@ferrule-io/ok-fine 0.3.6 → 0.3.8

package/README.md

@@ -9,6 +9,7 @@ from your own identity provider.
 - Every change is a git commit, attributed to the writing agent or human, with optional two-way sync to a remote.
 - Full-text keyword search (BM25), trust tiers (`unverified` → `machine-confirmed` → `human-reviewed`), staleness,
   link graph, and OKF conformance linting.
+- A read-only web UI at `/ui/` for browsing projects, concepts, links, history, and lint results.
 - Ships as an npm package (`npx @ferrule-io/ok-fine`), a container image, and a Helm chart.
 
 ## Quick start (local)
@@ -20,11 +21,11 @@ claude mcp add --scope user ok-fine -- npx -y @ferrule-io/ok-fine
 ```
 
 Other harnesses: [Coding agents](https://github.com/ferrule-io/ok-fine/wiki/Coding-Agents#local-setup-stdio). Git
-remotes, flags, and several concurrent sessions: [Running locally](https://github.com/ferrule-io/ok-fine/wiki/Running-Locally).
+remotes, flags, and concurrent sessions: [Running locally](https://github.com/ferrule-io/ok-fine/wiki/Running-Locally).
 
 ### HTTP server (REST + MCP)
 
-> **Warning:** `--no-auth` / `AUTH_MODE=none` disables authentication completely and gives every caller full admin access. Never expose it beyond localhost.
+> **Warning:** `--no-auth` / `AUTH_MODE=none` disables authentication completely and gives every caller full admin access. Never expose it beyond localhost. `--no-auth` refuses to start on a non-loopback `--host`/`HOST` (127.0.0.0/8, ::1, localhost) unless `ALLOW_UNAUTHENTICATED_NETWORK=true`.
 
 ```sh
 npx -y @ferrule-io/ok-fine serve --no-auth
@@ -33,7 +34,7 @@ npx -y @ferrule-io/ok-fine serve --no-auth
 Or with Docker (requires Docker):
 
 ```sh
-docker run --rm -p 127.0.0.1:8080:8080 -e AUTH_MODE=none -e PUBLIC_BASE_URL=http://localhost:8080 -v okf-data:/data ghcr.io/ferrule-io/ok-fine:latest
+docker run --rm -p 127.0.0.1:8080:8080 -e AUTH_MODE=none -e ALLOW_UNAUTHENTICATED_NETWORK=true -e PUBLIC_BASE_URL=http://localhost:8080 -v okf-data:/data ghcr.io/ferrule-io/ok-fine:latest
 ```
 
 Or, from a checkout, with Docker Compose (pulls the published image, or builds it from source when the pull fails):
@@ -70,7 +71,7 @@ curl -s -X PUT localhost:8080/api/v1/projects/demo/concepts/tables/orders \
 curl -s "localhost:8080/api/v1/search?q=orders"
 ```
 
-Next, [connect an MCP client](https://github.com/ferrule-io/ok-fine/wiki/Connecting-an-MCP-Client) to `http://localhost:8080/mcp`.
+Browse it at http://localhost:8080/ui/. Next, [connect an MCP client](https://github.com/ferrule-io/ok-fine/wiki/Connecting-an-MCP-Client) to `http://localhost:8080/mcp`.
 
 ## Documentation
 

package/dist/auth/discovery.js

@@ -51,6 +51,17 @@ export async function discoverAuthorizationServer(issuer, options) {
     if (!jwksUri) {
         throw new Error(`authorization server discovery failed for ${issuer}: missing jwks_uri`);
     }
+    const allowInsecureIssuer = options?.allowInsecureIssuer === true;
+    let parsedJwks;
+    try {
+        parsedJwks = new URL(jwksUri);
+    }
+    catch {
+        throw new Error(`authorization server discovery failed for ${issuer}: invalid jwks_uri`);
+    }
+    if (parsedJwks.protocol !== "https:" && !allowInsecureIssuer) {
+        throw new Error(`authorization server discovery failed for ${issuer}: jwks_uri must be https`);
+    }
     return { metadata, jwksUri };
 }
 //# sourceMappingURL=discovery.js.map

package/dist/auth/verifier.js

@@ -8,10 +8,12 @@ export class JwtTokenVerifier {
     audiences;
     identityClaims;
     jwks;
+    access;
     constructor(options) {
         this.issuer = options.issuer;
         this.audiences = options.audiences;
         this.identityClaims = options.identityClaims;
+        this.access = options.access;
         this.jwks = createRemoteJWKSet(new URL(options.jwksUri), {
             cooldownDuration: 30000,
             cacheMaxAge: 600000,
@@ -82,11 +84,52 @@ export class JwtTokenVerifier {
                 break;
             }
         }
+        if (this.access) {
+            const { allowedSubjects, allowedEmails, requiredGroups, groupsClaim, allowedClientIds } = this.access;
+            if (allowedSubjects.length > 0 || allowedEmails.length > 0) {
+                const sub = typeof payload.sub === "string" ? payload.sub : undefined;
+                const subMatch = sub !== undefined && allowedSubjects.includes(sub);
+                const email = typeof payload.email === "string" ? payload.email.toLowerCase() : undefined;
+                const emailVerified = payload.email_verified === true;
+                const emailMatch = emailVerified && email !== undefined && allowedEmails.includes(email);
+                if (!subMatch && !emailMatch) {
+                    throw new OAuthError(OAuthErrorCode.InsufficientScope, "token not permitted by this server's access policy");
+                }
+            }
+            if (requiredGroups.length > 0) {
+                const groupsVal = payload[groupsClaim];
+                let tokenGroups = [];
+                if (typeof groupsVal === "string") {
+                    tokenGroups = [groupsVal];
+                }
+                else if (Array.isArray(groupsVal)) {
+                    tokenGroups = groupsVal.filter((g) => typeof g === "string");
+                }
+                const hasRequiredGroup = tokenGroups.some((g) => requiredGroups.includes(g));
+                if (!hasRequiredGroup) {
+                    throw new OAuthError(OAuthErrorCode.InsufficientScope, "token not permitted by this server's access policy");
+                }
+            }
+            if (allowedClientIds.length > 0) {
+                const clientIds = [payload.azp, payload.client_id, payload.cid].filter((v) => typeof v === "string" && v.length > 0);
+                const clientAllowed = clientIds.some((id) => allowedClientIds.includes(id));
+                if (!clientAllowed) {
+                    throw new OAuthError(OAuthErrorCode.InsufficientScope, "token not permitted by this server's access policy");
+                }
+            }
+        }
         let identity = null;
         for (const claim of this.identityClaims) {
+            if (claim === "email" && payload.email_verified !== true) {
+                continue;
+            }
             const val = payload[claim];
             if (typeof val === "string" && val.trim().length > 0) {
-                identity = val.trim();
+                const trimmed = val.trim();
+                if (claim !== "email" && claim !== "sub" && trimmed.includes("@")) {
+                    continue;
+                }
+                identity = trimmed;
                 break;
             }
         }

package/dist/cli-options.js

@@ -3,7 +3,7 @@ import { parseArgs } from "node:util";
 export const USAGE = `Usage: ok-fine [stdio|serve] [options]
 
 Commands:
-  stdio (default)          Serve MCP over stdin/stdout for one local client
+  stdio (default)          Serve MCP over stdin/stdout
   serve                    Serve MCP and the REST API over HTTP
 
 Options:

package/dist/cli.js

@@ -5,7 +5,8 @@ import { pino } from "pino";
 import { parseCli, USAGE } from "./cli-options.js";
 import { loadConfig, loadStorageConfig } from "./config.js";
 import { lockDataDir } from "./data-dir-lock.js";
-import { startServer, startStdioServer } from "./server.js";
+import { startLocalHost, startServer } from "./server.js";
+import { startStdioProxy } from "./stdio-proxy.js";
 import { VERSION } from "./version.js";
 const message = (err) => (err instanceof Error ? err.message : String(err));
 /** `git config user.email` in the launch directory; null when unset or git is unavailable. Not `Git`: it forces ok-fine's own email. */
@@ -57,26 +58,23 @@ if (inv.command === "stdio") {
     }
     // stdout carries JSON-RPC only; every log line goes to stderr.
     const log = pino({ level: config.logLevel }, pino.destination({ dest: 2, sync: true }));
-    try {
-        const release = await lockDataDir(config.dataDir);
-        process.once("exit", release);
-    }
-    catch (err) {
-        log.error(message(err));
-        process.exit(1);
-    }
     const identity = await localGitEmail(inv.env);
     log.info({ dataDir: config.dataDir, identity }, "serving MCP over stdio");
-    let server;
+    let proxy;
     try {
-        server = await startStdioServer(config, { log, identity });
+        proxy = await startStdioProxy({
+            config,
+            identity,
+            log,
+            startHost: () => startLocalHost(config, { log }),
+        });
     }
     catch (err) {
         log.error({ err }, "ok-fine failed to start");
         process.exit(1);
     }
-    const shutdown = shutdownOnce(() => server.close(), (err) => log.error({ err }, "shutdown failed"));
-    void server.done.then(shutdown);
+    const shutdown = shutdownOnce(() => proxy.close(), (err) => log.error({ err }, "shutdown failed"));
+    void proxy.done.then(shutdown);
     process.once("SIGINT", shutdown);
     process.once("SIGTERM", shutdown);
 }
@@ -99,7 +97,7 @@ else {
     }
     let server;
     try {
-        server = await startServer(config);
+        server = await startServer(config, { hostEndpoint: config.auth.mode === "none" });
     }
     catch (err) {
         console.error("ok-fine failed to start:", err);

package/dist/config.js

@@ -1,3 +1,4 @@
+import { isIPv4 } from "node:net";
 import { z } from "zod";
 /** A whole-string decimal integer env var (rejects `8080junk`, `1x`, `1.5`, and blanks). */
 function intEnv(name, fallback, min, max = Number.MAX_SAFE_INTEGER) {
@@ -30,6 +31,41 @@ function httpUrl(value) {
         return false;
     }
 }
+function isLoopbackHost(host) {
+    const normalized = host.trim().toLowerCase();
+    if (normalized === "localhost" || normalized === "::1" || normalized === "[::1]") {
+        return true;
+    }
+    if (isIPv4(normalized)) {
+        const octets = normalized.split(".");
+        if (octets[0] === "127") {
+            return true;
+        }
+    }
+    return false;
+}
+function parseTrustProxy(val) {
+    if (val === undefined || val === "") {
+        return "loopback,linklocal,uniquelocal";
+    }
+    const trimmed = val.trim();
+    if (trimmed === "true")
+        return true;
+    if (trimmed === "false")
+        return false;
+    if (/^\d+$/.test(trimmed)) {
+        return Number.parseInt(trimmed, 10);
+    }
+    return trimmed;
+}
+function parseList(val) {
+    if (!val)
+        return [];
+    return val
+        .split(",")
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+}
 const storageEnvShape = {
     LOG_LEVEL: z.enum(["fatal", "error", "warn", "info", "debug", "trace", "silent"]).default("info"),
     DATA_DIR: z
@@ -62,7 +98,29 @@ const httpEnvShape = {
     OAUTH_SCOPE_ADMIN: z.string().default("okf:admin"),
     OAUTH_IDENTITY_CLAIMS: z.string().default("email,preferred_username,sub"),
     OAUTH_ALLOW_INSECURE_ISSUER: z.string().optional(),
+    OAUTH_ALLOWED_SUBJECTS: z.string().optional(),
+    OAUTH_ALLOWED_EMAILS: z.string().optional(),
+    OAUTH_REQUIRED_GROUPS: z.string().optional(),
+    OAUTH_GROUPS_CLAIM: z.string().default("groups"),
+    OAUTH_ALLOWED_CLIENT_IDS: z.string().optional(),
+    ALLOW_UNAUTHENTICATED_NETWORK: z.string().optional(),
+    TRUST_PROXY: z.string().optional(),
+    OAUTH_UI_CLIENT_ID: z.string().optional(),
 };
+function isValidGitRemoteUrl(url) {
+    if (url.startsWith("/") || url.startsWith("https://") || url.startsWith("ssh://") || url.startsWith("file://")) {
+        return true;
+    }
+    if (!url.includes("://")) {
+        const at = url.indexOf("@");
+        const colon = url.indexOf(":");
+        if (at !== -1 && colon !== -1 && at < colon) {
+            const slash = url.indexOf("/");
+            return slash === -1 || slash > colon;
+        }
+    }
+    return false;
+}
 function refineGitCredentials(data, ctx) {
     if (!data || typeof data !== "object")
         return;
@@ -73,11 +131,45 @@ function refineGitCredentials(data, ctx) {
             message: "GIT_HTTP_USERNAME and GIT_HTTP_PASSWORD must be provided together or neither",
         });
     }
+    if (data.GIT_REMOTE_URL !== undefined && !isValidGitRemoteUrl(data.GIT_REMOTE_URL)) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["GIT_REMOTE_URL"],
+            message: "GIT_REMOTE_URL must be https://, ssh://, user@host:path, file:// or an absolute path",
+        });
+    }
+    if (data.GIT_SSH_KEY_PATH?.trim() && !data.GIT_SSH_KNOWN_HOSTS_PATH?.trim()) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["GIT_SSH_KNOWN_HOSTS_PATH"],
+            message: "GIT_SSH_KNOWN_HOSTS_PATH is required when GIT_SSH_KEY_PATH is set",
+        });
+    }
 }
 const rawEnvSchema = z.object({ ...httpEnvShape, ...storageEnvShape }).superRefine((data, ctx) => {
     if (!data || typeof data !== "object")
         return;
     refineGitCredentials(data, ctx);
+    if (data.AUTH_MODE === "none") {
+        const isLoopback = isLoopbackHost(data.HOST ?? "0.0.0.0");
+        const allowUnauthenticated = data.ALLOW_UNAUTHENTICATED_NETWORK === "true";
+        if (!isLoopback && !allowUnauthenticated) {
+            ctx.addIssue({
+                code: "custom",
+                path: ["HOST"],
+                message: "AUTH_MODE=none requires a loopback HOST (127.0.0.0/8, ::1, localhost); set ALLOW_UNAUTHENTICATED_NETWORK=true only behind a loopback-only port mapping",
+            });
+        }
+    }
+    if (data.ALLOW_UNAUTHENTICATED_NETWORK !== undefined &&
+        data.ALLOW_UNAUTHENTICATED_NETWORK !== "true" &&
+        data.ALLOW_UNAUTHENTICATED_NETWORK !== "false") {
+        ctx.addIssue({
+            code: "custom",
+            path: ["ALLOW_UNAUTHENTICATED_NETWORK"],
+            message: "ALLOW_UNAUTHENTICATED_NETWORK must be true or false",
+        });
+    }
     if (data.AUTH_MODE === "oidc") {
         if (data.OAUTH_ISSUER === undefined) {
             ctx.addIssue({
@@ -93,12 +185,29 @@ const rawEnvSchema = z.object({ ...httpEnvShape, ...storageEnvShape }).superRefi
                 message: "OAUTH_ISSUER must be a valid URL",
             });
         }
-        if (data.OAUTH_JWKS_URI !== undefined && !httpUrl(data.OAUTH_JWKS_URI)) {
-            ctx.addIssue({
-                code: "custom",
-                path: ["OAUTH_JWKS_URI"],
-                message: "OAUTH_JWKS_URI must be a valid URL",
-            });
+        if (data.OAUTH_JWKS_URI !== undefined) {
+            if (!httpUrl(data.OAUTH_JWKS_URI)) {
+                ctx.addIssue({
+                    code: "custom",
+                    path: ["OAUTH_JWKS_URI"],
+                    message: "OAUTH_JWKS_URI must be a valid URL",
+                });
+            }
+            else {
+                try {
+                    const parsed = new URL(data.OAUTH_JWKS_URI);
+                    if (parsed.protocol !== "https:" && data.OAUTH_ALLOW_INSECURE_ISSUER !== "true") {
+                        ctx.addIssue({
+                            code: "custom",
+                            path: ["OAUTH_JWKS_URI"],
+                            message: "OAUTH_JWKS_URI must be https unless OAUTH_ALLOW_INSECURE_ISSUER=true",
+                        });
+                    }
+                }
+                catch {
+                    // Handled by httpUrl
+                }
+            }
         }
         if (data.OAUTH_ALLOW_INSECURE_ISSUER !== undefined &&
             data.OAUTH_ALLOW_INSECURE_ISSUER !== "true" &&
@@ -150,6 +259,8 @@ export function loadConfig(env = process.env, options = {}) {
         throw formatConfigError(result.error);
     const raw = result.data;
     const publicBaseUrl = raw.PUBLIC_BASE_URL.replace(/\/+$/, "");
+    const trustProxy = parseTrustProxy(raw.TRUST_PROXY);
+    const allowUnauthenticatedNetwork = raw.ALLOW_UNAUTHENTICATED_NETWORK === "true";
     let auth;
     if (raw.AUTH_MODE === "none") {
         auth = { mode: "none" };
@@ -171,6 +282,15 @@ export function loadConfig(env = process.env, options = {}) {
             .map((s) => s.trim())
             .filter((s) => s.length > 0);
         const allowInsecureIssuer = raw.OAUTH_ALLOW_INSECURE_ISSUER === "true";
+        const uiClientId = raw.OAUTH_UI_CLIENT_ID?.trim();
+        const groupsClaim = raw.OAUTH_GROUPS_CLAIM && raw.OAUTH_GROUPS_CLAIM.trim().length > 0 ? raw.OAUTH_GROUPS_CLAIM.trim() : "groups";
+        const access = {
+            allowedSubjects: parseList(raw.OAUTH_ALLOWED_SUBJECTS),
+            allowedEmails: parseList(raw.OAUTH_ALLOWED_EMAILS).map((s) => s.toLowerCase()),
+            requiredGroups: parseList(raw.OAUTH_REQUIRED_GROUPS),
+            groupsClaim,
+            allowedClientIds: parseList(raw.OAUTH_ALLOWED_CLIENT_IDS),
+        };
         auth = {
             mode: "oidc",
             issuer: raw.OAUTH_ISSUER,
@@ -178,6 +298,8 @@ export function loadConfig(env = process.env, options = {}) {
             ...(raw.OAUTH_JWKS_URI === undefined ? {} : { jwksUri: raw.OAUTH_JWKS_URI }),
             identityClaims,
             allowInsecureIssuer,
+            access,
+            ...(uiClientId ? { uiClientId } : {}),
         };
     }
     return {
@@ -191,6 +313,8 @@ export function loadConfig(env = process.env, options = {}) {
             write: raw.OAUTH_SCOPE_WRITE,
             admin: raw.OAUTH_SCOPE_ADMIN,
         },
+        allowUnauthenticatedNetwork,
+        trustProxy,
     };
 }
 //# sourceMappingURL=config.js.map

package/dist/data-dir-lock.js

@@ -1,43 +1,52 @@
 import { readFileSync, unlinkSync } from "node:fs";
 import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
-import { join } from "node:path";
-function errorCode(err) {
-    return err?.code;
-}
-function isRunning(pid) {
+import { join, resolve } from "node:path";
+/** Checks if a process with the given PID is alive. */
+export function isProcessAlive(pid) {
     try {
         process.kill(pid, 0);
         return true;
     }
     catch (err) {
-        return errorCode(err) === "EPERM";
+        return err?.code === "EPERM";
     }
 }
+/** In-process tracking so concurrent sessions in the same process do not clobber each other's locks. */
+const inProcessLocks = new Set();
 /**
- * Takes the exclusive per-data-dir lock for a local CLI process; a lock left by a dead process is taken over.
- * Returns a synchronous release, safe to call from `process.on("exit")`.
+ * Attempts to acquire the exclusive per-data-dir lock without throwing.
+ * Returns a release function (callable directly or via .release()) on success,
+ * or { acquired: false, holderPid } when held by another process or concurrent session.
  */
-export async function lockDataDir(dataDir) {
+export async function tryLockDataDir(dataDir) {
+    const canonicalDir = resolve(dataDir);
+    if (inProcessLocks.has(canonicalDir)) {
+        return { acquired: false, holderPid: process.pid };
+    }
     await mkdir(dataDir, { recursive: true });
     const lockPath = join(dataDir, "ok-fine.lock");
     const pid = String(process.pid);
-    let holder = "unknown";
     for (let attempt = 0; attempt < 2; attempt++) {
         try {
             await writeFile(lockPath, `${pid}\n`, { flag: "wx" });
-            return () => {
+            inProcessLocks.add(canonicalDir);
+            const releaseFn = (() => {
+                inProcessLocks.delete(canonicalDir);
                 try {
                     if (readFileSync(lockPath, "utf8").trim() === pid)
                         unlinkSync(lockPath);
                 }
                 catch (err) {
-                    if (errorCode(err) !== "ENOENT")
+                    if (err?.code !== "ENOENT")
                         throw err;
                 }
-            };
+            });
+            releaseFn.acquired = true;
+            releaseFn.release = releaseFn;
+            return releaseFn;
         }
         catch (err) {
-            if (errorCode(err) !== "EEXIST")
+            if (err?.code !== "EEXIST")
                 throw err;
         }
         let content;
@@ -45,16 +54,46 @@ export async function lockDataDir(dataDir) {
             content = (await readFile(lockPath, "utf8")).trim();
         }
         catch (err) {
-            if (errorCode(err) === "ENOENT")
+            if (err?.code === "ENOENT")
                 continue;
             throw err;
         }
-        holder = content || "unknown";
         const holderPid = Number.parseInt(content, 10);
-        if (Number.isInteger(holderPid) && holderPid > 0 && holderPid !== process.pid && isRunning(holderPid))
-            break;
+        if (Number.isInteger(holderPid) && holderPid > 0) {
+            if (holderPid !== process.pid && isProcessAlive(holderPid)) {
+                return { acquired: false, holderPid };
+            }
+            if (holderPid === process.pid && inProcessLocks.has(canonicalDir)) {
+                return { acquired: false, holderPid: process.pid };
+            }
+        }
         await rm(lockPath, { force: true });
     }
-    throw new Error(`ok-fine is already running on ${dataDir} (pid ${holder}). One process serves a data directory: connect more clients to \`ok-fine serve\` over HTTP, or pass a different --data-dir. If no ok-fine process is running, delete ${lockPath}.`);
+    let content = null;
+    try {
+        content = (await readFile(lockPath, "utf8")).trim();
+    }
+    catch {
+        // ignore
+    }
+    const finalHolder = content ? Number.parseInt(content, 10) : null;
+    return {
+        acquired: false,
+        holderPid: finalHolder !== null && Number.isInteger(finalHolder) && finalHolder > 0 ? finalHolder : null,
+    };
+}
+/**
+ * Takes the exclusive per-data-dir lock for a local CLI process; a lock left by a dead process is taken over.
+ * Returns a synchronous release, safe to call from `process.on("exit")`.
+ * Throws if already held by a live process or concurrent session.
+ */
+export async function lockDataDir(dataDir) {
+    const result = await tryLockDataDir(dataDir);
+    if (result.acquired) {
+        return result;
+    }
+    const lockPath = join(dataDir, "ok-fine.lock");
+    const holder = result.holderPid ?? "unknown";
+    throw new Error(`ok-fine is already running on ${dataDir} (pid ${holder}). Close existing ok-fine sessions or pass a different --data-dir. If no ok-fine process is running, delete ${lockPath}.`);
 }
 //# sourceMappingURL=data-dir-lock.js.map

package/dist/http/rest.js

@@ -90,7 +90,7 @@ const CONTENT_TYPE_BY_EXTENSION = {
     ".json": "application/json",
 };
 const searchQuery = z.object({
-    q: z.string().optional(),
+    q: z.string().max(512).optional(),
     project: z.string().optional(),
     type: z.string().optional(),
     tag: z.union([z.string(), z.array(z.string())]).optional(),

package/dist/http/ui.js

@@ -0,0 +1,118 @@
+import { readdir, readFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+/** <package>/dist/ui from both src/http (vitest) and dist/http (build). */
+export const DEFAULT_UI_DIR = fileURLToPath(new URL("../../dist/ui/", import.meta.url));
+const CONTENT_TYPES = {
+    ".html": "text/html; charset=utf-8",
+    ".js": "text/javascript; charset=utf-8",
+    ".css": "text/css; charset=utf-8",
+    ".svg": "image/svg+xml",
+    ".png": "image/png",
+    ".ico": "image/x-icon",
+    ".woff2": "font/woff2",
+    ".woff": "font/woff",
+    ".json": "application/json",
+    ".webmanifest": "application/manifest+json",
+    ".txt": "text/plain; charset=utf-8",
+};
+const IMMUTABLE = "public, max-age=31536000, immutable";
+/** Unique origins of the string http(s) URLs among `endpoints`; ignores anything else. */
+export function endpointOrigins(...endpoints) {
+    const origins = new Set();
+    for (const endpoint of endpoints) {
+        if (typeof endpoint !== "string")
+            continue;
+        let url;
+        try {
+            url = new URL(endpoint);
+        }
+        catch {
+            continue;
+        }
+        if (url.protocol === "http:" || url.protocol === "https:")
+            origins.add(url.origin);
+    }
+    return [...origins];
+}
+async function loadAssets(dir) {
+    let entries;
+    try {
+        entries = await readdir(dir, { recursive: true, withFileTypes: true });
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return null;
+        throw err;
+    }
+    const assets = new Map();
+    for (const entry of entries) {
+        if (!entry.isFile())
+            continue;
+        const abs = path.join(entry.parentPath, entry.name);
+        const rel = path.relative(dir, abs).split(path.sep).join("/");
+        assets.set(rel, {
+            body: await readFile(abs),
+            type: CONTENT_TYPES[path.extname(entry.name).toLowerCase()] ?? "application/octet-stream",
+            cache: rel.startsWith("assets/") ? IMMUTABLE : "no-cache",
+        });
+    }
+    return assets.has("index.html") ? assets : null;
+}
+/** Serves the built web UI from memory under /ui/. Returns false (and registers nothing) when `<dir>/index.html` is missing. */
+export async function registerUiRoutes(app, options) {
+    const assets = await loadAssets(options.dir);
+    const index = assets?.get("index.html");
+    if (!assets || !index) {
+        app.log.warn({ dir: options.dir }, "web UI assets not found; /ui disabled");
+        return false;
+    }
+    const csp = [
+        "default-src 'self'",
+        "script-src 'self'",
+        // Shiki emits inline style attributes.
+        "style-src 'self' 'unsafe-inline'",
+        "img-src 'self' data: https:",
+        "font-src 'self' data:",
+        `connect-src 'self'${options.connectSrc.map((origin) => ` ${origin}`).join("")}`,
+        "object-src 'none'",
+        "base-uri 'none'",
+        "form-action 'none'",
+        "frame-ancestors 'none'",
+    ].join("; ");
+    const sendHtml = (reply) => reply
+        .header("content-type", "text/html; charset=utf-8")
+        .header("cache-control", "no-cache")
+        .header("referrer-policy", "no-referrer")
+        .header("x-frame-options", "DENY")
+        .header("x-content-type-options", "nosniff")
+        .header("content-security-policy", csp)
+        .send(index.body);
+    app.get("/", async (_req, reply) => reply.redirect("/ui/", 302));
+    app.get("/ui", async (_req, reply) => reply.redirect("/ui/", 301));
+    app.get("/ui/config.json", async (_req, reply) => reply.header("cache-control", "no-store").header("x-content-type-options", "nosniff").send(options.clientConfig));
+    app.get("/ui/*", async (req, reply) => {
+        const rel = req.params["*"];
+        if (rel === "" || rel === "index.html")
+            return sendHtml(reply);
+        const asset = assets.get(rel);
+        if (asset) {
+            return reply
+                .header("content-type", asset.type)
+                .header("cache-control", asset.cache)
+                .header("x-content-type-options", "nosniff")
+                .send(asset.body);
+        }
+        const last = rel.slice(rel.lastIndexOf("/") + 1);
+        if (/\.[A-Za-z0-9]+$/.test(last)) {
+            return reply
+                .code(404)
+                .header("x-content-type-options", "nosniff")
+                .send({ error: { code: "not_found", message: "not found" } });
+        }
+        return sendHtml(reply);
+    });
+    app.log.info({ url: `${options.publicBaseUrl}/ui/` }, "web UI enabled");
+    return true;
+}
+//# sourceMappingURL=ui.js.map