@cyberismo/backend 1.1.2 → 1.2.0

package/dist/export.js.map

@@ -1 +1 @@
-{"version":3,"file":"export.js","sourceRoot":"","sources":["../src/export.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;EAWE;AAEF,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGlC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAEvD,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAEjC,OAAO,EACL,YAAY,EACZ,uBAAuB,GACxB,MAAM,2BAA2B,CAAC;AAMnC,MAAM,eAAe,GAAG,IAAI,GAAG,EAA0C,CAAC;AAC1E,MAAM,cAAc,GAAG,CAAC,CAAC,CAAC,+EAA+E;AAEzG;;;GAGG;AACH,MAAM,UAAU,KAAK;IACnB,eAAe,CAAC,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAwB,EACxB,OAAgB;IAEhB,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC;IAC5D,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,eAAe,CAAC,GAAG,CACjB,MAAM,EACN,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,eAAe,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QACnD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,QAAQ,OAAO,YAAY,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,QAAyB,EACzB,SAAkB,EAClB,OAA2B,EAC3B,UAAqD;IAErD,SAAS,GAAG,SAAS,IAAI,QAAQ,CAAC;IAClC,MAAM,EAAE,cAAc,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;IACtD,MAAM,IAAI,GAAgB;QACxB,SAAS,EAAE,KAAK;QAChB,GAAG,QAAQ;KACZ,CAAC;IAEF,IAAI,cAAc,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,oBAAoB,cAAc,wCAAwC,QAAQ;aAC/E,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;aACpB,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,cAAc,CAAC;IACzD,CAAC;IAED,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,gBAAgB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAEpE,4CAA4C;IAC5C,MAAM,EAAE,CAAC,yBAAyB,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpE,KAAK,EAAE,CAAC;IAER,4EAA4E;IAC5E,IAAI,KAAK,GAAG,cAAc,CAAC;IAC3B,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACjD,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClE,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;IAC7C,CAAC;IAED,wCAAwC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,UAAU,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,EAAE;QACnB,GAAG,EAAE,SAAS;QACd,WAAW,EAAE,CAAC;QACd,OAAO,EAAE;YACP;gBACE,iBAAiB,EAAE,CAAC,GAAG,EAAE,EAAE;oBACzB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC7B,mFAAmF;oBACnF,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;wBACpC,OAAO,KAAK,CAAC;oBACf,CAAC;oBACD,+DAA+D;oBAC/D,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;wBAC5C,OAAO,KAAK,CAAC;oBACf,CAAC;oBACD,OAAO,GAAG,CAAC;gBACb,CAAC;gBACD,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;oBACpC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;wBAC/C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;wBACpC,IACE,OAAO,KAAK,KAAK,QAAQ;4BACzB,KAAK,IAAI,IAAI;4BACb,OAAO,IAAI,KAAK;4BAChB,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAC/B,CAAC;4BACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;wBAC3B,CAAC;wBACD,OAAO,KAAK,CAAC,CAAC,eAAe;oBAC/B,CAAC;oBACD,IAAI,EAAE,CAAC;oBACP,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;wBACjB,KAAK,GAAG,IAAI,CAAC,CAAC,iCAAiC;oBACjD,CAAC;oBACD,UAAU,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBAC1B,OAAO,QAAQ,CAAC;gBAClB,CAAC;aACF;SACF;KACF,CAAC,CAAC;IACH,OAAO;QACL,MAAM;KACP,CAAC;AACJ,CAAC"}
+{"version":3,"file":"export.js","sourceRoot":"","sources":["../src/export.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;EAWE;AAEF,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGlC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAEvD,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAGjC,OAAO,EACL,YAAY,EACZ,uBAAuB,GACxB,MAAM,2BAA2B,CAAC;AAMnC,MAAM,eAAe,GAAG,IAAI,GAAG,EAA0C,CAAC;AAC1E,8DAA8D;AAC9D,MAAM,aAAa,GAAG,UAAU,CAAC;AACjC,MAAM,cAAc,GAAG,CAAC,CAAC,CAAC,+EAA+E;AAEzG;;;GAGG;AACH,MAAM,UAAU,KAAK;IACnB,eAAe,CAAC,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAwB,EACxB,OAAgB;IAEhB,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC;IAC5D,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,eAAe,CAAC,GAAG,CACjB,MAAM,EACN,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,eAAe,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QACnD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,QAAQ,OAAO,YAAY,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,QAAyB,EACzB,SAAkB,EAClB,OAA2B,EAC3B,UAAqD;IAErD,SAAS,GAAG,SAAS,IAAI,QAAQ,CAAC;IAClC,MAAM,EAAE,cAAc,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;IACtD,MAAM,IAAI,GAAgB;QACxB,SAAS,EAAE,KAAK;QAChB,GAAG,QAAQ;KACZ,CAAC;IAEF,IAAI,cAAc,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,oBAAoB,cAAc,wCAAwC,QAAQ;aAC/E,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;aACpB,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,cAAc,CAAC;IACzD,CAAC;IAED,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,gBAAgB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAEpE,4CAA4C;IAC5C,MAAM,EAAE,CAAC,yBAAyB,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpE,KAAK,EAAE,CAAC;IAER,4EAA4E;IAC5E,IAAI,KAAK,GAAG,cAAc,CAAC;IAC3B,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACjD,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClE,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;IAC7C,CAAC;IAED,4EAA4E;IAC5E,0EAA0E;IAC1E,wDAAwD;IACxD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAE,EAAE,CACrC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAClB,MAAM,IAAI,GAAG,iBAAiB,CAAC,EAAE,CAAC;QAClC,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEL,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,UAAU,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;QAC7C,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,EAAE;YACnB,GAAG,EAAE,SAAS;YACd,WAAW,EAAE,CAAC;YACd,OAAO,EAAE;gBACP;oBACE,iBAAiB,EAAE,CAAC,GAAG,EAAE,EAAE;wBACzB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;wBAC7B,mFAAmF;wBACnF,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;4BACpC,OAAO,KAAK,CAAC;wBACf,CAAC;wBACD,+DAA+D;wBAC/D,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;4BAC5C,OAAO,KAAK,CAAC;wBACf,CAAC;wBACD,OAAO,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;oBACzD,CAAC;oBACD,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;wBACpC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;4BAC/C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;4BACpC,IACE,OAAO,KAAK,KAAK,QAAQ;gCACzB,KAAK,IAAI,IAAI;gCACb,OAAO,IAAI,KAAK;gCAChB,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAC/B,CAAC;gCACD,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;4BAChC,CAAC;4BACD,OAAO,KAAK,CAAC,CAAC,eAAe;wBAC/B,CAAC;wBACD,IAAI,EAAE,CAAC;wBACP,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;4BACjB,KAAK,GAAG,IAAI,CAAC,CAAC,iCAAiC;wBACjD,CAAC;wBACD,UAAU,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;wBAC1B,OAAO,QAAQ,CAAC;oBAClB,CAAC;iBACF;aACF;SACF,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,IAAI,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,OAAO;QACL,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -5,6 +5,7 @@ export type { MockUserConfig } from './auth/mock.js';
 export type { AuthProvider } from './auth/types.js';
 export { exportSite, type ExportSiteOptions } from './export.js';
 export { ProjectRegistry } from './project-registry.js';
+export { formatProjectErrors, type ProjectErrors } from './project-errors.js';
 /**
  * Preview the exported site
  * @param dir - Directory to preview

package/dist/index.js

@@ -16,10 +16,12 @@ import { serveStatic } from '@hono/node-server/serve-static';
 import path from 'node:path';
 import { readFile } from 'node:fs/promises';
 import { findFreePort } from './utils.js';
+import { startPolicyPolling } from './overlay.js';
 import { createApp } from './app.js';
 export { MockAuthProvider } from './auth/mock.js';
 export { exportSite } from './export.js';
 export { ProjectRegistry } from './project-registry.js';
+export { formatProjectErrors } from './project-errors.js';
 const DEFAULT_PORT = 3000;
 const DEFAULT_MAX_PORT = DEFAULT_PORT + 100;
 /**
@@ -57,6 +59,7 @@ export async function startServer(authProvider, registry, findPort = true, multi
     if (findPort && !useOsAssigned) {
         port = await findFreePort(port, DEFAULT_MAX_PORT);
     }
+    startPolicyPolling(() => registry.list().map((p) => ({ prefix: p.prefix })));
     const app = createApp(authProvider, registry, undefined, false, multiProjectRoot);
     startApp(app, port);
 }

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;EAWE;AACF,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAE1C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAGrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGlD,OAAO,EAAE,UAAU,EAA0B,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,gBAAgB,GAAG,YAAY,GAAG,GAAG,CAAC;AAE5C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,WAAoB,IAAI;IACrE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACpC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvB,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,IAAI,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,YAAY,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IAErE,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACpD,CAAC;IACD,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,YAA0B,EAC1B,QAAyB,EACzB,WAAoB,IAAI,EACxB,gBAAyB;IAEzB,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,MAAM,CAAC;IAClE,IAAI,IAAI,GAAG,aAAa;QACtB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,YAAY,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9D,IAAI,QAAQ,IAAI,CAAC,aAAa,EAAE,CAAC;QAC/B,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CACnB,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,KAAK,EACL,gBAAgB,CACjB,CAAC;IACF,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,QAAQ,CACf,GAAkB,EAClB,IAAY;IAEZ,KAAK,CACH;QACE,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,WAAW;KAC1C,EACD,CAAC,IAAI,EAAE,EAAE;QACP,OAAO,CAAC,GAAG,CAAC,6CAA6C,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QACxC,+EAA+E;QAC/E,8EAA8E;QAC9E,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;EAWE;AACF,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAE1C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAGrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGlD,OAAO,EAAE,UAAU,EAA0B,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAsB,MAAM,qBAAqB,CAAC;AAE9E,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,gBAAgB,GAAG,YAAY,GAAG,GAAG,CAAC;AAE5C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,WAAoB,IAAI;IACrE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACpC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvB,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,IAAI,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,YAAY,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IAErE,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACpD,CAAC;IACD,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,YAA0B,EAC1B,QAAyB,EACzB,WAAoB,IAAI,EACxB,gBAAyB;IAEzB,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,MAAM,CAAC;IAClE,IAAI,IAAI,GAAG,aAAa;QACtB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,YAAY,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9D,IAAI,QAAQ,IAAI,CAAC,aAAa,EAAE,CAAC;QAC/B,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACpD,CAAC;IACD,kBAAkB,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,SAAS,CACnB,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,KAAK,EACL,gBAAgB,CACjB,CAAC;IACF,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,QAAQ,CACf,GAAkB,EAClB,IAAY;IAEZ,KAAK,CACH;QACE,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,WAAW;KAC1C,EACD,CAAC,IAAI,EAAE,EAAE;QACP,OAAO,CAAC,GAAG,CAAC,6CAA6C,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QACxC,+EAA+E;QAC/E,8EAA8E;QAC9E,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/main.js

@@ -16,6 +16,7 @@ import { exportSite } from './export.js';
 import { MockAuthProvider } from './auth/mock.js';
 import { KeycloakAuthProvider } from './auth/keycloak.js';
 import { ProjectRegistry } from './project-registry.js';
+import { formatProjectErrors } from './project-errors.js';
 import { gitOptionsFromEnv } from './utils.js';
 import { parseArgs } from 'node:util';
 import dotenv from 'dotenv';
@@ -28,7 +29,7 @@ function createAuthProvider() {
         process.exit(1);
     }
     if (authMode === 'mock') {
-        return new MockAuthProvider();
+        return new MockAuthProvider({ roster: true });
     }
     if (authMode === 'idp') {
         const issuer = process.env.OIDC_ISSUER;
@@ -65,15 +66,29 @@ if (args.export) {
         console.error('No projects found to export.');
         process.exit(1);
     }
-    const registry = await ProjectRegistry.fromScannedProjects(projects);
-    await exportSite(registry, undefined, {
-        defaultProject: typeof args['default-project'] === 'string'
-            ? args['default-project']
-            : undefined,
+    const defaultProject = typeof args['default-project'] === 'string'
+        ? args['default-project']
+        : undefined;
+    const { registry, failed } = await ProjectRegistry.fromScannedProjects(projects);
+    if (registry.list().length === 0 ||
+        failed.some((f) => f.prefix === defaultProject)) {
+        console.error(formatProjectErrors(failed));
+        process.exit(1);
+    }
+    const { errors: exportErrors } = await exportSite(registry, undefined, {
+        defaultProject,
     });
+    const errors = [...failed, ...exportErrors];
+    if (errors.length > 0) {
+        console.error(formatProjectErrors(errors));
+        process.exit(1);
+    }
 }
 else {
-    const registry = await ProjectRegistry.fromScannedProjects(projects, gitOptionsFromEnv());
+    const { registry, failed } = await ProjectRegistry.fromScannedProjects(projects, gitOptionsFromEnv());
+    if (failed.length > 0) {
+        console.error(formatProjectErrors(failed));
+    }
     const authProvider = createAuthProvider();
     await startServer(authProvider, registry, true, projectPath);
 }

package/dist/main.js.map

@@ -1 +1 @@
-{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;EAWE;AACF,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,4CAA4C;AAC5C,MAAM,CAAC,MAAM,EAAE,CAAC;AAEhB,SAAS,kBAAkB;IACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;IAEvC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CACX,4EAA4E,CAC7E,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO,IAAI,gBAAgB,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAE5C,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzB,OAAO,CAAC,KAAK,CACX,8FAA8F,CAC/F,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,OAAO,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,CAAC,KAAK,CACX,kCAAkC,QAAQ,6BAA6B,CACxE,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AACzE,IAAI,QAAQ,CAAC;AACb,IAAI,CAAC;IACH,QAAQ,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;AAChD,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,OAAO,CAAC,KAAK,CACX,KAAK,YAAY,KAAK;QACpB,CAAC,CAAC,KAAK,CAAC,OAAO;QACf,CAAC,CAAC,mCAAmC,WAAW,GAAG,CACtD,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC;IACjC,OAAO,EAAE;QACP,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;QAC3C,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KACtC;IACD,MAAM,EAAE,KAAK;CACd,CAAC,CAAC;AAEH,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;IAChB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACrE,MAAM,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE;QACpC,cAAc,EACZ,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,QAAQ;YACzC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;YACzB,CAAC,CAAC,SAAS;KAChB,CAAC,CAAC;AACL,CAAC;KAAM,CAAC;IACN,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,mBAAmB,CACxD,QAAQ,EACR,iBAAiB,EAAE,CACpB,CAAC;IACF,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;IAC1C,MAAM,WAAW,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;AAC/D,CAAC"}
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;EAWE;AACF,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,4CAA4C;AAC5C,MAAM,CAAC,MAAM,EAAE,CAAC;AAEhB,SAAS,kBAAkB;IACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;IAEvC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CACX,4EAA4E,CAC7E,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAE5C,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzB,OAAO,CAAC,KAAK,CACX,8FAA8F,CAC/F,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,OAAO,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,CAAC,KAAK,CACX,kCAAkC,QAAQ,6BAA6B,CACxE,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AACzE,IAAI,QAAQ,CAAC;AACb,IAAI,CAAC;IACH,QAAQ,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;AAChD,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,OAAO,CAAC,KAAK,CACX,KAAK,YAAY,KAAK;QACpB,CAAC,CAAC,KAAK,CAAC,OAAO;QACf,CAAC,CAAC,mCAAmC,WAAW,GAAG,CACtD,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC;IACjC,OAAO,EAAE;QACP,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;QAC3C,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KACtC;IACD,MAAM,EAAE,KAAK;CACd,CAAC,CAAC;AAEH,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;IAChB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,cAAc,GAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,QAAQ;QACzC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;QACzB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GACxB,MAAM,eAAe,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACtD,IACE,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,CAAC,EAC/C,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE;QACrE,cAAc;KACf,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;KAAM,CAAC;IACN,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,mBAAmB,CACpE,QAAQ,EACR,iBAAiB,EAAE,CACpB,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;IAC1C,MAAM,WAAW,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;AAC/D,CAAC"}

package/dist/middleware/auth.d.ts

@@ -17,6 +17,7 @@ import type { AuthProvider } from '../auth/types.js';
 declare module 'hono' {
     interface ContextVariableMap {
         user: UserInfo;
+        tokenExp: number;
     }
 }
 /**
@@ -24,6 +25,10 @@ declare module 'hono' {
  * Validates the user and attaches user info to the context.
  */
 export declare function createAuthMiddleware(provider: AuthProvider): MiddlewareHandler;
+/**
+ * Check if a role meets or exceeds a minimum role in the hierarchy.
+ */
+export declare function isAtLeastRole(role: UserRole, minimumRole: UserRole): boolean;
 /**
  * Check if the current user has at least the required role
  */

package/dist/middleware/auth.js

@@ -11,21 +11,31 @@
   License along with this program. If not, see <https://www.gnu.org/licenses/>.
 */
 import { UserRole } from '../types.js';
+import { isReadOnly } from '../overlay.js';
 const roleLevel = {
     [UserRole.Connector]: -1,
     [UserRole.Reader]: 0,
     [UserRole.Editor]: 1,
     [UserRole.Admin]: 2,
 };
+/** Everyone below administrator is a reader; lifting read-only is their job. */
+function applyReadOnly(user) {
+    if (user.role === UserRole.Admin) {
+        return user;
+    }
+    return { ...user, role: UserRole.Reader };
+}
 /**
  * Create authentication middleware from an AuthProvider.
  * Validates the user and attaches user info to the context.
  */
 export function createAuthMiddleware(provider) {
     return async (c, next) => {
-        const user = await provider.authenticate(c.req.raw);
-        if (user) {
-            c.set('user', user);
+        const result = await provider.authenticate(c.req.raw);
+        if (result) {
+            const { exp, ...user } = result;
+            c.set('user', isReadOnly(c.req.path) ? applyReadOnly(user) : user);
+            c.set('tokenExp', exp);
         }
         else {
             // RFC 9728 §5.1: include resource_metadata in WWW-Authenticate
@@ -43,6 +53,12 @@ export function createAuthMiddleware(provider) {
         await next();
     };
 }
+/**
+ * Check if a role meets or exceeds a minimum role in the hierarchy.
+ */
+export function isAtLeastRole(role, minimumRole) {
+    return roleLevel[role] >= roleLevel[minimumRole];
+}
 /**
  * Check if the current user has at least the required role
  */
@@ -51,7 +67,7 @@ export function hasRole(c, minimumRole) {
     if (!user) {
         return false;
     }
-    return roleLevel[user.role] >= roleLevel[minimumRole];
+    return isAtLeastRole(user.role, minimumRole);
 }
 /**
  * Require minimum role middleware factory.

package/dist/middleware/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;EAWE;AAIF,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAUvC,MAAM,SAAS,GAA6B;IAC1C,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACxB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IACpB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IACpB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;CACpB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAsB;IAEtB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEpD,IAAI,IAAI,EAAE,CAAC;YACT,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,+DAA+D;YAC/D,4DAA4D;YAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YACvC,IAAI,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;gBACtC,MAAM,WAAW,GAAG,GAAG,MAAM,2CAA2C,CAAC;gBACzE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE;oBAC5C,kBAAkB,EAAE,6BAA6B,WAAW,GAAG;iBAChE,CAAC,CAAC;YACL,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,OAAO,CAAC,CAAU,EAAE,WAAqB;IACvD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,WAAW,CAAC,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,WAAqB,EACrB,UAAuB;IAEvB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE3B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,CAAU;IACvC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;EAWE;AAIF,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAU3C,MAAM,SAAS,GAA6B;IAC1C,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACxB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IACpB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IACpB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;CACpB,CAAC;AAEF,gFAAgF;AAChF,SAAS,aAAa,CAAC,IAAc;IACnC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAsB;IAEtB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEtD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;YAChC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACnE,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,+DAA+D;YAC/D,4DAA4D;YAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YACvC,IAAI,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;gBACtC,MAAM,WAAW,GAAG,GAAG,MAAM,2CAA2C,CAAC;gBACzE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE;oBAC5C,kBAAkB,EAAE,6BAA6B,WAAW,GAAG;iBAChE,CAAC,CAAC;YACL,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,IAAc,EAAE,WAAqB;IACjE,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,WAAW,CAAC,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,OAAO,CAAC,CAAU,EAAE,WAAqB;IACvD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,WAAqB,EACrB,UAAuB;IAEvB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE3B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,CAAU;IACvC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;AAC/B,CAAC"}

package/dist/middleware/commandManager.d.ts

@@ -12,9 +12,11 @@
 import type { MiddlewareHandler } from 'hono';
 import type { CommandManager } from '@cyberismo/data-handler';
 import type { ProjectRegistry } from '../project-registry.js';
+import type { ProjectEvents } from '../domain/events/project-events.js';
 declare module 'hono' {
     interface ContextVariableMap {
         commands: CommandManager;
+        events: ProjectEvents;
         projectPath: string;
         registry: ProjectRegistry;
     }

package/dist/middleware/commandManager.js

@@ -46,6 +46,7 @@ export const attachProjectRegistry = (registry, fixedPrefix) => {
         if (!commands) {
             return c.json({ error: `Project '${prefix}' not found` }, 404);
         }
+        c.set('events', registry.eventsFor(commands));
         return runWithCommands(c, commands, next);
     };
 };

package/dist/middleware/commandManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"commandManager.js","sourceRoot":"","sources":["../../src/middleware/commandManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;EAUE;AAIF,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAY3C;;GAEG;AACH,KAAK,UAAU,eAAe,CAC5B,CAAU,EACV,QAAwB,EACxB,IAAyB;IAEzB,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC5B,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CACtE,IAAI,EAAE,CACP,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,QAAwB,EACL,EAAE;IACrB,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AACzD,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,QAAyB,EACzB,WAAoB,EACD,EAAE;IACrB,OAAO,KAAK,EAAE,CAAU,EAAE,IAAI,EAAE,EAAE;QAChC,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,MAAM,aAAa,EAAE,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,eAAe,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"commandManager.js","sourceRoot":"","sources":["../../src/middleware/commandManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;EAUE;AAIF,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAc3C;;GAEG;AACH,KAAK,UAAU,eAAe,CAC5B,CAAU,EACV,QAAwB,EACxB,IAAyB;IAEzB,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC5B,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CACtE,IAAI,EAAE,CACP,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,QAAwB,EACL,EAAE;IACrB,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AACzD,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,QAAyB,EACzB,WAAoB,EACD,EAAE;IACrB,OAAO,KAAK,EAAE,CAAU,EAAE,IAAI,EAAE,EAAE;QAChC,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,MAAM,aAAa,EAAE,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;QACD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9C,OAAO,eAAe,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC;AACJ,CAAC,CAAC"}

package/dist/overlay.d.ts

@@ -0,0 +1,45 @@
+/**
+  Cyberismo
+  Copyright © Cyberismo Ltd and contributors 2026
+  This program is free software: you can redistribute it and/or modify it under
+  the terms of the GNU Affero General Public License version 3 as published by
+  the Free Software Foundation. This program is distributed in the hope that it
+  will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty
+  of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+  See the GNU Affero General Public License for more details.
+  You should have received a copy of the GNU Affero General Public
+  License along with this program. If not, see <https://www.gnu.org/licenses/>.
+*/
+/**
+ * Which projects, or the whole instance, are read-only.
+ *
+ * Polled on a timer so no request waits for it, and permissive on every
+ * uncertain path: a freeze arriving late beats an outage. Unset
+ * CYBERISMO_OVERLAY_URL means no policy, which is the standalone default.
+ */
+import { z } from 'zod';
+import type { ProjectProvider } from '@cyberismo/data-handler';
+declare const policySchema: z.ZodCatch<z.ZodObject<{
+    readOnly: z.ZodCatch<z.ZodBoolean>;
+    projects: z.ZodCatch<z.ZodRecord<z.ZodString, z.ZodObject<{
+        readOnly: z.ZodCatch<z.ZodBoolean>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>>;
+export type Policy = z.infer<typeof policySchema>;
+export declare function getPolicy(): Policy;
+export declare function setPolicy(policy: Policy): void;
+export declare function isProjectReadOnly(prefix: string): boolean;
+/** `/api/projects/<prefix>/…` is the only request shape naming a project. */
+export declare function isReadOnly(path: string): boolean;
+export declare function startPolicyPolling(projects?: () => {
+    prefix: string;
+}[]): void;
+/**
+ * Hide read-only projects from MCP.
+ *
+ * MCP takes the project as an argument rather than in the path, so the role cap
+ * cannot see which one a call touches. Making a frozen project unresolvable
+ * fails closed, at the cost of hiding it from reads and from administrators too.
+ */
+export declare function writableProjects(provider: ProjectProvider): ProjectProvider;
+export {};

package/dist/overlay.js

@@ -0,0 +1,157 @@
+/**
+  Cyberismo
+  Copyright © Cyberismo Ltd and contributors 2026
+  This program is free software: you can redistribute it and/or modify it under
+  the terms of the GNU Affero General Public License version 3 as published by
+  the Free Software Foundation. This program is distributed in the hope that it
+  will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty
+  of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+  See the GNU Affero General Public License for more details.
+  You should have received a copy of the GNU Affero General Public
+  License along with this program. If not, see <https://www.gnu.org/licenses/>.
+*/
+/**
+ * Which projects, or the whole instance, are read-only.
+ *
+ * Polled on a timer so no request waits for it, and permissive on every
+ * uncertain path: a freeze arriving late beats an outage. Unset
+ * CYBERISMO_OVERLAY_URL means no policy, which is the standalone default.
+ */
+import { z } from 'zod';
+const POLL_INTERVAL_MS = 10_000;
+const FETCH_TIMEOUT_MS = 2_000;
+const policySchema = z
+    .object({
+    readOnly: z.boolean().catch(false),
+    projects: z
+        .record(z.string(), z.object({ readOnly: z.boolean().catch(false) }))
+        .catch({}),
+})
+    .catch(() => EMPTY);
+const EMPTY = { readOnly: false, projects: {} };
+let current = EMPTY;
+export function getPolicy() {
+    return current;
+}
+export function setPolicy(policy) {
+    current = policy;
+}
+export function isProjectReadOnly(prefix) {
+    return current.readOnly || current.projects[prefix]?.readOnly === true;
+}
+/** `/api/projects/<prefix>/…` is the only request shape naming a project. */
+export function isReadOnly(path) {
+    if (current.readOnly)
+        return true;
+    const match = /^\/api\/projects\/([^/?#]+)/.exec(path);
+    if (!match)
+        return false;
+    let prefix;
+    try {
+        prefix = decodeURIComponent(match[1]);
+    }
+    catch {
+        prefix = match[1];
+    }
+    return isProjectReadOnly(prefix);
+}
+/**
+ * Temporary: the app is the source of truth for which projects exist, so it
+ * tells overlay. That inverts once projects are created in overlay's admin
+ * views, after which overlay reports them and this goes away.
+ */
+async function reportProjects(base, token, projects) {
+    const response = await fetch(`${base.replace(/\/$/, '')}/projects`, {
+        method: 'PUT',
+        headers: {
+            'Content-Type': 'application/json',
+            ...(token ? { 'X-Overlay-Token': token } : {}),
+        },
+        body: JSON.stringify({ projects }),
+        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+    });
+    if (!response.ok) {
+        throw new Error(`responded ${response.status}`);
+    }
+}
+export function startPolicyPolling(projects = () => []) {
+    const base = process.env.CYBERISMO_OVERLAY_URL;
+    if (!base)
+        return;
+    const token = process.env.CYBERISMO_OVERLAY_TOKEN;
+    const url = `${base.replace(/\/$/, '')}/tenant`;
+    let lastFailure;
+    const poll = async () => {
+        try {
+            const response = await fetch(url, {
+                headers: token ? { 'X-Overlay-Token': token } : {},
+                signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+            });
+            if (!response.ok) {
+                throw new Error(`responded ${response.status}`);
+            }
+            setPolicy(policySchema.parse(await response.json()));
+            if (lastFailure) {
+                console.error(`overlay: ${url} is reachable again`);
+                lastFailure = undefined;
+            }
+        }
+        catch (error) {
+            const reason = error instanceof Error ? error.message : String(error);
+            if (reason !== lastFailure) {
+                lastFailure = reason;
+                console.error(`overlay: ${url} ${reason}, keeping the previous policy`);
+            }
+        }
+    };
+    // Reported every tick from a fresh list, so a project created after start-up
+    // is registered within one interval.
+    let lastReportFailure;
+    const report = async () => {
+        const current = projects();
+        if (current.length === 0)
+            return;
+        try {
+            await reportProjects(base, token, current);
+            lastReportFailure = undefined;
+        }
+        catch (error) {
+            const reason = error instanceof Error ? error.message : String(error);
+            if (reason !== lastReportFailure) {
+                lastReportFailure = reason;
+                console.error(`overlay: could not report projects, ${reason}`);
+            }
+        }
+    };
+    // setInterval does not wait for the previous run, so skip a tick rather than
+    // letting two overlap.
+    let running = false;
+    const tick = async () => {
+        if (running)
+            return;
+        running = true;
+        try {
+            await poll();
+            await report();
+        }
+        finally {
+            running = false;
+        }
+    };
+    void tick();
+    setInterval(() => void tick(), POLL_INTERVAL_MS).unref();
+}
+/**
+ * Hide read-only projects from MCP.
+ *
+ * MCP takes the project as an argument rather than in the path, so the role cap
+ * cannot see which one a call touches. Making a frozen project unresolvable
+ * fails closed, at the cost of hiding it from reads and from administrators too.
+ */
+export function writableProjects(provider) {
+    return {
+        get: (prefix) => isProjectReadOnly(prefix) ? undefined : provider.get(prefix),
+        list: () => provider.list().filter((p) => !isProjectReadOnly(p.prefix)),
+    };
+}
+//# sourceMappingURL=overlay.js.map

package/dist/overlay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"overlay.js","sourceRoot":"","sources":["../src/overlay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;EAWE;AAEF;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,MAAM,YAAY,GAAG,CAAC;KACnB,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;IAClC,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;SACpE,KAAK,CAAC,EAAE,CAAC;CACb,CAAC;KACD,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;AAItB,MAAM,KAAK,GAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAExD,IAAI,OAAO,GAAW,KAAK,CAAC;AAE5B,MAAM,UAAU,SAAS;IACvB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,OAAO,GAAG,MAAM,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,KAAK,IAAI,CAAC;AACzE,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAC3B,IAAY,EACZ,KAAyB,EACzB,QAA8B;IAE9B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,EAAE;QAClE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;QAClC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;KAC9C,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,WAAuC,GAAG,EAAE,CAAC,EAAE;IAE/C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAC/C,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAClD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC;IAEhD,IAAI,WAA+B,CAAC;IAEpC,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;QACtB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAChC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE;gBAClD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;aAC9C,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAClD,CAAC;YACD,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACrD,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,KAAK,CAAC,YAAY,GAAG,qBAAqB,CAAC,CAAC;gBACpD,WAAW,GAAG,SAAS,CAAC;YAC1B,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC3B,WAAW,GAAG,MAAM,CAAC;gBACrB,OAAO,CAAC,KAAK,CAAC,YAAY,GAAG,IAAI,MAAM,+BAA+B,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,6EAA6E;IAC7E,qCAAqC;IACrC,IAAI,iBAAqC,CAAC;IAC1C,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;QACxB,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACjC,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YAC3C,iBAAiB,GAAG,SAAS,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,IAAI,MAAM,KAAK,iBAAiB,EAAE,CAAC;gBACjC,iBAAiB,GAAG,MAAM,CAAC;gBAC3B,OAAO,CAAC,KAAK,CAAC,uCAAuC,MAAM,EAAE,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,6EAA6E;IAC7E,uBAAuB;IACvB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;QACtB,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;YACb,MAAM,MAAM,EAAE,CAAC;QACjB,CAAC;gBAAS,CAAC;YACT,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,IAAI,EAAE,CAAC;IACZ,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC,KAAK,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAyB;IACxD,OAAO;QACL,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,CACd,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;QAC9D,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;KACxE,CAAC;AACJ,CAAC"}

package/dist/project-errors.d.ts

@@ -0,0 +1,18 @@
+/**
+  Cyberismo
+  Copyright © Cyberismo Ltd and contributors 2026
+  This program is free software: you can redistribute it and/or modify it under
+  the terms of the GNU Affero General Public License version 3 as published by
+  the Free Software Foundation.
+  This program is distributed in the hope that it will be useful, but WITHOUT
+  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+  FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+  details. You should have received a copy of the GNU Affero General Public
+  License along with this program. If not, see <https://www.gnu.org/licenses/>.
+*/
+export interface ProjectErrors {
+    prefix: string;
+    errors: string[];
+}
+/** Formats errors as one block per project, capping each at `limit` lines. */
+export declare function formatProjectErrors(groups: ProjectErrors[], limit?: number): string;

package/dist/project-errors.js

@@ -0,0 +1,25 @@
+/**
+  Cyberismo
+  Copyright © Cyberismo Ltd and contributors 2026
+  This program is free software: you can redistribute it and/or modify it under
+  the terms of the GNU Affero General Public License version 3 as published by
+  the Free Software Foundation.
+  This program is distributed in the hope that it will be useful, but WITHOUT
+  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+  FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+  details. You should have received a copy of the GNU Affero General Public
+  License along with this program. If not, see <https://www.gnu.org/licenses/>.
+*/
+/** Formats errors as one block per project, capping each at `limit` lines. */
+export function formatProjectErrors(groups, limit = 10) {
+    const heading = `${groups.length} ${groups.length === 1 ? 'project has' : 'projects have'} errors:`;
+    const blocks = groups.map(({ prefix, errors }) => {
+        const lines = errors.slice(0, limit).map((e) => `  ${e}`);
+        if (errors.length > limit) {
+            lines.push(`  … ${errors.length - limit} more`);
+        }
+        return `${prefix} (${errors.length}):\n${lines.join('\n')}`;
+    });
+    return [heading, ...blocks].join('\n\n');
+}
+//# sourceMappingURL=project-errors.js.map

package/dist/project-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-errors.js","sourceRoot":"","sources":["../src/project-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;EAWE;AAOF,8EAA8E;AAC9E,MAAM,UAAU,mBAAmB,CACjC,MAAuB,EACvB,QAAgB,EAAE;IAElB,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,UAAU,CAAC;IACpG,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;QAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1D,IAAI,MAAM,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,MAAM,GAAG,KAAK,OAAO,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,GAAG,MAAM,KAAK,MAAM,CAAC,MAAM,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC9D,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC3C,CAAC"}

package/dist/project-registry.d.ts

@@ -11,6 +11,8 @@
   License along with this program. If not, see <https://www.gnu.org/licenses/>.
 */
 import { CommandManager, type ProjectProvider } from '@cyberismo/data-handler';
+import { ProjectEvents } from './domain/events/project-events.js';
+import type { ProjectErrors } from './project-errors.js';
 export type ProjectRegistryEntry = {
     prefix: string;
     commands: CommandManager;
@@ -29,11 +31,13 @@ export interface ScannedProject {
 }
 export declare class ProjectRegistry implements ProjectProvider {
     private projects;
+    private events;
     readonly options: ConstructorParameters<typeof CommandManager>[1];
     constructor(entries?: ProjectRegistryEntry[], options?: ConstructorParameters<typeof CommandManager>[1]);
     get(prefix: string): CommandManager | undefined;
     has(prefix: string): boolean;
     add(prefix: string, commands: CommandManager): void;
+    eventsFor(commands: CommandManager): ProjectEvents;
     list(): ProjectListItem[];
     /** Iterate over all registered CommandManagers. */
     values(): IterableIterator<CommandManager>;
@@ -52,6 +56,10 @@ export declare class ProjectRegistry implements ProjectProvider {
     static fromCommandManager(commands: CommandManager): ProjectRegistry;
     /**
      * Build a registry from scanned project entries, initializing each CommandManager.
+     * A project that fails to load is left out and reported in `failed`.
      */
-    static fromScannedProjects(projects: ScannedProject[], options?: ConstructorParameters<typeof CommandManager>[1]): Promise<ProjectRegistry>;
+    static fromScannedProjects(projects: ScannedProject[], options?: ConstructorParameters<typeof CommandManager>[1]): Promise<{
+        registry: ProjectRegistry;
+        failed: ProjectErrors[];
+    }>;
 }

package/dist/project-registry.js

@@ -11,8 +11,10 @@
   License along with this program. If not, see <https://www.gnu.org/licenses/>.
 */
 import { CommandManager } from '@cyberismo/data-handler';
+import { ProjectEvents } from './domain/events/project-events.js';
 export class ProjectRegistry {
     projects = new Map();
+    events = new Map();
     options;
     constructor(entries = [], options) {
         this.options = options;
@@ -32,6 +34,17 @@ export class ProjectRegistry {
         }
         this.projects.set(prefix, commands);
     }
+    eventsFor(commands) {
+        let events = this.events.get(commands);
+        if (!events) {
+            if (![...this.projects.values()].includes(commands)) {
+                throw new Error('Project is not registered');
+            }
+            events = new ProjectEvents();
+            this.events.set(commands, events);
+        }
+        return events;
+    }
     list() {
         return Array.from(this.projects.entries()).map(([prefix, commands]) => ({
             prefix,
@@ -49,6 +62,10 @@ export class ProjectRegistry {
         return first;
     }
     dispose() {
+        for (const events of this.events.values()) {
+            events.dispose();
+        }
+        this.events.clear();
         for (const commands of this.projects.values()) {
             commands.project.dispose();
         }
@@ -60,12 +77,9 @@ export class ProjectRegistry {
      * reset endpoint to swap project state without restarting the Hono app.
      */
     async replace(entries) {
-        for (const commands of this.projects.values()) {
-            commands.project.dispose();
-        }
-        this.projects.clear();
+        this.dispose();
         for (const entry of entries) {
-            this.projects.set(entry.prefix, entry.commands);
+            this.add(entry.prefix, entry.commands);
         }
     }
     /**
@@ -79,15 +93,29 @@ export class ProjectRegistry {
     }
     /**
      * Build a registry from scanned project entries, initializing each CommandManager.
+     * A project that fails to load is left out and reported in `failed`.
      */
     static async fromScannedProjects(projects, options) {
         const entries = [];
+        const failed = [];
         for (const project of projects) {
-            const commands = new CommandManager(project.path, options);
-            await commands.initialize();
-            entries.push({ prefix: project.prefix, commands });
+            let commands;
+            try {
+                commands = new CommandManager(project.path, options);
+                await commands.initialize();
+                entries.push({ prefix: project.prefix, commands });
+            }
+            catch (error) {
+                commands?.project.dispose();
+                failed.push({
+                    prefix: project.prefix,
+                    errors: [
+                        `Failed to load project (${project.path}): ${error instanceof Error ? error.message : String(error)}`,
+                    ],
+                });
+            }
         }
-        return new ProjectRegistry(entries, options);
+        return { registry: new ProjectRegistry(entries, options), failed };
     }
 }
 //# sourceMappingURL=project-registry.js.map