@serfab/cadre-host 0.7.1

package/dist/server/events/types.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Event types broadcast over the SPA's SSE channel.
+ *
+ * Publishers (orchestrator hook, route adapters, update observer) call
+ * EventBus.publish; the `/api/events` route fan-outs to connected clients.
+ */
+import type { ContainerStatus } from '@serfab/cadre-provider';
+import type { DirectReachability, PortForwardMode } from '../../nat/index.js';
+export type LocalUiEvent = {
+    type: 'node-state-changed';
+    nodeId: string;
+    status: ContainerStatus;
+} | {
+    type: 'trust-circle-changed';
+    kind: 'invited' | 'redeemed' | 'revoked';
+} | {
+    type: 'connectivity-changed';
+    portMode: PortForwardMode;
+    directReachability: DirectReachability;
+} | {
+    type: 'update-available';
+    version: string;
+    releaseNotesUrl?: string;
+};
+export type LocalUiEventType = LocalUiEvent['type'];

package/dist/server/events/types.js

@@ -0,0 +1,8 @@
+/**
+ * Event types broadcast over the SPA's SSE channel.
+ *
+ * Publishers (orchestrator hook, route adapters, update observer) call
+ * EventBus.publish; the `/api/events` route fan-outs to connected clients.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/server/events/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/server/events/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/server/index.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Public surface for the cadre-host local UI server.
+ *
+ * `createLocalUiServer(opts)` wires:
+ *   - the origin guard + error handler
+ *   - existing trust-circle / NAT / update typed handlers, mounted at
+ *     `/auth/*`, `/nat/*`, `/update/*` (the CLI contract)
+ *   - new UI-only routes under `/api/*` (status, nodes, settings, events)
+ *   - the static SPA mount at `/`
+ *
+ * Callers (cadre-host start) own the subsystems and pass them in. The
+ * server doesn't construct them — start has to own their lifecycle anyway
+ * (orchestrator init, trust-circle/NAT bring-up, update timer).
+ */
+import type { FastifyInstance } from 'fastify';
+import type { HostProcessOrchestrator } from '../orchestrator/index.js';
+import type { TrustCircleService } from '../auth/index.js';
+import type { NatService } from '../nat/index.js';
+import type { UpdateService } from '../update/index.js';
+import { EventBus } from './events/bus.js';
+import { HostSettingsStore } from './settings-store.js';
+export interface LocalUiServerOptions {
+    /** Configured UI port from host.config.json. May be re-bound on collision. */
+    uiPort: number;
+    /** Resolved data dir (passed by cadre-host start). */
+    dataDir: string;
+    /** Wired dependencies — all owned by the caller. */
+    orchestrator: HostProcessOrchestrator;
+    trustCircle: TrustCircleService;
+    nat: NatService;
+    /** Optional — 6.4.2 lands this; nullable while still iterating. */
+    update?: UpdateService;
+    /** Settings I/O facade. Defaults to a new one rooted at `dataDir`. */
+    settingsStore?: HostSettingsStore;
+    /** Bus instance — pass the same one to subsystems that publish events. */
+    events?: EventBus;
+    /**
+     * Static asset root override. Defaults to `<package>/dist/ui`. When the
+     * directory is absent the root handler returns a placeholder HTML.
+     */
+    staticRoot?: string;
+    /**
+     * Test-only: bind to port 0 (OS picks any free port). The returned URL
+     * reflects the actual bound port.
+     */
+    forcePort?: 0;
+    /**
+     * SSE heartbeat interval (ms). Defaults to 15 000 ms. Tests reduce this
+     * so the heartbeat can be observed quickly.
+     */
+    sseHeartbeatMs?: number;
+}
+export interface LocalUiServer {
+    app: FastifyInstance;
+    events: EventBus;
+    /** Resolves with the actually-bound port. */
+    start(): Promise<{
+        port: number;
+        url: string;
+    }>;
+    stop(): Promise<void>;
+}
+export declare function createLocalUiServer(opts: LocalUiServerOptions): LocalUiServer;
+export { EventBus } from './events/bus.js';
+export type { LocalUiEventListener } from './events/bus.js';
+export type { LocalUiEvent, LocalUiEventType } from './events/types.js';
+export { HostSettingsStore } from './settings-store.js';

package/dist/server/index.js

@@ -0,0 +1,149 @@
+/**
+ * Public surface for the cadre-host local UI server.
+ *
+ * `createLocalUiServer(opts)` wires:
+ *   - the origin guard + error handler
+ *   - existing trust-circle / NAT / update typed handlers, mounted at
+ *     `/auth/*`, `/nat/*`, `/update/*` (the CLI contract)
+ *   - new UI-only routes under `/api/*` (status, nodes, settings, events)
+ *   - the static SPA mount at `/`
+ *
+ * Callers (cadre-host start) own the subsystems and pass them in. The
+ * server doesn't construct them — start has to own their lifecycle anyway
+ * (orchestrator init, trust-circle/NAT bring-up, update timer).
+ */
+import { createTrustCircleHandlers } from '../auth/index.js';
+import { createNatHandlers } from '../nat/index.js';
+import { createUpdateHandlers } from '../update/index.js';
+import { EventBus } from './events/bus.js';
+import { registerSseRoute } from './events/sse-route.js';
+import { registerErrorHandler } from './error-handler.js';
+import { registerOriginGuard } from './origin-guard.js';
+import { registerStaticMount } from './static.js';
+import { buildFastify, startListening, stopListening } from './server.js';
+import { registerNatRoutes } from './routes/nat.js';
+import { registerTrustCircleRoutes } from './routes/trust-circle.js';
+import { registerUpdateRoutes } from './routes/update.js';
+import { registerStatusRoute } from './routes/status.js';
+import { registerNodesRoutes } from './routes/nodes.js';
+import { registerSettingsRoutes } from './routes/settings.js';
+import { HostSettingsStore } from './settings-store.js';
+/** How often to poll UpdateService.getState() looking for new versions. */
+const UPDATE_OBSERVER_INTERVAL_MS = 60000;
+export function createLocalUiServer(opts) {
+    const events = opts.events ?? new EventBus();
+    const settingsStore = opts.settingsStore ?? new HostSettingsStore({ dataDir: opts.dataDir });
+    const app = buildFastify();
+    // Bound port is unknown until start(); the guard is registered then.
+    registerErrorHandler(app);
+    // /api/events (SSE) — must be registered before the static fallback so
+    // the not-found handler doesn't try to serve it.
+    registerSseRoute(app, {
+        events,
+        ...(opts.sseHeartbeatMs !== undefined ? { heartbeatIntervalMs: opts.sseHeartbeatMs } : {}),
+    });
+    registerStatusRoute(app, {
+        orchestrator: opts.orchestrator,
+        trustCircle: opts.trustCircle,
+        nat: opts.nat,
+        ...(opts.update ? { update: opts.update } : {}),
+    });
+    registerNodesRoutes(app, { orchestrator: opts.orchestrator });
+    registerSettingsRoutes(app, { settingsStore, nat: opts.nat, ...(opts.update ? { update: opts.update } : {}) });
+    registerTrustCircleRoutes(app, { handlers: createTrustCircleHandlers(opts.trustCircle), events });
+    registerNatRoutes(app, { handlers: createNatHandlers(opts.nat), events });
+    if (opts.update) {
+        registerUpdateRoutes(app, { handlers: createUpdateHandlers(opts.update), events });
+    }
+    // Static mount registers as the not-found handler — declared last so the
+    // API paths above win.
+    registerStaticMount(app, { ...(opts.staticRoot !== undefined ? { rootDir: opts.staticRoot } : {}) });
+    let bound = null;
+    let stopped = false;
+    const teardown = [];
+    return {
+        app,
+        events,
+        async start() {
+            if (bound)
+                return bound;
+            // Origin guard reads the port at request time via the getter so the
+            // post-fallback bound port is honoured. Registered here (not at
+            // factory time) so it lives in the same lifecycle as listen.
+            registerOriginGuard(app, { port: () => bound?.port ?? opts.uiPort });
+            const started = await startListening(app, {
+                preferredPort: opts.uiPort,
+                ...(opts.forcePort === 0 ? { forcePort: 0 } : {}),
+            });
+            bound = started;
+            // Orchestrator → bus adapter: forward node state changes.
+            teardown.push(opts.orchestrator.onStateChange((info) => {
+                events.publish({
+                    type: 'node-state-changed',
+                    nodeId: info.id,
+                    status: info.status === 'running' ? 'running' : 'stopped',
+                });
+            }));
+            // One-shot connectivity publish — the SPA will get a sane initial
+            // signal even if no settings have changed yet this session.
+            try {
+                const snap = opts.nat.getStatus();
+                events.publish({
+                    type: 'connectivity-changed',
+                    portMode: snap.portMode,
+                    directReachability: snap.directReachability,
+                });
+            }
+            catch {
+                // NatService.start may not have completed; harmless to skip.
+            }
+            // Update observer: poll UpdateService.getState() every 60 s and emit
+            // `update-available` when `available.version` changes. Cheap, avoids
+            // poking at the service's internals.
+            if (opts.update) {
+                const update = opts.update;
+                let lastVersion;
+                const tick = async () => {
+                    try {
+                        const state = await update.getState();
+                        const available = state.available;
+                        if (available && available.version && available.version !== lastVersion) {
+                            lastVersion = available.version;
+                            events.publish({
+                                type: 'update-available',
+                                version: available.version,
+                                ...(available.releaseNotesUrl ? { releaseNotesUrl: available.releaseNotesUrl } : {}),
+                            });
+                        }
+                    }
+                    catch {
+                        // Update store I/O failure — silent, will retry next tick.
+                    }
+                };
+                // Fire once on boot in case the timer set `available` before the server bound.
+                void tick();
+                const timer = setInterval(() => { void tick(); }, UPDATE_OBSERVER_INTERVAL_MS);
+                if (typeof timer === 'object' && 'unref' in timer) {
+                    timer.unref?.();
+                }
+                teardown.push(() => clearInterval(timer));
+            }
+            return started;
+        },
+        async stop() {
+            if (stopped)
+                return;
+            stopped = true;
+            for (const fn of teardown.splice(0, teardown.length)) {
+                try {
+                    fn();
+                }
+                catch { /* ignore teardown errors */ }
+            }
+            await stopListening(app);
+        },
+    };
+}
+export { EventBus } from './events/bus.js';
+export { HostSettingsStore } from './settings-store.js';
+//# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AA0CxD,2EAA2E;AAC3E,MAAM,2BAA2B,GAAG,KAAM,CAAC;AAE3C,MAAM,UAAU,mBAAmB,CAAC,IAA0B;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;IAC7C,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAE7F,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAE3B,qEAAqE;IAErE,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAE1B,uEAAuE;IACvE,iDAAiD;IACjD,gBAAgB,CAAC,GAAG,EAAE;QACpB,MAAM;QACN,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3F,CAAC,CAAC;IAEH,mBAAmB,CAAC,GAAG,EAAE;QACvB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,mBAAmB,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IAC9D,sBAAsB,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAE/G,yBAAyB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,yBAAyB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAClG,iBAAiB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,oBAAoB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,yEAAyE;IACzE,uBAAuB;IACvB,mBAAmB,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAErG,IAAI,KAAK,GAAyC,IAAI,CAAC;IACvD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,QAAQ,GAAsB,EAAE,CAAC;IAEvC,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK,CAAC,KAAK;YACT,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;YACxB,oEAAoE;YACpE,gEAAgE;YAChE,6DAA6D;YAC7D,mBAAmB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE;gBACxC,aAAa,EAAE,IAAI,CAAC,MAAM;gBAC1B,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D,CAAC,CAAC;YACH,KAAK,GAAG,OAAO,CAAC;YAEhB,0DAA0D;YAC1D,QAAQ,CAAC,IAAI,CACX,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,EAAE;gBACvC,MAAM,CAAC,OAAO,CAAC;oBACb,IAAI,EAAE,oBAAoB;oBAC1B,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;iBAC1D,CAAC,CAAC;YACL,CAAC,CAAC,CACH,CAAC;YAEF,kEAAkE;YAClE,4DAA4D;YAC5D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;gBAClC,MAAM,CAAC,OAAO,CAAC;oBACb,IAAI,EAAE,sBAAsB;oBAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;iBAC5C,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,6DAA6D;YAC/D,CAAC;YAED,qEAAqE;YACrE,qEAAqE;YACrE,qCAAqC;YACrC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBAC3B,IAAI,WAA+B,CAAC;gBACpC,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;oBACrC,IAAI,CAAC;wBACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;wBACtC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;wBAClC,IAAI,SAAS,IAAI,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;4BACxE,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC;4BAChC,MAAM,CAAC,OAAO,CAAC;gCACb,IAAI,EAAE,kBAAkB;gCACxB,OAAO,EAAE,SAAS,CAAC,OAAO;gCAC1B,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;6BACrF,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,2DAA2D;oBAC7D,CAAC;gBACH,CAAC,CAAC;gBACF,+EAA+E;gBAC/E,KAAK,IAAI,EAAE,CAAC;gBACZ,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC;gBAC/E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;oBACjD,KAAgC,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC9C,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;YAC5C,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,KAAK,CAAC,IAAI;YACR,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrD,IAAI,CAAC;oBAAC,EAAE,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,4BAA4B,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAG3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/server/origin-guard.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Origin guard — defeats DNS-rebind attacks against the loopback listener.
+ *
+ * The listener is bound to 127.0.0.1 only, but a malicious page on
+ * `evil.example.com` can still resolve its own hostname to 127.0.0.1 and
+ * speak HTTP to us. We mitigate by requiring that:
+ *   - `Host` is `127.0.0.1[:port]` or `localhost[:port]` (case-insensitive),
+ *   - `Origin` (when present) matches one of those origins.
+ *
+ * Forbidden requests return 403 with the standard error envelope.
+ *
+ * The expected port can be supplied as a constant or as a getter — the
+ * server's port-fallback loop discovers the bound port only after `listen`,
+ * but Fastify hooks must be registered before `ready`, so the guard reads
+ * the port at request time via the getter.
+ */
+import type { FastifyInstance } from 'fastify';
+export interface OriginGuardOptions {
+    /** Bound port (constant) or a getter for the current bound port. */
+    port: number | (() => number);
+    /** Allow these additional hosts (test harnesses, integrations). */
+    extraAllowedHosts?: ReadonlyArray<string>;
+}
+export declare function registerOriginGuard(app: FastifyInstance, opts: OriginGuardOptions): void;

package/dist/server/origin-guard.js

@@ -0,0 +1,72 @@
+/**
+ * Origin guard — defeats DNS-rebind attacks against the loopback listener.
+ *
+ * The listener is bound to 127.0.0.1 only, but a malicious page on
+ * `evil.example.com` can still resolve its own hostname to 127.0.0.1 and
+ * speak HTTP to us. We mitigate by requiring that:
+ *   - `Host` is `127.0.0.1[:port]` or `localhost[:port]` (case-insensitive),
+ *   - `Origin` (when present) matches one of those origins.
+ *
+ * Forbidden requests return 403 with the standard error envelope.
+ *
+ * The expected port can be supplied as a constant or as a getter — the
+ * server's port-fallback loop discovers the bound port only after `listen`,
+ * but Fastify hooks must be registered before `ready`, so the guard reads
+ * the port at request time via the getter.
+ */
+const ALLOWED_HOSTNAMES = ['127.0.0.1', 'localhost', '[::1]', '::1'];
+export function registerOriginGuard(app, opts) {
+    const getPort = typeof opts.port === 'function' ? opts.port : () => opts.port;
+    const extras = (opts.extraAllowedHosts ?? []).map((e) => e.toLowerCase());
+    app.addHook('onRequest', async (request, reply) => {
+        const port = getPort();
+        const allowedHosts = buildAllowedHostHeaders(port, extras);
+        const allowedOrigins = buildAllowedOrigins(port, extras);
+        const hostHeader = (request.headers.host ?? '').toLowerCase();
+        if (!hostHeader || !allowedHosts.has(hostHeader)) {
+            return reply.code(403).send({
+                ok: false,
+                error: {
+                    code: 'forbidden_origin',
+                    message: `Host header "${request.headers.host ?? ''}" is not allowed`,
+                },
+            });
+        }
+        const origin = request.headers.origin;
+        if (typeof origin === 'string' && origin.length > 0) {
+            if (!allowedOrigins.has(origin.toLowerCase())) {
+                return reply.code(403).send({
+                    ok: false,
+                    error: {
+                        code: 'forbidden_origin',
+                        message: `Origin "${origin}" is not allowed`,
+                    },
+                });
+            }
+        }
+        return undefined;
+    });
+}
+function buildAllowedHostHeaders(port, extras) {
+    const set = new Set();
+    for (const host of ALLOWED_HOSTNAMES) {
+        set.add(host);
+        set.add(`${host}:${port}`);
+    }
+    for (const e of extras)
+        set.add(e);
+    return set;
+}
+function buildAllowedOrigins(port, extras) {
+    const set = new Set();
+    for (const host of ALLOWED_HOSTNAMES) {
+        set.add(`http://${host}`);
+        set.add(`http://${host}:${port}`);
+        set.add(`https://${host}`);
+        set.add(`https://${host}:${port}`);
+    }
+    for (const e of extras)
+        set.add(e);
+    return set;
+}
+//# sourceMappingURL=origin-guard.js.map

package/dist/server/origin-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin-guard.js","sourceRoot":"","sources":["../../src/server/origin-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAWH,MAAM,iBAAiB,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAU,CAAC;AAE9E,MAAM,UAAU,mBAAmB,CAAC,GAAoB,EAAE,IAAwB;IAChF,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAc,CAAC;IACxF,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAE1E,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC9E,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,YAAY,GAAG,uBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAEzD,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9D,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACjD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACL,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,gBAAgB,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,kBAAkB;iBACtE;aACF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;QACtC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC1B,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE;wBACL,IAAI,EAAE,kBAAkB;wBACxB,OAAO,EAAE,WAAW,MAAM,kBAAkB;qBAC7C;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY,EAAE,MAA6B;IAC1E,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACd,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,MAA6B;IACtE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QAC1B,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;QAClC,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QAC3B,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/server/routes/nat.d.ts

@@ -0,0 +1,16 @@
+/**
+ * NAT/DDNS HTTP routes — thin adapters around `NatHandlers`
+ * (`createNatHandlers(service)`). Side-effects (settings change, reachability
+ * re-test, DDNS reconfiguration) emit a `connectivity-changed` bus event.
+ *
+ * Mount path: `/nat/*` — matches the existing CLI (cadre-host nat ...).
+ */
+import type { FastifyInstance } from 'fastify';
+import type { NatHandlers, NatStatusSnapshot } from '../../nat/types.js';
+import type { EventBus } from '../events/bus.js';
+export interface NatRoutesOptions {
+    handlers: NatHandlers;
+    events: EventBus;
+}
+export declare function registerNatRoutes(app: FastifyInstance, opts: NatRoutesOptions): void;
+export declare function publishConnectivity(events: EventBus, snap: NatStatusSnapshot): void;

package/dist/server/routes/nat.js

@@ -0,0 +1,42 @@
+/**
+ * NAT/DDNS HTTP routes — thin adapters around `NatHandlers`
+ * (`createNatHandlers(service)`). Side-effects (settings change, reachability
+ * re-test, DDNS reconfiguration) emit a `connectivity-changed` bus event.
+ *
+ * Mount path: `/nat/*` — matches the existing CLI (cadre-host nat ...).
+ */
+export function registerNatRoutes(app, opts) {
+    const { handlers, events } = opts;
+    app.get('/nat/status', async () => handlers.getStatus());
+    app.post('/nat/test', async () => {
+        const snap = await handlers.testReachability();
+        publishConnectivity(events, snap);
+        return snap;
+    });
+    app.get('/nat/providers', async () => handlers.listDdnsProviders());
+    app.put('/nat/ddns', async (request) => {
+        const body = (request.body ?? {});
+        const snap = await handlers.putDdns({
+            providerId: body.providerId ?? '',
+            hostname: body.hostname ?? '',
+            config: body.config ?? {},
+            externallyManaged: body.externallyManaged ?? false,
+        });
+        publishConnectivity(events, snap);
+        return snap;
+    });
+    app.put('/nat/settings', async (request) => {
+        const body = (request.body ?? {});
+        const snap = await handlers.putSettings(body);
+        publishConnectivity(events, snap);
+        return snap;
+    });
+}
+export function publishConnectivity(events, snap) {
+    events.publish({
+        type: 'connectivity-changed',
+        portMode: snap.portMode,
+        directReachability: snap.directReachability,
+    });
+}
+//# sourceMappingURL=nat.js.map

package/dist/server/routes/nat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nat.js","sourceRoot":"","sources":["../../../src/server/routes/nat.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAYH,MAAM,UAAU,iBAAiB,CAAC,GAAoB,EAAE,IAAsB;IAC5E,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAElC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IAEzD,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE;QAC/B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAC/C,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,IAAI,EAAE,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAEpE,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAK/B,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;YAClC,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;YACzB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,IAAI,KAAK;SACnD,CAAC,CAAC;QACH,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAA8C,CAAC;QAC/E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC9C,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAgB,EAAE,IAAuB;IAC3E,MAAM,CAAC,OAAO,CAAC;QACb,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;KAC5C,CAAC,CAAC;AACL,CAAC"}

package/dist/server/routes/nodes.d.ts

@@ -0,0 +1,23 @@
+/**
+ * /api/nodes — list managed cadre nodes, look up details, and control
+ * lifecycle.
+ *
+ * Bus events for lifecycle transitions are emitted by the orchestrator's
+ * `onStateChange` (forwarded by `createLocalUiServer.start`) — the route
+ * handlers don't re-publish.
+ *
+ * v1 limits: cadre-host doesn't yet auto-spawn nodes (the trust-circle →
+ * node mapping ticket is separate). Until it lands, `listNodes()` is
+ * usually empty and start/restart are stubs. Stop on a running node works.
+ */
+import type { FastifyInstance } from 'fastify';
+import type { HostProcessOrchestrator } from '../../orchestrator/index.js';
+export interface NodesRoutesOptions {
+    orchestrator: HostProcessOrchestrator;
+}
+export declare function registerNodesRoutes(app: FastifyInstance, opts: NodesRoutesOptions): void;
+/**
+ * Read the last `n` lines from a log file by walking the tail in chunks.
+ * Returns [] for a missing file.
+ */
+export declare function tailLogFile(path: string, n: number): string[];

package/dist/server/routes/nodes.js

@@ -0,0 +1,128 @@
+/**
+ * /api/nodes — list managed cadre nodes, look up details, and control
+ * lifecycle.
+ *
+ * Bus events for lifecycle transitions are emitted by the orchestrator's
+ * `onStateChange` (forwarded by `createLocalUiServer.start`) — the route
+ * handlers don't re-publish.
+ *
+ * v1 limits: cadre-host doesn't yet auto-spawn nodes (the trust-circle →
+ * node mapping ticket is separate). Until it lands, `listNodes()` is
+ * usually empty and start/restart are stubs. Stop on a running node works.
+ */
+import { existsSync, openSync, readSync, closeSync, statSync } from 'node:fs';
+import { defaultLogPath } from '../../orchestrator/log-rotator.js';
+const DEFAULT_LOG_LINES = 200;
+const MAX_LOG_LINES = 2000;
+export function registerNodesRoutes(app, opts) {
+    const { orchestrator } = opts;
+    app.get('/api/nodes', async () => {
+        return { ok: true, data: { nodes: orchestrator.listNodes() } };
+    });
+    app.get('/api/nodes/:id', async (request, reply) => {
+        const node = orchestrator.getNode(request.params.id);
+        if (!node) {
+            return reply.code(404).send({
+                ok: false,
+                error: { code: 'not_found', message: `Unknown node: ${request.params.id}` },
+            });
+        }
+        let stats = null;
+        try {
+            stats = await orchestrator.getStats(node.dockerId);
+        }
+        catch {
+            // Stats unavailable (dead process etc.) — surface null.
+        }
+        return { ok: true, data: { node, stats } };
+    });
+    app.get('/api/nodes/:id/logs', async (request, reply) => {
+        const node = orchestrator.getNode(request.params.id);
+        if (!node) {
+            return reply.code(404).send({
+                ok: false,
+                error: { code: 'not_found', message: `Unknown node: ${request.params.id}` },
+            });
+        }
+        const requested = Number(request.query.lines ?? DEFAULT_LOG_LINES);
+        const tail = Number.isFinite(requested)
+            ? Math.max(1, Math.min(MAX_LOG_LINES, Math.floor(requested)))
+            : DEFAULT_LOG_LINES;
+        const lines = tailLogFile(defaultLogPath(node.workdir), tail);
+        return { ok: true, data: { lines } };
+    });
+    app.post('/api/nodes/:id/stop', async (request, reply) => {
+        const dockerId = orchestrator.resolveDockerId(request.params.id);
+        if (!dockerId) {
+            return reply.code(404).send({
+                ok: false,
+                error: { code: 'not_found', message: `Unknown node: ${request.params.id}` },
+            });
+        }
+        await orchestrator.stopContainer(dockerId);
+        // The orchestrator emits its own onStateChange — createLocalUiServer
+        // forwards that to the bus. Don't double-publish here.
+        return { ok: true };
+    });
+    // start / restart: the orchestrator's createContainer requires a full
+    // OrchestratorCreateRequest (partyId, bootstrapNodes, profile, ...).
+    // cadre-host doesn't yet own a "spawn this node from saved config" path
+    // — that lives in the trust-circle-driven node spawner planned for a
+    // follow-up ticket. Until then these endpoints stub out cleanly so the
+    // SPA gets a predictable error rather than a route-not-found 404.
+    app.post('/api/nodes/:id/start', async (request, reply) => {
+        return reply.code(501).send({
+            ok: false,
+            error: {
+                code: 'not_implemented',
+                message: `start ${request.params.id}: cadre-host v1 has no auto-spawn path. ` +
+                    `Restart the cadre-host service to bring up persisted nodes.`,
+            },
+        });
+    });
+    app.post('/api/nodes/:id/restart', async (request, reply) => {
+        return reply.code(501).send({
+            ok: false,
+            error: {
+                code: 'not_implemented',
+                message: `restart ${request.params.id}: cadre-host v1 has no auto-spawn path. ` +
+                    `Restart the cadre-host service to bring up persisted nodes.`,
+            },
+        });
+    });
+}
+/**
+ * Read the last `n` lines from a log file by walking the tail in chunks.
+ * Returns [] for a missing file.
+ */
+export function tailLogFile(path, n) {
+    if (!existsSync(path))
+        return [];
+    const fd = openSync(path, 'r');
+    try {
+        const size = statSync(path).size;
+        const chunkSize = 8192;
+        let pos = size;
+        const buffers = [];
+        let newlineCount = 0;
+        while (pos > 0 && newlineCount <= n) {
+            const readLen = Math.min(chunkSize, pos);
+            pos -= readLen;
+            const buf = Buffer.alloc(readLen);
+            readSync(fd, buf, 0, readLen, pos);
+            buffers.unshift(buf);
+            for (let i = 0; i < buf.length; i++) {
+                if (buf[i] === 0x0a)
+                    newlineCount++;
+            }
+        }
+        const joined = Buffer.concat(buffers).toString('utf8');
+        const lines = joined.split('\n');
+        const trimmed = lines[lines.length - 1] === '' ? lines.slice(0, -1) : lines;
+        return trimmed.slice(-n);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+//# sourceMappingURL=nodes.js.map

package/dist/server/routes/nodes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nodes.js","sourceRoot":"","sources":["../../../src/server/routes/nodes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAK9E,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAEnE,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,aAAa,GAAG,IAAI,CAAC;AAM3B,MAAM,UAAU,mBAAmB,CAAC,GAAoB,EAAE,IAAwB;IAChF,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAE9B,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;QAC/B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAA6B,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC7E,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE;aAC5E,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CACL,qBAAqB,EACrB,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE;aAC5E,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,iBAAiB,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YACrC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YAC7D,CAAC,CAAC,iBAAiB,CAAC;QACtB,MAAM,KAAK,GAAG,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;IACvC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CAA6B,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACnF,MAAM,QAAQ,GAAG,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE;aAC5E,CAAC,CAAC;QACL,CAAC;QACD,MAAM,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC3C,qEAAqE;QACrE,uDAAuD;QACvD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,qEAAqE;IACrE,wEAAwE;IACxE,qEAAqE;IACrE,uEAAuE;IACvE,kEAAkE;IAClE,GAAG,CAAC,IAAI,CAA6B,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACpF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC1B,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EACL,SAAS,OAAO,CAAC,MAAM,CAAC,EAAE,0CAA0C;oBACpE,6DAA6D;aAChE;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAA6B,wBAAwB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACtF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC1B,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EACL,WAAW,OAAO,CAAC,MAAM,CAAC,EAAE,0CAA0C;oBACtE,6DAA6D;aAChE;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,CAAS;IACjD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC;QACvB,IAAI,GAAG,GAAG,IAAI,CAAC;QACf,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,OAAO,GAAG,GAAG,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACzC,GAAG,IAAI,OAAO,CAAC;YACf,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAClC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YACnC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,YAAY,EAAE,CAAC;YACtC,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5E,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/server/routes/settings.d.ts

@@ -0,0 +1,26 @@
+/**
+ * /api/settings — host-level settings UI surface.
+ *
+ * The persisted shape is `host.config.json` (managed by the installer).
+ * This route is a thin passthrough plus a write-whitelist:
+ *
+ *   - uiPort        rejected (restart required; only edit at install time)
+ *   - libp2pPort    rejected (restart required)
+ *   - upnpEnabled   accepted → also propagated to NatService.putSettings
+ *   - updates.autoApply  accepted → propagated to UpdateService.putSettings
+ *   - updates.manifestUrl accepted → propagated to UpdateService.putSettings
+ *   - anything else 400 invalid_setting
+ *
+ * GET returns the full `HostConfigFile` (the SPA wants the full shape so it
+ * can render a read-only view of the rejected keys).
+ */
+import type { FastifyInstance } from 'fastify';
+import type { NatService } from '../../nat/index.js';
+import type { UpdateService } from '../../update/index.js';
+import type { HostSettingsStore } from '../settings-store.js';
+export interface SettingsRoutesOptions {
+    settingsStore: HostSettingsStore;
+    nat: NatService;
+    update?: UpdateService;
+}
+export declare function registerSettingsRoutes(app: FastifyInstance, opts: SettingsRoutesOptions): void;