@aotter/mantle 0.1.3 → 0.1.5-alpha.1

package/skills/update/SKILL.md

@@ -3,9 +3,9 @@ name: update
 description: Review and upgrade Mantle SDK dependencies and project-local skills while preserving application source, provider identities and plugin lockfiles.
 metadata:
   source: "@aotter/mantle"
-  sourcePath: skills/update/SKILL.md
+  sourcePath: docs/skills/update/SKILL.md
   applies_to: mantle grammar v0.1
-  projection: project, plugin
+  projection: project
 ---
 
 # Mantle Update

package/templates/chatgpt-sites/auth.ts

@@ -0,0 +1,66 @@
+import type { AdminAuth, AdminStaffUser, StaffRole } from '@aotter/mantle/admin';
+
+export interface Env { DB: D1Database; ASSETS?: Fetcher; PUBLIC_ORIGIN: string; OWNER_EMAIL?: string }
+type UserRow = { id: string; email: string; name: string; role: StaffRole | null; created_at: string; signed_in: number };
+const project = (row: UserRow): AdminStaffUser => ({ id:row.id,email:row.email,name:row.name,role:row.role,githubLogin:null,emailVerified:!!row.signed_in,createdAt:new Date(row.created_at) });
+
+// This adapter must only receive requests through Sites' identity-stripping dispatcher.
+// Never expose the Worker independently with caller-controlled oai-* headers.
+export function readIdentity(request: Request) {
+  const sub=request.headers.get('oai-authenticated-user-id');
+  const email=request.headers.get('oai-authenticated-user-email')?.trim().toLowerCase();
+  if(!sub || !email || sub.length>512 || email.length>320) return null;
+  let name=email;
+  if(request.headers.get('oai-authenticated-user-full-name-encoding')==='percent-encoded-utf-8') {
+    try { name=decodeURIComponent(request.headers.get('oai-authenticated-user-full-name')||'')||email; } catch {}
+  }
+  return {id:`chatgpt:${sub}`,email,name};
+}
+
+export function createChatGPTAuth(env: Env): AdminAuth {
+  const db=env.DB;
+  const roleFor=async(id:string)=>(await db.prepare('SELECT role FROM sites_users WHERE id = ?').bind(id).first<{role:StaffRole|null}>())?.role??null;
+  const auth: AdminAuth = {
+    basePath:'/api/auth', methods:[],
+    async getSession(request) {
+      const who=readIdentity(request); if(!who)return null;
+      let row=await db.prepare('SELECT * FROM sites_users WHERE id=?').bind(who.id).first<UserRow>();
+      if(!row){
+        // Claim an invitation before inserting; a stable identity keeps its existing role if its email later changes.
+        await db.prepare('UPDATE sites_users SET id=?,name=?,signed_in=1 WHERE email=? AND signed_in=0').bind(who.id,who.name,who.email).run();
+        await db.prepare('INSERT OR IGNORE INTO sites_users (id,email,name,role,signed_in) VALUES (?,?,?,?,1)')
+          .bind(who.id,who.email,who.name,who.email===env.OWNER_EMAIL?.trim().toLowerCase()?'owner':null).run();
+        row=await db.prepare('SELECT * FROM sites_users WHERE id=?').bind(who.id).first<UserRow>();
+      }
+      if(!row)return null;
+      return {session:{id:`sites:${who.id}`},user:{id:row.id,email:row.email,name:row.name,role:row.role,roleCurrent:true}};
+    },
+    getUserRole:roleFor,
+    async handler(request) {
+      const path=new URL(request.url).pathname;
+      if(path==='/api/auth/get-session' && request.method==='GET') return Response.json(await auth.getSession(request));
+      if(path==='/api/auth/sign-out' && request.method==='POST') {
+        if(request.headers.get('origin')!==env.PUBLIC_ORIGIN)return new Response('Forbidden',{status:403});
+        // The shipped Admin UI navigates here after its POST; the next top-level request signs out at Sites.
+        return Response.json({success:true},{headers:{'set-cookie':'mantle-sites-signout=1; Path=/admin/sign-in; HttpOnly; SameSite=Strict; Max-Age=60'+(env.PUBLIC_ORIGIN.startsWith('https:')?'; Secure':'')}});
+      }
+      return Response.json({error:'unsupported_auth_route'},{status:404});
+    },
+    async listUsers(){const r=await db.prepare('SELECT * FROM sites_users WHERE role IS NOT NULL ORDER BY created_at,id').all<UserRow>();return r.results.map(project);},
+    async listMembers(args){
+      // ponytail: one bounded page for this integration lab; add cursor pagination before a large member rollout.
+      const r=await db.prepare('SELECT * FROM sites_users WHERE role IS NULL AND (email LIKE ? OR name LIKE ?) ORDER BY created_at,id LIMIT ?').bind(`%${args.search||''}%`,`%${args.search||''}%`,Math.min(args.limit,100)).all<UserRow>();
+      return {items:r.results.map(project),previousCursor:null,nextCursor:null};
+    },
+    async setUserRole(id,role){if(role!==null&&!['owner','editor','contributor'].includes(role))throw new Error('Invalid role');return !!(await db.prepare('UPDATE sites_users SET role=? WHERE id=?').bind(role,id).run()).meta.changes;},
+    async inviteUser(email,role){
+      const normalized=email.trim().toLowerCase();const id=`invite:${crypto.randomUUID()}`;
+      const r=await db.prepare('INSERT OR IGNORE INTO sites_users (id,email,name,role,signed_in) VALUES (?,?,?,?,0)').bind(id,normalized,normalized,role).run();
+      if(r.meta.changes)return {kind:'created',id};
+      const existing=await db.prepare('SELECT id FROM sites_users WHERE email=?').bind(normalized).first<{id:string}>();
+      if(!existing)throw new Error('Invitation could not be saved');return {kind:'exists',id:existing.id};
+    },
+    async revokeInvite(id){return !!(await db.prepare('DELETE FROM sites_users WHERE id=? AND signed_in=0').bind(id).run()).meta.changes;},
+  };
+  return auth;
+}

package/templates/chatgpt-sites/build.mjs

@@ -0,0 +1,14 @@
+import { build } from 'esbuild';
+import { cp, mkdir, rm } from 'node:fs/promises';
+import { execFileSync } from 'node:child_process';
+
+execFileSync('node', ['node_modules/@aotter/mantle/dist/cli/main.js', 'generate', '--check'], { stdio: 'inherit' });
+execFileSync('node', ['node_modules/typescript/bin/tsc', '--noEmit'], { stdio: 'inherit' });
+await rm('dist', { recursive: true, force: true });
+await mkdir('dist/server', { recursive: true });
+await build({ entryPoints: ['src/index.ts'], outfile: 'dist/server/index.js', bundle: true, format: 'esm', platform: 'browser', conditions: ['workerd'], target: 'es2022', external: ['cloudflare:*', 'node:*'] });
+await mkdir('dist/client', { recursive: true });
+await cp('public', 'dist/client', { recursive: true, force: true }).catch(error => { if (error.code !== 'ENOENT') throw error; });
+await mkdir('dist/.openai', { recursive: true });
+await cp('.openai/hosting.json', 'dist/.openai/hosting.json');
+await cp('drizzle', 'dist/.openai/drizzle', { recursive: true });

package/templates/chatgpt-sites/env.ts

@@ -0,0 +1 @@
+export interface Env { DB: D1Database; PUBLIC_ORIGIN: string; ASSETS?: Fetcher }

package/templates/chatgpt-sites/mcp.ts

@@ -0,0 +1,48 @@
+import type { Hono } from 'hono';
+import type { AdminAuth, MantleAdminRuntime, StaffRole } from '@aotter/mantle/admin';
+import { McpJsonRpcDispatcher, projectCallableCapabilities, type RuntimePlan } from '@aotter/mantle/runtime';
+import type { Env } from './sites-auth';
+
+const staffRoles=new Set<string>(['owner','editor','contributor']);
+
+/** Sites-session MCP surfaces. Remote clients still need a separate OAuth bearer flow. */
+export function mountMcp(app:Hono<{Bindings:Env}>, get:()=>Promise<MantleAdminRuntime>, auth:AdminAuth, plan:RuntimePlan) {
+  const cache=new WeakMap<object,Map<'public'|'staff',McpJsonRpcDispatcher>>();
+  const dispatcher=async(surface:'public'|'staff',origin:string)=>{
+    const runtime=await get();
+    let dispatchers=cache.get(runtime);
+    if(!dispatchers)cache.set(runtime,dispatchers=new Map());
+    let value=dispatchers.get(surface);
+    if(!value) {
+      value=new McpJsonRpcDispatcher({
+        getEntry:runtime.getEntry,
+        createDraft:runtime.createDraft,
+        updateDraft:runtime.updateDraft,
+        requestPublish:runtime.requestPublish,
+        unpublish:runtime.unpublish,
+        archive:runtime.archive,
+        deleteEntry:runtime.deleteEntry,
+        executeView:{execute:request=>runtime.executeView({...request,view:request.view.metadata.name})},
+        invokeTrigger:{execute:request=>runtime.invokeTrigger(request)},
+      },[...runtime.schemas.values()],{
+        surface,
+        capabilities:projectCallableCapabilities(plan,{surface}),
+        serverInfo:{name:`aotter.mantle.${surface}`,title:`Mantle ${surface}`,websiteUrl:origin},
+      });
+      dispatchers.set(surface,value);
+    }
+    return value;
+  };
+  app.all('/api/mcp',async c=>(await dispatcher('public',c.env.PUBLIC_ORIGIN)).dispatch(c.req.raw,{user:null,staff:null,env:c.env,waitUntil:p=>c.executionCtx.waitUntil(p)}));
+  app.all('/api/mcp/staff',async c=>{
+    const session=await auth.getSession(c.req.raw);
+    if(!session)return Response.json({error:'unauthorized'},{status:401});
+    const role=session.user.roleCurrent?session.user.role:await auth.getUserRole(session.user.id);
+    if(!role||!staffRoles.has(role))return Response.json({error:'forbidden'},{status:403});
+    return (await dispatcher('staff',c.env.PUBLIC_ORIGIN)).dispatch(c.req.raw,{
+      user:{id:session.user.id},staff:{id:session.user.id,role:role as StaffRole},
+      auth:{credential:'session',credentialId:session.session.id,clientId:null,scopes:[]},
+      env:c.env,waitUntil:p=>c.executionCtx.waitUntil(p),
+    });
+  });
+}

package/templates/chatgpt-sites/public-mcp.ts

@@ -0,0 +1,29 @@
+import type { Hono } from 'hono';
+import { McpJsonRpcDispatcher, projectCallableCapabilities, type MantleRuntime, type RuntimePlan } from '@aotter/mantle/runtime';
+import type { Env } from './sites-env';
+
+export function mountPublicMcp(app:Hono<{Bindings:Env}>,get:()=>Promise<MantleRuntime>,plan:RuntimePlan) {
+  let current:MantleRuntime|undefined;
+  let dispatcher:McpJsonRpcDispatcher|undefined;
+  app.all('/api/mcp',async c=>{
+    const runtime=await get();
+    if(current!==runtime){
+      current=runtime;
+      dispatcher=new McpJsonRpcDispatcher({
+        getEntry:runtime.getEntry,
+        createDraft:runtime.createDraft,
+        updateDraft:runtime.updateDraft,
+        requestPublish:runtime.requestPublish,
+        unpublish:runtime.unpublish,
+        archive:runtime.archive,
+        deleteEntry:runtime.deleteEntry,
+        executeView:{execute:request=>runtime.executeView({...request,view:request.view.metadata.name})},
+        invokeTrigger:{execute:request=>runtime.invokeTrigger(request)},
+      },[...runtime.schemas.values()],{
+        surface:'public',capabilities:projectCallableCapabilities(plan,{surface:'public'}),
+        serverInfo:{name:'aotter.mantle.public',title:'Mantle public',websiteUrl:c.env.PUBLIC_ORIGIN},
+      });
+    }
+    return dispatcher!.dispatch(c.req.raw,{user:null,staff:null,env:c.env,waitUntil:p=>c.executionCtx.waitUntil(p)});
+  });
+}

package/templates/chatgpt-sites/smoke-local.mjs

@@ -0,0 +1,20 @@
+import assert from 'node:assert/strict';
+
+const origin=process.env.MANTLE_TEST_ORIGIN??'http://127.0.0.1:4174';
+const url=new URL(origin);
+assert.equal(url.protocol,'http:','Identity simulation requires loopback HTTP');
+assert.ok(['localhost','127.0.0.1','[::1]'].includes(url.hostname),'Identity simulation is loopback-only');
+const email=process.env.MANTLE_TEST_OWNER_EMAIL;
+assert.ok(email,'Set MANTLE_TEST_OWNER_EMAIL to the locally configured owner');
+const owner={'oai-authenticated-user-id':'mantle-local-owner','oai-authenticated-user-email':email};
+const stranger={'oai-authenticated-user-id':'mantle-local-stranger','oai-authenticated-user-email':'stranger@example.test'};
+const call=(path,headers={})=>fetch(new URL(path,url),{headers,redirect:'manual'});
+assert.equal((await call('/')).status,200);
+assert.equal((await call('/admin/api/me')).status,401);
+assert.equal((await call('/admin/api/me',stranger)).status,403);
+assert.equal((await call('/admin/api/me',owner)).status,200);
+const mcp=(path,headers={})=>fetch(new URL(path,url),{method:'POST',headers:{...headers,'content-type':'application/json','mcp-protocol-version':'2025-11-25'},body:JSON.stringify({jsonrpc:'2.0',id:1,method:'initialize'})});
+assert.equal((await mcp('/api/mcp')).status,200);
+assert.equal((await mcp('/api/mcp/staff')).status,401);
+assert.equal((await mcp('/api/mcp/staff',owner)).status,200);
+console.log('Local Sites identity simulation passed; this does not verify deployed ChatGPT sign-in.');