@frontmcp/plugin-dashboard 1.7.2 → 1.8.1

package/auth/dashboard-auth.d.ts

@@ -18,15 +18,5 @@ export interface DashboardAuthResult {
     status?: 401;
     message?: string;
 }
-/**
- * Create the dashboard's HTTP auth check.
- *
- * Returns `undefined` when authentication is not enabled, so the caller can skip
- * the check entirely rather than branch on a permissive validator.
- *
- * A token may be presented as `Authorization: Bearer <token>` (preferred — a URL
- * token lands in access logs, `Referer` headers and browser history) or as
- * `?token=<token>`, which is what the documented dashboard link uses.
- */
 export declare function createDashboardAuthValidator(auth: DashboardAuth | undefined): ((req: DashboardAuthRequest) => DashboardAuthResult) | undefined;
 //# sourceMappingURL=dashboard-auth.d.ts.map

package/auth/dashboard-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard-auth.d.ts","sourceRoot":"","sources":["../../src/auth/dashboard-auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;;;;;;;GASG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;CACnE;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA6BD;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,aAAa,GAAG,SAAS,GAC9B,CAAC,CAAC,GAAG,EAAE,oBAAoB,KAAK,mBAAmB,CAAC,GAAG,SAAS,CAsBlE"}
+{"version":3,"file":"dashboard-auth.d.ts","sourceRoot":"","sources":["../../src/auth/dashboard-auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;;;;;;;GASG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;CACnE;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAyDD,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,aAAa,GAAG,SAAS,GAC9B,CAAC,CAAC,GAAG,EAAE,oBAAoB,KAAK,mBAAmB,CAAC,GAAG,SAAS,CAqBlE"}

package/dashboard.config-store.d.ts

@@ -20,6 +20,13 @@ export declare function publishDashboardOptions(options: DashboardPluginOptions)
  * otherwise the defaults merged with whatever the caller supplied.
  */
 export declare function resolveDashboardOptions(fallback?: DashboardPluginOptionsInput): DashboardPluginOptions;
-/** Test seam — clears the published options between cases. */
+/**
+ * Clear the published options.
+ *
+ * Dashboard options are process-wide, and a second CONFLICTING auth
+ * configuration now throws rather than silently replacing the first (BC-036).
+ * A host that builds several servers serially — a test suite, a CLI that
+ * reconfigures between runs — calls this between constructions.
+ */
 export declare function resetDashboardOptions(): void;
 //# sourceMappingURL=dashboard.config-store.d.ts.map

package/dashboard.config-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard.config-store.d.ts","sourceRoot":"","sources":["../src/dashboard.config-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EACjC,MAAM,mBAAmB,CAAC;AAmB3B;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAuB7E;AAyBD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,GAAE,2BAAgC,GAAG,sBAAsB,CAG1G;AAED,8DAA8D;AAC9D,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C"}
+{"version":3,"file":"dashboard.config-store.d.ts","sourceRoot":"","sources":["../src/dashboard.config-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EACjC,MAAM,mBAAmB,CAAC;AAmB3B;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAuB7E;AAyBD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,GAAE,2BAAgC,GAAG,sBAAsB,CAG1G;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C"}

package/esm/index.mjs

@@ -368,6 +368,9 @@ function resolveDashboardOptions(fallback = {}) {
   if (publishedOptions) return publishedOptions;
   return dashboardPluginOptionsSchema.parse({ ...defaultDashboardPluginOptions, ...fallback });
 }
+function resetDashboardOptions() {
+  publishedOptions = void 0;
+}
 
 // plugins/plugin-dashboard/src/dashboard.symbol.ts
 var DashboardConfigToken = /* @__PURE__ */ Symbol("DashboardConfig");
@@ -3678,6 +3681,90 @@ var init_cloudflare_kv = __esm({
   }
 });
 init_runtime();
+var IPV4_OCTET_PATTERN = /^(0|[1-9]\d{0,2})$/;
+var IPV6_GROUP_PATTERN = /^[0-9a-f]{1,4}$/;
+var IPV4_BLOCKS = compileBlocks(
+  [
+    ["0.0.0.0/8", "this-network"],
+    ["10.0.0.0/8", "private"],
+    ["100.64.0.0/10", "carrier-grade-nat"],
+    ["127.0.0.0/8", "loopback"],
+    ["169.254.0.0/16", "link-local"],
+    ["172.16.0.0/12", "private"],
+    ["192.0.0.0/24", "ietf-protocol"],
+    ["192.168.0.0/16", "private"],
+    ["198.18.0.0/15", "benchmarking"],
+    ["224.0.0.0/4", "multicast"],
+    ["255.255.255.255/32", "reserved"],
+    ["240.0.0.0/4", "reserved"]
+  ],
+  parseIpv4
+);
+var IPV6_BLOCKS = compileBlocks(
+  [
+    ["::/128", "unspecified"],
+    ["::1/128", "loopback"],
+    ["fd00:ec2::254/128", "cloud-metadata"],
+    ["fc00::/7", "private"],
+    ["fe80::/10", "link-local"],
+    ["fec0::/10", "site-local"],
+    // RFC 8215 local-use NAT64: where the IPv4 address sits depends on the operator's prefix length.
+    ["64:ff9b:1::/48", "local-use-nat64"],
+    ["ff00::/8", "multicast"]
+  ],
+  expandIpv6
+);
+var IPV4_EMBEDDINGS = compileBlocks(
+  [
+    ["::ffff:0:0/96", 6],
+    ["::ffff:0:0:0/96", 6],
+    ["::/96", 6],
+    ["64:ff9b::/96", 6],
+    ["2002::/16", 1]
+  ],
+  expandIpv6
+);
+function parseIpv4(address) {
+  const parts = address.split(".");
+  if (parts.length !== 4 || !parts.every((part) => IPV4_OCTET_PATTERN.test(part))) return void 0;
+  const octets = parts.map(Number);
+  return octets.every((octet) => octet <= 255) ? octets : void 0;
+}
+function expandIpv6(address) {
+  const zoneIndex = address.indexOf("%");
+  let text = (zoneIndex === -1 ? address : address.slice(0, zoneIndex)).toLowerCase();
+  const lastColonIndex = text.lastIndexOf(":");
+  const trailingSegment = text.slice(lastColonIndex + 1);
+  if (lastColonIndex !== -1 && trailingSegment.includes(".")) {
+    const octets = parseIpv4(trailingSegment);
+    if (!octets) return void 0;
+    const highGroup = (octets[0] << 8 | octets[1]).toString(16);
+    const lowGroup = (octets[2] << 8 | octets[3]).toString(16);
+    text = `${text.slice(0, lastColonIndex + 1)}${highGroup}:${lowGroup}`;
+  }
+  const halves = text.split("::");
+  if (halves.length > 2) return void 0;
+  const head = parseIpv6Groups(halves[0]);
+  if (!head) return void 0;
+  if (halves.length === 1) return head.length === 8 ? head : void 0;
+  const tail = parseIpv6Groups(halves[1]);
+  if (!tail || head.length + tail.length > 7) return void 0;
+  return [...head, ...new Array(8 - head.length - tail.length).fill(0), ...tail];
+}
+function parseIpv6Groups(part) {
+  if (part === "") return [];
+  const groups = part.split(":");
+  if (!groups.every((group) => IPV6_GROUP_PATTERN.test(group))) return void 0;
+  return groups.map((group) => parseInt(group, 16));
+}
+function compileBlocks(entries, parseNetwork) {
+  return entries.map(([cidr, value]) => {
+    const [networkText, prefixText] = cidr.split("/");
+    const network = parseNetwork(networkText);
+    if (!network) throw new Error(`Invalid network in address block "${cidr}"`);
+    return { cidr, network, prefixLength: Number(prefixText), value };
+  });
+}
 init_fs2();
 init_crypto();
 var entryAvailabilitySchema = z3.object({
@@ -3724,6 +3811,14 @@ function tokenMatches(presented, expected) {
   if (presented.length === 0 || expected.length === 0) return false;
   return timingSafeEqual(sha256(presented), sha256(expected));
 }
+function readBearerToken(header) {
+  if (!header) return void 0;
+  const separator = header.indexOf(" ");
+  if (separator === -1) return void 0;
+  if (header.slice(0, separator).toLowerCase() !== "bearer") return void 0;
+  const token = header.slice(separator + 1).trim();
+  return token.length > 0 ? token : void 0;
+}
 function createDashboardAuthValidator(auth) {
   if (!auth?.enabled) return void 0;
   const expected = auth.token;
@@ -3731,8 +3826,7 @@ function createDashboardAuthValidator(auth) {
     if (!expected) {
       return { authorized: false, status: 401, message: "Dashboard authentication is misconfigured" };
     }
-    const header = readHeader(req.headers, "authorization");
-    const bearer = header?.startsWith("Bearer ") ? header.slice("Bearer ".length) : void 0;
+    const bearer = readBearerToken(readHeader(req.headers, "authorization"));
     if (bearer && tokenMatches(bearer, expected)) return AUTHORIZED;
     const queryToken = readQuery(req.query, "token");
     if (queryToken && tokenMatches(queryToken, expected)) return AUTHORIZED;
@@ -4915,5 +5009,6 @@ export {
   dashboardPluginOptionsSchema,
   DashboardPlugin as default,
   defaultDashboardPluginOptions,
-  isDashboardEnabled
+  isDashboardEnabled,
+  resetDashboardOptions
 };

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-dashboard",
-  "version": "1.7.2",
+  "version": "1.8.1",
   "description": "Dashboard plugin for FrontMCP - visual monitoring and introspection of MCP servers",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -47,12 +47,12 @@
     }
   },
   "dependencies": {
-    "@frontmcp/sdk": "1.7.2"
+    "@frontmcp/sdk": "1.8.1"
   },
   "devDependencies": {
     "reflect-metadata": "^0.2.2"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.7.2"
+    "@frontmcp/lazy-zod": "1.8.1"
   }
 }

package/index.d.ts

@@ -1,6 +1,7 @@
 export { default, default as DashboardPlugin } from './dashboard.plugin';
 export { DashboardApp } from './app';
 export { DashboardPluginOptions, DashboardPluginOptionsInput, dashboardPluginOptionsSchema, defaultDashboardPluginOptions, isDashboardEnabled, } from './dashboard.types';
+export { resetDashboardOptions } from './dashboard.config-store';
 export { DashboardConfigToken, GraphDataProviderToken, ParentScopeToken } from './dashboard.symbol';
 export type { GraphData, GraphNode, GraphEdge, GraphMetadata } from './shared/types';
 export { GraphDataProvider } from './providers';

package/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGzE,OAAO,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAGrC,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,4BAA4B,EAC5B,6BAA6B,EAC7B,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGpG,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGhD,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGzE,OAAO,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAGrC,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,4BAA4B,EAC5B,6BAA6B,EAC7B,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGpG,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGhD,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,6BAA6B,CAAC"}

package/index.js

@@ -297,7 +297,8 @@ __export(index_exports, {
   dashboardPluginOptionsSchema: () => dashboardPluginOptionsSchema,
   default: () => DashboardPlugin,
   defaultDashboardPluginOptions: () => defaultDashboardPluginOptions,
-  isDashboardEnabled: () => isDashboardEnabled
+  isDashboardEnabled: () => isDashboardEnabled,
+  resetDashboardOptions: () => resetDashboardOptions
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -387,6 +388,9 @@ function resolveDashboardOptions(fallback = {}) {
   if (publishedOptions) return publishedOptions;
   return dashboardPluginOptionsSchema.parse({ ...defaultDashboardPluginOptions, ...fallback });
 }
+function resetDashboardOptions() {
+  publishedOptions = void 0;
+}
 
 // plugins/plugin-dashboard/src/dashboard.symbol.ts
 var DashboardConfigToken = /* @__PURE__ */ Symbol("DashboardConfig");
@@ -3691,6 +3695,90 @@ var init_cloudflare_kv = __esm({
   }
 });
 init_runtime();
+var IPV4_OCTET_PATTERN = /^(0|[1-9]\d{0,2})$/;
+var IPV6_GROUP_PATTERN = /^[0-9a-f]{1,4}$/;
+var IPV4_BLOCKS = compileBlocks(
+  [
+    ["0.0.0.0/8", "this-network"],
+    ["10.0.0.0/8", "private"],
+    ["100.64.0.0/10", "carrier-grade-nat"],
+    ["127.0.0.0/8", "loopback"],
+    ["169.254.0.0/16", "link-local"],
+    ["172.16.0.0/12", "private"],
+    ["192.0.0.0/24", "ietf-protocol"],
+    ["192.168.0.0/16", "private"],
+    ["198.18.0.0/15", "benchmarking"],
+    ["224.0.0.0/4", "multicast"],
+    ["255.255.255.255/32", "reserved"],
+    ["240.0.0.0/4", "reserved"]
+  ],
+  parseIpv4
+);
+var IPV6_BLOCKS = compileBlocks(
+  [
+    ["::/128", "unspecified"],
+    ["::1/128", "loopback"],
+    ["fd00:ec2::254/128", "cloud-metadata"],
+    ["fc00::/7", "private"],
+    ["fe80::/10", "link-local"],
+    ["fec0::/10", "site-local"],
+    // RFC 8215 local-use NAT64: where the IPv4 address sits depends on the operator's prefix length.
+    ["64:ff9b:1::/48", "local-use-nat64"],
+    ["ff00::/8", "multicast"]
+  ],
+  expandIpv6
+);
+var IPV4_EMBEDDINGS = compileBlocks(
+  [
+    ["::ffff:0:0/96", 6],
+    ["::ffff:0:0:0/96", 6],
+    ["::/96", 6],
+    ["64:ff9b::/96", 6],
+    ["2002::/16", 1]
+  ],
+  expandIpv6
+);
+function parseIpv4(address) {
+  const parts = address.split(".");
+  if (parts.length !== 4 || !parts.every((part) => IPV4_OCTET_PATTERN.test(part))) return void 0;
+  const octets = parts.map(Number);
+  return octets.every((octet) => octet <= 255) ? octets : void 0;
+}
+function expandIpv6(address) {
+  const zoneIndex = address.indexOf("%");
+  let text = (zoneIndex === -1 ? address : address.slice(0, zoneIndex)).toLowerCase();
+  const lastColonIndex = text.lastIndexOf(":");
+  const trailingSegment = text.slice(lastColonIndex + 1);
+  if (lastColonIndex !== -1 && trailingSegment.includes(".")) {
+    const octets = parseIpv4(trailingSegment);
+    if (!octets) return void 0;
+    const highGroup = (octets[0] << 8 | octets[1]).toString(16);
+    const lowGroup = (octets[2] << 8 | octets[3]).toString(16);
+    text = `${text.slice(0, lastColonIndex + 1)}${highGroup}:${lowGroup}`;
+  }
+  const halves = text.split("::");
+  if (halves.length > 2) return void 0;
+  const head = parseIpv6Groups(halves[0]);
+  if (!head) return void 0;
+  if (halves.length === 1) return head.length === 8 ? head : void 0;
+  const tail = parseIpv6Groups(halves[1]);
+  if (!tail || head.length + tail.length > 7) return void 0;
+  return [...head, ...new Array(8 - head.length - tail.length).fill(0), ...tail];
+}
+function parseIpv6Groups(part) {
+  if (part === "") return [];
+  const groups = part.split(":");
+  if (!groups.every((group) => IPV6_GROUP_PATTERN.test(group))) return void 0;
+  return groups.map((group) => parseInt(group, 16));
+}
+function compileBlocks(entries, parseNetwork) {
+  return entries.map(([cidr, value]) => {
+    const [networkText, prefixText] = cidr.split("/");
+    const network = parseNetwork(networkText);
+    if (!network) throw new Error(`Invalid network in address block "${cidr}"`);
+    return { cidr, network, prefixLength: Number(prefixText), value };
+  });
+}
 init_fs2();
 init_crypto();
 var entryAvailabilitySchema = import_lazy_zod4.z.object({
@@ -3737,6 +3825,14 @@ function tokenMatches(presented, expected) {
   if (presented.length === 0 || expected.length === 0) return false;
   return timingSafeEqual(sha256(presented), sha256(expected));
 }
+function readBearerToken(header) {
+  if (!header) return void 0;
+  const separator = header.indexOf(" ");
+  if (separator === -1) return void 0;
+  if (header.slice(0, separator).toLowerCase() !== "bearer") return void 0;
+  const token = header.slice(separator + 1).trim();
+  return token.length > 0 ? token : void 0;
+}
 function createDashboardAuthValidator(auth) {
   if (!auth?.enabled) return void 0;
   const expected = auth.token;
@@ -3744,8 +3840,7 @@ function createDashboardAuthValidator(auth) {
     if (!expected) {
       return { authorized: false, status: 401, message: "Dashboard authentication is misconfigured" };
     }
-    const header = readHeader(req.headers, "authorization");
-    const bearer = header?.startsWith("Bearer ") ? header.slice("Bearer ".length) : void 0;
+    const bearer = readBearerToken(readHeader(req.headers, "authorization"));
     if (bearer && tokenMatches(bearer, expected)) return AUTHORIZED;
     const queryToken = readQuery(req.query, "token");
     if (queryToken && tokenMatches(queryToken, expected)) return AUTHORIZED;
@@ -4928,5 +5023,6 @@ DashboardApp = __decorateClass([
   ParentScopeToken,
   dashboardPluginOptionsSchema,
   defaultDashboardPluginOptions,
-  isDashboardEnabled
+  isDashboardEnabled,
+  resetDashboardOptions
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-dashboard",
-  "version": "1.7.2",
+  "version": "1.8.1",
   "description": "Dashboard plugin for FrontMCP - visual monitoring and introspection of MCP servers",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -47,12 +47,12 @@
     }
   },
   "dependencies": {
-    "@frontmcp/sdk": "1.7.2"
+    "@frontmcp/sdk": "1.8.1"
   },
   "devDependencies": {
     "reflect-metadata": "^0.2.2"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.7.2"
+    "@frontmcp/lazy-zod": "1.8.1"
   }
 }