@frontmcp/plugin-dashboard 1.7.1 → 1.7.2

package/app/dashboard.app.d.ts

@@ -1,5 +1,5 @@
-import { DynamicPlugin, ProviderType } from '@frontmcp/sdk';
-import { DashboardPluginOptions, DashboardPluginOptionsInput } from '../dashboard.types';
+import { DynamicPlugin, type ProviderType } from '@frontmcp/sdk';
+import { type DashboardPluginOptions, type DashboardPluginOptionsInput } from '../dashboard.types';
 /**
  * Internal Dashboard HTTP Plugin.
  *

package/app/dashboard.app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard.app.d.ts","sourceRoot":"","sources":["../../src/app/dashboard.app.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,aAAa,EAMb,YAAY,EAGb,MAAM,eAAe,CAAC;AAIvB,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAI5B,MAAM,oBAAoB,CAAC;AAmD5B;;;;;GAKG;AACH,cAIM,mBAAoB,SAAQ,aAAa,CAAC,sBAAsB,EAAE,2BAA2B,CAAC;IAClG,OAAO,EAAE,sBAAsB,CAAC;gBAEpB,OAAO,GAAE,2BAAgC;IAQrD;;OAEG;WACa,gBAAgB,CAAC,OAAO,EAAE,2BAA2B,GAAG,YAAY,EAAE;CAyBvF;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBAgCa,YAAY;CAAG;AAG5B,OAAO,EAAE,mBAAmB,EAAE,CAAC"}
+{"version":3,"file":"dashboard.app.d.ts","sourceRoot":"","sources":["../../src/app/dashboard.app.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,aAAa,EAOb,KAAK,YAAY,EAGlB,MAAM,eAAe,CAAC;AAOvB,OAAO,EAIL,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EACjC,MAAM,oBAAoB,CAAC;AAmE5B;;;;;GAKG;AACH,cAIM,mBAAoB,SAAQ,aAAa,CAAC,sBAAsB,EAAE,2BAA2B,CAAC;IAClG,OAAO,EAAE,sBAAsB,CAAC;gBAEpB,OAAO,GAAE,2BAAgC;IAQrD;;OAEG;WACa,gBAAgB,CAAC,OAAO,EAAE,2BAA2B,GAAG,YAAY,EAAE;CA+BvF;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBAmCa,YAAY;CAAG;AAG5B,OAAO,EAAE,mBAAmB,EAAE,CAAC"}

package/auth/dashboard-auth.d.ts

@@ -0,0 +1,32 @@
+import type { DashboardAuth } from '../dashboard.types';
+/**
+ * Token check for the dashboard's HTTP surface (GHSA-rgxj-434m-vxh3).
+ *
+ * `auth.token` was documented and schema-validated but never read, so a
+ * dashboard an operator believed was protected served its page — and, through
+ * its MCP scope, the whole server's inventory — to anyone.
+ *
+ * Shaped after `SkillHttpAuthValidator` in the SDK, which is the in-repo pattern
+ * for gating an HTTP surface on a shared secret.
+ */
+export interface DashboardAuthRequest {
+    headers?: Record<string, string | string[] | undefined> | undefined;
+    query?: Record<string, string | string[] | undefined> | undefined;
+}
+export interface DashboardAuthResult {
+    authorized: boolean;
+    status?: 401;
+    message?: string;
+}
+/**
+ * Create the dashboard's HTTP auth check.
+ *
+ * Returns `undefined` when authentication is not enabled, so the caller can skip
+ * the check entirely rather than branch on a permissive validator.
+ *
+ * A token may be presented as `Authorization: Bearer <token>` (preferred — a URL
+ * token lands in access logs, `Referer` headers and browser history) or as
+ * `?token=<token>`, which is what the documented dashboard link uses.
+ */
+export declare function createDashboardAuthValidator(auth: DashboardAuth | undefined): ((req: DashboardAuthRequest) => DashboardAuthResult) | undefined;
+//# sourceMappingURL=dashboard-auth.d.ts.map

package/auth/dashboard-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard-auth.d.ts","sourceRoot":"","sources":["../../src/auth/dashboard-auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;;;;;;;GASG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;CACnE;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA6BD;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,aAAa,GAAG,SAAS,GAC9B,CAAC,CAAC,GAAG,EAAE,oBAAoB,KAAK,mBAAmB,CAAC,GAAG,SAAS,CAsBlE"}

package/dashboard.config-store.d.ts

@@ -0,0 +1,25 @@
+import { type DashboardPluginOptions, type DashboardPluginOptionsInput } from './dashboard.types';
+/**
+ * Record the operator's parsed options. Called by `DashboardPlugin.init`.
+ *
+ * KNOWN LIMITATION — this store is process-wide. Two `@FrontMcp` servers built
+ * in one process that each configure the dashboard differently would share the
+ * last configuration published, including its `auth.token`. `init(...)` runs
+ * while decorator metadata is evaluated, before any server or scope exists, so
+ * there is no server identity to key on at that point; giving each server its
+ * own configuration needs the app-declared plugin to receive options through the
+ * provider graph, which the `@App` decorator shape does not currently allow.
+ *
+ * A conflicting publish is therefore reported loudly rather than silently
+ * winning. Single-server processes — every documented deployment — are
+ * unaffected.
+ */
+export declare function publishDashboardOptions(options: DashboardPluginOptions): void;
+/**
+ * The effective dashboard options: the operator's if they configured the plugin,
+ * otherwise the defaults merged with whatever the caller supplied.
+ */
+export declare function resolveDashboardOptions(fallback?: DashboardPluginOptionsInput): DashboardPluginOptions;
+/** Test seam — clears the published options between cases. */
+export declare function resetDashboardOptions(): void;
+//# sourceMappingURL=dashboard.config-store.d.ts.map

package/dashboard.config-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard.config-store.d.ts","sourceRoot":"","sources":["../src/dashboard.config-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EACjC,MAAM,mBAAmB,CAAC;AAmB3B;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAuB7E;AAyBD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,GAAE,2BAAgC,GAAG,sBAAsB,CAG1G;AAED,8DAA8D;AAC9D,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C"}

package/dashboard.plugin.d.ts

@@ -1,5 +1,5 @@
-import { DynamicPlugin, ProviderType } from '@frontmcp/sdk';
-import { DashboardPluginOptions, DashboardPluginOptionsInput } from './dashboard.types';
+import { DynamicPlugin, type ProviderType } from '@frontmcp/sdk';
+import { type DashboardPluginOptions, type DashboardPluginOptionsInput } from './dashboard.types';
 /**
  * FrontMCP Dashboard Plugin.
  *

package/dashboard.plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard.plugin.d.ts","sourceRoot":"","sources":["../src/dashboard.plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAU,YAAY,EAAE,MAAM,eAAe,CAAC;AAEpE,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAG5B,MAAM,mBAAmB,CAAC;AAG3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAMH,MAAM,CAAC,OAAO,OAAO,eAAgB,SAAQ,aAAa,CAAC,sBAAsB,EAAE,2BAA2B,CAAC;IAC7G,OAAO,EAAE,sBAAsB,CAAC;gBAEpB,OAAO,GAAE,2BAAgC;IASrD;;;;OAIG;WACa,gBAAgB,CAAC,OAAO,EAAE,2BAA2B,GAAG,YAAY,EAAE;CAevF"}
+{"version":3,"file":"dashboard.plugin.d.ts","sourceRoot":"","sources":["../src/dashboard.plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAU,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAIzE,OAAO,EAGL,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EACjC,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAMH,MAAM,CAAC,OAAO,OAAO,eAAgB,SAAQ,aAAa,CAAC,sBAAsB,EAAE,2BAA2B,CAAC;IAC7G,OAAO,EAAE,sBAAsB,CAAC;gBAEpB,OAAO,GAAE,2BAAgC;IAUrD;;;;OAIG;WACa,gBAAgB,CAAC,OAAO,EAAE,2BAA2B,GAAG,YAAY,EAAE;CAkBvF"}

package/dashboard.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard.types.d.ts","sourceRoot":"","sources":["../src/dashboard.types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAEvC;;GAEG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;gCAmB1B,CAAC;AAEH,sBAAsB;AACtB,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,eAAe,CAAC,CAAC;AAEzD;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;gCAK9B,CAAC;AAEH,0BAA0B;AAC1B,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEjE;;GAEG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCASvC,CAAC;AAEH,kDAAkD;AAClD,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAEnF,yDAAyD;AACzD,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAEvF,uCAAuC;AACvC,eAAO,MAAM,6BAA6B,EAAE,2BAI3C,CAAC;AAEF;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAM3E"}
+{"version":3,"file":"dashboard.types.d.ts","sourceRoot":"","sources":["../src/dashboard.types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAEvC;;GAEG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;gCAmB1B,CAAC;AAEH,sBAAsB;AACtB,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,eAAe,CAAC,CAAC;AAEzD;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;gCAe5B,CAAC;AAEL,0BAA0B;AAC1B,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEjE;;GAEG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCASvC,CAAC;AAEH,kDAAkD;AAClD,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAEnF,yDAAyD;AACzD,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAEvF,uCAAuC;AACvC,eAAO,MAAM,6BAA6B,EAAE,2BAI3C,CAAC;AAEF;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAM3E"}