@cyberismo/backend 0.0.23 → 0.0.25

package/src/export.ts

@@ -18,6 +18,7 @@ import fs, { readFile } from 'node:fs/promises';
 import type { CommandManager } from '@cyberismo/data-handler';
 import { createApp } from './app.js';
 import { MockAuthProvider } from './auth/mock.js';
+import type { ProjectRegistry } from './project-registry.js';
 import { cp, writeFile } from 'node:fs/promises';
 import { staticFrontendDirRelative } from './utils.js';
 import type { QueryResult } from '@cyberismo/data-handler/types/queries';
@@ -28,7 +29,11 @@ import {
   findRelevantAttachments,
 } from './domain/cards/service.js';
 
-let _cardQueryPromise: Promise<QueryResult<'card'>[]> | null = null;
+export interface ExportSiteOptions extends TreeOptions {
+  defaultProject?: string;
+}
+
+const _cardQueryCache = new Map<string, Promise<QueryResult<'card'>[]>>();
 const OVERHEAD_CALLS = 6; // estimated number of overhead calls during export in addition to card exports
 
 /**
@@ -36,7 +41,7 @@ const OVERHEAD_CALLS = 6; // estimated number of overhead calls during export in
  * Also resets the card query promise.
  */
 export function reset() {
-  _cardQueryPromise = null;
+  _cardQueryCache.clear();
 }
 
 /**
@@ -50,15 +55,14 @@ export async function getCardQueryResult(
   commands: CommandManager,
   cardKey?: string,
 ): Promise<QueryResult<'card'>[]> {
-  if (!_cardQueryPromise) {
-    // fetch all cards
-    _cardQueryPromise = commands.calculateCmd.runQuery(
-      'card',
-      'exportedSite',
-      {},
+  const prefix = commands.project.configuration.cardKeyPrefix;
+  if (!_cardQueryCache.has(prefix)) {
+    _cardQueryCache.set(
+      prefix,
+      commands.calculateCmd.runQuery('card', 'exportedSite', {}),
     );
   }
-  return _cardQueryPromise.then((results) => {
+  return _cardQueryCache.get(prefix)!.then((results) => {
     if (!cardKey) {
       return results;
     }
@@ -73,29 +77,38 @@ export async function getCardQueryResult(
 /**
  * Export the site to a given directory.
  * Note: Do not call this function in parallel.
- * @param commands - CommandManager instance for the project.
+ * @param registry - ProjectRegistry holding all project CommandManagers.
  * @param exportDir - Directory to export to.
  * @param options - Export options.
  * @param options.recursive - Whether to export cards recursively.
  * @param options.cardKey - Key of the card to export. If not provided, all cards will be exported.
- * @param level - Log level for the operation.
+ * @param options.defaultProject - Default project prefix to write into config.json.
  * @param onProgress - Optional progress callback function.
  * @returns An object containing any errors that occurred during export.
  */
 export async function exportSite(
-  commands: CommandManager,
+  registry: ProjectRegistry,
   exportDir?: string,
-  options?: TreeOptions,
+  options?: ExportSiteOptions,
   onProgress?: (current: number, total: number) => void,
 ): Promise<{ errors: string[] }> {
   exportDir = exportDir || 'static';
-  const opts = {
+  const { defaultProject, ...treeOpts } = options ?? {};
+  const opts: TreeOptions = {
     recursive: false,
-    cardKey: undefined,
-    ...options,
+    ...treeOpts,
   };
 
-  const app = createApp(new MockAuthProvider(), commands, opts);
+  if (defaultProject && !registry.has(defaultProject)) {
+    throw new Error(
+      `Default project '${defaultProject}' is not in the registry. Available: ${registry
+        .list()
+        .map((p) => p.prefix)
+        .join(', ')}`,
+    );
+  }
+
+  const app = createApp(new MockAuthProvider(), registry, opts, true);
 
   // copy whole frontend to the same directory
   await cp(staticFrontendDirRelative, exportDir, { recursive: true });
@@ -103,6 +116,9 @@ export async function exportSite(
   const config = await readFile(path.join(exportDir, 'config.json'), 'utf-8');
   const configJson = JSON.parse(config);
   configJson.staticMode = true;
+  if (defaultProject) {
+    configJson.defaultProject = defaultProject;
+  }
   await writeFile(
     path.join(exportDir, 'config.json'),
     JSON.stringify(configJson),
@@ -110,10 +126,13 @@ export async function exportSite(
 
   reset();
 
-  // estimate total based on the number of cards to export
-  const cards = await findAllCards(commands, opts);
-  const attachments = await findRelevantAttachments(commands, opts);
-  let total = cards.length + attachments.length + OVERHEAD_CALLS;
+  // estimate total based on the number of cards to export across all projects
+  let total = OVERHEAD_CALLS;
+  for (const commands of registry.values()) {
+    const cards = await findAllCards(commands, opts);
+    const attachments = await findRelevantAttachments(commands, opts);
+    total += cards.length + attachments.length;
+  }
 
   // Actual export with progress reporting
   let done = 0;
@@ -130,6 +149,10 @@ export async function exportSite(
           if (url.pathname.startsWith('/mcp')) {
             return false;
           }
+          // Skip OIDC/well-known routes — not relevant for static export
+          if (url.pathname.startsWith('/.well-known')) {
+            return false;
+          }
           return req;
         },
         afterResponseHook: async (response) => {

package/src/index.ts

@@ -16,14 +16,15 @@ import { Hono } from 'hono';
 import { serveStatic } from '@hono/node-server/serve-static';
 import path from 'node:path';
 import { readFile } from 'node:fs/promises';
-import type { CommandManager } from '@cyberismo/data-handler';
 import { findFreePort } from './utils.js';
 import { createApp } from './app.js';
 import type { AuthProvider } from './auth/types.js';
+import type { ProjectRegistry } from './project-registry.js';
 export { MockAuthProvider } from './auth/mock.js';
 export type { MockUserConfig } from './auth/mock.js';
 export type { AuthProvider } from './auth/types.js';
-export { exportSite } from './export.js';
+export { exportSite, type ExportSiteOptions } from './export.js';
+export { ProjectRegistry } from './project-registry.js';
 
 const DEFAULT_PORT = 3000;
 const DEFAULT_MAX_PORT = DEFAULT_PORT + 100;
@@ -56,12 +57,12 @@ export async function previewSite(dir: string, findPort: boolean = true) {
 /**
  * Start the server
  * @param authProvider - Authentication provider
- * @param commands - CommandManager instance for the project
+ * @param registry - ProjectRegistry holding all project CommandManagers
  * @param findPort - If true, find a free port
  */
 export async function startServer(
   authProvider: AuthProvider,
-  commands: CommandManager,
+  registry: ProjectRegistry,
   findPort: boolean = true,
 ) {
   let port = parseInt(process.env.PORT || DEFAULT_PORT.toString(), 10);
@@ -69,7 +70,7 @@ export async function startServer(
   if (findPort) {
     port = await findFreePort(port, DEFAULT_MAX_PORT);
   }
-  const app = createApp(authProvider, commands);
+  const app = createApp(authProvider, registry);
   startApp(app, port);
 }
 

package/src/main.ts

@@ -10,12 +10,14 @@
   details. You should have received a copy of the GNU Affero General Public
   License along with this program. If not, see <https://www.gnu.org/licenses/>.
 */
-import { CommandManager } from '@cyberismo/data-handler';
+import { scanForProjects } from '@cyberismo/data-handler';
 import { startServer } from './index.js';
 import { exportSite } from './export.js';
 import { MockAuthProvider } from './auth/mock.js';
 import { KeycloakAuthProvider } from './auth/keycloak.js';
 import type { AuthProvider } from './auth/types.js';
+import { ProjectRegistry } from './project-registry.js';
+import { parseArgs } from 'node:util';
 import dotenv from 'dotenv';
 
 // Load environment variables from .env file
@@ -55,12 +57,50 @@ function createAuthProvider(): AuthProvider {
   process.exit(1);
 }
 
-const projectPath = process.env.npm_config_project_path || '';
-const commands = await CommandManager.getInstance(projectPath);
+const projectPath = process.env.npm_config_project_path || process.cwd();
+let projects;
+try {
+  projects = await scanForProjects(projectPath);
+} catch (error) {
+  console.error(
+    error instanceof Error
+      ? error.message
+      : `Failed to scan for projects in '${projectPath}'`,
+  );
+  process.exit(1);
+}
+
+const { values: args } = parseArgs({
+  options: {
+    export: { type: 'boolean', default: false },
+    'default-project': { type: 'string' },
+  },
+  strict: false,
+});
 
-if (process.argv.includes('--export')) {
-  await exportSite(commands);
+if (args.export) {
+  if (projects.length === 0) {
+    console.error('No projects found to export.');
+    process.exit(1);
+  }
+  const registry = await ProjectRegistry.fromScannedProjects(projects);
+  await exportSite(registry, undefined, {
+    defaultProject:
+      typeof args['default-project'] === 'string'
+        ? args['default-project']
+        : undefined,
+  });
 } else {
+  if (projects.length === 0) {
+    console.error(
+      `No projects found in "${projectPath}". Cannot start the server without at least one project.`,
+    );
+    process.exit(1);
+  }
+  const autocommit = process.env.CYBERISMO_AUTOCOMMIT === 'true';
+  const registry = await ProjectRegistry.fromScannedProjects(projects, {
+    autocommit,
+  });
   const authProvider = createAuthProvider();
-  await startServer(authProvider, commands);
+  await startServer(authProvider, registry);
 }

package/src/middleware/auth.ts

@@ -42,6 +42,16 @@ export function createAuthMiddleware(
     if (user) {
       c.set('user', user);
     } else {
+      // RFC 9728 §5.1: include resource_metadata in WWW-Authenticate
+      // only for MCP routes, where the metadata document applies.
+      const issuer = process.env.OIDC_ISSUER;
+      if (issuer && c.req.path.startsWith('/mcp')) {
+        const origin = new URL(issuer).origin;
+        const resourceUrl = `${origin}/.well-known/oauth-protected-resource/mcp`;
+        return c.json({ error: 'Unauthorized' }, 401, {
+          'WWW-Authenticate': `Bearer resource_metadata="${resourceUrl}"`,
+        });
+      }
       return c.json({ error: 'Unauthorized' }, 401);
     }
 

package/src/middleware/commandManager.ts

@@ -13,28 +13,66 @@
 import type { Context, MiddlewareHandler } from 'hono';
 import type { CommandManager } from '@cyberismo/data-handler';
 import { getCurrentUser } from './auth.js';
+import type { ProjectRegistry } from '../project-registry.js';
 
 // Extend Hono Context type to include our custom properties
 declare module 'hono' {
   interface ContextVariableMap {
     commands: CommandManager;
     projectPath: string;
+    registry: ProjectRegistry;
   }
 }
 
+/**
+ * Set CommandManager on context and run the next handler as the authenticated user.
+ */
+async function runWithCommands(
+  c: Context,
+  commands: CommandManager,
+  next: () => Promise<void>,
+) {
+  const user = getCurrentUser(c);
+  if (!user) {
+    throw new Error('CommandManager expects a user');
+  }
+  c.set('commands', commands);
+  c.set('projectPath', commands.project.basePath);
+  await commands.runAsAuthor({ name: user.name, email: user.email }, () =>
+    next(),
+  );
+}
+
+// TODO: Remove once MCP is made project-scoped via attachProjectRegistry
 export const attachCommandManager = (
   commands: CommandManager,
+): MiddlewareHandler => {
+  return (c, next) => runWithCommands(c, commands, next);
+};
+
+/**
+ * Middleware that resolves the project from the registry and sets the
+ * CommandManager on context.
+ *
+ * @param registry - Project registry to look up projects.
+ * @param fixedPrefix - When provided, used instead of the `:prefix` route
+ *   param. This is needed in export/SSG mode where routes are mounted at
+ *   concrete paths (e.g. `/api/projects/decision/...`) with no dynamic param.
+ */
+export const attachProjectRegistry = (
+  registry: ProjectRegistry,
+  fixedPrefix?: string,
 ): MiddlewareHandler => {
   return async (c: Context, next) => {
-    c.set('commands', commands);
-    c.set('projectPath', commands.project.basePath);
-    const user = getCurrentUser(c);
-    if (user) {
-      await commands.runAsAuthor({ name: user.name, email: user.email }, () =>
-        next(),
-      );
-    } else {
-      throw new Error('CommandManager expects a user');
+    c.set('registry', registry);
+    const prefix = c.req.param('prefix') ?? fixedPrefix;
+    if (!prefix) {
+      return c.json({ error: 'Project prefix is required' }, 400);
+    }
+    const commands = registry.get(prefix);
+    if (!commands) {
+      return c.json({ error: `Project '${prefix}' not found` }, 404);
     }
+    return runWithCommands(c, commands, next);
   };
 };

package/src/project-registry.ts

@@ -0,0 +1,110 @@
+/**
+  Cyberismo
+  Copyright © Cyberismo Ltd and contributors 2026
+  This program is free software: you can redistribute it and/or modify it under
+  the terms of the GNU Affero General Public License version 3 as published by
+  the Free Software Foundation.
+  This program is distributed in the hope that it will be useful, but WITHOUT
+  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+  FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+  details. You should have received a copy of the GNU Affero General Public
+  License along with this program. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import { CommandManager, type ProjectProvider } from '@cyberismo/data-handler';
+
+export type ProjectRegistryEntry = {
+  prefix: string;
+  commands: CommandManager;
+};
+
+export type ProjectListItem = {
+  prefix: string;
+  name: string;
+  category?: string;
+  description?: string;
+};
+
+/** Minimal project descriptor returned by scanForProjects. */
+export interface ScannedProject {
+  path: string;
+  prefix: string;
+  name: string;
+}
+
+export class ProjectRegistry implements ProjectProvider {
+  private projects: Map<string, CommandManager> = new Map();
+
+  constructor(entries: ProjectRegistryEntry[] = []) {
+    for (const entry of entries) {
+      this.add(entry.prefix, entry.commands);
+    }
+  }
+
+  get(prefix: string): CommandManager | undefined {
+    return this.projects.get(prefix);
+  }
+
+  has(prefix: string): boolean {
+    return this.projects.has(prefix);
+  }
+
+  add(prefix: string, commands: CommandManager): void {
+    if (this.projects.has(prefix)) {
+      throw new Error(`Project '${prefix}' is already registered`);
+    }
+    this.projects.set(prefix, commands);
+  }
+
+  list(): ProjectListItem[] {
+    return Array.from(this.projects.entries()).map(([prefix, commands]) => ({
+      prefix,
+      name: commands.project.configuration.name,
+      category: commands.project.configuration.category || undefined,
+      description: commands.project.configuration.description || undefined,
+    }));
+  }
+
+  /** Iterate over all registered CommandManagers. */
+  values(): IterableIterator<CommandManager> {
+    return this.projects.values();
+  }
+
+  first(): CommandManager | undefined {
+    const [first] = this.projects.values();
+    return first;
+  }
+
+  dispose(): void {
+    for (const commands of this.projects.values()) {
+      commands.project.dispose();
+    }
+    this.projects.clear();
+  }
+
+  /**
+   * Create a single-project registry from a CommandManager.
+   * Used by export mode and tests where only one project is needed.
+   */
+  static fromCommandManager(commands: CommandManager): ProjectRegistry {
+    return new ProjectRegistry([
+      { prefix: commands.project.configuration.cardKeyPrefix, commands },
+    ]);
+  }
+
+  /**
+   * Build a registry from scanned project entries, initializing each CommandManager.
+   */
+  static async fromScannedProjects(
+    projects: ScannedProject[],
+    options?: ConstructorParameters<typeof CommandManager>[1],
+  ): Promise<ProjectRegistry> {
+    const entries: ProjectRegistryEntry[] = [];
+    for (const project of projects) {
+      const commands = new CommandManager(project.path, options);
+      await commands.initialize();
+      entries.push({ prefix: project.prefix, commands });
+    }
+    return new ProjectRegistry(entries);
+  }
+}