@coffer-org/server 1.7.0 → 1.8.0

package/dist/index.js

@@ -1,11 +1,3 @@
-var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
-    if (typeof path === "string" && /^\.\.?\//.test(path)) {
-        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
-            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
-        });
-    }
-    return path;
-};
 import { randomUUID } from 'node:crypto';
 import { createWriteStream, existsSync } from 'node:fs';
 import { realpath } from 'node:fs/promises';
@@ -17,21 +9,24 @@ import cors from '@fastify/cors';
 import multipart from '@fastify/multipart';
 import fastifyStatic from '@fastify/static';
 import { serialize } from '@mikro-orm/core';
-import { textSearchKeys, recordTitle, buildZodObject } from '@coffer-org/sdk/module';
+import { textSearchKeys, recordTitle } from '@coffer-org/sdk/shelf';
 import { tokenize } from '@coffer-org/core/search';
-import { moduleTableName } from "./entity-schema.js";
+import { shelfTableName } from "./entity-schema.js";
 import { getEm, closeDb } from "./db.js";
-import { ValidationError, NotFoundError, toIssue } from "./mutate.js";
+import { ValidationError, NotFoundError } from "./mutate.js";
 import { resolveEmbed } from "./embed.js";
 import { resolveWithinHome, filterSort, listDir } from "./fs-list.js";
 import { initPlugins, teardownPlugins, readDisabled, purgePluginData, getPluginSettings, getPlugins, } from "./plugin-runtime.js";
 import { registerPluginsApi } from "./plugins-api.js";
+import { pluginHooks, HttpError } from "./plugin-hooks.js";
 import { registerAuthApi, resolveRequestUser, requireAdmin, PUBLIC_API_PATHS } from "./auth-api.js";
-import { discoverPluginAssets } from "./plugin-discovery.js";
-import { checkLatestVersion, resolveUpdateTarget, resolveAllUpdateTargets, runNpmInstall } from "./plugin-updates.js";
+import { registerMcpHttp } from "./mcp-http.js";
+import { discoverPluginAssets, discoverRuntime } from "./plugin-discovery.js";
+import { checkLatestVersion, resolveUpdateTarget, resolveAllUpdateTargets, resolveRuntimeTarget, runNpmInstall, } from "./plugin-updates.js";
 import { buildClientSchema } from "./schema-api.js";
 import { recordList, recordGet, recordCreate, recordUpdate, recordDelete, rowMatch, UnknownTypeError } from "./records-api.js";
-import { maskTree, preserveTree } from "./secrets.js";
+import { maskTree, preserveTree } from "./field-masking.js";
+import { writePluginSettings } from "./settings-write.js";
 import { rootLogger, getLogger } from "./log.js";
 import { uploadsDir } from "./uploads.js";
 const ENV_FILE = join(process.cwd(), '.env');
@@ -39,12 +34,12 @@ if (existsSync(ENV_FILE))
     process.loadEnvFile(ENV_FILE);
 const PORT = Number(process.env.PORT ?? 7023);
 const reg = await initPlugins();
-const { vaults, modules, getModule, extends_, getExtendsFor } = reg;
+const { libraries, shelves, getShelf, extends_, getExtendsFor } = reg;
 const entityNames = new Map();
-const moduleDefs = new Map();
-for (const m of modules) {
-    entityNames.set(`${m.vault}/${m.module}`, moduleTableName(m.vault, m.module));
-    moduleDefs.set(`${m.vault}/${m.module}`, m);
+const shelfDefs = new Map();
+for (const m of shelves) {
+    entityNames.set(`${m.library}/${m.shelf}`, shelfTableName(m.library, m.shelf));
+    shelfDefs.set(`${m.library}/${m.shelf}`, m);
 }
 const UPLOADS = uploadsDir();
 const app = Fastify({
@@ -72,7 +67,7 @@ app.addHook('onSend', async (req, reply, payload) => {
     return payload;
 });
 app.addHook('onRequest', async (req, reply) => {
-    const gated = req.url.startsWith('/api/') || req.url.startsWith('/uploads/');
+    const gated = req.url.startsWith('/api/') || req.url.startsWith('/uploads/') || req.url === '/mcp' || req.url.startsWith('/mcp?');
     if (!gated)
         return;
     if (PUBLIC_API_PATHS.some((p) => req.url.startsWith(p)))
@@ -100,8 +95,8 @@ app.post('/api/embed', async (req, reply) => {
         return reply.code(422).send({ error: 'unresolved' });
     return reply.send(rec);
 });
-function key(vault, type) {
-    return `${vault}/${type}`;
+function key(library, type) {
+    return `${library}/${type}`;
 }
 async function guard(reply, fn) {
     try {
@@ -125,11 +120,11 @@ app.get('/health', async (_req, reply) => {
         return reply.code(503).send({ status: 'db_unavailable' });
     }
 });
-app.get('/api/vaults', () => buildClientSchema());
+app.get('/api/libraries', () => buildClientSchema());
 app.get('/api/counts', async () => {
     const fork = getEm().fork();
     const out = {};
-    for (const [k, mdef] of moduleDefs) {
+    for (const [k, mdef] of shelfDefs) {
         if (mdef.standalone === false)
             continue;
         const ename = entityNames.get(k);
@@ -147,7 +142,7 @@ app.get('/api/search', async (req) => {
     const lim = Math.min(Number(limit) || 20, 100);
     const fork = getEm().fork();
     const scored = [];
-    for (const [k, mdef] of moduleDefs) {
+    for (const [k, mdef] of shelfDefs) {
         if (mdef.standalone === false)
             continue;
         const ename = entityNames.get(k);
@@ -155,7 +150,7 @@ app.get('/api/search', async (req) => {
             continue;
         if (!textSearchKeys(mdef).length)
             continue;
-        const [vault, type] = k.split('/');
+        const [library, type] = k.split('/');
         const rows = (await fork.find(ename, {}, { limit: 1000 })).map((r) => serialize(r));
         for (const row of rows) {
             const m = rowMatch(mdef, row, tokens);
@@ -164,7 +159,7 @@ app.get('/api/search', async (req) => {
             const label = recordTitle(mdef, row);
             scored.push({
                 score: m.score,
-                result: { vault, type, id: String(row.id), label, snippet: m.snippet },
+                result: { library, type, id: String(row.id), label, snippet: m.snippet },
             });
         }
     }
@@ -245,15 +240,28 @@ app.post('/api/plugins/update-all', async (req, reply) => {
     if (!requireAdmin(req, reply))
         return;
     const assets = await discoverPluginAssets();
-    const latestById = new Map(await Promise.all(assets.map(async (a) => [a.id, a.local ? null : await checkLatestVersion(a.packageName)])));
+    const runtime = await discoverRuntime();
+    const [latestById, runtimeLatest] = await Promise.all([
+        Promise.all(assets.map(async (a) => [a.id, a.local ? null : await checkLatestVersion(a.packageName)])).then((entries) => new Map(entries)),
+        runtime && !runtime.local ? checkLatestVersion(runtime.packageName) : Promise.resolve(null),
+    ]);
     const targets = resolveAllUpdateTargets(assets, latestById);
-    if (targets.length === 0)
+    const runtimeTarget = resolveRuntimeTarget(runtime, runtimeLatest);
+    const specs = [
+        ...targets.map((t) => `${t.packageName}@${t.to}`),
+        ...(runtimeTarget ? [`${runtimeTarget.packageName}@${runtimeTarget.to}`] : []),
+    ];
+    if (specs.length === 0)
         return reply.code(400).send({ error: 'no_update_available' });
-    const result = await runNpmInstall(targets.map((t) => `${t.packageName}@${t.to}`), process.cwd());
+    const result = await runNpmInstall(specs, process.cwd());
     if (!result.ok) {
         return reply.code(500).send({ error: 'install_failed', stderr: result.stderr });
     }
-    reply.send({ ok: true, updated: targets.map(({ id, from, to }) => ({ id, from, to })) });
+    const updated = [
+        ...targets.map(({ id, from, to }) => ({ id, from, to })),
+        ...(runtimeTarget ? [{ id: 'runtime', from: runtimeTarget.from, to: runtimeTarget.to }] : []),
+    ];
+    reply.send({ ok: true, updated });
     setTimeout(() => process.exit(0), 500);
 });
 app.get('/api/plugins/:id/settings', async (req, reply) => {
@@ -278,123 +286,27 @@ app.put('/api/plugins/:id/settings', (req, reply) => {
         if (!p || !p.settings || p.settings.fields.length === 0) {
             return reply.code(404).send({ error: 'no_settings' });
         }
-        const syntheticMod = {
-            vault: '_settings',
-            module: id,
-            label: `${id}.plugin.label`,
-            fields: p.settings.fields,
-        };
-        const existing = await getPluginSettings(id);
-        const body = preserveTree(p.settings.fields, (req.body ?? {}), existing);
-        const parsed = buildZodObject(syntheticMod).safeParse(body);
-        if (!parsed.success) {
-            throw new ValidationError(parsed.error.issues.map(toIssue));
-        }
-        const entityName = `_settings__${id}`;
-        const row = { plugin_id: id, ...parsed.data };
-        await getEm()
-            .fork()
-            .upsert(entityName, row);
-        return { ok: true, row: maskTree(p.settings.fields, row) };
+        const row = await writePluginSettings(getEm().fork(), id, (req.body ?? {}), req.user.login, plugins);
+        return { ok: true, row };
     });
 });
-app.post('/api/plugins/finance/test', async (req, reply) => {
-    if (!requireAdmin(req, reply))
-        return;
-    const settings = await getPluginSettings('finance');
-    const url = settings['firefly_url'];
-    const token = settings['token'];
-    if (!url || !token) {
-        return reply.code(400).send({ error: 'Finance settings not configured. Save them first.' });
-    }
-    const finRuntime = '@coffer-org/plugin-finance/runtime';
-    const { checkFireflyConnection } = (await import(__rewriteRelativeImportExtension(finRuntime)));
-    const result = await checkFireflyConnection(url, token);
-    if (result.ok)
-        return { ok: true };
-    return reply.code(400).send({ error: result.error });
-});
-app.post('/api/plugins/finance/sync', async (req, reply) => {
-    if (!requireAdmin(req, reply))
-        return;
-    const finRuntime = '@coffer-org/plugin-finance/runtime';
-    const { runSync } = (await import(__rewriteRelativeImportExtension(finRuntime)));
-    try {
-        const counts = await runSync();
-        return { ok: true, ...counts };
-    }
-    catch (e) {
-        return reply.code(400).send({ error: e.message });
-    }
-});
-app.post('/api/plugins/finance/import-wise', async (req, reply) => {
-    if (!requireAdmin(req, reply))
-        return;
-    const finRuntime = '@coffer-org/plugin-finance/runtime';
-    const { importWise } = (await import(__rewriteRelativeImportExtension(finRuntime)));
-    try {
-        return await importWise();
-    }
-    catch (e) {
-        return reply.code(400).send({ error: e.message });
-    }
-});
-app.post('/api/plugins/devices/scan', async (req, reply) => {
+app.post('/api/plugins/:id/:action', async (req, reply) => {
     if (!requireAdmin(req, reply))
         return;
-    const devRuntime = '@coffer-org/plugin-devices/runtime';
-    const { runScan } = (await import(__rewriteRelativeImportExtension(devRuntime)));
+    const { id, action } = req.params;
+    const fn = pluginHooks[id]?.actions?.[action];
+    if (!fn)
+        return reply.code(404).send({ error: `unknown action ${id}/${action}` });
     try {
-        const result = await runScan({ create: true });
-        return { ok: true, result };
+        return await fn((req.body ?? {}));
     }
     catch (e) {
         if (e instanceof ValidationError) {
             const detail = e.issues.map((i) => `${i.path.join('.') || i.field}: ${i.code}`).join('; ');
-            return reply.code(422).send({ error: `Validation error during scan — ${detail}`, issues: e.issues });
+            return reply.code(422).send({ error: `Validation error — ${detail}`, issues: e.issues });
         }
-        return reply.code(409).send({ error: e.message });
-    }
-});
-app.post('/api/plugins/media/test', async (req, reply) => {
-    if (!requireAdmin(req, reply))
-        return;
-    const settings = await getPluginSettings('media');
-    const url = settings['jellyfin_url'];
-    const token = settings['jellyfin_token'];
-    if (!url || !token) {
-        return reply.code(400).send({ error: 'Jellyfin settings not configured. Save them first.' });
-    }
-    const mediaRuntime = '@coffer-org/plugin-media/runtime';
-    const { testConnection } = (await import(__rewriteRelativeImportExtension(mediaRuntime)));
-    const result = await testConnection(url, token);
-    if (result.ok)
-        return { ok: true };
-    return reply.code(400).send({ error: result.error });
-});
-app.post('/api/plugins/media/sync', async (req, reply) => {
-    if (!requireAdmin(req, reply))
-        return;
-    const mediaRuntime = '@coffer-org/plugin-media/runtime';
-    const { runJellyfinSync } = (await import(__rewriteRelativeImportExtension(mediaRuntime)));
-    try {
-        const counts = await runJellyfinSync();
-        return { ok: true, ...counts };
-    }
-    catch (e) {
-        return reply.code(400).send({ error: e.message });
-    }
-});
-app.post('/api/plugins/media/add', async (req, reply) => {
-    if (!requireAdmin(req, reply))
-        return;
-    const { query, tmdb_id, kind } = (req.body ?? {});
-    const mediaRuntime = '@coffer-org/plugin-media/runtime';
-    const { addTitle } = (await import(__rewriteRelativeImportExtension(mediaRuntime)));
-    try {
-        return await addTitle(query, tmdb_id, kind);
-    }
-    catch (e) {
+        if (e instanceof HttpError)
+            return reply.code(e.status).send({ error: e.message });
         return reply.code(400).send({ error: e.message });
     }
 });
@@ -421,12 +333,12 @@ app.get('/api/fs/list', async (req, reply) => {
         return { dir: abs, entries: [] };
     }
 });
-function maskRecordRow(vault, type, row) {
-    const m = getModule(vault, type);
+function maskRecordRow(library, type, row) {
+    const m = getShelf(library, type);
     let out = m ? maskTree(m.fields, row) : row;
     const ext = out._extends;
     if (ext) {
-        const defs = getExtendsFor(vault, type);
+        const defs = getExtendsFor(library, type);
         const maskedExt = {};
         for (const [id, sub] of Object.entries(ext)) {
             const def = defs.find((e) => e.id === id);
@@ -436,12 +348,12 @@ function maskRecordRow(vault, type, row) {
     }
     return out;
 }
-app.get('/api/:vault/:type', async (req, reply) => {
-    const { vault, type } = req.params;
+app.get('/api/:library/:type', async (req, reply) => {
+    const { library, type } = req.params;
     const query = req.query;
     try {
-        const rows = await recordList(vault, type, query);
-        return rows.map((r) => maskRecordRow(vault, type, r));
+        const rows = await recordList(library, type, query);
+        return rows.map((r) => maskRecordRow(library, type, r));
     }
     catch (e) {
         if (e instanceof UnknownTypeError)
@@ -449,16 +361,16 @@ app.get('/api/:vault/:type', async (req, reply) => {
         throw e;
     }
 });
-app.get('/api/:vault/:type/:id', async (req, reply) => {
-    const { vault, type, id } = req.params;
+app.get('/api/:library/:type/:id', async (req, reply) => {
+    const { library, type, id } = req.params;
     const rid = Number(id);
     if (isNaN(rid))
         return reply.code(400).send({ error: 'invalid_id' });
     try {
-        const row = await recordGet(vault, type, rid);
+        const row = await recordGet(library, type, rid);
         if (!row)
             return reply.code(404).send({ error: 'not_found' });
-        return maskRecordRow(vault, type, row);
+        return maskRecordRow(library, type, row);
     }
     catch (e) {
         if (e instanceof UnknownTypeError)
@@ -466,15 +378,15 @@ app.get('/api/:vault/:type/:id', async (req, reply) => {
         throw e;
     }
 });
-app.post('/api/:vault/:type', (req, reply) => guard(reply, async () => {
-    const { vault, type } = req.params;
+app.post('/api/:library/:type', (req, reply) => guard(reply, async () => {
+    const { library, type } = req.params;
     try {
-        const m = getModule(vault, type);
+        const m = getShelf(library, type);
         let body = (req.body ?? {});
         if (m)
             body = preserveTree(m.fields, body, {});
-        const row = await recordCreate(vault, type, body);
-        return reply.code(201).send(maskRecordRow(vault, type, row));
+        const row = await recordCreate(library, type, body);
+        return reply.code(201).send(maskRecordRow(library, type, row));
     }
     catch (e) {
         if (e instanceof UnknownTypeError)
@@ -482,18 +394,18 @@ app.post('/api/:vault/:type', (req, reply) => guard(reply, async () => {
         throw e;
     }
 }));
-app.patch('/api/:vault/:type/:id', (req, reply) => guard(reply, async () => {
-    const { vault, type, id } = req.params;
+app.patch('/api/:library/:type/:id', (req, reply) => guard(reply, async () => {
+    const { library, type, id } = req.params;
     const rid = Number(id);
     if (isNaN(rid))
         return reply.code(400).send({ error: 'invalid_id' });
     try {
-        const m = getModule(vault, type);
+        const m = getShelf(library, type);
         let body = (req.body ?? {});
         if (m) {
-            const existing = (await recordGet(vault, type, rid)) ?? {};
+            const existing = (await recordGet(library, type, rid)) ?? {};
             body = preserveTree(m.fields, body, existing);
-            const exDefs = getExtendsFor(vault, type);
+            const exDefs = getExtendsFor(library, type);
             const exRecs = (existing._extends ?? {});
             for (const def of exDefs) {
                 const bk = `_extend_${def.id}`;
@@ -503,8 +415,8 @@ app.patch('/api/:vault/:type/:id', (req, reply) => guard(reply, async () => {
                 }
             }
         }
-        const row = await recordUpdate(vault, type, rid, body);
-        return maskRecordRow(vault, type, row);
+        const row = await recordUpdate(library, type, rid, body);
+        return maskRecordRow(library, type, row);
     }
     catch (e) {
         if (e instanceof UnknownTypeError)
@@ -512,13 +424,13 @@ app.patch('/api/:vault/:type/:id', (req, reply) => guard(reply, async () => {
         throw e;
     }
 }));
-app.delete('/api/:vault/:type/:id', (req, reply) => guard(reply, async () => {
-    const { vault, type, id } = req.params;
+app.delete('/api/:library/:type/:id', (req, reply) => guard(reply, async () => {
+    const { library, type, id } = req.params;
     const rid = Number(id);
     if (isNaN(rid))
         return reply.code(400).send({ error: 'invalid_id' });
     try {
-        await recordDelete(vault, type, rid);
+        await recordDelete(library, type, rid);
         return reply.code(204).send();
     }
     catch (e) {
@@ -528,6 +440,7 @@ app.delete('/api/:vault/:type/:id', (req, reply) => guard(reply, async () => {
     }
 }));
 await registerAuthApi(app);
+await registerMcpHttp(app);
 await registerPluginsApi(app);
 const WEB_DIST = process.env.WEB_DIST;
 if (WEB_DIST && existsSync(join(WEB_DIST, 'index.html'))) {
@@ -549,7 +462,7 @@ if (WEB_DIST && existsSync(join(WEB_DIST, 'index.html'))) {
 }
 app
     .listen({ port: PORT, host: '0.0.0.0' })
-    .then(() => app.log.info(`vault-server :${PORT}`))
+    .then(() => app.log.info(`library-server :${PORT}`))
     .catch((e) => {
     app.log.error(e);
     process.exit(1);

package/dist/local-api.d.ts

@@ -1,5 +1,5 @@
 import { UnknownTypeError } from './records-api.ts';
 export { UnknownTypeError };
-export declare function localExists(vault: string, type: string, id: number): Promise<boolean>;
-export declare function localPost(vault: string, type: string, body: unknown): Promise<Record<string, unknown>>;
-export declare function localPatch(vault: string, type: string, id: number, body: unknown): Promise<Record<string, unknown>>;
+export declare function localExists(library: string, type: string, id: number): Promise<boolean>;
+export declare function localPost(library: string, type: string, body: unknown): Promise<Record<string, unknown>>;
+export declare function localPatch(library: string, type: string, id: number, body: unknown): Promise<Record<string, unknown>>;

package/dist/local-api.js

@@ -1,8 +1,8 @@
 import { recordCreate, recordUpdate, recordGet, UnknownTypeError } from "./records-api.js";
 export { UnknownTypeError };
-export async function localExists(vault, type, id) {
+export async function localExists(library, type, id) {
     try {
-        return Boolean(await recordGet(vault, type, id));
+        return Boolean(await recordGet(library, type, id));
     }
     catch (e) {
         if (e instanceof UnknownTypeError)
@@ -10,9 +10,9 @@ export async function localExists(vault, type, id) {
         throw e;
     }
 }
-export function localPost(vault, type, body) {
-    return recordCreate(vault, type, body, 'import');
+export function localPost(library, type, body) {
+    return recordCreate(library, type, body, 'import');
 }
-export function localPatch(vault, type, id, body) {
-    return recordUpdate(vault, type, id, body, 'import');
+export function localPatch(library, type, id, body) {
+    return recordUpdate(library, type, id, body, 'import');
 }

package/dist/mcp-http.d.ts

@@ -0,0 +1,5 @@
+import type { FastifyInstance } from 'fastify';
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { AuthRole } from './plugin-hooks.ts';
+export declare function buildMcpServer(role: AuthRole, actor: string): Promise<McpServer>;
+export declare function registerMcpHttp(app: FastifyInstance): Promise<void>;

package/dist/mcp-http.js

@@ -0,0 +1,37 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { collectMcpTools, resolveRagDeps, buildDomainSections, buildMcpInstructions } from "./mcp-tools.js";
+import { getLogger } from "./log.js";
+const log = getLogger('mcp-http');
+export async function buildMcpServer(role, actor) {
+    const rag = await resolveRagDeps();
+    const tools = (await collectMcpTools({ rag, includeAdmin: role === 'admin', actor })).filter((t) => role === 'admin' || t.role === 'member');
+    const sections = await buildDomainSections();
+    const server = new McpServer({ name: 'coffer', version: '1.0.0' }, { instructions: buildMcpInstructions(sections) });
+    const registerTool = server.registerTool.bind(server);
+    for (const t of tools) {
+        registerTool(t.httpName, { description: t.description, inputSchema: t.inputSchema }, async (args) => t.handler(args));
+    }
+    return server;
+}
+export async function registerMcpHttp(app) {
+    app.all('/mcp', async (req, reply) => {
+        const role = req.user.role;
+        const actor = req.user.login;
+        const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+        reply.hijack();
+        reply.raw.on('close', () => void transport.close());
+        try {
+            const server = await buildMcpServer(role, actor);
+            await server.connect(transport);
+            await transport.handleRequest(req.raw, reply.raw, req.body);
+        }
+        catch (e) {
+            log.error(`/mcp handler error: ${e.message}`);
+            if (!reply.raw.headersSent) {
+                reply.raw.writeHead(500, { 'content-type': 'application/json' });
+                reply.raw.end(JSON.stringify({ jsonrpc: '2.0', error: { code: -32603, message: 'internal' }, id: null }));
+            }
+        }
+    });
+}

package/dist/mcp-http.test-helpers.d.ts

@@ -0,0 +1,17 @@
+import { type FastifyInstance } from 'fastify';
+import { closeDb } from './db.ts';
+export declare function freshMcpApp(opts?: {
+    withAdminTool?: boolean;
+    withInstructions?: boolean;
+}): Promise<FastifyInstance>;
+export declare function adminToken(): Promise<string>;
+export declare function memberToken(): Promise<string>;
+export declare function parseRpcResult(res: {
+    body: string;
+    headers: Record<string, unknown>;
+}): Record<string, unknown> | undefined;
+export declare function parseToolNames(res: {
+    body: string;
+    headers: Record<string, unknown>;
+}): string[];
+export { closeDb };

package/dist/mcp-http.test-helpers.js

@@ -0,0 +1,117 @@
+import Fastify from 'fastify';
+import { initDb, closeDb } from "./db.js";
+import { systemEntities } from "./entity-schema.js";
+import { registerAuthApi, resolveRequestUser, PUBLIC_API_PATHS } from "./auth-api.js";
+import { registerMcpHttp } from "./mcp-http.js";
+import { createUser, createApiToken } from "./auth-store.js";
+import { pluginHooks } from "./plugin-hooks.js";
+let currentAdminToken;
+let currentMemberToken;
+export async function freshMcpApp(opts = {}) {
+    process.env['DB_PATH'] = ':memory:';
+    const orm = await initDb(systemEntities);
+    await orm.schema.update({ safe: false, dropTables: false });
+    const app = Fastify();
+    app.addHook('onRequest', async (req, reply) => {
+        const gated = req.url.startsWith('/api/') || req.url.startsWith('/uploads/') || req.url === '/mcp' || req.url.startsWith('/mcp?');
+        if (!gated)
+            return;
+        if (PUBLIC_API_PATHS.some((p) => req.url.startsWith(p)))
+            return;
+        const user = await resolveRequestUser(req);
+        if (!user)
+            return reply.code(401).send({ error: 'unauthorized' });
+        req.user = user;
+    });
+    await registerAuthApi(app);
+    await registerMcpHttp(app);
+    const admin = await createUser({ login: 'admin', password: 'hunter2', displayName: 'Admin', role: 'admin' });
+    const member = await createUser({ login: 'member', password: 'hunter2', displayName: 'Member', role: 'member' });
+    currentAdminToken = `admin-raw-token-${Math.random().toString(36).slice(2)}`;
+    currentMemberToken = `member-raw-token-${Math.random().toString(36).slice(2)}`;
+    await createApiToken(admin.id, 'admin-token', currentAdminToken);
+    await createApiToken(member.id, 'member-token', currentMemberToken);
+    if (opts.withAdminTool || opts.withInstructions) {
+        pluginHooks['demo'] = {
+            agent: {
+                ...(opts.withInstructions ? { instructions: 'Demo library — widgets.' } : {}),
+                ...(opts.withAdminTool
+                    ? { tools: [{ name: 'danger', description: 'd', inputSchema: {}, role: 'admin', handler: () => 1 }] }
+                    : {}),
+            },
+        };
+    }
+    const origClose = app.close.bind(app);
+    app.close = ((...args) => {
+        delete pluginHooks['demo'];
+        return origClose(...args);
+    });
+    return app;
+}
+export async function adminToken() {
+    if (!currentAdminToken)
+        throw new Error('adminToken() called before freshMcpApp()');
+    return currentAdminToken;
+}
+export async function memberToken() {
+    if (!currentMemberToken)
+        throw new Error('memberToken() called before freshMcpApp()');
+    return currentMemberToken;
+}
+export function parseRpcResult(res) {
+    const contentType = String(res.headers['content-type'] ?? '');
+    const raw = [];
+    if (contentType.includes('text/event-stream')) {
+        for (const line of res.body.split('\n')) {
+            const trimmed = line.trim();
+            if (trimmed.startsWith('data:'))
+                raw.push(trimmed.slice('data:'.length).trim());
+        }
+    }
+    else {
+        raw.push(res.body);
+    }
+    for (const s of raw) {
+        if (!s)
+            continue;
+        try {
+            const parsed = JSON.parse(s);
+            const msg = (Array.isArray(parsed) ? parsed : [parsed]).find((m) => m.result);
+            if (msg?.result)
+                return msg.result;
+        }
+        catch {
+        }
+    }
+    return undefined;
+}
+export function parseToolNames(res) {
+    const contentType = String(res.headers['content-type'] ?? '');
+    const messages = [];
+    if (contentType.includes('text/event-stream')) {
+        for (const line of res.body.split('\n')) {
+            const trimmed = line.trim();
+            if (!trimmed.startsWith('data:'))
+                continue;
+            const jsonStr = trimmed.slice('data:'.length).trim();
+            if (!jsonStr)
+                continue;
+            try {
+                messages.push(JSON.parse(jsonStr));
+            }
+            catch {
+            }
+        }
+    }
+    else {
+        try {
+            const parsed = JSON.parse(res.body);
+            messages.push(...(Array.isArray(parsed) ? parsed : [parsed]));
+        }
+        catch {
+        }
+    }
+    const withTools = messages.find((m) => m.result?.tools);
+    return (withTools?.result?.tools ?? []).map((t) => t.name);
+}
+export { closeDb };

package/dist/mcp-local.d.ts

@@ -0,0 +1,10 @@
+import type { CofferClientApi } from '@coffer-org/mcp/client';
+export declare function mapError(e: unknown): never;
+export declare class LocalClient implements CofferClientApi {
+    getSchema(): Promise<unknown>;
+    listRecords(library: string, type: string, query?: Record<string, unknown>): Promise<unknown>;
+    getRecord(library: string, type: string, id: number): Promise<unknown>;
+    createRecord(library: string, type: string, fields: Record<string, unknown>): Promise<unknown>;
+    updateRecord(library: string, type: string, id: number, fields: Record<string, unknown>): Promise<unknown>;
+    deleteRecord(library: string, type: string, id: number): Promise<unknown>;
+}