flex-start; gap: 10px; cursor: pointer; min-width: 0; }
+.dns-shared-allocation > span { display: grid; gap: 4px; min-width: 0; overflow-wrap: anywhere; }
+.dns-shared-allocation input { flex: 0 0 auto; margin-top: 4px; }
+.dns-shared-allocation small { color: var(--mute); }
+.dns-shared-dialog input[type="file"] { max-width: 100%; min-width: 0; color: var(--ink); }
+.dns-shared-dialog input[type="file"]::file-selector-button { color: var(--ink); background: var(--surface2); border: 1px solid var(--line); border-radius: 6px; padding: 7px 10px; margin-right: 8px; cursor: pointer; }
+.dns-shared-confirm { min-width: 0; overflow-wrap: anywhere; }
+
+/* Private connection/key facts also fit narrow embedded Admin content. */
+.shared-validation-operator { container-type: inline-size; }
+.shared-validation-operator .flat-value { min-width: 0; overflow-wrap: anywhere; }
+.shared-validation-operator code { overflow-wrap: anywhere; white-space: normal; }
+@container (max-width: 420px) {
+    .shared-validation-operator .flat-row { grid-template-columns: minmax(0, 1fr); gap: 4px; }
+    .shared-validation-operator .flat-action:empty { display: none; }
+}

package/src/styles/components/admin-domains.css

@@ -0,0 +1,12 @@
+.domains-header,.domains-actions,.domains-overview-actions{display:flex;align-items:center;justify-content:space-between;gap:10px;flex-wrap:wrap}.domains-header{margin-bottom:16px}.domains-actions,.domains-overview-actions{justify-content:flex-start}.domains-header p{margin:0;max-width:60ch}.domains-scope{overflow-wrap:anywhere}.domains-advanced{margin-top:16px;padding:16px;border:1px solid var(--line);border-radius:8px;background:var(--surface)}.domains-advanced summary{font-weight:650;cursor:pointer}.domains-overview-actions{margin-bottom:18px}.domains-registrar-settings{display:grid;gap:14px}.domains-registrar-settings label{display:flex;gap:10px;align-items:center}.domains-demo{display:grid;gap:16px;min-width:0}.domains-demo .seg{flex-wrap:wrap}@media(max-width:560px){.domains-header{align-items:flex-start;flex-direction:column}.domains-actions{width:100%}.domains-actions .btn{flex:1 1 auto;white-space:normal}}
+
+.domains-header h1 { margin: 4px 0 8px; font-size: 26px; line-height: 1.2; font-weight: 750; letter-spacing: -.025em; color: var(--ink-strong); }
+.domains-header { align-items: center; margin-bottom: 24px; }
+
+.domains-page, .domains-page > * { min-width: 0; }
+.domains-demo { grid-template-columns: minmax(0, 1fr); }
+.domains-demo > * { min-width: 0; }
+@media (max-width: 560px) { .domains-header { align-items: flex-start; } }
+
+.domain-onboarding > .dim { margin: 4px 0 20px; }
+.domain-onboarding .dns-registrar-grid { gap: 20px; }