postnhost 0.1.1 → 0.2.0

data/app/services/postnhost/management/content_actions.rb

@@ -0,0 +1,75 @@
+module Postnhost
+  module Management
+    class ContentActions < BaseService
+      def initialize(resource:, action:, scope:, arguments:, record: nil)
+        @resource = resource
+        @action = action
+        @scope = scope
+        @arguments = arguments
+        @record = record
+      end
+
+      def call
+        case action
+        when "publish", "unpublish" then transition
+        when "bulk_publish", "bulk_unpublish" then bulk_transition
+        when "bulk_delete" then bulk_delete
+        when "translate" then Translation::Enqueue.call(record:, language_ids: arguments.fetch("language_ids"))
+        when "versions" then versions
+        when "version_preview" then record.versions.find(arguments.fetch("version_id")).reify
+        when "restore" then Publishing::Versions::RestoreDraft.call(record:, version: record.versions.find(arguments.fetch("version_id")))
+        when "preview" then { draft: record, html: record.content }
+        when "remove_cover"
+          record.update_column(:cover_image, nil)
+          record.reload
+        else
+          SettingsActions.call(action:, record:, arguments:)
+        end
+      end
+
+      private
+
+      attr_reader :resource, :action, :scope, :arguments, :record
+
+      def versions
+        columns = record.versions.klass.column_names - ["object"]
+        record.versions.select(*columns).order(id: :desc).map(&:attributes)
+      end
+
+      def transition
+        return failure("Translation is still generating", status: :conflict) if record.respond_to?(:generating?) && record.generating?
+
+        service = publishing_module.const_get(action.classify, false)
+        result = service.call(resource.singularize.to_sym => record)
+        result.success? ? success(record.reload, status: result.status) : result
+      end
+
+      def bulk_transition
+        parent_resource = Resources::DEFINITIONS.fetch(resource).fetch(:parent)
+        parent = Resources.model(parent_resource).find(arguments.fetch("parent_id"))
+        service = publishing_module.const_get("#{action.delete_prefix('bulk_').classify}Many", false)
+        service.call(parent_resource.singularize.to_sym => parent, ids: arguments.fetch("ids"))
+      end
+
+      def publishing_module
+        Publishing.const_get(resource.camelize, false)
+      end
+
+      def bulk_delete
+        records = scope.where(id: arguments.fetch("ids")).order(:id)
+        failures = (arguments.fetch("ids") - records.pluck(:id)).index_with { ["Translation not found"] }
+        deleted = []
+        records.each do |variant|
+          if variant.generating?
+            failures[variant.id] = ["Translation is still generating"]
+          elsif variant.destroy
+            deleted << variant.id
+          else
+            failures[variant.id] = variant.errors.full_messages
+          end
+        end
+        success({ deleted:, failures: }, status: failures.empty? ? :ok : :unprocessable_content)
+      end
+    end
+  end
+end

data/app/services/postnhost/management/input.rb

@@ -0,0 +1,49 @@
+module Postnhost
+  module Management
+    module Input
+      TYPES = {
+        "object" => [Hash],
+        "array" => [Array],
+        "integer" => [Integer],
+        "string" => [String],
+        "boolean" => [TrueClass, FalseClass],
+        "null" => [NilClass]
+      }.freeze
+
+      def self.validate!(value, schema, path = "arguments")
+        valid = Array(schema[:type]).any? do |type|
+          TYPES.fetch(type).any? { |klass| value.is_a?(klass) }
+        end
+        raise ArgumentError, "#{path} has an invalid type" unless valid
+
+        Time.iso8601(value) if schema[:format] == "date-time" && value
+
+        case value
+        when Hash
+          validate_object!(value, schema, path)
+        when Array
+          raise ArgumentError, "#{path} has an invalid length" if value.size < schema.fetch(:minItems, 0) || value.size > schema.fetch(:maxItems, 1000)
+          raise ArgumentError, "#{path} must contain unique values" if schema[:uniqueItems] && value.uniq != value
+
+          value.each { |item| validate!(item, schema[:items], path) } if schema[:items]
+        when Integer
+          raise ArgumentError, "#{path} is out of range" if value < schema.fetch(:minimum, value) || value > schema.fetch(:maximum, value)
+        end
+      end
+
+      def self.validate_object!(value, schema, path)
+        properties = schema.fetch(:properties, {}).stringify_keys
+        missing = schema.fetch(:required, []) - value.keys
+        raise ArgumentError, "#{path} requires #{missing.join(', ')}" if missing.any?
+
+        unknown = value.keys - properties.keys
+        raise ArgumentError, "#{path} contains unknown fields: #{unknown.join(', ')}" if schema[:additionalProperties] == false && unknown.any?
+
+        value.each do |key, item|
+          child = properties[key] || schema[:additionalProperties]
+          validate!(item, child, "#{path}.#{key}") if child.is_a?(Hash)
+        end
+      end
+    end
+  end
+end

data/app/services/postnhost/management/mcp.rb

@@ -0,0 +1,54 @@
+module Postnhost
+  module Management
+    class Mcp
+      VERSIONS = %w[2025-11-25 2025-06-18 2025-03-26].freeze
+
+      def initialize(user:, script_name: "")
+        @user = user
+        @script_name = script_name
+      end
+
+      def call(message)
+        return error(nil, -32_600, "Invalid Request") unless message.is_a?(Hash)
+
+        id = message["id"]
+        return error(nil, -32_600, "Invalid Request") unless message["jsonrpc"] == "2.0" && message["method"].is_a?(String) && (!message.key?("id") || id.is_a?(String) || id.is_a?(Integer))
+        return nil unless message.key?("id")
+
+        params = message.fetch("params", {})
+        return error(id, -32_602, "params must be an object") unless params.is_a?(Hash)
+
+        result = case message["method"]
+                 when "initialize"
+                   { protocolVersion: VERSIONS.include?(params["protocolVersion"]) ? params["protocolVersion"] : VERSIONS.first,
+                     capabilities: { tools: { listChanged: false } }, serverInfo: { name: "PostnHost", version: Postnhost::VERSION },
+                     instructions: "Manage CMS drafts, translations and settings. Publishing is explicit. Generate translations from published sources. Files use base64 and follow the same upload limits as the CMS." }
+                 when "ping" then {}
+                 when "tools/list" then { tools: Catalog.tools }
+                 when "tools/call" then call_tool(params)
+                 else return error(id, -32_601, "Method not found")
+                 end
+        { jsonrpc: "2.0", id:, result: }
+      rescue ArgumentError => e
+        error(id, -32_602, e.message)
+      end
+
+      private
+
+      def call_tool(params)
+        name = params.fetch("name", "")
+        Catalog.fetch(name)
+        arguments = params.fetch("arguments", {})
+        raise ArgumentError, "arguments must be an object" unless arguments.is_a?(Hash)
+
+        result = Command.call(name:, arguments:, user: @user, script_name: @script_name)
+        data = { data: result.value, errors: result.errors, status: Rack::Utils.status_code(result.status) }
+        { content: [{ type: "text", text: data.to_json }], structuredContent: data, isError: !result.success? || data[:status] >= 400 }
+      end
+
+      def error(id, code, message)
+        { jsonrpc: "2.0", id:, error: { code:, message: } }
+      end
+    end
+  end
+end

data/app/services/postnhost/management/preview.rb

@@ -0,0 +1,25 @@
+module Postnhost
+  module Management
+    module Preview
+      def self.call(user:, record: nil, template: nil, script_name: "")
+        action = record ? "preview" : "index"
+        path = record ? "/preview/#{record.id}" : "/?preview_template=#{template}"
+        origin = Setting.current.effective_site_url || "http://example.com"
+        env = Rack::MockRequest.env_for("#{origin}#{script_name}#{path}")
+        env["SCRIPT_NAME"] = script_name
+        env["PATH_INFO"] = path.split("?").first
+        env["postnhost.management_user"] = user
+        env["action_dispatch.request.path_parameters"] = { controller: "postnhost/management_preview", action:, id: record&.id }
+        env["action_dispatch.routes"] = Engine.routes
+        status, _headers, body = I18n.with_locale(I18n.default_locale) { ManagementPreviewController.action(action).call(env) }
+        html = +""
+        body.each { |chunk| html << chunk }
+        raise ArgumentError, "Preview could not be rendered" unless status == 200
+
+        { html:, template: template || Template.active_name }
+      ensure
+        body&.close if body.respond_to?(:close)
+      end
+    end
+  end
+end

data/app/services/postnhost/management/resources.rb

@@ -0,0 +1,30 @@
+module Postnhost
+  module Management
+    module Resources
+      TEXT = %w[title title_tag og_title meta_description content language_id].freeze
+      EXCERPT = %w[custom_excerpt use_excerpt_as_meta_description].freeze
+      ARTICLE = (TEXT + EXCERPT + %w[schema_headline schema_article_type slug cover_image_alt scheduled_at top_pick author_ids category_ids suggested_article_ids]).freeze
+      PAGE = (TEXT + %w[slug]).freeze
+      USER = %w[email name slug position bio website_url x_url linkedin_url threads_url tiktok_url youtube_url facebook_url instagram_url bluesky_url mastodon_url password password_confirmation].freeze
+      SETTING = %w[site_url site_indexing public_page_size timezone author_pages_enabled search_enabled show_powered_by use_auto_header_navigation use_auto_footer_navigation schema_settings schema_locale_overrides].freeze
+      DEFINITIONS = {
+        "api_tokens" => { model: "ApiToken", fields: %w[name] },
+        "articles" => { model: "Article", fields: ARTICLE, snapshot: :article_snapshot },
+        "pages" => { model: "Page", fields: PAGE, snapshot: :page_snapshot },
+        "categories" => { model: "Category", fields: %w[name slug meta_description] },
+        "languages" => { model: "Language", fields: %w[name html_lang default] },
+        "users" => { model: "User", fields: USER + %w[schema_profile schema_locale_overrides] },
+        "article_variants" => { model: "ArticleVariant", fields: TEXT + EXCERPT + %w[schema_headline], parent: "articles", snapshot: :article_variant_snapshot },
+        "page_variants" => { model: "PageVariant", fields: TEXT, parent: "pages", snapshot: :page_variant_snapshot },
+        "category_variants" => { model: "CategoryVariant", fields: %w[name meta_description language_id], parent: "categories" },
+        "settings" => { model: "Setting", fields: SETTING, singleton: true },
+        "template" => { model: "Template", fields: %w[name], singleton: true },
+        "site_scripts" => { model: "SiteScript", fields: %w[placement script] }
+      }.freeze
+
+      def self.model(resource)
+        Postnhost.const_get(DEFINITIONS.fetch(resource).fetch(:model), false)
+      end
+    end
+  end
+end

data/app/services/postnhost/management/schema_fields.rb

@@ -0,0 +1,25 @@
+module Postnhost
+  module Management
+    module SchemaFields
+      TEXT = { type: %w[string null] }.freeze
+      STRINGS = { type: "array", items: { type: "string" }, maxItems: 100 }.freeze
+
+      def self.settings
+        fields = Postnhost::Settings::SchemaManageable::SCHEMA_SETTING_FIELDS.index_with { TEXT }
+        fields["same_as"] = STRINGS
+        fields["policies"] = { type: "object", properties: Postnhost::SchemaHelper::POLICY_FIELDS.keys.index_with { TEXT }, additionalProperties: false }
+        { type: "object", properties: fields, additionalProperties: false }
+      end
+
+      def self.profile
+        fields = Postnhost::Users::SchemaManageable::USER_SCHEMA_PROFILE_FIELDS.index_with { |field| %w[same_as knows_language].include?(field) ? STRINGS : TEXT }
+        { type: "object", properties: fields, additionalProperties: false }
+      end
+
+      def self.overrides(resource)
+        fields = resource == "users" ? Postnhost::Users::SchemaManageable::USER_SCHEMA_TEXT_FIELDS : Postnhost::SchemaHelper::SETTINGS_TEXT_OVERRIDE_FIELDS
+        { type: "object", additionalProperties: { type: "object", properties: fields.index_with { TEXT }, additionalProperties: false } }
+      end
+    end
+  end
+end

data/app/services/postnhost/management/serializer.rb

@@ -0,0 +1,40 @@
+module Postnhost
+  module Management
+    module Serializer
+      SUMMARY_FIELDS = %w[
+        id user_id article_id page_id category_id language_id name title slug email position
+        html_lang default created_at updated_at scheduled_at publication_error top_pick generating
+        articles_count article_variants_count page_variants_count placement revoked_at
+        cover_image cover_image_alt avatar_file
+      ].freeze
+
+      def self.summary(record)
+        data = record.attributes.slice(*SUMMARY_FIELDS)
+        data["published"] = record["management_snapshot_id"].present? if record.has_attribute?("management_snapshot_id")
+        %w[cover_image avatar_file].each do |field|
+          data["#{field}_url"] = record.public_send(field).url if record.has_attribute?(field)
+        end
+        data
+      end
+
+      def self.call(value)
+        case value
+        when ActiveRecord::Base
+          data = value.attributes.except("password_digest", "token_digest", "scheduled_job_id")
+          if value.respond_to?(:published?)
+            data["published"] = value.published?
+            data["unpublished_changes"] = value.unpublished_changes?
+          end
+          data.merge!("author_ids" => value.author_ids, "category_ids" => value.category_ids, "suggested_article_ids" => value.suggested_article_ids) if value.is_a?(Article)
+          %w[cover_image avatar_file site_logo og_image].each do |field|
+            data["#{field}_url"] = value.public_send(field).url if value.respond_to?(field)
+          end
+          data
+        when Hash then value.transform_values { |item| call(item) }
+        when Array then value.map { |item| call(item) }
+        else value
+        end
+      end
+    end
+  end
+end

data/app/services/postnhost/management/settings_actions.rb

@@ -0,0 +1,64 @@
+module Postnhost
+  module Management
+    class SettingsActions < BaseService
+      include Postnhost::Settings::NavigationManageable
+
+      def initialize(action:, record:, arguments:)
+        @action = action
+        @record = record
+        @arguments = arguments
+      end
+
+      def call
+        return upload if action.start_with?("upload_")
+
+        if %w[remove_logo remove_og_image].include?(action)
+          field = action == "remove_logo" ? :site_logo : :og_image
+          record.update!(field => nil)
+          return record
+        end
+
+        validate_locale!
+        case action
+        when "get_navigation"
+          @setting = record
+          @selected_navigation_locale_key = arguments.fetch("locale")
+          @default_navigation_locale_key = Language.blog_default&.html_lang || I18n.default_locale.to_s
+          @navigation = record.current_navigation
+          { tree: navigation_tree_for_editor, targets: navigation_target_options }
+        when "replace_navigation"
+          tree = arguments.fetch("tree")
+          record.current_navigation.replace_tree!(tree:, locale_key: arguments.fetch("locale"))
+          { navigation: record.current_navigation.navigation_items.to_a }
+        when "get_translations"
+          Settings::I18nOverrides.editable_translations_for_locale(arguments.fetch("locale"), record.locale_overrides)
+        when "update_translations"
+          overrides = Settings::I18nOverrides.merge_locale_overrides(record.locale_overrides, arguments.fetch("locale"), arguments.fetch("translations"))
+          record.update!(locale_overrides: overrides)
+          record
+        else
+          raise ArgumentError, "Unsupported action"
+        end
+      end
+
+      private
+
+      attr_reader :action, :record, :arguments
+
+      def validate_locale!
+        raise ArgumentError, "Locale must belong to a configured language" unless Language.exists?(html_lang: arguments["locale"])
+      end
+
+      def upload
+        file = Upload.open(arguments.fetch("file"))
+        if action == "upload_image"
+          result = record.upload_inline_image(file)
+          return result[:success] ? success({ url: result[:url] }) : failure(result[:error])
+        end
+        field = { "upload_cover" => :cover_image, "upload_avatar" => :avatar_file, "upload_logo" => :site_logo, "upload_og_image" => :og_image }.fetch(action)
+        record.update!(field => file)
+        { url: record.public_send(field).url }
+      end
+    end
+  end
+end

data/app/services/postnhost/management/upload.rb

@@ -0,0 +1,18 @@
+require "base64"
+require "stringio"
+
+module Postnhost
+  module Management
+    module Upload
+      def self.open(payload)
+        filename = payload.fetch("filename")
+        raise ArgumentError, "Invalid filename" if filename.blank? || filename != File.basename(filename) || filename.include?("\\")
+
+        file = StringIO.new(Base64.strict_decode64(payload.fetch("base64")))
+        file.define_singleton_method(:original_filename) { filename }
+        file.define_singleton_method(:content_type) { payload.fetch("content_type") }
+        file
+      end
+    end
+  end
+end

data/app/services/postnhost/translation/enqueue.rb

@@ -0,0 +1,59 @@
+module Postnhost
+  module Translation
+    class Enqueue < BaseService
+      def initialize(record:, language_ids:)
+        @record = record
+        @language_ids = language_ids
+      end
+
+      def call
+        return success({ variants: [], job_ids: [] }) if language_ids.empty?
+
+        kind = record.class.model_name.element
+        return failure("Publish the source before generating translations") if record.respond_to?(:published?) && !record.published?
+
+        languages = language_ids.map { |id| Language.find(id) }
+        primary_id = record.respond_to?(:language_id) ? record.language_id : Language.blog_default&.id
+        return failure("Cannot translate into the source language") if languages.any? { |language| language.id == primary_id }
+
+        variants = record.class.transaction do
+          languages.map { |language| record.public_send("#{kind}_variants").create!(language:, generating: true) }
+        end
+        enqueue_variants(variants, Translation.const_get("#{kind.camelize}VariantJob", false))
+      rescue ActiveRecord::RecordInvalid => e
+        failure(e.record.errors.full_messages)
+      rescue ActiveRecord::RecordNotFound
+        failure("Language not found", status: :not_found)
+      end
+
+      private
+
+      attr_reader :record, :language_ids
+
+      def enqueue_variants(variants, job_class)
+        jobs = []
+        variants.each do |variant|
+          job = enqueue(job_class, variant)
+          unless job
+            unqueued = variants.drop(jobs.size)
+            unqueued.each(&:destroy!)
+            return ServiceResult.new(
+              value: { variants: variants.take(jobs.size), job_ids: jobs.map(&:job_id), failed_language_ids: unqueued.map(&:language_id) },
+              errors: ["Could not queue all translations. Retry the failed languages."], status: :service_unavailable
+            )
+          end
+          jobs << job
+        end
+        success({ variants:, job_ids: jobs.map(&:job_id) }, status: :accepted)
+      end
+
+      def enqueue(job_class, variant)
+        job = job_class.new(record.id, variant.language_id)
+        job_class.perform_later(job)
+      rescue StandardError => e
+        Rails.logger.error("Postnhost translation enqueue failed (#{e.class})")
+        job if job&.successfully_enqueued?
+      end
+    end
+  end
+end

data/app/views/layouts/postnhost/_sidebar.html.erb

@@ -58,6 +58,13 @@
             <span class="text-sm font-medium">Settings</span>
           <% end %>
 
+          <%= link_to api_tokens_path, class: "group flex items-center space-x-3 text-gray-700 hover:text-gray-900 hover:bg-white font-medium px-3 py-2.5 rounded-xl transition-all duration-200 #{controller_name == 'api_tokens' ? 'bg-white text-gray-900' : ''}" do %>
+            <div class="flex-shrink-0 <%= controller_name == 'api_tokens' ? 'text-gray-900' : 'text-gray-500 group-hover:text-gray-700' %>">
+              <%= icon("code-bracket", css_class: "h-5 w-5") %>
+            </div>
+            <span class="text-sm font-medium">API &amp; MCP</span>
+          <% end %>
+
           <%= link_to edit_template_path, class: "group flex items-center space-x-3 text-gray-700 hover:text-gray-900 hover:bg-white font-medium px-3 py-2.5 rounded-xl transition-all duration-200 #{current_page?(edit_template_path) || controller_name == 'templates' ? 'bg-white text-gray-900' : ''}" do %>
             <div class="flex-shrink-0 #{current_page?(edit_template_path) || controller_name == 'templates' ? 'text-gray-900' : 'text-gray-500 group-hover:text-gray-700'}">
               <%= icon("eye", css_class: "h-5 w-5") %>

data/app/views/postnhost/api_tokens/index.html.erb

@@ -0,0 +1,92 @@
+<% content_for :title, "API & MCP" %>
+<% content_for :head do %>
+  <meta name="turbo-cache-control" content="no-cache">
+<% end %>
+
+<div class="space-y-8">
+  <%= render "postnhost/shared/elements/page_header", title: "API & MCP access", description: "Connect agents and integrations to your CMS." %>
+
+  <% if @secret.present? %>
+    <section class="rounded-2xl border border-green-200 bg-green-50 p-6 space-y-3" aria-label="New token">
+      <div class="flex items-center gap-2 text-green-800">
+        <%= icon("check-circle", css_class: "h-5 w-5") %>
+        <h2 class="font-medium">Token created</h2>
+      </div>
+      <p class="text-sm text-green-800">Copy this token now. It is shown only once.</p>
+      <code class="block rounded-xl border border-green-200 bg-white p-4 text-sm text-gray-900 break-all select-all"><%= @secret %></code>
+    </section>
+  <% end %>
+
+  <div class="grid grid-cols-1 lg:grid-cols-3 gap-6">
+    <section class="lg:col-span-2 <%= form_card_classes %>" aria-labelledby="create-token-title">
+      <div>
+        <h2 id="create-token-title" class="text-lg font-medium text-gray-900">Create an access token</h2>
+        <p class="mt-2 text-sm text-gray-500">Tokens grant your CMS permissions. Give each integration its own token so you can revoke access separately.</p>
+      </div>
+      <%= form_with scope: :api_token, url: api_tokens_path, data: { turbo: false }, class: "space-y-6" do |form| %>
+        <div>
+          <%= form.label :name, class: form_label_classes %>
+          <%= form.text_field :name, required: true, placeholder: "e.g. Writing agent", class: form_input_classes %>
+        </div>
+        <%= form.submit "Create token", class: button_classes %>
+      <% end %>
+    </section>
+
+    <section class="<%= form_card_classes %>" aria-labelledby="connection-title">
+      <div>
+        <h2 id="connection-title" class="text-lg font-medium text-gray-900">Connection details</h2>
+        <p class="mt-2 text-sm text-gray-500">Use your token to authenticate either connection.</p>
+      </div>
+      <dl class="space-y-5">
+        <div>
+          <dt class="text-sm font-medium text-gray-700">Management API · v1</dt>
+          <dd class="mt-2 rounded-xl bg-gray-50 p-3 text-xs text-gray-900 break-all"><code><%= api_v1_commands_url %></code></dd>
+        </div>
+        <div>
+          <dt class="text-sm font-medium text-gray-700">MCP · v1</dt>
+          <dd class="mt-2 rounded-xl bg-gray-50 p-3 text-xs text-gray-900 break-all"><code><%= api_v1_mcp_url %></code></dd>
+          <dd class="mt-2 text-xs text-gray-500">Connect using Streamable HTTP.</dd>
+        </div>
+        <div>
+          <dt class="text-sm font-medium text-gray-700">Authorization header</dt>
+          <dd class="mt-2 rounded-xl bg-gray-50 p-3 text-xs text-gray-900 break-all"><code>Bearer &lt;your-token&gt;</code></dd>
+        </div>
+      </dl>
+    </section>
+  </div>
+
+  <section class="space-y-4" aria-labelledby="access-tokens-title">
+    <div>
+      <h2 id="access-tokens-title" class="text-lg font-medium text-gray-900">Access tokens</h2>
+      <p class="mt-2 text-sm text-gray-500">Manage the tokens you have created for your account.</p>
+    </div>
+    <% if @api_tokens.any? %>
+      <%= render "postnhost/shared/elements/table_container", headers: [
+        { text: "Token", class: "col-span-8" },
+        { text: "Actions", class: "col-span-4 text-right" }
+      ] do %>
+        <% @api_tokens.each do |token| %>
+          <div class="<%= table_row_classes %>">
+            <div class="grid grid-cols-12 gap-4 items-center">
+              <div class="col-span-8 min-w-0 space-y-2">
+                <p class="font-medium text-gray-900 break-words"><%= token.name %></p>
+                <% if token.revoked_at? %>
+                  <span class="inline-flex <%= stats_badge_classes(variant: :gray) %>">Revoked</span>
+                <% else %>
+                  <span class="inline-flex <%= stats_badge_classes(variant: :green) %>">Active</span>
+                <% end %>
+              </div>
+              <div class="col-span-4 flex justify-end">
+                <% unless token.revoked_at? %>
+                  <%= button_to "Revoke", api_token_path(token), method: :delete, class: button_classes(variant: :danger) %>
+                <% end %>
+              </div>
+            </div>
+          </div>
+        <% end %>
+      <% end %>
+    <% else %>
+      <%= render "postnhost/shared/elements/empty_state", icon: "code-bracket", title: "No access tokens", description: "Create a token above to connect your first agent or integration." %>
+    <% end %>
+  </section>
+</div>

data/config/routes.rb

@@ -33,6 +33,7 @@ Postnhost::Engine.routes.draw do
   end
 
   # Admin routes
+  resources :api_tokens, only: %i[index create destroy]
   resource :onboarding, only: %i[show update], controller: "onboarding"
   resource :session, only: %i[new create destroy], controller: "sessions"
   resources :users, only: %i[index new create edit update destroy] do
@@ -106,6 +107,17 @@ Postnhost::Engine.routes.draw do
     resources :site_scripts, only: %i[create update destroy], controller: "settings/site_scripts"
   end
 
+  # Management API and MCP
+  namespace :api do
+    namespace :v1 do
+      get "openapi", to: "commands#schema", as: :openapi
+      get "commands", to: "commands#index", as: :commands
+      post "commands/:command", to: "commands#create", as: :command
+      post "mcp", to: "mcp#create", as: :mcp
+      match "mcp", to: "mcp#unsupported", via: %i[get delete]
+    end
+  end
+
   # Public static pages from host app views:
   # app/views/postnhost/static_pages/*.html.erb
   get "/:slug", to: "public/static_pages#show", as: :public_static_page

data/db/migrate/20261008120000_create_api_tokens.rb

@@ -0,0 +1,12 @@
+class CreateApiTokens < ActiveRecord::Migration[7.2]
+  def change
+    create_table :postnhost_api_tokens do |t|
+      t.references :user, null: false, foreign_key: { to_table: :postnhost_users }
+      t.string :name, null: false
+      t.string :token_digest, null: false
+      t.datetime :revoked_at
+      t.timestamps
+    end
+    add_index :postnhost_api_tokens, :token_digest, unique: true
+  end
+end

data/lib/postnhost/version.rb

@@ -1,3 +1,3 @@
 module Postnhost
-  VERSION = "0.1.1"
+  VERSION = "0.2.0"
 end