postnhost 0.1.0 → 0.2.0

data/app/services/postnhost/management/input.rb

@@ -0,0 +1,49 @@
+module Postnhost
+  module Management
+    module Input
+      TYPES = {
+        "object" => [Hash],
+        "array" => [Array],
+        "integer" => [Integer],
+        "string" => [String],
+        "boolean" => [TrueClass, FalseClass],
+        "null" => [NilClass]
+      }.freeze
+
+      def self.validate!(value, schema, path = "arguments")
+        valid = Array(schema[:type]).any? do |type|
+          TYPES.fetch(type).any? { |klass| value.is_a?(klass) }
+        end
+        raise ArgumentError, "#{path} has an invalid type" unless valid
+
+        Time.iso8601(value) if schema[:format] == "date-time" && value
+
+        case value
+        when Hash
+          validate_object!(value, schema, path)
+        when Array
+          raise ArgumentError, "#{path} has an invalid length" if value.size < schema.fetch(:minItems, 0) || value.size > schema.fetch(:maxItems, 1000)
+          raise ArgumentError, "#{path} must contain unique values" if schema[:uniqueItems] && value.uniq != value
+
+          value.each { |item| validate!(item, schema[:items], path) } if schema[:items]
+        when Integer
+          raise ArgumentError, "#{path} is out of range" if value < schema.fetch(:minimum, value) || value > schema.fetch(:maximum, value)
+        end
+      end
+
+      def self.validate_object!(value, schema, path)
+        properties = schema.fetch(:properties, {}).stringify_keys
+        missing = schema.fetch(:required, []) - value.keys
+        raise ArgumentError, "#{path} requires #{missing.join(', ')}" if missing.any?
+
+        unknown = value.keys - properties.keys
+        raise ArgumentError, "#{path} contains unknown fields: #{unknown.join(', ')}" if schema[:additionalProperties] == false && unknown.any?
+
+        value.each do |key, item|
+          child = properties[key] || schema[:additionalProperties]
+          validate!(item, child, "#{path}.#{key}") if child.is_a?(Hash)
+        end
+      end
+    end
+  end
+end

data/app/services/postnhost/management/mcp.rb

@@ -0,0 +1,54 @@
+module Postnhost
+  module Management
+    class Mcp
+      VERSIONS = %w[2025-11-25 2025-06-18 2025-03-26].freeze
+
+      def initialize(user:, script_name: "")
+        @user = user
+        @script_name = script_name
+      end
+
+      def call(message)
+        return error(nil, -32_600, "Invalid Request") unless message.is_a?(Hash)
+
+        id = message["id"]
+        return error(nil, -32_600, "Invalid Request") unless message["jsonrpc"] == "2.0" && message["method"].is_a?(String) && (!message.key?("id") || id.is_a?(String) || id.is_a?(Integer))
+        return nil unless message.key?("id")
+
+        params = message.fetch("params", {})
+        return error(id, -32_602, "params must be an object") unless params.is_a?(Hash)
+
+        result = case message["method"]
+                 when "initialize"
+                   { protocolVersion: VERSIONS.include?(params["protocolVersion"]) ? params["protocolVersion"] : VERSIONS.first,
+                     capabilities: { tools: { listChanged: false } }, serverInfo: { name: "PostnHost", version: Postnhost::VERSION },
+                     instructions: "Manage CMS drafts, translations and settings. Publishing is explicit. Generate translations from published sources. Files use base64 and follow the same upload limits as the CMS." }
+                 when "ping" then {}
+                 when "tools/list" then { tools: Catalog.tools }
+                 when "tools/call" then call_tool(params)
+                 else return error(id, -32_601, "Method not found")
+                 end
+        { jsonrpc: "2.0", id:, result: }
+      rescue ArgumentError => e
+        error(id, -32_602, e.message)
+      end
+
+      private
+
+      def call_tool(params)
+        name = params.fetch("name", "")
+        Catalog.fetch(name)
+        arguments = params.fetch("arguments", {})
+        raise ArgumentError, "arguments must be an object" unless arguments.is_a?(Hash)
+
+        result = Command.call(name:, arguments:, user: @user, script_name: @script_name)
+        data = { data: result.value, errors: result.errors, status: Rack::Utils.status_code(result.status) }
+        { content: [{ type: "text", text: data.to_json }], structuredContent: data, isError: !result.success? || data[:status] >= 400 }
+      end
+
+      def error(id, code, message)
+        { jsonrpc: "2.0", id:, error: { code:, message: } }
+      end
+    end
+  end
+end

data/app/services/postnhost/management/preview.rb

@@ -0,0 +1,25 @@
+module Postnhost
+  module Management
+    module Preview
+      def self.call(user:, record: nil, template: nil, script_name: "")
+        action = record ? "preview" : "index"
+        path = record ? "/preview/#{record.id}" : "/?preview_template=#{template}"
+        origin = Setting.current.effective_site_url || "http://example.com"
+        env = Rack::MockRequest.env_for("#{origin}#{script_name}#{path}")
+        env["SCRIPT_NAME"] = script_name
+        env["PATH_INFO"] = path.split("?").first
+        env["postnhost.management_user"] = user
+        env["action_dispatch.request.path_parameters"] = { controller: "postnhost/management_preview", action:, id: record&.id }
+        env["action_dispatch.routes"] = Engine.routes
+        status, _headers, body = I18n.with_locale(I18n.default_locale) { ManagementPreviewController.action(action).call(env) }
+        html = +""
+        body.each { |chunk| html << chunk }
+        raise ArgumentError, "Preview could not be rendered" unless status == 200
+
+        { html:, template: template || Template.active_name }
+      ensure
+        body&.close if body.respond_to?(:close)
+      end
+    end
+  end
+end

data/app/services/postnhost/management/resources.rb

@@ -0,0 +1,30 @@
+module Postnhost
+  module Management
+    module Resources
+      TEXT = %w[title title_tag og_title meta_description content language_id].freeze
+      EXCERPT = %w[custom_excerpt use_excerpt_as_meta_description].freeze
+      ARTICLE = (TEXT + EXCERPT + %w[schema_headline schema_article_type slug cover_image_alt scheduled_at top_pick author_ids category_ids suggested_article_ids]).freeze
+      PAGE = (TEXT + %w[slug]).freeze
+      USER = %w[email name slug position bio website_url x_url linkedin_url threads_url tiktok_url youtube_url facebook_url instagram_url bluesky_url mastodon_url password password_confirmation].freeze
+      SETTING = %w[site_url site_indexing public_page_size timezone author_pages_enabled search_enabled show_powered_by use_auto_header_navigation use_auto_footer_navigation schema_settings schema_locale_overrides].freeze
+      DEFINITIONS = {
+        "api_tokens" => { model: "ApiToken", fields: %w[name] },
+        "articles" => { model: "Article", fields: ARTICLE, snapshot: :article_snapshot },
+        "pages" => { model: "Page", fields: PAGE, snapshot: :page_snapshot },
+        "categories" => { model: "Category", fields: %w[name slug meta_description] },
+        "languages" => { model: "Language", fields: %w[name html_lang default] },
+        "users" => { model: "User", fields: USER + %w[schema_profile schema_locale_overrides] },
+        "article_variants" => { model: "ArticleVariant", fields: TEXT + EXCERPT + %w[schema_headline], parent: "articles", snapshot: :article_variant_snapshot },
+        "page_variants" => { model: "PageVariant", fields: TEXT, parent: "pages", snapshot: :page_variant_snapshot },
+        "category_variants" => { model: "CategoryVariant", fields: %w[name meta_description language_id], parent: "categories" },
+        "settings" => { model: "Setting", fields: SETTING, singleton: true },
+        "template" => { model: "Template", fields: %w[name], singleton: true },
+        "site_scripts" => { model: "SiteScript", fields: %w[placement script] }
+      }.freeze
+
+      def self.model(resource)
+        Postnhost.const_get(DEFINITIONS.fetch(resource).fetch(:model), false)
+      end
+    end
+  end
+end

data/app/services/postnhost/management/schema_fields.rb

@@ -0,0 +1,25 @@
+module Postnhost
+  module Management
+    module SchemaFields
+      TEXT = { type: %w[string null] }.freeze
+      STRINGS = { type: "array", items: { type: "string" }, maxItems: 100 }.freeze
+
+      def self.settings
+        fields = Postnhost::Settings::SchemaManageable::SCHEMA_SETTING_FIELDS.index_with { TEXT }
+        fields["same_as"] = STRINGS
+        fields["policies"] = { type: "object", properties: Postnhost::SchemaHelper::POLICY_FIELDS.keys.index_with { TEXT }, additionalProperties: false }
+        { type: "object", properties: fields, additionalProperties: false }
+      end
+
+      def self.profile
+        fields = Postnhost::Users::SchemaManageable::USER_SCHEMA_PROFILE_FIELDS.index_with { |field| %w[same_as knows_language].include?(field) ? STRINGS : TEXT }
+        { type: "object", properties: fields, additionalProperties: false }
+      end
+
+      def self.overrides(resource)
+        fields = resource == "users" ? Postnhost::Users::SchemaManageable::USER_SCHEMA_TEXT_FIELDS : Postnhost::SchemaHelper::SETTINGS_TEXT_OVERRIDE_FIELDS
+        { type: "object", additionalProperties: { type: "object", properties: fields.index_with { TEXT }, additionalProperties: false } }
+      end
+    end
+  end
+end

data/app/services/postnhost/management/serializer.rb

@@ -0,0 +1,40 @@
+module Postnhost
+  module Management
+    module Serializer
+      SUMMARY_FIELDS = %w[
+        id user_id article_id page_id category_id language_id name title slug email position
+        html_lang default created_at updated_at scheduled_at publication_error top_pick generating
+        articles_count article_variants_count page_variants_count placement revoked_at
+        cover_image cover_image_alt avatar_file
+      ].freeze
+
+      def self.summary(record)
+        data = record.attributes.slice(*SUMMARY_FIELDS)
+        data["published"] = record["management_snapshot_id"].present? if record.has_attribute?("management_snapshot_id")
+        %w[cover_image avatar_file].each do |field|
+          data["#{field}_url"] = record.public_send(field).url if record.has_attribute?(field)
+        end
+        data
+      end
+
+      def self.call(value)
+        case value
+        when ActiveRecord::Base
+          data = value.attributes.except("password_digest", "token_digest", "scheduled_job_id")
+          if value.respond_to?(:published?)
+            data["published"] = value.published?
+            data["unpublished_changes"] = value.unpublished_changes?
+          end
+          data.merge!("author_ids" => value.author_ids, "category_ids" => value.category_ids, "suggested_article_ids" => value.suggested_article_ids) if value.is_a?(Article)
+          %w[cover_image avatar_file site_logo og_image].each do |field|
+            data["#{field}_url"] = value.public_send(field).url if value.respond_to?(field)
+          end
+          data
+        when Hash then value.transform_values { |item| call(item) }
+        when Array then value.map { |item| call(item) }
+        else value
+        end
+      end
+    end
+  end
+end

data/app/services/postnhost/management/settings_actions.rb

@@ -0,0 +1,64 @@
+module Postnhost
+  module Management
+    class SettingsActions < BaseService
+      include Postnhost::Settings::NavigationManageable
+
+      def initialize(action:, record:, arguments:)
+        @action = action
+        @record = record
+        @arguments = arguments
+      end
+
+      def call
+        return upload if action.start_with?("upload_")
+
+        if %w[remove_logo remove_og_image].include?(action)
+          field = action == "remove_logo" ? :site_logo : :og_image
+          record.update!(field => nil)
+          return record
+        end
+
+        validate_locale!
+        case action
+        when "get_navigation"
+          @setting = record
+          @selected_navigation_locale_key = arguments.fetch("locale")
+          @default_navigation_locale_key = Language.blog_default&.html_lang || I18n.default_locale.to_s
+          @navigation = record.current_navigation
+          { tree: navigation_tree_for_editor, targets: navigation_target_options }
+        when "replace_navigation"
+          tree = arguments.fetch("tree")
+          record.current_navigation.replace_tree!(tree:, locale_key: arguments.fetch("locale"))
+          { navigation: record.current_navigation.navigation_items.to_a }
+        when "get_translations"
+          Settings::I18nOverrides.editable_translations_for_locale(arguments.fetch("locale"), record.locale_overrides)
+        when "update_translations"
+          overrides = Settings::I18nOverrides.merge_locale_overrides(record.locale_overrides, arguments.fetch("locale"), arguments.fetch("translations"))
+          record.update!(locale_overrides: overrides)
+          record
+        else
+          raise ArgumentError, "Unsupported action"
+        end
+      end
+
+      private
+
+      attr_reader :action, :record, :arguments
+
+      def validate_locale!
+        raise ArgumentError, "Locale must belong to a configured language" unless Language.exists?(html_lang: arguments["locale"])
+      end
+
+      def upload
+        file = Upload.open(arguments.fetch("file"))
+        if action == "upload_image"
+          result = record.upload_inline_image(file)
+          return result[:success] ? success({ url: result[:url] }) : failure(result[:error])
+        end
+        field = { "upload_cover" => :cover_image, "upload_avatar" => :avatar_file, "upload_logo" => :site_logo, "upload_og_image" => :og_image }.fetch(action)
+        record.update!(field => file)
+        { url: record.public_send(field).url }
+      end
+    end
+  end
+end

data/app/services/postnhost/management/upload.rb

@@ -0,0 +1,18 @@
+require "base64"
+require "stringio"
+
+module Postnhost
+  module Management
+    module Upload
+      def self.open(payload)
+        filename = payload.fetch("filename")
+        raise ArgumentError, "Invalid filename" if filename.blank? || filename != File.basename(filename) || filename.include?("\\")
+
+        file = StringIO.new(Base64.strict_decode64(payload.fetch("base64")))
+        file.define_singleton_method(:original_filename) { filename }
+        file.define_singleton_method(:content_type) { payload.fetch("content_type") }
+        file
+      end
+    end
+  end
+end

data/app/services/postnhost/translation/enqueue.rb

@@ -0,0 +1,59 @@
+module Postnhost
+  module Translation
+    class Enqueue < BaseService
+      def initialize(record:, language_ids:)
+        @record = record
+        @language_ids = language_ids
+      end
+
+      def call
+        return success({ variants: [], job_ids: [] }) if language_ids.empty?
+
+        kind = record.class.model_name.element
+        return failure("Publish the source before generating translations") if record.respond_to?(:published?) && !record.published?
+
+        languages = language_ids.map { |id| Language.find(id) }
+        primary_id = record.respond_to?(:language_id) ? record.language_id : Language.blog_default&.id
+        return failure("Cannot translate into the source language") if languages.any? { |language| language.id == primary_id }
+
+        variants = record.class.transaction do
+          languages.map { |language| record.public_send("#{kind}_variants").create!(language:, generating: true) }
+        end
+        enqueue_variants(variants, Translation.const_get("#{kind.camelize}VariantJob", false))
+      rescue ActiveRecord::RecordInvalid => e
+        failure(e.record.errors.full_messages)
+      rescue ActiveRecord::RecordNotFound
+        failure("Language not found", status: :not_found)
+      end
+
+      private
+
+      attr_reader :record, :language_ids
+
+      def enqueue_variants(variants, job_class)
+        jobs = []
+        variants.each do |variant|
+          job = enqueue(job_class, variant)
+          unless job
+            unqueued = variants.drop(jobs.size)
+            unqueued.each(&:destroy!)
+            return ServiceResult.new(
+              value: { variants: variants.take(jobs.size), job_ids: jobs.map(&:job_id), failed_language_ids: unqueued.map(&:language_id) },
+              errors: ["Could not queue all translations. Retry the failed languages."], status: :service_unavailable
+            )
+          end
+          jobs << job
+        end
+        success({ variants:, job_ids: jobs.map(&:job_id) }, status: :accepted)
+      end
+
+      def enqueue(job_class, variant)
+        job = job_class.new(record.id, variant.language_id)
+        job_class.perform_later(job)
+      rescue StandardError => e
+        Rails.logger.error("Postnhost translation enqueue failed (#{e.class})")
+        job if job&.successfully_enqueued?
+      end
+    end
+  end
+end

data/app/views/layouts/postnhost/_sidebar.html.erb

@@ -58,6 +58,13 @@
             <span class="text-sm font-medium">Settings</span>
           <% end %>
 
+          <%= link_to api_tokens_path, class: "group flex items-center space-x-3 text-gray-700 hover:text-gray-900 hover:bg-white font-medium px-3 py-2.5 rounded-xl transition-all duration-200 #{controller_name == 'api_tokens' ? 'bg-white text-gray-900' : ''}" do %>
+            <div class="flex-shrink-0 <%= controller_name == 'api_tokens' ? 'text-gray-900' : 'text-gray-500 group-hover:text-gray-700' %>">
+              <%= icon("code-bracket", css_class: "h-5 w-5") %>
+            </div>
+            <span class="text-sm font-medium">API &amp; MCP</span>
+          <% end %>
+
           <%= link_to edit_template_path, class: "group flex items-center space-x-3 text-gray-700 hover:text-gray-900 hover:bg-white font-medium px-3 py-2.5 rounded-xl transition-all duration-200 #{current_page?(edit_template_path) || controller_name == 'templates' ? 'bg-white text-gray-900' : ''}" do %>
             <div class="flex-shrink-0 #{current_page?(edit_template_path) || controller_name == 'templates' ? 'text-gray-900' : 'text-gray-500 group-hover:text-gray-700'}">
               <%= icon("eye", css_class: "h-5 w-5") %>

data/app/views/layouts/postnhost/application.html.erb

@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html lang="<%= content_for?(:lang) ? yield(:lang) : 'en' %>">
+<html lang="<%= content_for?(:lang) ? yield(:lang) : 'en' %>" data-postnhost>
   <head>
     <title><%= content_for?(:title) ? yield(:title) : "postnhost" %></title>
     <meta name="description" content="<%= content_for?(:meta_description) ? yield(:meta_description) : "postnhost" %>">
@@ -10,7 +10,7 @@
     <%= csrf_meta_tags %>
     <%= csp_meta_tag %>
 
-    <%= stylesheet_link_tag(*postnhost_stylesheet_assets, "data-turbo-track": "reload", media: "all") %>
+    <%= stylesheet_link_tag "postnhost/application", "data-turbo-track": "reload", media: "all" %>
     <%= javascript_include_tag "postnhost/application", "data-turbo-track": "reload", type: "module" %>
 
     <%= render "layouts/postnhost/favicon" %>

data/app/views/layouts/postnhost/articles.html.erb

@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html lang="<%= content_for?(:lang) ? yield(:lang) : 'en' %>">
+<html lang="<%= content_for?(:lang) ? yield(:lang) : 'en' %>" data-postnhost>
   <head>
     <title><%= content_for?(:title) ? yield(:title) : "postnhost" %></title>
     <meta name="description" content="<%= content_for?(:meta_description) ? yield(:meta_description) : "postnhost dashboard - Manage your account and projects" %>">
@@ -7,7 +7,7 @@
     <%= csrf_meta_tags %>
     <%= csp_meta_tag %>
 
-    <%= stylesheet_link_tag(*postnhost_stylesheet_assets, 'data-turbo-track': 'reload') %>
+    <%= stylesheet_link_tag "postnhost/application", "data-turbo-track": "reload" %>
     <%= javascript_include_tag 'postnhost/application', 'data-turbo-track': 'reload', type: "module" %>
     <%= turbo_refreshes_with method: :morph, scroll: :preserve %>
 
@@ -31,4 +31,4 @@
       </div>
     </main>
   </body>
-</html>
+</html>

data/app/views/layouts/postnhost/product.html.erb

@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html lang="<%= content_for?(:lang) ? yield(:lang) : 'en' %>">
+<html lang="<%= content_for?(:lang) ? yield(:lang) : 'en' %>" data-postnhost>
   <head>
     <title><%= content_for?(:title) ? yield(:title) : "postnhost" %></title>
     <meta name="description" content="<%= content_for?(:meta_description) ? yield(:meta_description) : "postnhost dashboard - Manage your account and projects" %>">
@@ -7,7 +7,7 @@
     <%= csrf_meta_tags %>
     <%= csp_meta_tag %>
 
-    <%= stylesheet_link_tag(*postnhost_stylesheet_assets, 'data-turbo-track': 'reload') %>
+    <%= stylesheet_link_tag "postnhost/application", "data-turbo-track": "reload" %>
     <%= javascript_include_tag 'postnhost/application', 'data-turbo-track': 'reload', type: "module" %>
 
     <%= turbo_refreshes_with method: :morph, scroll: :preserve %>
@@ -33,4 +33,4 @@
       </div>
     </div>
   </body>
-</html>
+</html>

data/app/views/layouts/postnhost/public/templates/default.html.erb

@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html lang="<%= document_lang %>" class="[scrollbar-gutter:stable]">
+<html lang="<%= document_lang %>" data-postnhost>
   <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width,initial-scale=1">
@@ -10,7 +10,7 @@
     <%= csrf_meta_tags %>
     <%= csp_meta_tag %>
 
-    <%= stylesheet_link_tag(*postnhost_stylesheet_assets, "data-turbo-track": "reload") %>
+    <%= stylesheet_link_tag "postnhost/application", "data-turbo-track": "reload" %>
     <%= javascript_include_tag "postnhost/application", "data-turbo-track": "reload", type: "module" %>
 
     <%= render 'layouts/postnhost/favicon' %>

data/app/views/layouts/postnhost/public/templates/swiss-editorial.html.erb

@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html lang="<%= document_lang %>" class="[scrollbar-gutter:stable]">
+<html lang="<%= document_lang %>" data-postnhost>
   <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width,initial-scale=1">
@@ -10,7 +10,7 @@
     <%= csrf_meta_tags %>
     <%= csp_meta_tag %>
 
-    <%= stylesheet_link_tag(*postnhost_stylesheet_assets, "data-turbo-track": "reload") %>
+    <%= stylesheet_link_tag "postnhost/application", "data-turbo-track": "reload" %>
     <%= javascript_include_tag "postnhost/application", "data-turbo-track": "reload", type: "module" %>
 
     <%= render "layouts/postnhost/favicon" %>

data/app/views/layouts/postnhost/public/templates/workspace-journal.html.erb

@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html lang="<%= document_lang %>" class="[scrollbar-gutter:stable]">
+<html lang="<%= document_lang %>" data-postnhost>
   <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width,initial-scale=1">
@@ -10,7 +10,7 @@
     <%= csrf_meta_tags %>
     <%= csp_meta_tag %>
 
-    <%= stylesheet_link_tag(*postnhost_stylesheet_assets, "data-turbo-track": "reload") %>
+    <%= stylesheet_link_tag "postnhost/application", "data-turbo-track": "reload" %>
     <%= javascript_include_tag "postnhost/application", "data-turbo-track": "reload", type: "module" %>
 
     <%= render "layouts/postnhost/favicon" %>

data/app/views/postnhost/api_tokens/index.html.erb

@@ -0,0 +1,92 @@
+<% content_for :title, "API & MCP" %>
+<% content_for :head do %>
+  <meta name="turbo-cache-control" content="no-cache">
+<% end %>
+
+<div class="space-y-8">
+  <%= render "postnhost/shared/elements/page_header", title: "API & MCP access", description: "Connect agents and integrations to your CMS." %>
+
+  <% if @secret.present? %>
+    <section class="rounded-2xl border border-green-200 bg-green-50 p-6 space-y-3" aria-label="New token">
+      <div class="flex items-center gap-2 text-green-800">
+        <%= icon("check-circle", css_class: "h-5 w-5") %>
+        <h2 class="font-medium">Token created</h2>
+      </div>
+      <p class="text-sm text-green-800">Copy this token now. It is shown only once.</p>
+      <code class="block rounded-xl border border-green-200 bg-white p-4 text-sm text-gray-900 break-all select-all"><%= @secret %></code>
+    </section>
+  <% end %>
+
+  <div class="grid grid-cols-1 lg:grid-cols-3 gap-6">
+    <section class="lg:col-span-2 <%= form_card_classes %>" aria-labelledby="create-token-title">
+      <div>
+        <h2 id="create-token-title" class="text-lg font-medium text-gray-900">Create an access token</h2>
+        <p class="mt-2 text-sm text-gray-500">Tokens grant your CMS permissions. Give each integration its own token so you can revoke access separately.</p>
+      </div>
+      <%= form_with scope: :api_token, url: api_tokens_path, data: { turbo: false }, class: "space-y-6" do |form| %>
+        <div>
+          <%= form.label :name, class: form_label_classes %>
+          <%= form.text_field :name, required: true, placeholder: "e.g. Writing agent", class: form_input_classes %>
+        </div>
+        <%= form.submit "Create token", class: button_classes %>
+      <% end %>
+    </section>
+
+    <section class="<%= form_card_classes %>" aria-labelledby="connection-title">
+      <div>
+        <h2 id="connection-title" class="text-lg font-medium text-gray-900">Connection details</h2>
+        <p class="mt-2 text-sm text-gray-500">Use your token to authenticate either connection.</p>
+      </div>
+      <dl class="space-y-5">
+        <div>
+          <dt class="text-sm font-medium text-gray-700">Management API · v1</dt>
+          <dd class="mt-2 rounded-xl bg-gray-50 p-3 text-xs text-gray-900 break-all"><code><%= api_v1_commands_url %></code></dd>
+        </div>
+        <div>
+          <dt class="text-sm font-medium text-gray-700">MCP · v1</dt>
+          <dd class="mt-2 rounded-xl bg-gray-50 p-3 text-xs text-gray-900 break-all"><code><%= api_v1_mcp_url %></code></dd>
+          <dd class="mt-2 text-xs text-gray-500">Connect using Streamable HTTP.</dd>
+        </div>
+        <div>
+          <dt class="text-sm font-medium text-gray-700">Authorization header</dt>
+          <dd class="mt-2 rounded-xl bg-gray-50 p-3 text-xs text-gray-900 break-all"><code>Bearer &lt;your-token&gt;</code></dd>
+        </div>
+      </dl>
+    </section>
+  </div>
+
+  <section class="space-y-4" aria-labelledby="access-tokens-title">
+    <div>
+      <h2 id="access-tokens-title" class="text-lg font-medium text-gray-900">Access tokens</h2>
+      <p class="mt-2 text-sm text-gray-500">Manage the tokens you have created for your account.</p>
+    </div>
+    <% if @api_tokens.any? %>
+      <%= render "postnhost/shared/elements/table_container", headers: [
+        { text: "Token", class: "col-span-8" },
+        { text: "Actions", class: "col-span-4 text-right" }
+      ] do %>
+        <% @api_tokens.each do |token| %>
+          <div class="<%= table_row_classes %>">
+            <div class="grid grid-cols-12 gap-4 items-center">
+              <div class="col-span-8 min-w-0 space-y-2">
+                <p class="font-medium text-gray-900 break-words"><%= token.name %></p>
+                <% if token.revoked_at? %>
+                  <span class="inline-flex <%= stats_badge_classes(variant: :gray) %>">Revoked</span>
+                <% else %>
+                  <span class="inline-flex <%= stats_badge_classes(variant: :green) %>">Active</span>
+                <% end %>
+              </div>
+              <div class="col-span-4 flex justify-end">
+                <% unless token.revoked_at? %>
+                  <%= button_to "Revoke", api_token_path(token), method: :delete, class: button_classes(variant: :danger) %>
+                <% end %>
+              </div>
+            </div>
+          </div>
+        <% end %>
+      <% end %>
+    <% else %>
+      <%= render "postnhost/shared/elements/empty_state", icon: "code-bracket", title: "No access tokens", description: "Create a token above to connect your first agent or integration." %>
+    <% end %>
+  </section>
+</div>

data/app/views/postnhost/onboarding/_post_install_checklist.html.erb

@@ -1,29 +1,29 @@
 <div class="space-y-5">
   <p class="text-sm text-gray-600">
-    Final manual checks for host app integration. Most of these are inherited from the root app and can be customized there. You can find this checklist later in the README.
+    Review these host-app settings before deployment. Details are available in the Production checklist section of the README.
   </p>
 
   <div class="rounded-xl border border-gray-200 bg-gray-50 p-4">
     <ul class="space-y-3 text-sm text-gray-700">
       <li>
         <span class="font-medium text-gray-900">1. Favicon</span><br>
-        Inherited from the root app. Update host favicon files/links if needed.
+        Replace the favicon and related icon files in the host app if needed.
       </li>
       <li>
-        <span class="font-medium text-gray-900">2. 404 / 500 pages</span><br>
-        Inherited from root app static error pages (`public/404.html` and `public/500.html`).
+        <span class="font-medium text-gray-900">2. 404 and 500 pages</span><br>
+        Review the host app&rsquo;s static error pages at <code>public/404.html</code> and <code>public/500.html</code>.
       </li>
       <li>
         <span class="font-medium text-gray-900">3. robots.txt</span><br>
-        Inherited from root app (`public/robots.txt`). Confirm the sitemap URL matches your mount path.
+        Update the host app&rsquo;s <code>public/robots.txt</code> and confirm that the sitemap URL matches your mount path.
       </li>
       <li>
         <span class="font-medium text-gray-900">4. Public template styling</span><br>
-        Customize by running <code>rails g postnhost:views --views_scope=minimal</code> (or <code>full</code>) and editing copied templates in the host app.
+        To customize the public site, run <code>bin/rails g postnhost:views --views-scope=minimal</code> or use <code>--views-scope=full</code>, then edit the copied templates.
       </li>
       <li>
-        <span class="font-medium text-gray-900">5. S3 upload settings</span><br>
-        Configure credentials/bucket/endpoint in host app credentials and initializer (`config/initializers/postnhost.rb`).
+        <span class="font-medium text-gray-900">5. Production uploads</span><br>
+        The generated CarrierWave initializer uses S3-compatible storage in production. Configure it through Rails credentials or <code>config/initializers/postnhost.rb</code>, or replace that storage configuration.
       </li>
     </ul>
   </div>

data/app/views/postnhost/pages/index.html.erb

@@ -104,7 +104,7 @@
     </div>
   <% else %>
     <div class="rounded-xl border border-gray-200 bg-gray-50 px-4 py-3 text-sm text-gray-600">
-      No code-defined static pages found. Add templates in <code>app/views/postnhost/static_pages</code> (for example, <code>about.html.erb</code> maps to <code>/about</code>), or run <code>rails g postnhost:static_pages about</code> to scaffold a starter template.
+      No code-defined static pages found. Add templates in <code>app/views/postnhost/static_pages</code> (for example, <code>about.html.erb</code> maps to <code>/about</code>), or run <code>bin/rails g postnhost:static_pages about</code> to scaffold a starter template.
     </div>
   <% end %>
 </div>