@knowzai/cli 0.1.0

package/dist/lib/setup-server.js

@@ -0,0 +1,936 @@
+import { randomBytes as cryptoRandomBytes } from 'node:crypto';
+import { Buffer } from 'node:buffer';
+import { serve } from '@hono/node-server';
+import { Hono } from 'hono';
+import { createRedactor, registerSecret, validateCloudAiKeyFormat } from '@knowzai/core';
+import { PLATFORM_SECRET_KEYS, redactPlatformSecrets, validatePort, validatePublicUrl, validateStorageMode, } from './platform-runtime.js';
+import { renderPage } from './setup-page.js';
+import { setupPlanToFrontDoorInput, } from './setup-plan.js';
+import { PROVIDER_PRESETS } from './provider-presets.js';
+import { validateModelName, } from './platform-provider-probe.js';
+const BODY_LIMIT = 64 * 1024;
+export const SETUP_IDLE_TIMEOUT_MS = 15 * 60 * 1_000;
+const realClock = {
+    setTimeout: (callback, delayMs) => setTimeout(callback, delayMs),
+    clearTimeout: (id) => clearTimeout(id),
+};
+export function mintSetupToken(randomBytes = cryptoRandomBytes) {
+    return Buffer.from(randomBytes(32)).toString('hex');
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function containsPlatformSecretKey(value) {
+    if (!isRecord(value))
+        return false;
+    for (const [key, nested] of Object.entries(value)) {
+        if (PLATFORM_SECRET_KEYS.includes(key))
+            return true;
+        if (containsPlatformSecretKey(nested))
+            return true;
+    }
+    return false;
+}
+function registerCollectedSecrets(value) {
+    if (!isRecord(value))
+        return;
+    for (const [key, nested] of Object.entries(value)) {
+        if (typeof nested === 'string' && /(apiKey|token|password|secret|credential|passphrase)/i.test(key)) {
+            registerSecret(nested);
+        }
+        else if (isRecord(nested)) {
+            registerCollectedSecrets(nested);
+        }
+    }
+}
+export function parseProviderFields(provider, value, schema) {
+    if (!isRecord(value))
+        throw new Error('Provider fields must be an object.');
+    const formFields = schema[provider];
+    const byKey = new Map(formFields.map((field) => [field.key, field]));
+    if (Object.keys(value).some((key) => !byKey.has(key))) {
+        throw new Error('Provider configuration contains an unsupported field.');
+    }
+    const providerFields = {};
+    for (const field of formFields) {
+        const raw = value[field.key];
+        if (field.required && (raw === undefined || String(raw).trim() === '')) {
+            throw new Error(`${field.label} is required.`);
+        }
+        if (raw === undefined || String(raw).trim() === '')
+            continue;
+        providerFields[field.key] = field.number ? Number(raw) : String(raw);
+    }
+    return providerFields;
+}
+function parseSetupProvider(value, schema) {
+    if (typeof value !== 'string' || !Object.prototype.hasOwnProperty.call(schema, value)) {
+        throw new Error('Unsupported setup provider.');
+    }
+    return value;
+}
+const setupPortNames = ['api', 'web', 'mcp', 'publicSite'];
+function findPortCollisions(ports) {
+    const namesByPort = new Map();
+    for (const name of setupPortNames) {
+        const port = ports[name];
+        if (port === undefined)
+            continue;
+        namesByPort.set(port, [...(namesByPort.get(port) ?? []), name]);
+    }
+    return [...namesByPort.entries()]
+        .filter(([, names]) => names.length > 1)
+        .map(([port, names]) => ({ port, names }));
+}
+function describePortCollisions(collisions) {
+    const collision = collisions[0];
+    if (!collision)
+        return undefined;
+    const names = collision.names.length === 2
+        ? collision.names.join(' and ')
+        : `${collision.names.slice(0, -1).join(', ')}, and ${collision.names.at(-1)}`;
+    return `Ports must be distinct — ${names} ${collision.names.length === 2 ? 'both' : 'all'} use ${collision.port}`;
+}
+function parsePlan(value, schema, defaults) {
+    if (!isRecord(value))
+        throw new Error('Setup request must be a JSON object.');
+    if (containsPlatformSecretKey(value)) {
+        throw new Error('Machine-minted platform secrets cannot be supplied by the setup form.');
+    }
+    const allowed = new Set([
+        'provider',
+        'providerFields',
+        'imageMode',
+        'version',
+        'name',
+        'ports',
+        'components',
+        'storage',
+        'publicUrls',
+        'orgName',
+        'superAdminPassphrase',
+        'ghcrToken',
+        'accountName',
+        'accountEmail',
+        'seedDemo',
+        'open',
+        'reconfigure',
+    ]);
+    if (Object.keys(value).some((key) => !allowed.has(key))) {
+        throw new Error('Setup request contains an unsupported field.');
+    }
+    const provider = parseSetupProvider(value.provider, schema);
+    const imageMode = value.imageMode ?? defaults.imageMode ?? 'pull';
+    if (imageMode !== 'build' && imageMode !== 'pull')
+        throw new Error('Image mode must be build or pull.');
+    const providerFields = parseProviderFields(provider, value.providerFields ?? {}, schema);
+    let storage = defaults.storage;
+    if (value.storage !== undefined) {
+        if (typeof value.storage !== 'string')
+            throw new Error('Storage mode is invalid.');
+        storage = validateStorageMode(value.storage);
+    }
+    let publicUrls = defaults.publicUrls;
+    if (value.publicUrls !== undefined) {
+        if (!isRecord(value.publicUrls) ||
+            Object.keys(value.publicUrls).some((key) => !['api', 'web', 'mcp', 'publicSite'].includes(key))) {
+            throw new Error('Public URLs contain an unsupported field.');
+        }
+        const parsed = {};
+        for (const [key, label, originOnly] of [
+            ['api', 'Public API URL', false],
+            ['web', 'Public web origin', true],
+            ['mcp', 'Public MCP URL', false],
+            ['publicSite', 'Public site origin', true],
+        ]) {
+            const raw = value.publicUrls[key];
+            if (raw === undefined || raw === '')
+                continue;
+            if (typeof raw !== 'string')
+                throw new Error(`${label} is invalid.`);
+            parsed[key] = validatePublicUrl(raw.trim(), label, originOnly);
+        }
+        publicUrls = parsed;
+    }
+    let orgName = defaults.orgName;
+    if (value.orgName !== undefined) {
+        if (typeof value.orgName !== 'string') {
+            throw new Error('Organization name must be 1–64 characters without control characters.');
+        }
+        const candidate = value.orgName.trim();
+        if (candidate && (candidate.length > 64 || /[\u0000-\u001f\u007f]/.test(candidate))) {
+            throw new Error('Organization name must be 1–64 characters without control characters.');
+        }
+        orgName = candidate || undefined;
+    }
+    let superAdminPassphrase = defaults.superAdminPassphrase;
+    if (value.superAdminPassphrase !== undefined) {
+        if (typeof value.superAdminPassphrase !== 'string') {
+            throw new Error('SuperAdmin passphrase must be 12–128 characters and mix letters with digits or symbols.');
+        }
+        const candidate = value.superAdminPassphrase.trim();
+        if (candidate &&
+            (candidate.length < 12 || candidate.length > 128 || !/[A-Za-z]/.test(candidate) || !/[^A-Za-z]/.test(candidate))) {
+            throw new Error('SuperAdmin passphrase must be 12–128 characters and mix letters with digits or symbols.');
+        }
+        superAdminPassphrase = candidate || undefined;
+    }
+    let ports = defaults.ports;
+    if (value.ports !== undefined) {
+        if (!isRecord(value.ports) || Object.keys(value.ports).some((key) => !setupPortNames.includes(key))) {
+            throw new Error('Ports contain an unsupported value.');
+        }
+        ports = {
+            api: value.ports.api === undefined ? undefined : validatePort(Number(value.ports.api), 'API'),
+            web: value.ports.web === undefined ? undefined : validatePort(Number(value.ports.web), 'WEB'),
+            mcp: value.ports.mcp === undefined ? undefined : validatePort(Number(value.ports.mcp), 'MCP'),
+            publicSite: value.ports.publicSite === undefined
+                ? undefined
+                : validatePort(Number(value.ports.publicSite), 'public site'),
+        };
+    }
+    let components = defaults.components;
+    if (value.components !== undefined) {
+        if (!isRecord(value.components) ||
+            Object.keys(value.components).some((key) => !['mcp', 'publicSite'].includes(key)) ||
+            Object.values(value.components).some((entry) => typeof entry !== 'boolean')) {
+            throw new Error('Components must contain only boolean mcp and publicSite values.');
+        }
+        components = {
+            mcp: value.components.mcp,
+            publicSite: value.components.publicSite,
+        };
+    }
+    const selectedPorts = {
+        api: ports?.api,
+        web: ports?.web,
+        ...(components?.mcp === false ? {} : { mcp: ports?.mcp }),
+        ...(components?.publicSite === true ? { publicSite: ports?.publicSite } : {}),
+    };
+    const collisionMessage = describePortCollisions(findPortCollisions(selectedPorts));
+    if (collisionMessage)
+        throw new Error(collisionMessage);
+    const accountName = typeof value.accountName === 'string' ? value.accountName.trim() : undefined;
+    const accountEmail = typeof value.accountEmail === 'string' ? value.accountEmail.trim() : undefined;
+    if (Boolean(accountName) !== Boolean(accountEmail)) {
+        throw new Error('Account name and account email must be supplied together.');
+    }
+    return setupPlanToFrontDoorInput({
+        provider,
+        providerFields,
+        imageMode,
+        version: typeof value.version === 'string' ? value.version : defaults.version,
+        name: typeof value.name === 'string' ? value.name : defaults.name,
+        configDir: defaults.configDir,
+        ports,
+        components,
+        storage,
+        publicUrls,
+        orgName,
+        superAdminPassphrase,
+        ghcrToken: typeof value.ghcrToken === 'string' ? value.ghcrToken : undefined,
+        account: accountName && accountEmail ? { name: accountName, email: accountEmail } : defaults.account,
+        seedDemo: value.seedDemo === true,
+        open: value.open === true,
+        reconfigure: value.reconfigure === true,
+    });
+}
+export function createSetupApp(deps) {
+    const app = new Hono();
+    const clock = deps.clock ?? realClock;
+    const now = deps.now ?? Date.now;
+    const idleTimeoutMs = deps.idleTimeoutMs ?? SETUP_IDLE_TIMEOUT_MS;
+    const redact = createRedactor();
+    const progress = [];
+    const subscribers = new Set();
+    const encoder = new TextEncoder();
+    let expectedPort = deps.expectedPort;
+    let shutdown = deps.shutdown;
+    let tokenValid = true;
+    let inFlight = false;
+    let probeInFlight = false;
+    let cloudActivationInFlight = false;
+    let completed = false;
+    let idleTimer;
+    let completionResolved = false;
+    let resolveCompletion;
+    app.completion = new Promise((resolve) => {
+        resolveCompletion = resolve;
+    });
+    const safe = (line) => redact(redactPlatformSecrets(line));
+    const safePayload = (value) => {
+        if (typeof value === 'string')
+            return safe(value);
+        if (Array.isArray(value))
+            return value.map(safePayload);
+        if (isRecord(value)) {
+            return Object.fromEntries(Object.entries(value).map(([key, nested]) => [key, safePayload(nested)]));
+        }
+        return value;
+    };
+    const frame = (event, payload) => encoder.encode(`event: ${event}\ndata: ${JSON.stringify(safePayload(payload))}\n\n`);
+    const publish = (line, event = 'progress') => {
+        const redacted = safe(line);
+        progress.push({ event, payload: redacted });
+        deps.log?.(redacted);
+        const encoded = frame(event, redacted);
+        for (const subscriber of subscribers)
+            subscriber.enqueue(encoded);
+    };
+    const publishPayload = (payload, event) => {
+        const redacted = safePayload(payload);
+        progress.push({ event, payload: redacted });
+        const encoded = frame(event, redacted);
+        for (const subscriber of subscribers)
+            subscriber.enqueue(encoded);
+    };
+    const closeSubscribers = () => {
+        for (const subscriber of subscribers)
+            subscriber.close();
+        subscribers.clear();
+    };
+    const finishCompletion = (value) => {
+        if (completionResolved)
+            return;
+        completionResolved = true;
+        resolveCompletion(value);
+    };
+    const clearIdle = () => {
+        if (idleTimer !== undefined)
+            clock.clearTimeout(idleTimer);
+        idleTimer = undefined;
+    };
+    const armIdle = () => {
+        clearIdle();
+        if (inFlight || completed || !tokenValid)
+            return;
+        idleTimer = clock.setTimeout(() => {
+            if (inFlight || completed || !tokenValid)
+                return;
+            tokenValid = false;
+            publish('Setup console timed out — re-run `knowz setup`.', 'timeout');
+            closeSubscribers();
+            finishCompletion({ status: 'timeout' });
+            void shutdown?.('timeout');
+        }, idleTimeoutMs);
+    };
+    const authenticated = (headers) => {
+        if (!tokenValid || headers.get('x-setup-token') !== deps.token)
+            return false;
+        const origin = headers.get('origin');
+        const site = headers.get('sec-fetch-site');
+        const expectedOrigin = expectedPort === undefined ? undefined : `http://127.0.0.1:${expectedPort}`;
+        const localhostOrigin = expectedPort === undefined ? undefined : `http://localhost:${expectedPort}`;
+        const originOk = origin === expectedOrigin || origin === localhostOrigin;
+        const siteOk = site === 'same-origin';
+        if (!originOk && !siteOk)
+            return false;
+        if (origin && !originOk)
+            return false;
+        if (site && !siteOk)
+            return false;
+        armIdle();
+        return true;
+    };
+    const buildResultSummary = (result, progressStart) => {
+        const record = isRecord(result) ? result : undefined;
+        const state = record && isRecord(record.state) ? record.state : undefined;
+        const stateUrls = state && isRecord(state.serviceUrls) ? state.serviceUrls : undefined;
+        const currentRunLines = progress
+            .slice(progressStart)
+            .map((item) => typeof item.payload === 'string' ? item.payload : '')
+            .filter(Boolean);
+        const warning = currentRunLines.find((line) => /warning: provider .*round-trip failed/i.test(line));
+        const verified = currentRunLines.some((line) => /provider .*round-trip confirmed/i.test(line));
+        const apiUrl = typeof stateUrls?.api === 'string' ? stateUrls.api : deps.serviceUrls?.apiUrl;
+        const summary = {
+            webUrl: typeof stateUrls?.web === 'string' ? stateUrls.web : deps.serviceUrls?.webUrl,
+            apiUrl,
+            mcpUrl: typeof stateUrls?.mcp === 'string' ? stateUrls.mcp : deps.serviceUrls?.mcpUrl,
+            publicSiteUrl: typeof stateUrls?.publicSite === 'string'
+                ? stateUrls.publicSite
+                : deps.serviceUrls?.publicSiteUrl,
+            loginMode: typeof record?.loginMode === 'string' ? record.loginMode : undefined,
+            existing: record?.existing === true ? true : undefined,
+            verify: warning
+                ? { api: 'warn', probeWarning: 'Provider round-trip failed — check credentials and endpoint configuration.' }
+                : verified
+                    ? { api: 'ok' }
+                    : { api: 'unknown' },
+        };
+        return Object.fromEntries(Object.entries(summary).filter(([, value]) => value !== undefined));
+    };
+    app.setExpectedPort = (port) => {
+        expectedPort = port;
+    };
+    app.setShutdown = (next) => {
+        shutdown = next;
+    };
+    app.isInFlight = () => inFlight;
+    app.close = (reason = 'closed') => {
+        tokenValid = false;
+        clearIdle();
+        closeSubscribers();
+        finishCompletion({ status: reason });
+    };
+    app.use('*', async (c, next) => {
+        const host = c.req.header('host') ?? '';
+        const allowed = expectedPort !== undefined &&
+            (host === `127.0.0.1:${expectedPort}` || host === `localhost:${expectedPort}`);
+        if (!allowed)
+            return c.json({ error: 'Forbidden.' }, 403);
+        await next();
+    });
+    app.get('/', async (c) => {
+        const url = new URL(c.req.url);
+        if ([...url.searchParams.keys()].some((key) => /(key|token|password|secret|credential|passphrase)/i.test(key))) {
+            return c.json({ error: 'Credentials are accepted only in the setup POST body.' }, 400);
+        }
+        if (completed)
+            return c.html('<!doctype html><title>Knowz setup complete</title><p>Setup complete.</p>');
+        const report = await deps.preflight();
+        let licenseStatus = { linked: false };
+        try {
+            licenseStatus = await deps.licenseStatus?.() ?? licenseStatus;
+        }
+        catch { /* The setup page remains available while the local API is down. */ }
+        c.header('Cache-Control', 'no-store');
+        c.header('Referrer-Policy', 'no-referrer');
+        c.header('X-Content-Type-Options', 'nosniff');
+        c.header('Content-Security-Policy', "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; font-src data:; "
+            + "connect-src 'self'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'");
+        return c.html(renderPage({
+            token: deps.token,
+            schema: deps.formSchema,
+            preflight: report,
+            currentState: deps.currentState?.(),
+            defaults: deps.planDefaults ?? {},
+            credentialFilePath: deps.credentialFilePath,
+            licenseStatus,
+        }));
+    });
+    app.get('/api/progress', (c) => {
+        if (!authenticated(c.req.raw.headers))
+            return c.json({ error: 'Forbidden.' }, 403);
+        const waitForRun = c.req.header('x-setup-progress-stream') === '1';
+        let ownController;
+        const stream = new ReadableStream({
+            start(controller) {
+                ownController = controller;
+                for (const item of progress)
+                    controller.enqueue(frame(item.event, item.payload));
+                if (inFlight || waitForRun)
+                    subscribers.add(controller);
+                else
+                    controller.close();
+            },
+            cancel() {
+                if (ownController)
+                    subscribers.delete(ownController);
+            },
+        });
+        return c.body(stream, 200, {
+            'Content-Type': 'text/event-stream; charset=utf-8',
+            'Cache-Control': 'no-store',
+            Connection: 'keep-alive',
+        });
+    });
+    app.post('/api/cloud-ai/activate', async (c) => {
+        if (!authenticated(c.req.raw.headers))
+            return c.json({ ok: false, message: safe('Forbidden.') }, 403);
+        if (!deps.activateCloudAi) {
+            return c.json({ ok: false, message: safe('Knowz Cloud account activation is unavailable.') }, 503);
+        }
+        if (inFlight || probeInFlight || cloudActivationInFlight) {
+            return c.json({ ok: false, message: safe('Another setup operation is already running.') }, 409);
+        }
+        cloudActivationInFlight = true;
+        try {
+            const credential = await deps.activateCloudAi();
+            if (!validateCloudAiKeyFormat(credential).ok) {
+                throw new Error('The mothership returned a malformed Knowz Cloud AI credential.');
+            }
+            registerSecret(credential);
+            c.header('Cache-Control', 'no-store');
+            return c.json({ ok: true, credential });
+        }
+        catch (error) {
+            return c.json({
+                ok: false,
+                message: safe(error instanceof Error ? error.message : 'Knowz Cloud account activation failed.'),
+            }, 400);
+        }
+        finally {
+            cloudActivationInFlight = false;
+        }
+    });
+    app.post('/api/test-connection', async (c) => {
+        if (!authenticated(c.req.raw.headers)) {
+            return c.json({ ok: false, message: safe('Forbidden.') }, 403);
+        }
+        if (probeInFlight || cloudActivationInFlight) {
+            return c.json({ ok: false, message: safe('A connection test is already running.') }, 409);
+        }
+        if (inFlight)
+            return c.json({ ok: false, message: safe('Setup is already running.') }, 409);
+        // Claim before the first await so two test requests cannot both probe.
+        probeInFlight = true;
+        try {
+            const declaredLength = Number(c.req.header('content-length') ?? '0');
+            if (Number.isFinite(declaredLength) && declaredLength > BODY_LIMIT) {
+                return c.json({ ok: false, message: safe('Connection test request is too large.') }, 413);
+            }
+            const text = await c.req.text();
+            if (Buffer.byteLength(text, 'utf8') > BODY_LIMIT) {
+                return c.json({ ok: false, message: safe('Connection test request is too large.') }, 413);
+            }
+            let body;
+            try {
+                body = JSON.parse(text);
+            }
+            catch {
+                return c.json({ ok: false, message: safe('Malformed connection test request.') }, 400);
+            }
+            // Register submitted credentials before validation or any other surface.
+            registerCollectedSecrets(body);
+            if (!isRecord(body) || Object.keys(body).some((key) => !['provider', 'providerFields'].includes(key))) {
+                return c.json({ ok: false, message: safe('Connection test request contains an unsupported field.') }, 400);
+            }
+            if (containsPlatformSecretKey(body)) {
+                return c.json({
+                    ok: false,
+                    message: safe('Machine-minted platform secrets cannot be supplied by the setup form.'),
+                }, 400);
+            }
+            let provider;
+            try {
+                provider = parseSetupProvider(body.provider, deps.formSchema);
+            }
+            catch {
+                return c.json({ ok: false, message: safe('Unsupported setup provider.') }, 400);
+            }
+            let selection;
+            try {
+                const providerFields = parseProviderFields(provider, body.providerFields ?? {}, deps.formSchema);
+                // This is the same conversion used by /api/setup, so its shared endpoint
+                // validators run before the injected probe can make any outbound call.
+                const input = setupPlanToFrontDoorInput({
+                    provider,
+                    providerFields,
+                    imageMode: 'pull',
+                    name: deps.planDefaults?.name,
+                    version: deps.planDefaults?.version,
+                });
+                selection = {
+                    provider,
+                    azure: input.base.azure,
+                    gcp: input.base.gcp,
+                    openAiCompatible: input.base.openAiCompatible,
+                };
+            }
+            catch (error) {
+                return c.json({
+                    ok: false,
+                    message: safe(error instanceof Error ? error.message : 'Invalid provider configuration.'),
+                }, 400);
+            }
+            if (provider === 'offline') {
+                return c.json({ ok: true, message: safe('Offline stub ready — no credentials needed') });
+            }
+            if (!deps.probeProvider) {
+                return c.json({ ok: false, category: 'unknown', message: safe('Connection test is unavailable') });
+            }
+            const startedAt = now();
+            let outcome;
+            try {
+                outcome = await deps.probeProvider(selection);
+            }
+            catch {
+                outcome = { ok: false };
+            }
+            if (outcome.ok) {
+                const credential = selection.openAiCompatible?.apiKey;
+                const discovered = provider === 'knowz-cloud' && credential && deps.discoverCloudAiModels
+                    ? await deps.discoverCloudAiModels(credential)
+                    : undefined;
+                return c.json({
+                    ok: true,
+                    latencyMs: Math.max(0, Math.round(now() - startedAt)),
+                    message: safe('Connection confirmed'),
+                    ...(discovered ? {
+                        models: {
+                            chat: discovered.chatModels,
+                            embedding: discovered.embeddingModels,
+                        },
+                        ...(discovered.warning ? { discoveryWarning: safe(discovered.warning) } : {}),
+                    } : {}),
+                });
+            }
+            if (outcome.timedOut) {
+                return c.json({
+                    ok: false,
+                    category: 'network',
+                    message: safe('Timed out — check the URL/network'),
+                });
+            }
+            const warning = outcome.warning ?? '';
+            const gcpAdcConfigurationFailure = provider === 'gcp' &&
+                warning === 'ADC credentials file could not be read or parsed.';
+            const category = gcpAdcConfigurationFailure
+                ? 'endpoint'
+                : /\b(?:401|403|auth|credential)/i.test(warning)
+                    ? 'auth'
+                    : /network|reach|connect|dns/i.test(warning)
+                        ? 'network'
+                        : /model/i.test(warning)
+                            ? 'model'
+                            : 'unknown';
+            const message = category === 'auth'
+                ? 'Authentication failed — check the provider credentials'
+                : category === 'network'
+                    ? 'Provider could not be reached — check the URL/network'
+                    : category === 'model'
+                        ? 'Provider responded but the configured model is unavailable'
+                        : category === 'endpoint'
+                            ? 'ADC credentials file could not be read or parsed.'
+                            : 'Connection test failed — check the provider configuration';
+            // Only the probe's explicitly browser-safe canned detail may cross to the
+            // page; `warning` stays quarantined (it can carry provider response text).
+            const safeDetail = outcome.safeDetail ?? '';
+            const detailed = safeDetail && safeDetail !== message ? `${message} · ${safeDetail}` : message;
+            return c.json({ ok: false, category, message: safe(detailed) });
+        }
+        finally {
+            probeInFlight = false;
+            armIdle();
+        }
+    });
+    app.post('/api/test-model', async (c) => {
+        if (!authenticated(c.req.raw.headers)) {
+            return c.json({ ok: false, message: safe('Forbidden.') }, 403);
+        }
+        if (probeInFlight) {
+            return c.json({ ok: false, message: safe('A model or connection test is already running.') }, 409);
+        }
+        if (inFlight)
+            return c.json({ ok: false, message: safe('Setup is already running.') }, 409);
+        // Shared single-flight claim happens synchronously before the body-read await (SEC-R0-01).
+        probeInFlight = true;
+        try {
+            const declaredLength = Number(c.req.header('content-length') ?? '0');
+            if (Number.isFinite(declaredLength) && declaredLength > BODY_LIMIT) {
+                return c.json({ ok: false, message: safe('Model test request is too large.') }, 413);
+            }
+            const text = await c.req.text();
+            if (Buffer.byteLength(text, 'utf8') > BODY_LIMIT) {
+                return c.json({ ok: false, message: safe('Model test request is too large.') }, 413);
+            }
+            let body;
+            try {
+                body = JSON.parse(text);
+            }
+            catch {
+                return c.json({ ok: false, message: safe('Malformed model test request.') }, 400);
+            }
+            // Register submitted credentials before validation, logging, or any outbound dependency call.
+            registerCollectedSecrets(body);
+            if (!isRecord(body) || Object.keys(body).some((key) => !['provider', 'providerFields', 'modelRole'].includes(key))) {
+                return c.json({ ok: false, message: safe('Model test request contains an unsupported field.') }, 400);
+            }
+            if (containsPlatformSecretKey(body)) {
+                return c.json({
+                    ok: false,
+                    message: safe('Machine-minted platform secrets cannot be supplied by the setup form.'),
+                }, 400);
+            }
+            let provider;
+            try {
+                provider = parseSetupProvider(body.provider, deps.formSchema);
+            }
+            catch {
+                return c.json({ ok: false, message: safe('Unsupported setup provider.') }, 400);
+            }
+            if (body.modelRole !== 'chat' && body.modelRole !== 'embedding' && body.modelRole !== 'vision') {
+                return c.json({ ok: false, message: safe('Model role must be chat, embedding, or vision.') }, 400);
+            }
+            let providerFields;
+            try {
+                const family = PROVIDER_PRESETS[provider].optionsFamily;
+                const requiredForProbe = family === 'azure'
+                    ? new Set(['endpoint', 'apiKey'])
+                    : family === 'gcp'
+                        ? new Set(['project', 'adcPath'])
+                        : family === 'openAiCompatible'
+                            ? new Set(['endpoint', body.modelRole === 'embedding' ? 'embeddingModel' : 'chatModel'])
+                            : new Set();
+                const probeSchema = {
+                    ...deps.formSchema,
+                    [provider]: deps.formSchema[provider].map((field) => ({
+                        ...field,
+                        required: requiredForProbe.has(field.key),
+                    })),
+                };
+                providerFields = parseProviderFields(provider, body.providerFields ?? {}, probeSchema);
+                // Reuse the exact setup conversion so shared endpoint validators run before probeModel.
+                setupPlanToFrontDoorInput({
+                    provider,
+                    providerFields,
+                    imageMode: 'pull',
+                    name: deps.planDefaults?.name,
+                    version: deps.planDefaults?.version,
+                });
+                if (family === 'openAiCompatible') {
+                    validateModelName(providerFields[body.modelRole === 'embedding' ? 'embeddingModel' : 'chatModel']);
+                }
+            }
+            catch (error) {
+                return c.json({
+                    ok: false,
+                    message: safe(error instanceof Error ? error.message : 'Invalid provider configuration.'),
+                }, 400);
+            }
+            if (provider === 'offline') {
+                return c.json({ ok: true, message: safe('Offline stub — no model to test') });
+            }
+            if (!deps.probeModel) {
+                return c.json({
+                    ok: false,
+                    category: 'unknown',
+                    message: safe('Model test is not available in this CLI build'),
+                }, 503);
+            }
+            let outcome;
+            try {
+                outcome = await deps.probeModel({ provider, providerFields, modelRole: body.modelRole });
+            }
+            catch {
+                outcome = { ok: false, category: 'unknown', message: 'Model test failed — check the provider configuration' };
+            }
+            if (outcome.ok) {
+                return c.json({
+                    ok: true,
+                    latencyMs: outcome.latencyMs === undefined
+                        ? undefined
+                        : Math.max(0, Math.round(outcome.latencyMs)),
+                    message: safe(outcome.message),
+                });
+            }
+            return c.json({
+                ok: false,
+                category: outcome.category ?? 'unknown',
+                message: safe(outcome.message),
+            });
+        }
+        finally {
+            probeInFlight = false;
+            armIdle();
+        }
+    });
+    app.post('/api/test-ports', async (c) => {
+        if (!authenticated(c.req.raw.headers)) {
+            return c.json({ ok: false, message: safe('Forbidden.') }, 403);
+        }
+        if (probeInFlight) {
+            return c.json({ ok: false, message: safe('A connection, model, or port test is already running.') }, 409);
+        }
+        if (inFlight)
+            return c.json({ ok: false, message: safe('Setup is already running.') }, 409);
+        // Shared single-flight claim happens synchronously before the first body-read await (SEC-R0-01).
+        probeInFlight = true;
+        try {
+            const declaredLength = Number(c.req.header('content-length') ?? '0');
+            if (Number.isFinite(declaredLength) && declaredLength > BODY_LIMIT) {
+                return c.json({ ok: false, message: safe('Port test request is too large.') }, 413);
+            }
+            const text = await c.req.text();
+            if (Buffer.byteLength(text, 'utf8') > BODY_LIMIT) {
+                return c.json({ ok: false, message: safe('Port test request is too large.') }, 413);
+            }
+            let body;
+            try {
+                body = JSON.parse(text);
+            }
+            catch {
+                return c.json({ ok: false, message: safe('Malformed port test request.') }, 400);
+            }
+            registerCollectedSecrets(body);
+            if (containsPlatformSecretKey(body)) {
+                return c.json({
+                    ok: false,
+                    message: safe('Machine-minted platform secrets cannot be supplied by the setup form.'),
+                }, 400);
+            }
+            if (!isRecord(body) ||
+                Object.keys(body).some((key) => !['ports', 'components'].includes(key)) ||
+                !Object.prototype.hasOwnProperty.call(body, 'ports')) {
+                return c.json({ ok: false, message: safe('Port test request contains an unsupported field.') }, 400);
+            }
+            if (!isRecord(body.ports)) {
+                return c.json({ ok: false, message: safe('Ports must be an object.') }, 400);
+            }
+            if (body.components !== undefined && (!isRecord(body.components) ||
+                Object.keys(body.components).some((key) => !['mcp', 'publicSite'].includes(key)) ||
+                Object.values(body.components).some((value) => typeof value !== 'boolean'))) {
+                return c.json({ ok: false, message: safe('Components must contain only boolean mcp and publicSite values.') }, 400);
+            }
+            const requestedPorts = body.ports;
+            const requestedNames = Object.keys(requestedPorts);
+            const requiredNames = ['api', 'web', 'mcp'];
+            if (requiredNames.some((name) => !requestedNames.includes(name)) ||
+                requestedNames.some((key) => !setupPortNames.includes(key)) ||
+                (requestedNames.length !== 3 && requestedNames.length !== 4)) {
+                return c.json({ ok: false, message: safe('Ports must contain api, web, mcp, and optionally publicSite.') }, 400);
+            }
+            const components = isRecord(body.components) ? body.components : {};
+            const names = setupPortNames.filter((name) => requestedNames.includes(name) &&
+                (name !== 'mcp' || components.mcp !== false) &&
+                (name !== 'publicSite' || components.publicSite === true));
+            let ports;
+            try {
+                ports = Object.fromEntries(names.map((name) => {
+                    const value = requestedPorts[name];
+                    if (typeof value !== 'number')
+                        throw new Error('invalid');
+                    return [name, validatePort(value, name.toUpperCase())];
+                }));
+            }
+            catch {
+                return c.json({ ok: false, message: safe('Ports must be integers from 1 through 65535.') }, 400);
+            }
+            const collisions = findPortCollisions(ports);
+            const collisionMessage = describePortCollisions(collisions);
+            const collidingNames = new Set(collisions.flatMap((collision) => collision.names));
+            if (!deps.probePort) {
+                return c.json({ ok: false, message: safe('Port testing is unavailable') }, 503);
+            }
+            const outcomes = await Promise.all(names.map(async (name) => {
+                if (collidingNames.has(name)) {
+                    return [name, { port: ports[name], available: false }];
+                }
+                let available = false;
+                try {
+                    available = await deps.probePort(ports[name]);
+                }
+                catch {
+                    available = false;
+                }
+                return [name, { port: ports[name], available }];
+            }));
+            const result = Object.fromEntries(outcomes);
+            const ok = collisions.length === 0 && names.every((name) => result[name].available);
+            return c.json({
+                ok,
+                ports: result,
+                message: safe(collisionMessage ??
+                    (ok ? 'All selected ports are available' : 'One or more selected ports are already in use')),
+            });
+        }
+        finally {
+            probeInFlight = false;
+            armIdle();
+        }
+    });
+    app.post('/api/setup', async (c) => {
+        if (!authenticated(c.req.raw.headers))
+            return c.json({ error: 'Forbidden.' }, 403);
+        if (completed)
+            return c.json({ error: 'Setup already completed.' }, 409);
+        if (inFlight)
+            return c.json({ error: 'Setup is already running.' }, 409);
+        // Claim before the first await so concurrent authenticated POSTs cannot
+        // both parse and apply against the same runtime configuration.
+        inFlight = true;
+        clearIdle();
+        try {
+            const declaredLength = Number(c.req.header('content-length') ?? '0');
+            if (Number.isFinite(declaredLength) && declaredLength > BODY_LIMIT) {
+                return c.json({ error: 'Setup request is too large.' }, 413);
+            }
+            const text = await c.req.text();
+            if (Buffer.byteLength(text, 'utf8') > BODY_LIMIT) {
+                return c.json({ error: 'Setup request is too large.' }, 413);
+            }
+            let body;
+            try {
+                body = JSON.parse(text);
+            }
+            catch {
+                return c.json({ error: 'Malformed setup request.' }, 400);
+            }
+            registerCollectedSecrets(body);
+            let input;
+            try {
+                input = parsePlan(body, deps.formSchema, deps.planDefaults ?? {});
+            }
+            catch (error) {
+                const message = safe(error instanceof Error ? error.message : 'Invalid setup request.');
+                return c.json({ error: message }, 400);
+            }
+            const currentState = deps.currentState?.();
+            if (currentState && isRecord(body) && body.reconfigure !== true) {
+                const result = { existing: true, state: currentState };
+                const summary = buildResultSummary(result, progress.length);
+                publishPayload(summary, 'result');
+                completed = true;
+                tokenValid = false;
+                closeSubscribers();
+                finishCompletion({ status: 'success', result });
+                setTimeout(() => void shutdown?.('success'), 10);
+                return c.json({ ok: true, existing: true, result: summary });
+            }
+            try {
+                const progressStart = progress.length;
+                const result = await deps.runSetup(input, (line) => publish(line));
+                const summary = buildResultSummary(result, progressStart);
+                // The browser receives the final structured frame while the token and
+                // subscribers are still valid; invalidation happens immediately after.
+                publishPayload(summary, 'result');
+                completed = true;
+                tokenValid = false;
+                closeSubscribers();
+                // In-process consumers (up.ts) need the full result — `state` included;
+                // only the wire/browser frames carry the redacted summary.
+                finishCompletion({ status: 'success', result });
+                setTimeout(() => void shutdown?.('success'), 10);
+                return c.json({ ok: true, result: summary });
+            }
+            catch (error) {
+                publish(error instanceof Error ? error.message : 'Setup failed.', 'error');
+                closeSubscribers();
+                return c.json({ error: 'Setup failed. Correct the configuration and retry.' }, 500);
+            }
+        }
+        finally {
+            inFlight = false;
+            armIdle();
+        }
+    });
+    armIdle();
+    return app;
+}
+export async function startSetupServer(app) {
+    const host = '127.0.0.1';
+    return new Promise((resolve) => {
+        let closed = false;
+        const server = serve({ fetch: app.fetch, hostname: host, port: 0 }, (info) => {
+            app.setExpectedPort(info.port);
+            const close = async () => {
+                if (closed)
+                    return;
+                closed = true;
+                app.close('closed');
+                await new Promise((done) => server.close(() => done()));
+            };
+            app.setShutdown(async () => close());
+            resolve({
+                host,
+                requestedPort: 0,
+                port: info.port,
+                url: `http://${host}:${info.port}/`,
+                close,
+                completion: app.completion,
+            });
+        });
+    });
+}
+//# sourceMappingURL=setup-server.js.map