@agentcairn/mcp-server 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,24 @@
-# Temporary Holding Version
+# @agentcairn/mcp-server
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The server of [Agent Cairn](https://github.com/itsmemac/agentcairn): shared project memory for AI coding agents, stored in Neo4j.
+
+It exposes:
+
+- an **MCP endpoint** (`POST /mcp`, stateless Streamable HTTP) with the tools `cairn_briefing`, `cairn_recall`, `cairn_remember`, `cairn_checkpoint`, `cairn_areas`, `cairn_forget` and `cairn_status`;
+- a **JSON API** (`/api/*`) used by the `cairn` CLI and Claude Code hooks;
+- a **dashboard** at `/ui/`: live request feed, projects, memory graph, read-only Cypher console, token management;
+- `GET /healthz` for container health checks.
+
+## Run it
+
+Most people run the Docker image (`ghcr.io/itsmemac/agentcairn`); see the [self-hosting guide](https://github.com/itsmemac/agentcairn/blob/main/docs/self-hosting.md). To run from source or npm:
+
+```bash
+NEO4J_URI=bolt://localhost:7687 NEO4J_PASSWORD=... npx -p @agentcairn/mcp-server cairn-mcp-http
+```
+
+The first start prints a one-time setup code in its log; open `http://localhost:8787/ui/` and use it to create the admin account.
+
+There is also a local **stdio mode** (`cairn-mcp`) that talks to Neo4j directly and reads the working directory for the project, for single-machine use.
+
+All settings are listed in [docs/configuration.md](https://github.com/itsmemac/agentcairn/blob/main/docs/configuration.md). MIT licensed.

package/dist/authn.d.ts

@@ -0,0 +1,38 @@
+import type { IncomingMessage } from 'node:http';
+import { type Brain } from '@agentcairn/core';
+export type AuthResult = {
+    ok: true;
+    kind: 'env' | 'managed' | 'open';
+    name: string;
+} | {
+    ok: false;
+    reason: 'missing' | 'invalid' | 'no_tokens';
+};
+export interface AuthOptions {
+    /** A static token from the environment (CAIRN_TOKEN). */
+    envToken?: string;
+    /** Explicit opt-in to no authentication at all. */
+    noAuth?: boolean;
+}
+/**
+ * Checks bearer tokens for the machine-facing endpoints: the static
+ * environment token, or tokens created in the dashboard (stored hashed).
+ * Lookups are cached briefly so a busy agent does not hit the database on
+ * every call; `invalidate()` makes revocations take effect at once.
+ */
+export declare class Authenticator {
+    private readonly brain;
+    private readonly options;
+    private readonly clock;
+    private readonly log;
+    private readonly good;
+    private readonly bad;
+    private readonly touched;
+    private managed;
+    constructor(brain: Brain, options?: AuthOptions, clock?: () => number, log?: (m: string) => void);
+    invalidate(): void;
+    private hasManagedTokens;
+    check(req: IncomingMessage): Promise<AuthResult>;
+    private touch;
+}
+export declare const authFailureMessage: (reason: "missing" | "invalid" | "no_tokens") => string;

package/dist/authn.js

@@ -0,0 +1,86 @@
+import { createHash, timingSafeEqual } from 'node:crypto';
+import { countActiveTokens, findApiToken, touchApiToken } from '@agentcairn/core';
+const digest = (s) => createHash('sha256').update(s).digest();
+const POSITIVE_MS = 30_000;
+const NEGATIVE_MS = 5_000;
+const TOUCH_MS = 60_000;
+/**
+ * Checks bearer tokens for the machine-facing endpoints: the static
+ * environment token, or tokens created in the dashboard (stored hashed).
+ * Lookups are cached briefly so a busy agent does not hit the database on
+ * every call; `invalidate()` makes revocations take effect at once.
+ */
+export class Authenticator {
+    brain;
+    options;
+    clock;
+    log;
+    good = new Map();
+    bad = new Map();
+    touched = new Map();
+    managed;
+    constructor(brain, options = {}, clock = Date.now, log = () => undefined) {
+        this.brain = brain;
+        this.options = options;
+        this.clock = clock;
+        this.log = log;
+    }
+    invalidate() {
+        this.good.clear();
+        this.bad.clear();
+        this.managed = undefined;
+    }
+    async hasManagedTokens() {
+        const now = this.clock();
+        if (this.managed && this.managed.until > now)
+            return this.managed.value;
+        const value = (await countActiveTokens(this.brain)) > 0;
+        this.managed = { value, until: now + NEGATIVE_MS };
+        return value;
+    }
+    async check(req) {
+        if (this.options.noAuth)
+            return { ok: true, kind: 'open', name: 'open' };
+        const header = req.headers.authorization ?? '';
+        const bearer = header.startsWith('Bearer ') ? header.slice(7).trim() : '';
+        if (bearer && this.options.envToken) {
+            const a = digest(bearer);
+            const b = digest(this.options.envToken);
+            if (timingSafeEqual(a, b))
+                return { ok: true, kind: 'env', name: 'env' };
+        }
+        if (bearer) {
+            const key = createHash('sha256').update(bearer).digest('hex');
+            const now = this.clock();
+            const cached = this.good.get(key);
+            if (cached && cached.until > now) {
+                this.touch(cached.id, now);
+                return { ok: true, kind: 'managed', name: cached.name };
+            }
+            if ((this.bad.get(key) ?? 0) > now)
+                return { ok: false, reason: 'invalid' };
+            const found = await findApiToken(this.brain, bearer);
+            if (found) {
+                this.good.set(key, { ...found, until: now + POSITIVE_MS });
+                this.touch(found.id, now);
+                return { ok: true, kind: 'managed', name: found.name };
+            }
+            if (this.bad.size > 500)
+                this.bad.clear();
+            this.bad.set(key, now + NEGATIVE_MS);
+        }
+        if (!this.options.envToken && !(await this.hasManagedTokens()))
+            return { ok: false, reason: 'no_tokens' };
+        return { ok: false, reason: bearer ? 'invalid' : 'missing' };
+    }
+    touch(id, now) {
+        if ((this.touched.get(id) ?? 0) + TOUCH_MS > now)
+            return;
+        this.touched.set(id, now);
+        void touchApiToken(this.brain, id).catch(error => this.log(`could not record token use: ${error.message}`));
+    }
+}
+export const authFailureMessage = (reason) => reason === 'no_tokens'
+    ? 'No access tokens exist yet. Open the dashboard (/ui/) and create one.'
+    : 'Missing or invalid bearer token.';
+//# sourceMappingURL=authn.js.map

package/dist/authn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authn.js","sourceRoot":"","sources":["../src/authn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAEzD,OAAO,EAAc,iBAAiB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAa7F,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAA;AACrE,MAAM,WAAW,GAAG,MAAM,CAAA;AAC1B,MAAM,WAAW,GAAG,KAAK,CAAA;AACzB,MAAM,QAAQ,GAAG,MAAM,CAAA;AAEvB;;;;;GAKG;AACH,MAAM,OAAO,aAAa;IAOL;IACA;IACA;IACA;IATF,IAAI,GAAG,IAAI,GAAG,EAAuD,CAAA;IACrE,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC/B,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC5C,OAAO,CAA+C;IAE9D,YACmB,KAAY,EACZ,UAAuB,EAAE,EACzB,QAAsB,IAAI,CAAC,GAAG,EAC9B,MAA2B,GAAG,EAAE,CAAC,SAAS;QAH1C,UAAK,GAAL,KAAK,CAAO;QACZ,YAAO,GAAP,OAAO,CAAkB;QACzB,UAAK,GAAL,KAAK,CAAyB;QAC9B,QAAG,GAAH,GAAG,CAAuC;IAC1D,CAAC;IAEJ,UAAU;QACR,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAA;QACjB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAA;QAChB,IAAI,CAAC,OAAO,GAAG,SAAS,CAAA;IAC1B,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAA;QACxB,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAA;QACvE,MAAM,KAAK,GAAG,CAAC,MAAM,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAA;QACvD,IAAI,CAAC,OAAO,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,GAAG,WAAW,EAAE,CAAA;QAClD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAoB;QAC9B,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QAExE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAA;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QAEzE,IAAI,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;YACxB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YACvC,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;QAC1E,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAA;YACxB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACjC,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,GAAG,GAAG,EAAE,CAAC;gBACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;gBAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;YACzD,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;YAE3E,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;YACpD,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,GAAG,GAAG,WAAW,EAAE,CAAC,CAAA;gBAC1D,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;gBACzB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAA;YACxD,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG;gBAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAA;YACzC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,WAAW,CAAC,CAAA;QACtC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;QACzG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CAAA;IAC9D,CAAC;IAEO,KAAK,CAAC,EAAU,EAAE,GAAW;QACnC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,QAAQ,GAAG,GAAG;YAAE,OAAM;QACxD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;QACzB,KAAK,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,+BAAgC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IACxH,CAAC;CACF;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAA2C,EAAU,EAAE,CACxF,MAAM,KAAK,WAAW;IACpB,CAAC,CAAC,uEAAuE;IACzE,CAAC,CAAC,kCAAkC,CAAA"}

package/dist/bin.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin.js

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+import { loadConfig, loadEnvironment, openBrain } from '@agentcairn/core';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { createBrainServer } from './server.js';
+async function main() {
+    const cwd = process.cwd();
+    loadEnvironment(cwd);
+    const brain = openBrain(loadConfig());
+    const server = createBrainServer(brain, cwd);
+    const shutdown = async () => {
+        await server.close().catch(() => undefined);
+        await brain.close().catch(() => undefined);
+        process.exit(0);
+    };
+    process.on('SIGINT', shutdown);
+    process.on('SIGTERM', shutdown);
+    // stdout carries the protocol: log to stderr only.
+    await server.connect(new StdioServerTransport());
+    console.error(`cairn: ready (folder ${cwd})`);
+}
+main().catch(error => {
+    console.error('cairn: failed to start:', error);
+    process.exit(1);
+});
+//# sourceMappingURL=bin.js.map

package/dist/bin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAA;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAE/C,KAAK,UAAU,IAAI;IACjB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;IACzB,eAAe,CAAC,GAAG,CAAC,CAAA;IACpB,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,CAAA;IACrC,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAE5C,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC3C,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAA;IACD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;IAC9B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IAE/B,mDAAmD;IACnD,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAA;IAChD,OAAO,CAAC,KAAK,CAAC,wBAAwB,GAAG,GAAG,CAAC,CAAA;AAC/C,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAA;IAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}

package/dist/context.d.ts

@@ -0,0 +1,49 @@
+import { type Brain, type ProjectHint, type ResolvedProject } from '@agentcairn/core';
+/**
+ * Where the project comes from. A local (stdio) server reads the folder the
+ * agent works in; a remote server cannot, so the client says who it is.
+ */
+export type Scope = {
+    cwd: string;
+} | {
+    hint: ProjectHint;
+};
+export interface Provenance {
+    commitSha?: string;
+    author?: string;
+    agent?: string;
+    machine?: string;
+}
+/** Everything a tool call needs: the brain, which project, and who is asking. */
+export declare class BrainContext {
+    readonly brain: Brain;
+    readonly scope: Scope;
+    private readonly clientName;
+    /** Told which project each call resolved to (the dashboard shows it). */
+    private readonly onProject;
+    private schema;
+    constructor(brain: Brain, scope: Scope, clientName?: () => string | undefined, 
+    /** Told which project each call resolved to (the dashboard shows it). */
+    onProject?: (projectId: string) => void);
+    /** The folder, when the server can see one (stdio mode). */
+    get cwd(): string | undefined;
+    /** Creates the schema once; a failed attempt is retried on the next call. */
+    ready(): Promise<void>;
+    /**
+     * Identifies the project. Writes also create a project that was only known
+     * by its git remote (an explicit id is never auto-created here: `cairn init`
+     * does that on purpose).
+     */
+    project(options: {
+        write: boolean;
+    }): Promise<ResolvedProject>;
+    /**
+     * Who wrote a memory. Locally the server reads git itself; remotely the
+     * client's hook supplies the commit and author. Values that do not look like
+     * a commit are ignored, so an agent guessing cannot corrupt staleness.
+     */
+    provenance(given?: {
+        commitSha?: string;
+        author?: string;
+    }): Promise<Provenance>;
+}

package/dist/context.js

@@ -0,0 +1,79 @@
+import { hostname } from 'node:os';
+import { RemoteConflictError, attachRemote, ensureProject, ensureSchema, getRepoState, resolveProject, resolveProjectFromHint, } from '@agentcairn/core';
+const SHA = /^[0-9a-f]{7,40}$/i;
+/** Everything a tool call needs: the brain, which project, and who is asking. */
+export class BrainContext {
+    brain;
+    scope;
+    clientName;
+    onProject;
+    schema;
+    constructor(brain, scope, clientName = () => undefined, 
+    /** Told which project each call resolved to (the dashboard shows it). */
+    onProject = () => undefined) {
+        this.brain = brain;
+        this.scope = scope;
+        this.clientName = clientName;
+        this.onProject = onProject;
+    }
+    /** The folder, when the server can see one (stdio mode). */
+    get cwd() {
+        return 'cwd' in this.scope ? this.scope.cwd : undefined;
+    }
+    /** Creates the schema once; a failed attempt is retried on the next call. */
+    ready() {
+        this.schema ??= ensureSchema(this.brain).catch(error => {
+            this.schema = undefined;
+            throw error;
+        });
+        return this.schema;
+    }
+    /**
+     * Identifies the project. Writes also create a project that was only known
+     * by its git remote (an explicit id is never auto-created here: `cairn init`
+     * does that on purpose).
+     */
+    async project(options) {
+        await this.ready();
+        const project = 'cwd' in this.scope
+            ? await resolveProject(this.brain, this.scope.cwd)
+            : await resolveProjectFromHint(this.brain, this.scope.hint);
+        this.onProject(project.projectId);
+        if (options.write && project.isNew && project.source === 'remote') {
+            await ensureProject(this.brain, project.projectId);
+            if (project.remoteHash) {
+                try {
+                    await attachRemote(this.brain, project.projectId, project.remoteHash);
+                }
+                catch (error) {
+                    if (!(error instanceof RemoteConflictError))
+                        throw error;
+                }
+            }
+            return { ...project, isNew: false };
+        }
+        return project;
+    }
+    /**
+     * Who wrote a memory. Locally the server reads git itself; remotely the
+     * client's hook supplies the commit and author. Values that do not look like
+     * a commit are ignored, so an agent guessing cannot corrupt staleness.
+     */
+    async provenance(given = {}) {
+        const given_ = {
+            commitSha: given.commitSha && SHA.test(given.commitSha) ? given.commitSha : undefined,
+            author: given.author?.trim().slice(0, 100) || undefined,
+        };
+        if (this.cwd) {
+            const repo = await getRepoState(this.cwd);
+            return {
+                commitSha: given_.commitSha ?? repo.head ?? undefined,
+                author: given_.author ?? repo.user ?? undefined,
+                agent: this.clientName(),
+                machine: hostname(),
+            };
+        }
+        return { ...given_, agent: this.clientName() };
+    }
+}
+//# sourceMappingURL=context.js.map

package/dist/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAClC,OAAO,EAIL,mBAAmB,EACnB,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,sBAAsB,GACvB,MAAM,kBAAkB,CAAA;AAezB,MAAM,GAAG,GAAG,mBAAmB,CAAA;AAE/B,iFAAiF;AACjF,MAAM,OAAO,YAAY;IAIZ;IACA;IACQ;IAEA;IAPX,MAAM,CAA2B;IAEzC,YACW,KAAY,EACZ,KAAY,EACJ,aAAuC,GAAG,EAAE,CAAC,SAAS;IACvE,yEAAyE;IACxD,YAAyC,GAAG,EAAE,CAAC,SAAS;QAJhE,UAAK,GAAL,KAAK,CAAO;QACZ,UAAK,GAAL,KAAK,CAAO;QACJ,eAAU,GAAV,UAAU,CAA4C;QAEtD,cAAS,GAAT,SAAS,CAA+C;IACxE,CAAC;IAEJ,4DAA4D;IAC5D,IAAI,GAAG;QACL,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;IACzD,CAAC;IAED,6EAA6E;IAC7E,KAAK;QACH,IAAI,CAAC,MAAM,KAAK,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;YACrD,IAAI,CAAC,MAAM,GAAG,SAAS,CAAA;YACvB,MAAM,KAAK,CAAA;QACb,CAAC,CAAC,CAAA;QACF,OAAO,IAAI,CAAC,MAAM,CAAA;IACpB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,OAA2B;QACvC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;QAClB,MAAM,OAAO,GACX,KAAK,IAAI,IAAI,CAAC,KAAK;YACjB,CAAC,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YAClD,CAAC,CAAC,MAAM,sBAAsB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAE/D,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACjC,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClE,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;YAClD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;gBACvE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,CAAC,KAAK,YAAY,mBAAmB,CAAC;wBAAE,MAAM,KAAK,CAAA;gBAC1D,CAAC;YACH,CAAC;YACD,OAAO,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;QACrC,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,QAAiD,EAAE;QAClE,MAAM,MAAM,GAAG;YACb,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YACrF,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,SAAS;SACxD,CAAA;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACzC,OAAO;gBACL,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,IAAI,SAAS;gBACrD,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,IAAI,SAAS;gBAC/C,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE;gBACxB,OAAO,EAAE,QAAQ,EAAE;aACpB,CAAA;QACH,CAAC;QACD,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAA;IAChD,CAAC;CACF"}

package/dist/dashboard.d.ts

@@ -0,0 +1,29 @@
+import { type IncomingMessage, type ServerResponse } from 'node:http';
+import { type Brain } from '@agentcairn/core';
+import type { Authenticator } from './authn.js';
+import type { EventLog } from './events.js';
+import { type SessionStore, type SetupGate } from './security.js';
+export interface DashboardDeps {
+    brain: Brain;
+    events: EventLog;
+    auth: Authenticator;
+    sessions: SessionStore;
+    setup: SetupGate;
+    version: string;
+    port: number;
+    uiDir: string;
+    trustProxy: boolean;
+    secureCookies: boolean;
+    maxBodyBytes: number;
+    capture: 'full' | 'meta';
+    authMode: {
+        envToken: boolean;
+        noAuth: boolean;
+    };
+    log: (message: string) => void;
+}
+/**
+ * The web dashboard: static UI under /ui/, JSON under /admin/api/. Returns a
+ * handler that answers true when it took the request.
+ */
+export declare function createDashboard(deps: DashboardDeps): (req: IncomingMessage, res: ServerResponse, path: string) => Promise<boolean>;