@antasphere/chassis-server 1.0.0

package/dist/projects/access.js

@@ -0,0 +1,133 @@
+import { sql } from 'drizzle-orm';
+import { projects } from '@antasphere/chassis-db';
+/**
+ * THE project access rule, stated once. A tool links its own resources to
+ * projects through a table of its own, and asks ONE question of the chassis:
+ * "does this principal hold a grant of at least `<role>` on the project in
+ * this column?". The chassis routes (`api/projects.ts`) ask the same question
+ * through the same builder, so a tool cannot drift from them.
+ *
+ * What the predicate carries, and every clause is load-bearing:
+ *
+ *  - **The guest refusal.** An `origin='guest'` membership exists for
+ *    principal resolution only (D2): it is never a project member. Refused on
+ *    the PRINCIPAL (`false`, no query at all) AND on the membership row the
+ *    grant rides on (`origin <> 'guest'`), so a stray row is inert.
+ *  - **The live membership.** The grant is read THROUGH its
+ *    `workspace_members` row: same user, same workspace as the request,
+ *    `is_active`. A deleted membership took the grant with it (the foreign
+ *    key's cascade); a deactivated one resolves no principal at all.
+ *  - **One workspace.** The project belongs to the request's workspace and to
+ *    the membership's. A request never spans workspaces (ADR 014).
+ *  - **The role ladder.** `manager` contains `editor` contains `viewer`.
+ *  - **A team's grant (PRDCT-2794).** A person seated in a team that holds a
+ *    place on the project holds the team's role, on the same live membership
+ *    row; their effective role is the highest of their own grant and their
+ *    teams'. A seat or a grant removed is felt on the next request.
+ *  - **The operator view.** A workspace owner or admin acts as a manager on
+ *    every project of the workspace (ADR 006), which is why a project with no
+ *    manager stays manageable and there is no last-manager guard.
+ *  - **The archived-write rule.** `access: 'write'` is off while the project
+ *    is archived, for everyone, the operator included. A READ stays.
+ *
+ * Callers answer 404, never 403, when a READ predicate is false: a project a
+ * principal cannot read must not reveal its existence.
+ */
+const LADDER = {
+    viewer: ['viewer', 'editor', 'manager'],
+    editor: ['editor', 'manager'],
+    manager: ['manager']
+};
+/**
+ * A boolean SQL expression over `projectId`, a column (or expression) of the
+ * CALLER's query that holds a project id: the tool's link table column, or
+ * `projects.id` itself. The aliases are prefixed so they cannot collide with
+ * the ones of the query the predicate is embedded in.
+ *
+ * **Pass a QUALIFIED reference when the predicate lands in a SELECT LIST.**
+ * drizzle renders a column object of a single-table select WITHOUT its table
+ * name there (`"id"`), and inside this subquery a bare `"id"` binds to the
+ * subquery's own tables: ambiguous at best, always-true at worst. A raw
+ * `sql\`"link_table"."project_id"\`` (or `PROJECTS_ID` below) is immune; a
+ * column object is safe in a WHERE, where drizzle always qualifies it.
+ */
+export function projectGrantPredicate(principal, projectId, opts) {
+    if (principal.origin === 'guest')
+        return sql `false`;
+    const live = opts.access === 'write' ? sql `AND prj_pr.archived_at IS NULL` : sql ``;
+    if (principal.role === 'owner' || principal.role === 'admin') {
+        return sql `EXISTS (
+      SELECT 1 FROM projects prj_pr
+      WHERE prj_pr.id = ${projectId}
+        AND prj_pr.workspace_id = ${principal.workspaceId}
+        ${live}
+    )`;
+    }
+    const roles = sql.join(LADDER[opts.atLeast].map((role) => sql `${role}`), sql `, `);
+    // Two ways to hold a grant, judged on the SAME live membership row: the
+    // person's own entry (`project_members`), or the entry of a team the person
+    // is seated in (`project_teams` through `workspace_team_members`, PRDCT-2794).
+    // The team's workspace is checked against the membership's like the
+    // project's, so a seat can never reach across workspaces; the effective
+    // role is the highest of the two, which the ladder's IN list yields.
+    return sql `EXISTS (
+    SELECT 1
+    FROM workspace_members prj_wm
+    JOIN projects prj_pr ON prj_pr.workspace_id = prj_wm.workspace_id
+    WHERE prj_pr.id = ${projectId}
+      AND prj_wm.user_id = ${principal.userId}
+      AND prj_wm.workspace_id = ${principal.workspaceId}
+      AND prj_wm.is_active
+      AND prj_wm.origin <> 'guest'
+      ${live}
+      AND (
+        EXISTS (
+          SELECT 1 FROM project_members prj_pm
+          WHERE prj_pm.project_id = prj_pr.id
+            AND prj_pm.member_id = prj_wm.id
+            AND prj_pm.role IN (${roles})
+        )
+        OR EXISTS (
+          SELECT 1
+          FROM project_teams prj_pt
+          JOIN workspace_team_members prj_tm ON prj_tm.team_id = prj_pt.team_id
+          JOIN workspace_teams prj_t ON prj_t.id = prj_pt.team_id
+          WHERE prj_pt.project_id = prj_pr.id
+            AND prj_tm.member_id = prj_wm.id
+            AND prj_t.workspace_id = prj_wm.workspace_id
+            AND prj_pt.role IN (${roles})
+        )
+      )
+  )`;
+}
+/** `projects.id`, always qualified: safe in a select list as in a WHERE (see above). */
+export const PROJECTS_ID = sql.raw('"projects"."id"');
+/**
+ * The caller's effective role on a project AS A SQL EXPRESSION over a project
+ * id column: `manager`, `editor`, `viewer`, or NULL (no read). Built from the
+ * predicate above, never beside it. Archive-blind on purpose: a role is a
+ * READ fact, and whether an act is allowed on an archived project is the
+ * act's own question (`access: 'write'`, or the route's 409).
+ */
+export function projectRoleExpression(principal, projectId) {
+    const has = (atLeast) => projectGrantPredicate(principal, projectId, { atLeast, access: 'read' });
+    return sql `CASE
+    WHEN ${has('manager')} THEN 'manager'
+    WHEN ${has('editor')} THEN 'editor'
+    WHEN ${has('viewer')} THEN 'viewer'
+  END`;
+}
+/**
+ * The effective role of `principal` on one project of the request's
+ * workspace, or null. **null = 404**: no such project here, or a project the
+ * principal cannot read; the two must stay indistinguishable to the caller.
+ */
+export async function projectRole(conn, principal, projectId) {
+    const rows = await conn
+        .select({ role: projectRoleExpression(principal, PROJECTS_ID) })
+        .from(projects)
+        .where(sql `${projects.id} = ${projectId} AND ${projects.workspaceId} = ${principal.workspaceId}`)
+        .limit(1);
+    return rows[0]?.role ?? null;
+}
+//# sourceMappingURL=access.js.map

package/dist/projects/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/projects/access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAA6B,MAAM,aAAa,CAAC;AAE7D,OAAO,EAAE,QAAQ,EAAe,MAAM,wBAAwB,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,MAAM,MAAM,GAAgD;IAC1D,MAAM,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC;IACvC,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC7B,OAAO,EAAE,CAAC,SAAS,CAAC;CACrB,CAAC;AASF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAwE,EACxE,SAAqB,EACrB,IAAyB;IAEzB,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,GAAG,CAAA,OAAO,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAA,gCAAgC,CAAC,CAAC,CAAC,GAAG,CAAA,EAAE,CAAC;IACnF,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7D,OAAO,GAAG,CAAA;;0BAEY,SAAS;oCACC,SAAS,CAAC,WAAW;UAC/C,IAAI;MACR,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CACpB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAA,GAAG,IAAI,EAAE,CAAC,EAChD,GAAG,CAAA,IAAI,CACR,CAAC;IACF,wEAAwE;IACxE,4EAA4E;IAC5E,+EAA+E;IAC/E,oEAAoE;IACpE,wEAAwE;IACxE,qEAAqE;IACrE,OAAO,GAAG,CAAA;;;;wBAIY,SAAS;6BACJ,SAAS,CAAC,MAAM;kCACX,SAAS,CAAC,WAAW;;;QAG/C,IAAI;;;;;;kCAMsB,KAAK;;;;;;;;;;kCAUL,KAAK;;;IAGnC,CAAC;AACL,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,MAAM,WAAW,GAAQ,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAE3D;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAwE,EACxE,SAAqB;IAErB,MAAM,GAAG,GAAG,CAAC,OAAoB,EAAE,EAAE,CACnC,qBAAqB,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3E,OAAO,GAAG,CAAoB;WACrB,GAAG,CAAC,SAAS,CAAC;WACd,GAAG,CAAC,QAAQ,CAAC;WACb,GAAG,CAAC,QAAQ,CAAC;MAClB,CAAC;AACP,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAY,EACZ,SAAwE,EACxE,SAAiB;IAEjB,MAAM,IAAI,GAAG,MAAM,IAAI;SACpB,MAAM,CAAC,EAAE,IAAI,EAAE,qBAAqB,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;SAC/D,IAAI,CAAC,QAAQ,CAAC;SACd,KAAK,CAAC,GAAG,CAAA,GAAG,QAAQ,CAAC,EAAE,MAAM,SAAS,QAAQ,QAAQ,CAAC,WAAW,MAAM,SAAS,CAAC,WAAW,EAAE,CAAC;SAChG,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;AAC/B,CAAC"}

package/dist/projects/index.d.ts

@@ -0,0 +1,2 @@
+export { PROJECTS_ID, projectGrantPredicate, projectRole, projectRoleExpression, type ProjectGrantOptions } from './access.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/projects/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/projects/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,WAAW,EACX,qBAAqB,EACrB,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAC"}

package/dist/projects/index.js

@@ -0,0 +1,2 @@
+export { PROJECTS_ID, projectGrantPredicate, projectRole, projectRoleExpression } from './access.js';
+//# sourceMappingURL=index.js.map

package/dist/projects/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/projects/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,WAAW,EACX,qBAAqB,EAEtB,MAAM,aAAa,CAAC"}

package/dist/route-label.d.ts

@@ -0,0 +1,23 @@
+import type { Context } from 'hono';
+/**
+ * The low-cardinality, secret-free label for a request, used by BOTH the
+ * completion log line and the trace span.
+ *
+ * The raw `c.req.path` must never reach the log stream or a span attribute.
+ * Path segments are request data like any other: the moment a route puts a
+ * capability in the URL — a share secret, a one-time token, an invitation
+ * code — every log sink, every trace backend, and every operator with
+ * `docker logs` holds a working credential, and the redaction list cannot
+ * help (it keys off object properties, and `path` is one opaque string).
+ * Logging the MATCHED ROUTE PATTERN instead (`/v/:secret`, not
+ * `/v/9f3c…`) keeps the line just as useful for debugging and cardinality
+ * bounded, and it is secret-free by construction for every route that will
+ * ever be added.
+ *
+ * `routePath` is only populated once routing has run, so callers must read
+ * this AFTER `await next()`. Unmatched requests have no pattern to report:
+ * they get the literal `(unmatched)` rather than the attacker-controlled URL
+ * they probed with.
+ */
+export declare function routeLabel(c: Context): string;
+//# sourceMappingURL=route-label.d.ts.map

package/dist/route-label.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-label.d.ts","sourceRoot":"","sources":["../src/route-label.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,CAM7C"}

package/dist/route-label.js

@@ -0,0 +1,29 @@
+/**
+ * The low-cardinality, secret-free label for a request, used by BOTH the
+ * completion log line and the trace span.
+ *
+ * The raw `c.req.path` must never reach the log stream or a span attribute.
+ * Path segments are request data like any other: the moment a route puts a
+ * capability in the URL — a share secret, a one-time token, an invitation
+ * code — every log sink, every trace backend, and every operator with
+ * `docker logs` holds a working credential, and the redaction list cannot
+ * help (it keys off object properties, and `path` is one opaque string).
+ * Logging the MATCHED ROUTE PATTERN instead (`/v/:secret`, not
+ * `/v/9f3c…`) keeps the line just as useful for debugging and cardinality
+ * bounded, and it is secret-free by construction for every route that will
+ * ever be added.
+ *
+ * `routePath` is only populated once routing has run, so callers must read
+ * this AFTER `await next()`. Unmatched requests have no pattern to report:
+ * they get the literal `(unmatched)` rather than the attacker-controlled URL
+ * they probed with.
+ */
+export function routeLabel(c) {
+    const matched = c.req.routePath;
+    // Hono answers '/*' for a catch-all match and for no match at all; neither
+    // says anything the pattern doesn't, and both are safe to report as-is.
+    if (!matched)
+        return '(unmatched)';
+    return matched;
+}
+//# sourceMappingURL=route-label.js.map

package/dist/route-label.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-label.js","sourceRoot":"","sources":["../src/route-label.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,UAAU,CAAC,CAAU;IACnC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;IAChC,2EAA2E;IAC3E,wEAAwE;IACxE,IAAI,CAAC,OAAO;QAAE,OAAO,aAAa,CAAC;IACnC,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/routes/health.d.ts

@@ -0,0 +1,30 @@
+import { Hono } from 'hono';
+import type { RuntimeState } from '../state.js';
+/**
+ * /healthz — liveness. No dependencies: answers 200 whenever the event loop
+ * runs, so orchestrators never restart a replica that is merely waiting on
+ * the database.
+ *
+ * /readyz — readiness. 503 until env is parsed, migrations are applied (or
+ * confirmed current), and the DB is reachable; 503 again while draining; and
+ * 503 whenever the backing store stops being writable.
+ *
+ * That last clause is the whole point of `probeStorage`. Readiness used to be
+ * a boot-time boolean, so the storage probe ran exactly once, at startup: an
+ * instance whose /data volume was emptied, unmounted or turned read-only
+ * after boot — the state a failed restore leaves behind — kept answering 200
+ * and kept taking traffic it could not serve. Readiness has to be a live
+ * claim about the dependencies, not a memory of them.
+ */
+export interface HealthDeps {
+    /** Re-probe the backing store. Must throw when it is not writable. */
+    probeStorage?: () => Promise<void>;
+    /** How long a SUCCESSFUL probe is trusted before it re-runs. */
+    storageProbeTtlMs?: number;
+    /** Called with the probe failure so it lands in the logs. */
+    onStorageFailure?: (err: unknown) => void;
+    /** Injectable clock (tests). */
+    now?: () => number;
+}
+export declare function healthRoutes(state: RuntimeState, deps?: HealthDeps): Hono;
+//# sourceMappingURL=health.d.ts.map

package/dist/routes/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/routes/health.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,UAAU;IACzB,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,gEAAgE;IAChE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,6DAA6D;IAC7D,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;IAC1C,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AASD,wBAAgB,YAAY,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,GAAE,UAAe,GAAG,IAAI,CAyC7E"}

package/dist/routes/health.js

@@ -0,0 +1,54 @@
+import { Hono } from 'hono';
+/**
+ * Successes are cached briefly so a fast readiness poll does not become a
+ * PUT+DELETE per second against S3. Failures are NEVER cached: the next
+ * request re-probes, so recovery is observed immediately.
+ */
+const DEFAULT_STORAGE_PROBE_TTL_MS = 10_000;
+export function healthRoutes(state, deps = {}) {
+    const app = new Hono();
+    const { probeStorage, onStorageFailure } = deps;
+    const ttlMs = deps.storageProbeTtlMs ?? DEFAULT_STORAGE_PROBE_TTL_MS;
+    const now = deps.now ?? (() => Date.now());
+    let trustedUntil = 0;
+    let inflight = null;
+    /** Resolves to the failure, or null when storage is reachable. */
+    function checkStorage() {
+        if (!probeStorage)
+            return Promise.resolve(null);
+        if (now() < trustedUntil)
+            return Promise.resolve(null);
+        // One probe at a time: a burst of readiness polls must not fan out into a
+        // burst of writes against the store.
+        const pending = (inflight ??= (async () => {
+            try {
+                await probeStorage();
+                trustedUntil = now() + ttlMs;
+                return null;
+            }
+            catch (err) {
+                trustedUntil = 0;
+                onStorageFailure?.(err);
+                return err ?? new Error('storage probe failed');
+            }
+            finally {
+                inflight = null;
+            }
+        })());
+        return pending;
+    }
+    app.get('/healthz', (c) => c.json({ status: 'ok' }));
+    app.get('/readyz', async (c) => {
+        if (state.draining)
+            return c.json({ status: 'unavailable', reason: 'draining' }, 503);
+        if (!state.ready)
+            return c.json({ status: 'unavailable', reason: state.reason }, 503);
+        // The reason stays coarse on purpose: /readyz is unauthenticated and a
+        // driver's error text carries bucket names and filesystem paths.
+        if (await checkStorage())
+            return c.json({ status: 'unavailable', reason: 'storage' }, 503);
+        return c.json({ status: 'ready' });
+    });
+    return app;
+}
+//# sourceMappingURL=health.js.map

package/dist/routes/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../src/routes/health.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AA8B5B;;;;GAIG;AACH,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAE5C,MAAM,UAAU,YAAY,CAAC,KAAmB,EAAE,OAAmB,EAAE;IACrE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,EAAE,YAAY,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,IAAI,4BAA4B,CAAC;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAE3C,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,QAAQ,GAA4B,IAAI,CAAC;IAE7C,kEAAkE;IAClE,SAAS,YAAY;QACnB,IAAI,CAAC,YAAY;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,GAAG,EAAE,GAAG,YAAY;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvD,0EAA0E;QAC1E,qCAAqC;QACrC,MAAM,OAAO,GAAG,CAAC,QAAQ,KAAK,CAAC,KAAK,IAAI,EAAE;YACxC,IAAI,CAAC;gBACH,MAAM,YAAY,EAAE,CAAC;gBACrB,YAAY,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,YAAY,GAAG,CAAC,CAAC;gBACjB,gBAAgB,EAAE,CAAC,GAAG,CAAC,CAAC;gBACxB,OAAO,GAAG,IAAI,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAClD,CAAC;oBAAS,CAAC;gBACT,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC,CAAC;QACN,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACrD,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7B,IAAI,KAAK,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC;QACtF,IAAI,CAAC,KAAK,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACtF,uEAAuE;QACvE,iEAAiE;QACjE,IAAI,MAAM,YAAY,EAAE;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/routes/index.d.ts

@@ -0,0 +1,3 @@
+export { healthRoutes } from './health.js';
+export { wellKnownRoutes } from './wellknown.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/routes/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/routes/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/routes/index.js

@@ -0,0 +1,3 @@
+export { healthRoutes } from './health.js';
+export { wellKnownRoutes } from './wellknown.js';
+//# sourceMappingURL=index.js.map

package/dist/routes/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/routes/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/routes/wellknown.d.ts

@@ -0,0 +1,11 @@
+import { Hono } from 'hono';
+import { type Auth } from '../identity/better-auth.js';
+export interface WellKnownDeps {
+    auth: Auth;
+    publicBaseUrl: string;
+    instanceName?: string;
+    /** The tool's OAuth scope list, as registered with the provider: what `scopes_supported` advertises. */
+    oauthScopes: readonly string[];
+}
+export declare function wellKnownRoutes({ auth, publicBaseUrl, oauthScopes }: WellKnownDeps): Hono;
+//# sourceMappingURL=wellknown.d.ts.map

package/dist/routes/wellknown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wellknown.d.ts","sourceRoot":"","sources":["../../src/routes/wellknown.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAK1C,OAAO,EAAkB,KAAK,IAAI,EAAE,MAAM,4BAA4B,CAAC;AAoBvE,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,IAAI,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wGAAwG;IACxG,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CAChC;AAED,wBAAgB,eAAe,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,EAAE,aAAa,GAAG,IAAI,CAiCzF"}

package/dist/routes/wellknown.js

@@ -0,0 +1,45 @@
+import { Hono } from 'hono';
+import { oauthProviderAuthServerMetadata, oauthProviderOpenIdConfigMetadata } from '@better-auth/oauth-provider';
+import { mcpResourceUrl } from '../identity/better-auth.js';
+/**
+ * Root-level OAuth discovery surface.
+ *
+ * The oauthProvider plugin serves RFC 8414 / OIDC discovery under the
+ * /api/v1/auth base path, but clients resolve discovery from the ISSUER (the
+ * bare origin — jwt.issuer in identity/better-auth.ts), so the same documents
+ * must exist at the origin root. RFC 9728 protected-resource metadata is ours:
+ * it points the 401-challenged MCP client at this same origin as its
+ * authorization server. All documents are public by design and fetched
+ * cross-origin by browser-based MCP hosts — wide-open CORS is correct.
+ */
+const CORS_HEADERS = {
+    'Access-Control-Allow-Origin': '*',
+    'Access-Control-Allow-Methods': 'GET, OPTIONS',
+    'Access-Control-Allow-Headers': 'Content-Type, Authorization, mcp-protocol-version',
+    'Access-Control-Max-Age': '86400'
+};
+export function wellKnownRoutes({ auth, publicBaseUrl, oauthScopes }) {
+    const app = new Hono();
+    const asMetadata = oauthProviderAuthServerMetadata(auth, {
+        headers: { ...CORS_HEADERS, 'Cache-Control': 'public, max-age=3600' }
+    });
+    const oidcMetadata = oauthProviderOpenIdConfigMetadata(auth, {
+        headers: { ...CORS_HEADERS, 'Cache-Control': 'public, max-age=3600' }
+    });
+    app.get('/.well-known/oauth-authorization-server', (c) => asMetadata(c.req.raw));
+    app.get('/.well-known/openid-configuration', (c) => oidcMetadata(c.req.raw));
+    // RFC 9728: served at the origin level AND at the path-aware derivation
+    // (clients insert /.well-known/oauth-protected-resource between origin and
+    // the resource path /mcp) — both return the same document.
+    const protectedResource = (c) => c.json({
+        resource: mcpResourceUrl(publicBaseUrl),
+        authorization_servers: [publicBaseUrl],
+        scopes_supported: [...oauthScopes],
+        bearer_methods_supported: ['header']
+    }, 200, { ...CORS_HEADERS, 'Cache-Control': 'public, max-age=3600' });
+    app.get('/.well-known/oauth-protected-resource', (c) => protectedResource(c));
+    app.get('/.well-known/oauth-protected-resource/mcp', (c) => protectedResource(c));
+    app.options('/.well-known/*', (c) => c.body(null, 204, { ...CORS_HEADERS }));
+    return app;
+}
+//# sourceMappingURL=wellknown.js.map

package/dist/routes/wellknown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wellknown.js","sourceRoot":"","sources":["../../src/routes/wellknown.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAC1C,OAAO,EACL,+BAA+B,EAC/B,iCAAiC,EAClC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,cAAc,EAAa,MAAM,4BAA4B,CAAC;AAEvE;;;;;;;;;;GAUG;AACH,MAAM,YAAY,GAAG;IACnB,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,cAAc;IAC9C,8BAA8B,EAAE,mDAAmD;IACnF,wBAAwB,EAAE,OAAO;CACzB,CAAC;AAUX,MAAM,UAAU,eAAe,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAiB;IACjF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,UAAU,GAAG,+BAA+B,CAAC,IAAI,EAAE;QACvD,OAAO,EAAE,EAAE,GAAG,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE;KACtE,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,iCAAiC,CAAC,IAAI,EAAE;QAC3D,OAAO,EAAE,EAAE,GAAG,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE;KACtE,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACjF,GAAG,CAAC,GAAG,CAAC,mCAAmC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7E,wEAAwE;IACxE,2EAA2E;IAC3E,2DAA2D;IAC3D,MAAM,iBAAiB,GAAG,CAAC,CAAU,EAAE,EAAE,CACvC,CAAC,CAAC,IAAI,CACJ;QACE,QAAQ,EAAE,cAAc,CAAC,aAAa,CAAC;QACvC,qBAAqB,EAAE,CAAC,aAAa,CAAC;QACtC,gBAAgB,EAAE,CAAC,GAAG,WAAW,CAAC;QAClC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;KACrC,EACD,GAAG,EACH,EAAE,GAAG,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,CAC7D,CAAC;IACJ,GAAG,CAAC,GAAG,CAAC,uCAAuC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,GAAG,CAAC,GAAG,CAAC,2CAA2C,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;IAElF,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC,CAAC;IAE7E,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/secret.d.ts

@@ -0,0 +1,30 @@
+import type { Logger } from './logger.js';
+/**
+ * Resolve the auth secret: prefer AUTH_SECRET from the environment; otherwise
+ * persist a generated one under DATA_DIR (n8n-style zero-config first run).
+ * The file is written 0600 and reused on every subsequent boot, so sessions
+ * survive restarts even when the operator never set a secret.
+ */
+export declare function resolveAuthSecret(envSecret: string | undefined, dataDir: string, log: Logger): Promise<string>;
+/** Where a boot-generated setup token lives until the instance is claimed. */
+export declare function generatedSetupTokenPath(dataDir: string): string;
+/**
+ * The credential POST /api/v1/setup REQUIRES (PRDCT-1347, audit A7). The
+ * first-boot claim decides who owns the instance, so it can never be free:
+ *
+ *  - `SETUP_TOKEN` set → that is the token (setup.sh writes one);
+ *  - instance already set up → nothing to claim, no token needed (null);
+ *  - otherwise → a token is generated ONCE into `$DATA_DIR/setup-token`
+ *    (0600, atomic write, reused on every later boot until the claim) and
+ *    printed to the container log, so the `docker run` / plain
+ *    `docker compose up` paths — which never go through setup.sh — still
+ *    produce an instance claimable only with a secret. The file is removed
+ *    once setup completes (see clearGeneratedSetupToken).
+ *
+ * Optional-when-set was the hole: a minimal-env container answered the
+ * claim with 201 and no credential at all.
+ */
+export declare function resolveSetupToken(envToken: string | undefined, dataDir: string, alreadySetUp: boolean, log: Logger): Promise<string | null>;
+/** Best-effort removal of the generated token once the claim has succeeded. */
+export declare function clearGeneratedSetupToken(dataDir: string): Promise<void>;
+//# sourceMappingURL=secret.d.ts.map

package/dist/secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.d.ts","sourceRoot":"","sources":["../src/secret.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CA8BjB;AAED,8EAA8E;AAC9E,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,OAAO,EACrB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoCxB;AAED,+EAA+E;AAC/E,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7E"}

package/dist/secret.js

@@ -0,0 +1,97 @@
+import { randomBytes } from 'node:crypto';
+import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+/**
+ * Resolve the auth secret: prefer AUTH_SECRET from the environment; otherwise
+ * persist a generated one under DATA_DIR (n8n-style zero-config first run).
+ * The file is written 0600 and reused on every subsequent boot, so sessions
+ * survive restarts even when the operator never set a secret.
+ */
+export async function resolveAuthSecret(envSecret, dataDir, log) {
+    if (envSecret)
+        return envSecret;
+    const secretPath = join(dataDir, 'secret');
+    try {
+        const existing = (await readFile(secretPath, 'utf8')).trim();
+        if (existing.length >= 32)
+            return existing;
+        log.warn({ secretPath }, 'existing secret file is too short — regenerating');
+    }
+    catch {
+        // no secret file yet
+    }
+    const secret = randomBytes(32).toString('hex');
+    await mkdir(dataDir, { recursive: true });
+    // Write + rename (same dir → atomic) so a crash mid-write never leaves a
+    // truncated secret that a later boot would accept and lock everyone out.
+    const tmpPath = join(dataDir, `.secret.${randomBytes(6).toString('hex')}.tmp`);
+    try {
+        await writeFile(tmpPath, secret + '\n', { mode: 0o600 });
+        await rename(tmpPath, secretPath);
+    }
+    catch (err) {
+        await rm(tmpPath, { force: true });
+        throw err;
+    }
+    log.warn({ secretPath }, 'AUTH_SECRET was not set — generated one into the data volume. ' +
+        'Set AUTH_SECRET explicitly for multi-replica deployments; all replicas must share it.');
+    return secret;
+}
+/** Where a boot-generated setup token lives until the instance is claimed. */
+export function generatedSetupTokenPath(dataDir) {
+    return join(dataDir, 'setup-token');
+}
+/**
+ * The credential POST /api/v1/setup REQUIRES (PRDCT-1347, audit A7). The
+ * first-boot claim decides who owns the instance, so it can never be free:
+ *
+ *  - `SETUP_TOKEN` set → that is the token (setup.sh writes one);
+ *  - instance already set up → nothing to claim, no token needed (null);
+ *  - otherwise → a token is generated ONCE into `$DATA_DIR/setup-token`
+ *    (0600, atomic write, reused on every later boot until the claim) and
+ *    printed to the container log, so the `docker run` / plain
+ *    `docker compose up` paths — which never go through setup.sh — still
+ *    produce an instance claimable only with a secret. The file is removed
+ *    once setup completes (see clearGeneratedSetupToken).
+ *
+ * Optional-when-set was the hole: a minimal-env container answered the
+ * claim with 201 and no credential at all.
+ */
+export async function resolveSetupToken(envToken, dataDir, alreadySetUp, log) {
+    if (envToken)
+        return envToken;
+    if (alreadySetUp)
+        return null;
+    const tokenPath = generatedSetupTokenPath(dataDir);
+    try {
+        const existing = (await readFile(tokenPath, 'utf8')).trim();
+        if (existing.length >= 16) {
+            log.warn({ tokenPath }, `SETUP_TOKEN is not set — the setup wizard requires the token generated at first boot: ${existing}`);
+            return existing;
+        }
+        log.warn({ tokenPath }, 'existing setup-token file is too short — regenerating');
+    }
+    catch {
+        // no token file yet
+    }
+    const token = randomBytes(16).toString('hex');
+    await mkdir(dataDir, { recursive: true });
+    const tmpPath = join(dataDir, `.setup-token.${randomBytes(6).toString('hex')}.tmp`);
+    try {
+        await writeFile(tmpPath, token + '\n', { mode: 0o600 });
+        await rename(tmpPath, tokenPath);
+    }
+    catch (err) {
+        await rm(tmpPath, { force: true });
+        throw err;
+    }
+    log.warn({ tokenPath }, 'SETUP_TOKEN was not set — generated one for the first-boot setup wizard. ' +
+        `Use this token to claim the instance: ${token}  ` +
+        '(also readable inside the container at that path; set SETUP_TOKEN explicitly to choose your own)');
+    return token;
+}
+/** Best-effort removal of the generated token once the claim has succeeded. */
+export async function clearGeneratedSetupToken(dataDir) {
+    await rm(generatedSetupTokenPath(dataDir), { force: true });
+}
+//# sourceMappingURL=secret.js.map

package/dist/secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.js","sourceRoot":"","sources":["../src/secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,SAA6B,EAC7B,OAAe,EACf,GAAW;IAEX,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAEhC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,IAAI,QAAQ,CAAC,MAAM,IAAI,EAAE;YAAE,OAAO,QAAQ,CAAC;QAC3C,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,EAAE,kDAAkD,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/E,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,MAAM,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,GAAG,CAAC,IAAI,CACN,EAAE,UAAU,EAAE,EACd,gEAAgE;QAC9D,uFAAuF,CAC1F,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,OAAO,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAA4B,EAC5B,OAAe,EACf,YAAqB,EACrB,GAAW;IAEX,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,YAAY;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5D,IAAI,QAAQ,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CACN,EAAE,SAAS,EAAE,EACb,yFAAyF,QAAQ,EAAE,CACpG,CAAC;YACF,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,uDAAuD,CAAC,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,oBAAoB;IACtB,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,gBAAgB,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpF,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,OAAO,EAAE,KAAK,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,MAAM,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,GAAG,CAAC,IAAI,CACN,EAAE,SAAS,EAAE,EACb,2EAA2E;QACzE,yCAAyC,KAAK,IAAI;QAClD,kGAAkG,CACrG,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAAe;IAC5D,MAAM,EAAE,CAAC,uBAAuB,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9D,CAAC"}

package/dist/setup-transport.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Transport guard for the one-shot first-boot wizard (PLT-10).
+ *
+ * `POST /api/v1/setup` carries the owner's password and the setup token. Over
+ * plaintext HTTP to a non-loopback origin both cross the network in the clear
+ * — and this is the single request that decides who owns the instance. The
+ * documented no-domain install path used to walk operators straight into
+ * exactly that, so the server refuses instead of trusting the runbook.
+ *
+ * Loopback is fine: nothing leaves the host, which is what makes the
+ * `ssh -L` tunnel a legitimate way to finish setup on a server with no TLS
+ * yet. `https` is fine anywhere. Everything else needs the conscious
+ * `ALLOW_INSECURE_SETUP=true` opt-in.
+ */
+export declare function isSecureSetupOrigin(publicBaseUrl: string): boolean;
+/**
+ * `URL.hostname` KEEPS the brackets around an IPv6 literal (`[::1]`), so they
+ * are stripped here. IPv4 loopback is the whole 127.0.0.0/8 block, not just
+ * 127.0.0.1. Exported for the demo sign-in's host rule
+ * (identity/demo-pass-rules.ts): one loopback test for the whole server.
+ */
+export declare function isLoopbackHost(hostname: string): boolean;
+//# sourceMappingURL=setup-transport.d.ts.map

package/dist/setup-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-transport.d.ts","sourceRoot":"","sources":["../src/setup-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAWlE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAYxD"}

package/dist/setup-transport.js

@@ -0,0 +1,52 @@
+/**
+ * Transport guard for the one-shot first-boot wizard (PLT-10).
+ *
+ * `POST /api/v1/setup` carries the owner's password and the setup token. Over
+ * plaintext HTTP to a non-loopback origin both cross the network in the clear
+ * — and this is the single request that decides who owns the instance. The
+ * documented no-domain install path used to walk operators straight into
+ * exactly that, so the server refuses instead of trusting the runbook.
+ *
+ * Loopback is fine: nothing leaves the host, which is what makes the
+ * `ssh -L` tunnel a legitimate way to finish setup on a server with no TLS
+ * yet. `https` is fine anywhere. Everything else needs the conscious
+ * `ALLOW_INSECURE_SETUP=true` opt-in.
+ */
+export function isSecureSetupOrigin(publicBaseUrl) {
+    let url;
+    try {
+        url = new URL(publicBaseUrl);
+    }
+    catch {
+        // Unparseable never reaches here (the env schema validates a URL), and a
+        // guard that cannot read the origin must fail closed.
+        return false;
+    }
+    if (url.protocol === 'https:')
+        return true;
+    return isLoopbackHost(url.hostname);
+}
+/**
+ * `URL.hostname` KEEPS the brackets around an IPv6 literal (`[::1]`), so they
+ * are stripped here. IPv4 loopback is the whole 127.0.0.0/8 block, not just
+ * 127.0.0.1. Exported for the demo sign-in's host rule
+ * (identity/demo-pass-rules.ts): one loopback test for the whole server.
+ */
+export function isLoopbackHost(hostname) {
+    let host = hostname.toLowerCase();
+    if (host.startsWith('[') && host.endsWith(']'))
+        host = host.slice(1, -1);
+    if (host === 'localhost' || host.endsWith('.localhost'))
+        return true;
+    if (host === '::1' || host === '0:0:0:0:0:0:0:1')
+        return true;
+    const v4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+    if (v4) {
+        const octets = v4.slice(1).map(Number);
+        if (octets.some((o) => o > 255))
+            return false;
+        return octets[0] === 127;
+    }
+    return false;
+}
+//# sourceMappingURL=setup-transport.js.map

package/dist/setup-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-transport.js","sourceRoot":"","sources":["../src/setup-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,aAAqB;IACvD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,sDAAsD;QACtD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,IAAI,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAClC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzE,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,EAAE,GAAG,8CAA8C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrE,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9C,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}