team-chat 0.0.0-stage → 0.3.1

package/server/dist/src/team/team.controller.js

@@ -0,0 +1,178 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RunnerController = exports.TeamController = void 0;
+const common_1 = require("@nestjs/common");
+const participant_guard_1 = require("../auth/participant.guard");
+const chats_service_1 = require("../chats/chats.service");
+const runner_service_1 = require("./runner.service");
+const team_service_1 = require("./team.service");
+/** Команда: агенты, роли, машины. Читают все, меняет владелец. */
+let TeamController = class TeamController {
+    team;
+    chats;
+    constructor(team, chats) {
+        this.team = team;
+        this.chats = chats;
+    }
+    index() {
+        return this.team.overview();
+    }
+    addAgent(me, body) {
+        return this.team.addAgent(me, body);
+    }
+    updateAgent(me, handle, body) {
+        return this.team.updateAgent(me, handle, body);
+    }
+    addRole(me, body) {
+        return this.team.addRole(me, body);
+    }
+    updateRole(me, slug, body) {
+        return this.team.updateRole(me, slug, body);
+    }
+    removeRole(me, slug) {
+        return this.team.removeRole(me, slug);
+    }
+    async chatRole(me, slug, body) {
+        return this.team.setChatRole(me, await this.chats.bySlug(slug), body);
+    }
+    addRunner(me, body, request) {
+        return this.team.addRunner(me, body, origin(request));
+    }
+    rotateRunner(me, handle, request) {
+        return this.team.rotateRunner(me, handle, origin(request));
+    }
+};
+exports.TeamController = TeamController;
+__decorate([
+    (0, common_1.Get)('team'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", void 0)
+], TeamController.prototype, "index", null);
+__decorate([
+    (0, common_1.Post)('agents'),
+    __param(0, (0, participant_guard_1.Me)()),
+    __param(1, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", void 0)
+], TeamController.prototype, "addAgent", null);
+__decorate([
+    (0, common_1.Patch)('agents/:handle'),
+    __param(0, (0, participant_guard_1.Me)()),
+    __param(1, (0, common_1.Param)('handle')),
+    __param(2, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, Object]),
+    __metadata("design:returntype", void 0)
+], TeamController.prototype, "updateAgent", null);
+__decorate([
+    (0, common_1.Post)('roles'),
+    __param(0, (0, participant_guard_1.Me)()),
+    __param(1, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", void 0)
+], TeamController.prototype, "addRole", null);
+__decorate([
+    (0, common_1.Patch)('roles/:slug'),
+    __param(0, (0, participant_guard_1.Me)()),
+    __param(1, (0, common_1.Param)('slug')),
+    __param(2, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, Object]),
+    __metadata("design:returntype", void 0)
+], TeamController.prototype, "updateRole", null);
+__decorate([
+    (0, common_1.Delete)('roles/:slug'),
+    __param(0, (0, participant_guard_1.Me)()),
+    __param(1, (0, common_1.Param)('slug')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String]),
+    __metadata("design:returntype", void 0)
+], TeamController.prototype, "removeRole", null);
+__decorate([
+    (0, common_1.Put)('chats/:chat/roles'),
+    __param(0, (0, participant_guard_1.Me)()),
+    __param(1, (0, common_1.Param)('chat')),
+    __param(2, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, Object]),
+    __metadata("design:returntype", Promise)
+], TeamController.prototype, "chatRole", null);
+__decorate([
+    (0, common_1.Post)('runners'),
+    __param(0, (0, participant_guard_1.Me)()),
+    __param(1, (0, common_1.Body)()),
+    __param(2, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, Object]),
+    __metadata("design:returntype", void 0)
+], TeamController.prototype, "addRunner", null);
+__decorate([
+    (0, common_1.Post)('runners/:handle/token'),
+    (0, common_1.HttpCode)(200),
+    __param(0, (0, participant_guard_1.Me)()),
+    __param(1, (0, common_1.Param)('handle')),
+    __param(2, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, Object]),
+    __metadata("design:returntype", void 0)
+], TeamController.prototype, "rotateRunner", null);
+exports.TeamController = TeamController = __decorate([
+    (0, common_1.Controller)('api'),
+    (0, common_1.UseGuards)(participant_guard_1.ParticipantGuard),
+    __metadata("design:paramtypes", [team_service_1.TeamService, chats_service_1.ChatsService])
+], TeamController);
+/** Раннер на машине с агентами — только участник host. */
+let RunnerController = class RunnerController {
+    runner;
+    constructor(runner) {
+        this.runner = runner;
+    }
+    agents(me, runtimes) {
+        return this.runner.agents(me, runtimes);
+    }
+    token(me, handle) {
+        return this.runner.token(me, handle);
+    }
+};
+exports.RunnerController = RunnerController;
+__decorate([
+    (0, common_1.Get)('agents'),
+    __param(0, (0, participant_guard_1.Me)()),
+    __param(1, (0, common_1.Query)('runtimes')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String]),
+    __metadata("design:returntype", void 0)
+], RunnerController.prototype, "agents", null);
+__decorate([
+    (0, common_1.Post)('agents/:handle/token'),
+    (0, common_1.HttpCode)(200),
+    __param(0, (0, participant_guard_1.Me)()),
+    __param(1, (0, common_1.Param)('handle')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String]),
+    __metadata("design:returntype", void 0)
+], RunnerController.prototype, "token", null);
+exports.RunnerController = RunnerController = __decorate([
+    (0, common_1.Controller)('api/runner'),
+    (0, common_1.UseGuards)(participant_guard_1.ParticipantGuard),
+    __metadata("design:paramtypes", [runner_service_1.RunnerService])
+], RunnerController);
+/** Адрес, по которому открыли страницу: по нему чат виден и с другой машины. */
+function origin(request) {
+    return `${request.protocol}://${request.get('host')}`;
+}

package/server/dist/src/team/team.module.js

@@ -0,0 +1,25 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TeamModule = void 0;
+const common_1 = require("@nestjs/common");
+const conversation_module_1 = require("../conversation.module");
+const runner_service_1 = require("./runner.service");
+const team_controller_1 = require("./team.controller");
+const team_service_1 = require("./team.service");
+/** Команда и раннеры: кто есть, в каких ролях и на каких машинах. */
+let TeamModule = class TeamModule {
+};
+exports.TeamModule = TeamModule;
+exports.TeamModule = TeamModule = __decorate([
+    (0, common_1.Module)({
+        imports: [conversation_module_1.ConversationModule],
+        providers: [team_service_1.TeamService, runner_service_1.RunnerService],
+        controllers: [team_controller_1.TeamController, team_controller_1.RunnerController],
+    })
+], TeamModule);

package/server/dist/src/team/team.service.js

@@ -0,0 +1,280 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TeamService = void 0;
+const common_1 = require("@nestjs/common");
+const drizzle_orm_1 = require("drizzle-orm");
+const zod_1 = require("zod");
+const clock_1 = require("../common/clock");
+const errors_1 = require("../common/errors");
+const format_1 = require("../common/format");
+const slug_1 = require("../common/slug");
+const validation_1 = require("../common/validation");
+const database_module_1 = require("../db/database.module");
+const schema_1 = require("../db/schema");
+const directory_service_1 = require("../participants/directory.service");
+const participants_service_1 = require("../participants/participants.service");
+const ROLE_SLUG = /^[a-z0-9][a-z0-9-]{0,39}$/;
+const RUNTIME = /^[a-z0-9_-]{1,40}$/;
+const ACCENT = /^#[0-9a-fA-F]{6}$/;
+/** Слаги служебных участников: ролью агента они быть не могут. */
+const RESERVED_ROLES = [participants_service_1.ROLE_OWNER, participants_service_1.ROLE_HOST];
+const agentSchema = zod_1.z.object({
+    handle: zod_1.z.string().regex(participants_service_1.HANDLE_PATTERN, { error: 'Имя агента — латиница, цифры, дефис и подчёркивание, от 2 до 40 знаков.' })
+        // @all раскрывается на всех — агент с таким именем перехватил бы обращение.
+        .refine(h => h !== 'all', { error: 'Имя all занято обращением ко всем.' }),
+    name: zod_1.z.string().max(60),
+    role: zod_1.z.string(),
+    runtime: zod_1.z.string().regex(RUNTIME),
+    accent: zod_1.z.string().regex(ACCENT).nullish(),
+});
+const agentUpdateSchema = zod_1.z.object({
+    name: zod_1.z.string().max(60).optional(),
+    role: zod_1.z.string().optional(),
+    runtime: zod_1.z.string().regex(RUNTIME).optional(),
+    accent: zod_1.z.string().regex(ACCENT).optional(),
+    disabled: (0, validation_1.flag)().optional(),
+    // На какой машине работает: handle раннера; null — «свободен, заберёт первый».
+    host: zod_1.z.string().nullish(),
+});
+const roleSchema = zod_1.z.object({
+    slug: zod_1.z.string().regex(ROLE_SLUG, { error: 'Адрес роли — латиница, цифры и дефис.' })
+        .refine(s => !RESERVED_ROLES.includes(s), { error: 'Это имя занято служебной ролью.' }),
+    name: zod_1.z.string().max(60),
+    instructions: zod_1.z.string().max(20000),
+});
+const roleUpdateSchema = zod_1.z.object({
+    name: zod_1.z.string().max(60).optional(),
+    instructions: zod_1.z.string().max(20000).optional(),
+    // На слаг ссылаются агенты и замены в чатах.
+    slug: zod_1.z.undefined({ error: 'Адрес роли не меняется.' }).optional(),
+});
+const chatRoleSchema = zod_1.z.object({ handle: zod_1.z.string(), role: zod_1.z.string().nullable() });
+/**
+ * Команда: агенты, роли, машины. Видят все, меняет только владелец — роль это инструкция
+ * агенту, а агент работает на машине владельца.
+ */
+let TeamService = class TeamService {
+    db;
+    participants;
+    directories;
+    constructor(db, participants, directories) {
+        this.db = db;
+        this.participants = participants;
+        this.directories = directories;
+    }
+    async overview() {
+        const [agents, allRoles, runners, overrides, directory] = await Promise.all([
+            this.db.select().from(schema_1.participants).where((0, drizzle_orm_1.eq)(schema_1.participants.kind, 'ai')).orderBy((0, drizzle_orm_1.asc)(schema_1.participants.id)),
+            this.db.select().from(schema_1.roles).orderBy((0, drizzle_orm_1.asc)(schema_1.roles.id)),
+            this.db.select().from(schema_1.participants).where((0, drizzle_orm_1.eq)(schema_1.participants.kind, participants_service_1.KIND_HOST)).orderBy((0, drizzle_orm_1.asc)(schema_1.participants.id)),
+            this.chatRoles(),
+            this.directories.load(),
+        ]);
+        const usedRoles = new Set([...agents.map(a => a.role), ...overrides.map(o => o.role)]);
+        const runnerById = new Map(runners.map(r => [r.id, r]));
+        return {
+            agents: agents.map(a => this.agentApi(a, directory, runnerById, overrides)),
+            roles: allRoles.map(r => ({ ...roleApi(r), in_use: usedRoles.has(r.slug) })),
+            runners: runners.map(r => ({
+                handle: r.handle,
+                name: r.name,
+                seen_at: (0, format_1.iso)(r.lastSeenAt),
+                // Движки сообщает каждый раннер сам — какие есть на его машине.
+                runtimes: r.runtimes ?? [],
+                agents: agents.filter(a => a.hostId === r.id).map(a => a.handle),
+            })),
+            runtimes: [...new Set(runners.flatMap(r => r.runtimes ?? []))],
+        };
+    }
+    /** Ещё одна машина с агентами: участник-раннер и его токен — вместе с командой для той машины. */
+    async addRunner(me, input, origin) {
+        ownerOnly(me);
+        const { name } = (0, validation_1.validate)(zod_1.z.object({ name: zod_1.z.string().max(60) }), input);
+        const base = `host-${(0, slug_1.slugify)(name) || 'machine'}`;
+        const taken = new Set((await this.db.select({ handle: schema_1.participants.handle }).from(schema_1.participants)
+            .where((0, drizzle_orm_1.like)(schema_1.participants.handle, `${base}%`))).map(p => p.handle));
+        let handle = base;
+        for (let i = 2; taken.has(handle); i++)
+            handle = `${base}-${i}`;
+        const [runner] = await this.db.insert(schema_1.participants).values({ handle, name, kind: participants_service_1.KIND_HOST, role: participants_service_1.ROLE_HOST }).returning();
+        return this.runnerToken(runner, origin);
+    }
+    /** Новый токен машины — старый перестаёт работать (утёк, машину сменили). */
+    async rotateRunner(me, handle, origin) {
+        ownerOnly(me);
+        return this.runnerToken(await this.byHandle(handle, participants_service_1.KIND_HOST), origin);
+    }
+    /** Агента запускает раннер, и токен он берёт себе сам — здесь токен не выдаётся. */
+    async addAgent(me, input) {
+        ownerOnly(me);
+        const data = (0, validation_1.validate)(agentSchema, input);
+        if (await this.handleTaken(data.handle))
+            throw errors_1.ValidationFailed.field('handle', 'Такое имя уже занято.');
+        await this.requireRole(data.role);
+        const [agent] = await this.db.insert(schema_1.participants).values({
+            handle: data.handle, name: data.name, kind: 'ai', role: data.role, runtime: data.runtime, accent: data.accent ?? '#6d28d9',
+        }).returning();
+        return { agent: await this.agent(agent) };
+    }
+    async updateAgent(me, handle, input) {
+        ownerOnly(me);
+        const agent = await this.byHandle(handle, 'ai');
+        const data = (0, validation_1.validate)(agentUpdateSchema, input);
+        if (data.role !== undefined)
+            await this.requireRole(data.role);
+        const changes = {};
+        for (const key of ['name', 'role', 'runtime', 'accent'])
+            if (data[key] !== undefined)
+                changes[key] = data[key];
+        if (data.host !== undefined) {
+            changes.hostId = data.host === null ? null : (await this.hostByHandleOr422(data.host)).id;
+        }
+        else if (data.runtime !== undefined && data.runtime !== agent.runtime) {
+            // Сменился движок — машина могла его не уметь: пусть заберёт та, что умеет.
+            changes.hostId = null;
+        }
+        if (data.disabled !== undefined)
+            changes.disabledAt = data.disabled ? agent.disabledAt ?? (0, clock_1.now)() : null;
+        const [updated] = Object.keys(changes).length
+            ? await this.db.update(schema_1.participants).set(changes).where((0, drizzle_orm_1.eq)(schema_1.participants.id, agent.id)).returning()
+            : [agent];
+        return { agent: await this.agent(updated) };
+    }
+    async addRole(me, input) {
+        ownerOnly(me);
+        const raw = (input ?? {});
+        const data = (0, validation_1.validate)(roleSchema, { ...raw, slug: raw.slug || (0, slug_1.slugify)(String(raw.name ?? '')) });
+        const [exists] = await this.db.select({ id: schema_1.roles.id }).from(schema_1.roles).where((0, drizzle_orm_1.eq)(schema_1.roles.slug, data.slug));
+        if (exists)
+            throw errors_1.ValidationFailed.field('slug', 'Роль с таким адресом уже есть.');
+        const [role] = await this.db.insert(schema_1.roles).values(data).returning();
+        return { role: roleApi(role) };
+    }
+    async updateRole(me, slug, input) {
+        ownerOnly(me);
+        const role = await this.role(slug);
+        const data = (0, validation_1.validate)(roleUpdateSchema, input);
+        const changes = Object.fromEntries(Object.entries({ name: data.name, instructions: data.instructions }).filter(([, v]) => v !== undefined));
+        const [updated] = Object.keys(changes).length
+            ? await this.db.update(schema_1.roles).set(changes).where((0, drizzle_orm_1.eq)(schema_1.roles.id, role.id)).returning()
+            : [role];
+        return { role: roleApi(updated) };
+    }
+    async removeRole(me, slug) {
+        ownerOnly(me);
+        const role = await this.role(slug);
+        const [agent] = await this.db.select({ id: schema_1.participants.id }).from(schema_1.participants).where((0, drizzle_orm_1.eq)(schema_1.participants.role, slug)).limit(1);
+        const [override] = await this.db.select({ id: schema_1.chatAgentRoles.id }).from(schema_1.chatAgentRoles).where((0, drizzle_orm_1.eq)(schema_1.chatAgentRoles.role, slug)).limit(1);
+        if (agent || override)
+            throw (0, errors_1.conflict)('in_use', 'Роль назначена агентам — сначала смените им роль.');
+        await this.db.delete(schema_1.roles).where((0, drizzle_orm_1.eq)(schema_1.roles.id, role.id));
+        return { deleted: slug };
+    }
+    /** Роль агента в этом чате. role = null или основная — снять замену. */
+    async setChatRole(me, chat, input) {
+        ownerOnly(me);
+        const data = (0, validation_1.validate)(chatRoleSchema, input);
+        const [agent] = await this.db.select().from(schema_1.participants).where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.participants.handle, data.handle), (0, drizzle_orm_1.eq)(schema_1.participants.kind, 'ai')));
+        if (!agent)
+            throw errors_1.ValidationFailed.field('handle', 'Такого агента нет.');
+        if (data.role !== null)
+            await this.requireRole(data.role);
+        const key = (0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.chatAgentRoles.chatId, chat.id), (0, drizzle_orm_1.eq)(schema_1.chatAgentRoles.participantId, agent.id));
+        if (data.role === null || data.role === agent.role) {
+            await this.db.delete(schema_1.chatAgentRoles).where(key);
+        }
+        else {
+            await this.db.insert(schema_1.chatAgentRoles).values({ chatId: chat.id, participantId: agent.id, role: data.role })
+                .onConflictDoUpdate({ target: [schema_1.chatAgentRoles.chatId, schema_1.chatAgentRoles.participantId], set: { role: data.role } });
+        }
+        return { handle: agent.handle, role: (await this.directories.load()).roleIn(agent, chat.id) };
+    }
+    async runnerToken(runner, origin) {
+        const token = await this.participants.issueToken(runner.id);
+        return {
+            runner: { handle: runner.handle, name: runner.name },
+            token,
+            // Адрес — тот, по которому владелец открыл страницу: с другой машины чат виден по нему же.
+            connect: `team-chat connect ${origin} --token ${token}`,
+        };
+    }
+    async agent(agent) {
+        const [directory, overrides, runners] = await Promise.all([
+            this.directories.load(),
+            this.chatRoles([agent.id]),
+            this.db.select().from(schema_1.participants).where((0, drizzle_orm_1.eq)(schema_1.participants.kind, participants_service_1.KIND_HOST)),
+        ]);
+        return this.agentApi(agent, directory, new Map(runners.map(r => [r.id, r])), overrides);
+    }
+    agentApi(p, directory, runners, overrides) {
+        const host = p.hostId === null ? undefined : runners.get(p.hostId);
+        return {
+            handle: p.handle,
+            name: p.name,
+            accent: p.accent,
+            role: p.role,
+            role_name: directory.roleName(p.role),
+            runtime: p.runtime,
+            host: host ? { handle: host.handle, name: host.name } : null,
+            disabled: p.disabledAt !== null,
+            seen_at: (0, format_1.iso)(p.lastSeenAt),
+            chat_roles: Object.fromEntries(overrides.filter(o => o.participantId === p.id).map(o => [o.chat, o.role])),
+        };
+    }
+    chatRoles(participantIds) {
+        return this.db.select({ participantId: schema_1.chatAgentRoles.participantId, role: schema_1.chatAgentRoles.role, chat: schema_1.chats.slug })
+            .from(schema_1.chatAgentRoles).innerJoin(schema_1.chats, (0, drizzle_orm_1.eq)(schema_1.chats.id, schema_1.chatAgentRoles.chatId))
+            .where(participantIds ? (0, drizzle_orm_1.inArray)(schema_1.chatAgentRoles.participantId, participantIds) : undefined);
+    }
+    async byHandle(handle, kind) {
+        const [p] = await this.db.select().from(schema_1.participants).where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.participants.handle, handle), (0, drizzle_orm_1.eq)(schema_1.participants.kind, kind)));
+        if (!p)
+            throw (0, errors_1.notFound)();
+        return p;
+    }
+    async hostByHandleOr422(handle) {
+        const [p] = await this.db.select().from(schema_1.participants).where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.participants.handle, handle), (0, drizzle_orm_1.eq)(schema_1.participants.kind, participants_service_1.KIND_HOST)));
+        if (!p)
+            throw errors_1.ValidationFailed.field('host', 'Такой машины нет.');
+        return p;
+    }
+    async role(slug) {
+        const [role] = await this.db.select().from(schema_1.roles).where((0, drizzle_orm_1.eq)(schema_1.roles.slug, slug));
+        if (!role)
+            throw (0, errors_1.notFound)();
+        return role;
+    }
+    async requireRole(slug) {
+        const [role] = await this.db.select({ id: schema_1.roles.id }).from(schema_1.roles).where((0, drizzle_orm_1.eq)(schema_1.roles.slug, slug));
+        if (!role)
+            throw errors_1.ValidationFailed.field('role', 'Такой роли нет.');
+    }
+    async handleTaken(handle) {
+        const [p] = await this.db.select({ id: schema_1.participants.id }).from(schema_1.participants).where((0, drizzle_orm_1.eq)(schema_1.participants.handle, handle));
+        return Boolean(p);
+    }
+};
+exports.TeamService = TeamService;
+exports.TeamService = TeamService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(database_module_1.DATABASE)),
+    __metadata("design:paramtypes", [Object, participants_service_1.ParticipantsService,
+        directory_service_1.DirectoryService])
+], TeamService);
+const roleApi = (r) => ({ slug: r.slug, name: r.name, instructions: r.instructions });
+function ownerOnly(me) {
+    if (!(0, participants_service_1.isOwner)(me))
+        throw (0, errors_1.forbidden)('Агентов и роли настраивает только владелец.');
+}

package/server/dist/src/web/template.js

@@ -0,0 +1,57 @@
+"use strict";
+// Страницы — HTML-файлы из server/views с подстановками. Почти вся страница — клиентский
+// JS, который ходит в API тем же токеном, что и агенты; серверу остаётся вставить
+// несколько значений:
+//
+//   {{ chat.name }}            значение, экранированное для HTML
+//   {{json token}}             значение как JSON — безопасно внутри <script>
+//   {{#owner}}…{{/owner}}      блок, если значение истинно
+//   {{^owner}}…{{/owner}}      блок, если ложно
+//
+// Неизвестное имя — ошибка, а не пустая строка: опечатка в шаблоне должна быть видна сразу.
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.render = render;
+exports.renderString = renderString;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const VIEWS = node_path_1.default.join(__dirname, '..', '..', '..', 'views');
+const cache = new Map();
+function render(view, vars) {
+    return renderString(load(view), vars, view);
+}
+function renderString(template, vars, name = 'шаблон') {
+    const value = (key) => {
+        let current = vars;
+        for (const part of key.split('.')) {
+            if (current === null || typeof current !== 'object' || !(part in current)) {
+                throw new Error(`${name}: нет значения «${key}»`);
+            }
+            current = current[part];
+        }
+        return current;
+    };
+    return template
+        .replace(/\{\{([#^])([\w.]+)\}\}([\s\S]*?)\{\{\/\2\}\}/g, (_, kind, key, body) => (Boolean(value(key)) === (kind === '#') ? body : ''))
+        .replace(/\{\{json ([\w.]+)\}\}/g, (_, key) => scriptJson(value(key)))
+        .replace(/\{\{ ([\w.]+) \}\}/g, (_, key) => escapeHtml(String(value(key))));
+}
+function load(view) {
+    let template = cache.get(view);
+    if (template === undefined) {
+        template = node_fs_1.default.readFileSync(node_path_1.default.join(VIEWS, `${view}.html`), 'utf8');
+        cache.set(view, template);
+    }
+    return template;
+}
+function escapeHtml(text) {
+    return text.replace(/[&<>"']/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
+}
+/** JSON внутри <script>: «</script>» в данных не должен закрыть тег. */
+function scriptJson(data) {
+    return JSON.stringify(data ?? null)
+        .replace(/</g, '\\u003c').replace(/>/g, '\\u003e').replace(/&/g, '\\u0026')
+        .replace(/\u2028/g, '\\u2028').replace(/\u2029/g, '\\u2029');
+}

package/server/dist/src/web/web-login.service.js

@@ -0,0 +1,74 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebLoginService = exports.COOKIE_MAX_AGE_MS = exports.COOKIE = void 0;
+const common_1 = require("@nestjs/common");
+const drizzle_orm_1 = require("drizzle-orm");
+const clock_1 = require("../common/clock");
+const tokens_1 = require("../common/tokens");
+const config_1 = require("../config/config");
+const database_module_1 = require("../db/database.module");
+const schema_1 = require("../db/schema");
+const participants_service_1 = require("../participants/participants.service");
+/** Cookie со входом браузера. Имя — как у PHP-сервера. */
+exports.COOKIE = 'chat_token';
+/** Сколько живёт ссылка, если ею не воспользовались. */
+const LINK_TTL_MS = 15 * 60_000;
+/** Сколько живёт вход в браузере: год — это рабочий инструмент, а не банк. */
+exports.COOKIE_MAX_AGE_MS = 365 * 24 * 60 * 60_000;
+/**
+ * Вход в страницы по одноразовой ссылке. Ссылку печатает консоль (team-chat login): кто
+ * может запустить команду на машине, тот и владелец. По ссылке браузер получает свой
+ * токен — отдельный на каждый вход, и выход отзывает только его.
+ */
+let WebLoginService = class WebLoginService {
+    db;
+    config;
+    participants;
+    constructor(db, config, participants) {
+        this.db = db;
+        this.config = config;
+        this.participants = participants;
+    }
+    async link(participant) {
+        const code = (0, tokens_1.randomToken)(40);
+        await this.db.insert(schema_1.loginCodes).values({
+            codeHash: (0, tokens_1.hashToken)(code), participantId: participant.id, expiresAt: new Date((0, clock_1.now)().getTime() + LINK_TTL_MS),
+        });
+        return `${this.config.url}/login/${code}`;
+    }
+    /** Ссылка одноразовая: первый же переход её гасит. → свежий токен браузера или null. */
+    async consume(code) {
+        const [used] = await this.db.delete(schema_1.loginCodes)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.loginCodes.codeHash, (0, tokens_1.hashToken)(code)), (0, drizzle_orm_1.gt)(schema_1.loginCodes.expiresAt, (0, clock_1.now)())))
+            .returning();
+        if (!used)
+            return null;
+        const [participant] = await this.db.select().from(schema_1.participants).where((0, drizzle_orm_1.eq)(schema_1.participants.id, used.participantId));
+        if (!participant || participant.kind !== 'human')
+            return null;
+        return { participant, token: await this.participants.issueExtraToken(participant.id, `web:${(0, tokens_1.randomToken)(12)}`) };
+    }
+    /** Выход отзывает только токен этого браузера. */
+    async logout(token) {
+        await this.db.delete(schema_1.participantTokens).where((0, drizzle_orm_1.eq)(schema_1.participantTokens.tokenHash, (0, tokens_1.hashToken)(token)));
+    }
+};
+exports.WebLoginService = WebLoginService;
+exports.WebLoginService = WebLoginService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(database_module_1.DATABASE)),
+    __param(1, (0, common_1.Inject)(config_1.SERVER_CONFIG)),
+    __metadata("design:paramtypes", [Object, Object, participants_service_1.ParticipantsService])
+], WebLoginService);