@synoikia/core 0.1.0

package/dist/http/admin/system.js

@@ -0,0 +1,225 @@
+import { streamSSE } from 'hono/streaming';
+import { asc, count, eq } from 'drizzle-orm';
+import { z } from 'zod';
+import { auditCsvChunks, queryAudit } from '../../audit-query.js';
+import { toPublicUser } from '../../auth/users.js';
+import { pluginInstances, plugins } from '../../db/schema.js';
+import { ConflictError, NotFoundError, ValidationError } from '../../errors.js';
+import { CORE_EVENT_NAMES } from '../../events.js';
+import { getSettings, isSettingsSection, updateSettings } from '../../settings.js';
+import { readJson } from '../common.js';
+import { assertSsoRemains } from './auth.js';
+/** Global Admin API routes (design §8.4): overview, plugins, audit, tokens, users, settings, events. */
+export function registerSystemRoutes(app, ctx) {
+    const actor = (c) => ({ userId: c.get('user').id });
+    const mcpBase = () => ctx.config.PUBLIC_MCP_URL?.replace(/\/$/, '') ?? '';
+    app.get('/api/overview', (c) => {
+        const mcpSettings = getSettings(ctx.db, 'mcp');
+        const instances = ctx.instances.list().map((i) => ({
+            ...i,
+            endpointUrl: `${mcpBase()}/${i.slug}`,
+            effectiveAuthMode: i.authMode ?? mcpSettings.defaultAuthMode,
+        }));
+        return c.json({
+            instances,
+            plugins: ctx.db
+                .select()
+                .from(plugins)
+                .orderBy(asc(plugins.pluginId))
+                .all()
+                .map((p) => ({
+                id: p.id,
+                pluginId: p.pluginId,
+                status: p.status,
+                enabled: p.enabled,
+            })),
+            warnings: ctx.warnings,
+            publicMcpUrl: ctx.config.PUBLIC_MCP_URL ?? null,
+        });
+    });
+    // ── plugins ──
+    app.get('/api/plugins', (c) => {
+        const counts = new Map(ctx.db
+            .select({ pluginId: pluginInstances.pluginId, n: count() })
+            .from(pluginInstances)
+            .groupBy(pluginInstances.pluginId)
+            .all()
+            .map((r) => [r.pluginId, r.n]));
+        return c.json(ctx.db
+            .select()
+            .from(plugins)
+            .orderBy(asc(plugins.pluginId))
+            .all()
+            .map((p) => ({ ...p, instances: counts.get(p.id) ?? 0 })));
+    });
+    app.patch('/api/plugins/:id', async (c) => {
+        const { enabled } = await readJson(c, z.object({ enabled: z.boolean() }));
+        await ctx.instances.setPluginEnabled(c.req.param('id'), enabled, actor(c));
+        return c.json(ctx.db
+            .select()
+            .from(plugins)
+            .where(eq(plugins.id, c.req.param('id')))
+            .get() ?? null);
+    });
+    app.post('/api/plugins/rescan', (c) => c.json(ctx.discoverPlugins()));
+    app.post('/api/plugins/install', async (c) => c.json(await ctx.repos.install(await readJson(c, z.unknown()), actor(c)), 201));
+    app.delete('/api/plugins/:id', (c) => {
+        ctx.repos.uninstall(c.req.param('id'), actor(c));
+        return c.body(null, 204);
+    });
+    // ── plugin repositories (design §4.2–4.3) ──
+    app.get('/api/plugin-repos', (c) => c.json(ctx.repos.list()));
+    app.get('/api/plugin-repos/available', (c) => c.json(ctx.repos.available()));
+    app.post('/api/plugin-repos', async (c) => c.json(await ctx.repos.add(await readJson(c, z.unknown()), actor(c)), 201));
+    app.post('/api/plugin-repos/:id/refresh', async (c) => c.json(await ctx.repos.refresh(c.req.param('id'))));
+    app.post('/api/plugin-repos/:id/confirm-key', async (c) => {
+        const { publicKey } = await readJson(c, z.object({ publicKey: z.string() }));
+        return c.json(ctx.repos.confirmKey(c.req.param('id'), publicKey, actor(c)));
+    });
+    app.delete('/api/plugin-repos/:id', (c) => {
+        ctx.repos.remove(c.req.param('id'), actor(c));
+        return c.body(null, 204);
+    });
+    // ── notification channels (design §9) ──
+    app.get('/api/notifiers', (c) => c.json(ctx.notifier.list()));
+    app.post('/api/notifiers', async (c) => c.json(ctx.notifier.save(await readJson(c, z.unknown()), { actor: actor(c) }), 201));
+    app.patch('/api/notifiers/:id', async (c) => c.json(ctx.notifier.save(await readJson(c, z.unknown()), { id: c.req.param('id'), actor: actor(c) })));
+    app.delete('/api/notifiers/:id', (c) => {
+        ctx.notifier.remove(c.req.param('id'), actor(c));
+        return c.body(null, 204);
+    });
+    app.post('/api/notifiers/:id/test', async (c) => c.json(await ctx.notifier.test(c.req.param('id'))));
+    // ── audit ──
+    app.get('/api/audit', (c) => c.json(queryAudit(ctx.db, c.req.query())));
+    app.get('/api/audit/export.csv', (c) => {
+        c.header('content-type', 'text/csv; charset=utf-8');
+        c.header('content-disposition', `attachment; filename="audit-${new Date().toISOString().slice(0, 10)}.csv"`);
+        const chunks = auditCsvChunks(ctx.db, c.req.query());
+        const encoder = new TextEncoder();
+        return c.body(new ReadableStream({
+            pull(controller) {
+                const next = chunks.next();
+                if (next.done)
+                    controller.close();
+                else
+                    controller.enqueue(encoder.encode(next.value));
+            },
+            cancel() {
+                chunks.return(undefined);
+            },
+        }));
+    });
+    // ── MCP bearer tokens (design §6.2) ──
+    app.get('/api/tokens', (c) => c.json(ctx.tokens.list()));
+    app.post('/api/tokens', async (c) => c.json(ctx.tokens.create(await readJson(c, z.unknown()), actor(c)), 201));
+    app.delete('/api/tokens/:id', (c) => {
+        ctx.tokens.revoke(c.req.param('id'), actor(c));
+        return c.body(null, 204);
+    });
+    // ── OAuth clients & grants (design §6.2) ──
+    app.get('/api/oauth/clients', (c) => c.json(ctx.oauth.listClients()));
+    app.post('/api/oauth/clients', async (c) => {
+        const body = await readJson(c, z.object({
+            name: z.string().trim().min(1).max(100),
+            redirectUris: z.array(z.string()).min(1).max(10),
+            confidential: z.boolean().default(false),
+        }));
+        return c.json(ctx.oauth.register({
+            client_name: body.name,
+            redirect_uris: body.redirectUris,
+            token_endpoint_auth_method: body.confidential ? 'client_secret_post' : 'none',
+        }, 'admin', actor(c)), 201);
+    });
+    app.delete('/api/oauth/clients/:id', (c) => {
+        ctx.oauth.revokeClient(c.req.param('id'), actor(c));
+        return c.body(null, 204);
+    });
+    app.get('/api/oauth/grants', (c) => c.json(ctx.oauth.listGrants()));
+    app.delete('/api/oauth/grants/:id', (c) => {
+        ctx.oauth.revokeGrant(c.req.param('id'), actor(c));
+        return c.body(null, 204);
+    });
+    // ── users (no roles: every user is an admin) ──
+    app.get('/api/users', (c) => c.json(ctx.users.list()));
+    app.post('/api/users', async (c) => {
+        const body = await readJson(c, z.object({ username: z.string(), password: z.string().optional() }));
+        return c.json(await ctx.users.create(body, actor(c)), 201);
+    });
+    app.patch('/api/users/:id', async (c) => {
+        const body = await readJson(c, z.object({ disabled: z.boolean().optional(), password: z.string().optional() }));
+        const id = c.req.param('id');
+        if (body.disabled !== undefined) {
+            if (id === c.get('user').id && body.disabled)
+                throw new ConflictError('self_disable', 'You cannot disable yourself');
+            if (body.disabled)
+                assertSsoRemains(ctx, { losingUser: id });
+            ctx.users.setDisabled(id, body.disabled, actor(c));
+            if (body.disabled) {
+                // Everything the user could still reach MCP with goes too; re-enabling revives none of it.
+                ctx.sessions.revokeUser(id);
+                ctx.oauth.revokeUserGrants(id, 'user_disabled', actor(c));
+                ctx.tokens.revokeCreatedBy(id, actor(c));
+            }
+        }
+        if (body.password !== undefined) {
+            await ctx.users.setPassword(id, body.password, { actorId: c.get('user').id });
+            ctx.sessions.revokeUser(id);
+            ctx.oauth.revokeUserGrants(id, 'password_changed', actor(c));
+        }
+        return c.json(toPublicUser(ctx.users.get(id)));
+    });
+    app.post('/api/users/:id/reset-totp', (c) => {
+        ctx.users.resetTotp(c.req.param('id'), actor(c));
+        return c.json(toPublicUser(ctx.users.get(c.req.param('id'))));
+    });
+    // ── settings ──
+    app.get('/api/settings', (c) => c.json({
+        security: getSettings(ctx.db, 'security'),
+        mcp: getSettings(ctx.db, 'mcp'),
+        audit: getSettings(ctx.db, 'audit'),
+        oidc: ctx.oidc.getSettings(),
+        forceLocalLogin: ctx.config.ADMIN_FORCE_LOCAL_LOGIN,
+        publicMcpUrl: ctx.config.PUBLIC_MCP_URL ?? null,
+        publicAdminUrl: ctx.config.PUBLIC_ADMIN_URL ?? null,
+    }));
+    app.put('/api/settings/oidc', async (c) => {
+        const body = await readJson(c, z.record(z.string(), z.unknown()));
+        if (body.enabled === false)
+            assertSsoRemains(ctx, { oidcOff: true });
+        return c.json(ctx.oidc.updateSettings(body, actor(c)));
+    });
+    app.put('/api/settings/:section', async (c) => {
+        const section = c.req.param('section');
+        if (!isSettingsSection(section))
+            throw new NotFoundError('unknown_section', 'Unknown settings section');
+        const body = await readJson(c, z.record(z.string(), z.unknown()));
+        // Disabling local login locks everyone out unless SSO works and someone can use it (design §6.1).
+        if (section === 'security' && body.disableLocalLogin === true) {
+            if (!ctx.oidc.isEnabled() || !ctx.users.hasOidcLinkedUser()) {
+                throw new ValidationError('oidc_required', 'Enable OIDC and link at least one user before disabling local login');
+            }
+        }
+        return c.json(updateSettings(ctx.db, section, body, actor(c)));
+    });
+    // ── live events for the portal (approvals, instance status, sync) ──
+    app.get('/api/events', (c) => streamSSE(c, async (stream) => {
+        const handlers = CORE_EVENT_NAMES.map((name) => {
+            const handler = (payload) => void stream.writeSSE({ event: name, data: JSON.stringify(payload) });
+            ctx.events.on(name, handler);
+            return [name, handler];
+        });
+        const heartbeat = setInterval(() => void stream.writeSSE({ event: 'ping', data: '{}' }), 25_000);
+        await new Promise((resolve) => {
+            stream.onAbort(resolve);
+            // Shutdown ends the stream so closing the listener doesn't wait for the browser to leave.
+            if (ctx.shutdownSignal.aborted)
+                resolve();
+            else
+                ctx.shutdownSignal.addEventListener('abort', () => resolve(), { once: true });
+        });
+        clearInterval(heartbeat);
+        for (const [name, handler] of handlers)
+            ctx.events.off(name, handler);
+    }));
+}
+//# sourceMappingURL=system.js.map

package/dist/http/admin/system.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system.js","sourceRoot":"","sources":["../../../src/http/admin/system.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnF,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAG7C,wGAAwG;AACxG,MAAM,UAAU,oBAAoB,CAAC,GAAmB,EAAE,GAAe;IACvE,MAAM,KAAK,GAAG,CAAC,CAAyC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAE5F,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IAE1E,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE;QAC7B,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjD,GAAG,CAAC;YACJ,WAAW,EAAE,GAAG,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE;YACrC,iBAAiB,EAAE,CAAC,CAAC,QAAQ,IAAI,WAAW,CAAC,eAAe;SAC7D,CAAC,CAAC,CAAC;QACJ,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,SAAS;YACT,OAAO,EAAE,GAAG,CAAC,EAAE;iBACZ,MAAM,EAAE;iBACR,IAAI,CAAC,OAAO,CAAC;iBACb,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;iBAC9B,GAAG,EAAE;iBACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACX,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,OAAO,EAAE,CAAC,CAAC,OAAO;aACnB,CAAC,CAAC;YACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,IAAI;SAChD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,gBAAgB;IAEhB,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE;QAC5B,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,GAAG,CAAC,EAAE;aACH,MAAM,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;aAC1D,IAAI,CAAC,eAAe,CAAC;aACrB,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC;aACjC,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CACjC,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CACX,GAAG,CAAC,EAAE;aACH,MAAM,EAAE;aACR,IAAI,CAAC,OAAO,CAAC;aACb,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;aAC9B,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAC5D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1E,MAAM,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC,IAAI,CACX,GAAG,CAAC,EAAE;aACH,MAAM,EAAE;aACR,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;aACxC,GAAG,EAAE,IAAI,IAAI,CACjB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;IACtE,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAC3C,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAC/E,CAAC;IACF,GAAG,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE;QACnC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,8CAA8C;IAE9C,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9D,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAC7E,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CACxC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAC3E,CAAC;IACF,GAAG,CAAC,IAAI,CAAC,+BAA+B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3G,GAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7E,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,MAAM,CAAC,uBAAuB,EAAE,CAAC,CAAC,EAAE,EAAE;QACxC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,0CAA0C;IAE1C,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9D,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CACrC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CACpF,CAAC;IACF,GAAG,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAC1C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CACtG,CAAC;IACF,GAAG,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE;QACrC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAErG,cAAc;IAEd,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC,CAAC,EAAE,EAAE;QACrC,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC;QACpD,CAAC,CAAC,MAAM,CAAC,qBAAqB,EAAE,+BAA+B,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;QAC7G,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,OAAO,CAAC,CAAC,IAAI,CACX,IAAI,cAAc,CAAa;YAC7B,IAAI,CAAC,UAAU;gBACb,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC3B,IAAI,IAAI,CAAC,IAAI;oBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;;oBAC7B,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACtD,CAAC;YACD,MAAM;gBACJ,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC3B,CAAC;SACF,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,wCAAwC;IAExC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/G,GAAG,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE;QAClC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,6CAA6C;IAE7C,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACtE,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,CAAC,EACD,CAAC,CAAC,MAAM,CAAC;YACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;YACvC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;SACzC,CAAC,CACH,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CACX,GAAG,CAAC,KAAK,CAAC,QAAQ,CAChB;YACE,WAAW,EAAE,IAAI,CAAC,IAAI;YACtB,aAAa,EAAE,IAAI,CAAC,YAAY;YAChC,0BAA0B,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM;SAC9E,EACD,OAAO,EACP,KAAK,CAAC,CAAC,CAAC,CACT,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,MAAM,CAAC,wBAAwB,EAAE,CAAC,CAAC,EAAE,EAAE;QACzC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACpE,GAAG,CAAC,MAAM,CAAC,uBAAuB,EAAE,CAAC,CAAC,EAAE,EAAE;QACxC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,iDAAiD;IAEjD,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACvD,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;QACpG,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;QAChH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,QAAQ;gBAC1C,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,6BAA6B,CAAC,CAAC;YACzE,IAAI,IAAI,CAAC,QAAQ;gBAAE,gBAAgB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,2FAA2F;gBAC3F,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;gBAC5B,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1D,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9E,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC5B,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,CAAC,EAAE,EAAE;QAC1C,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,iBAAiB;IAEjB,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAC7B,CAAC,CAAC,IAAI,CAAC;QACL,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC;QACzC,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC;QAC/B,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC;QACnC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE;QAC5B,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,uBAAuB;QACnD,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,IAAI;QAC/C,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,gBAAgB,IAAI,IAAI;KACpD,CAAC,CACH,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK;YAAE,gBAAgB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,0BAA0B,CAAC,CAAC;QACxG,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAClE,kGAAkG;QAClG,IAAI,OAAO,KAAK,UAAU,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YAC9D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC;gBAC5D,MAAM,IAAI,eAAe,CACvB,eAAe,EACf,qEAAqE,CACtE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,sEAAsE;IAEtE,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC3G,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,OAAgB,CAAC,CAAC;YACtC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAU,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QACjG,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACxB,0FAA0F;YAC1F,IAAI,GAAG,CAAC,cAAc,CAAC,OAAO;gBAAE,OAAO,EAAE,CAAC;;gBACrC,GAAG,CAAC,cAAc,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;QACH,aAAa,CAAC,SAAS,CAAC,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,QAAQ;YAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,OAAgB,CAAC,CAAC;IACjF,CAAC,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/http/admin-app.d.ts

@@ -0,0 +1,9 @@
+import { Hono } from 'hono';
+import type { AppContext } from '../app.js';
+import type { AdminEnv } from './admin/auth.js';
+export interface AdminAppOptions {
+    /** Built admin-ui assets. The SPA is optional so the API can run without a UI build (tests, dev). */
+    uiDir?: string;
+}
+/** The LAN-only admin listener (design §2.1): Vue SPA + Admin API + login/OIDC. */
+export declare function createAdminApp(ctx: AppContext, { uiDir }?: AdminAppOptions): Hono<AdminEnv>;

package/dist/http/admin-app.js

@@ -0,0 +1,51 @@
+import { existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import { serveStatic } from '@hono/node-server/serve-static';
+import { Hono } from 'hono';
+import { csrfGuard, registerAuthRoutes, registerProfileRoutes, requireUser } from './admin/auth.js';
+import { registerInstanceRoutes } from './admin/instances.js';
+import { registerSystemRoutes } from './admin/system.js';
+import { errorResponse } from './common.js';
+/** Paths the SPA fallback must never swallow, so API/auth typos surface as 404s. */
+const NON_SPA_PREFIXES = ['/api', '/auth', '/.well-known', '/healthz'];
+/** The LAN-only admin listener (design §2.1): Vue SPA + Admin API + login/OIDC. */
+export function createAdminApp(ctx, { uiDir } = {}) {
+    const app = new Hono();
+    app.onError(errorResponse);
+    // The SPA loads only its own bundle; nothing may frame the portal (clickjacking on approvals).
+    app.use('*', async (c, next) => {
+        await next();
+        c.header('Content-Security-Policy', "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; " +
+            "frame-ancestors 'none'; base-uri 'none'; form-action 'self'");
+        c.header('X-Frame-Options', 'DENY');
+        c.header('X-Content-Type-Options', 'nosniff');
+        c.header('Referrer-Policy', 'same-origin');
+    });
+    app.get('/healthz', (c) => c.json({ status: 'ok' }));
+    app.use('/api/*', csrfGuard(ctx));
+    app.use('/auth/*', csrfGuard(ctx));
+    registerAuthRoutes(app, ctx); // public: session probe, setup, login, OIDC
+    // Everything else under /api needs a signed-in user.
+    app.use('/api/*', async (c, next) => {
+        if (c.req.path === '/api/session' || c.req.path === '/api/setup')
+            return next();
+        return requireUser(ctx)(c, next);
+    });
+    registerProfileRoutes(app, ctx);
+    registerInstanceRoutes(app, ctx);
+    registerSystemRoutes(app, ctx);
+    app.all('/api/*', (c) => c.json({ error: 'not_found', message: 'No such API route' }, 404));
+    const indexHtml = uiDir ? path.join(uiDir, 'index.html') : undefined;
+    if (uiDir && indexHtml && existsSync(indexHtml)) {
+        const html = readFileSync(indexHtml, 'utf8');
+        app.use('/assets/*', serveStatic({ root: path.relative(process.cwd(), uiDir) }));
+        app.get('*', (c, next) => {
+            if (NON_SPA_PREFIXES.some((p) => c.req.path === p || c.req.path.startsWith(`${p}/`)))
+                return next();
+            return c.html(html);
+        });
+    }
+    app.notFound((c) => c.json({ error: 'not_found' }, 404));
+    return app;
+}
+//# sourceMappingURL=admin-app.js.map

package/dist/http/admin-app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-app.js","sourceRoot":"","sources":["../../src/http/admin-app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAO5C,oFAAoF;AACpF,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;AAEvE,mFAAmF;AACnF,MAAM,UAAU,cAAc,CAAC,GAAe,EAAE,EAAE,KAAK,KAAsB,EAAE;IAC7E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAY,CAAC;IACjC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAE3B,+FAA+F;IAC/F,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,IAAI,EAAE,CAAC;QACb,CAAC,CAAC,MAAM,CACN,yBAAyB,EACzB,qHAAqH;YACnH,6DAA6D,CAChE,CAAC;QACF,CAAC,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC,CAAC,MAAM,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QAC9C,CAAC,CAAC,MAAM,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAErD,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,4CAA4C;IAE1E,qDAAqD;IACrD,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAClC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,IAAI,EAAE,CAAC;QAChF,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IACH,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChC,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjC,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/B,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IAE5F,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,IAAI,KAAK,IAAI,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC7C,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QACjF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE;YACvB,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAC;YACpG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IACzD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/http/common.d.ts

@@ -0,0 +1,32 @@
+import type { Context } from 'hono';
+import { z } from 'zod';
+/** Helpers shared by the admin and MCP listeners. */
+/**
+ * The client's IP. Behind `trustProxy` proxies, X-Forwarded-For is read from the right: each trusted
+ * proxy appends the address it saw, so the entry `trustProxy` places from the end is the one the
+ * outermost proxy recorded. Anything further left was sent by the client and can be forged.
+ */
+export declare function clientIp(c: Context, trustProxy: number | boolean): string | undefined;
+/** Whether the client reached us over TLS (directly, or at a trusted reverse proxy). */
+export declare function isSecure(c: Context, trustProxy: number | boolean): boolean;
+/** The origin the client used, honoring X-Forwarded-* only when the proxy is trusted. */
+export declare function requestOrigin(c: Context, trustProxy: number | boolean): string;
+export declare function readJson<S extends z.ZodType>(c: Context, schema: S): Promise<z.infer<S>>;
+/** Like `readJson`, but an empty body is `undefined` rather than `{}`. Malformed JSON is a 400. */
+export declare function readOptionalJson<S extends z.ZodType>(c: Context, schema: S): Promise<z.infer<S> | undefined>;
+/** Maps service errors onto JSON responses; anything unexpected is a 500 without internals. */
+export declare function errorResponse(err: unknown, c: Context): (Response & import("hono").TypedResponse<{
+    details?: null | undefined;
+    error: string;
+    message: string;
+}, 400 | 404 | 409, "json">) | (Response & import("hono").TypedResponse<{
+    error: string;
+    message: string;
+    details: string[];
+}, 400, "json">) | (Response & import("hono").TypedResponse<{
+    error: string;
+    message: string;
+}, 503, "json">) | (Response & import("hono").TypedResponse<{
+    error: string;
+    message: string;
+}, 500, "json">);

package/dist/http/common.js

@@ -0,0 +1,80 @@
+import { getConnInfo } from '@hono/node-server/conninfo';
+import { ZodError } from 'zod';
+import { z } from 'zod';
+import { ServiceError, ValidationError } from '../errors.js';
+import { PluginTimeoutError, PluginUnavailableError } from '../plugins/process.js';
+/** Helpers shared by the admin and MCP listeners. */
+/**
+ * The client's IP. Behind `trustProxy` proxies, X-Forwarded-For is read from the right: each trusted
+ * proxy appends the address it saw, so the entry `trustProxy` places from the end is the one the
+ * outermost proxy recorded. Anything further left was sent by the client and can be forged.
+ */
+export function clientIp(c, trustProxy) {
+    const hops = Number(trustProxy);
+    if (hops > 0) {
+        const chain = (c.req.header('x-forwarded-for') ?? '')
+            .split(',')
+            .map((p) => p.trim())
+            .filter(Boolean);
+        const ip = chain[chain.length - hops];
+        if (ip)
+            return ip;
+    }
+    try {
+        return getConnInfo(c).remote.address;
+    }
+    catch {
+        return undefined; // app.request() in tests has no socket
+    }
+}
+/** Whether the client reached us over TLS (directly, or at a trusted reverse proxy). */
+export function isSecure(c, trustProxy) {
+    if (new URL(c.req.url).protocol === 'https:')
+        return true;
+    return Number(trustProxy) > 0 && c.req.header('x-forwarded-proto')?.split(',')[0]?.trim() === 'https';
+}
+/** The origin the client used, honoring X-Forwarded-* only when the proxy is trusted. */
+export function requestOrigin(c, trustProxy) {
+    const url = new URL(c.req.url);
+    const proto = isSecure(c, trustProxy) ? 'https' : url.protocol.replace(':', '');
+    const host = (Number(trustProxy) > 0 && c.req.header('x-forwarded-host')?.split(',')[0]?.trim()) ||
+        c.req.header('host') ||
+        url.host;
+    return `${proto}://${host}`;
+}
+export async function readJson(c, schema) {
+    return schema.parse((await readOptionalJson(c, z.unknown())) ?? {});
+}
+/** Like `readJson`, but an empty body is `undefined` rather than `{}`. Malformed JSON is a 400. */
+export async function readOptionalJson(c, schema) {
+    const text = await c.req.text();
+    if (!text)
+        return undefined;
+    let body;
+    try {
+        body = JSON.parse(text);
+    }
+    catch {
+        throw new ValidationError('invalid_json', 'Request body must be JSON');
+    }
+    return schema.parse(body);
+}
+/** Maps service errors onto JSON responses; anything unexpected is a 500 without internals. */
+export function errorResponse(err, c) {
+    if (err instanceof ServiceError) {
+        return c.json({ error: err.code, message: err.message, ...(err.details !== undefined ? { details: err.details } : {}) }, err.status);
+    }
+    if (err instanceof ZodError) {
+        return c.json({
+            error: 'invalid_request',
+            message: 'Invalid request',
+            details: err.issues.map((i) => `${i.path.join('.') || '(body)'}: ${i.message}`),
+        }, 400);
+    }
+    if (err instanceof PluginUnavailableError || err instanceof PluginTimeoutError) {
+        return c.json({ error: 'plugin_unavailable', message: err.message }, 503);
+    }
+    console.error(err);
+    return c.json({ error: 'internal', message: 'Internal error' }, 500);
+}
+//# sourceMappingURL=common.js.map

package/dist/http/common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../src/http/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAC/B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAEnF,qDAAqD;AAErD;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,CAAU,EAAE,UAA4B;IAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;aAClD,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QACtC,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;IACpB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,CAAC,uCAAuC;IAC3D,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,QAAQ,CAAC,CAAU,EAAE,UAA4B;IAC/D,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,OAAO,CAAC;AACxG,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,aAAa,CAAC,CAAU,EAAE,UAA4B;IACpE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAChF,MAAM,IAAI,GACR,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACnF,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;QACpB,GAAG,CAAC,IAAI,CAAC;IACX,OAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAsB,CAAU,EAAE,MAAS;IACvE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAsB,CAAU,EAAE,MAAS;IAC/E,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,aAAa,CAAC,GAAY,EAAE,CAAU;IACpD,IAAI,GAAG,YAAY,YAAY,EAAE,CAAC;QAChC,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EACzG,GAAG,CAAC,MAAM,CACX,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;QAC5B,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE,iBAAiB;YACxB,OAAO,EAAE,iBAAiB;YAC1B,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;SAChF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,YAAY,sBAAsB,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;QAC/E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;AACvE,CAAC"}

package/dist/http/mcp/approval-routes.d.ts

@@ -0,0 +1,11 @@
+import type { Hono } from 'hono';
+import type { AppContext } from '../../app.js';
+/** A locked operation needs a TOTP code proved this recently (design §5.3). */
+export declare const LOCKED_TOTP_MAX_AGE_MS: number;
+/**
+ * The approval page (design §5.3). The MCP client is asked to open it (URL-mode elicitation); the
+ * link only opens this page. Deciding needs a signed-in user with TOTP enrolled, a TOTP proof in this
+ * session (a fresh one for locked operations) and a CSRF-protected POST, so neither the client that
+ * holds the link nor a prefetch can decide anything.
+ */
+export declare function registerApprovalRoutes(app: Hono, ctx: AppContext): void;

package/dist/http/mcp/approval-routes.js

@@ -0,0 +1,117 @@
+import { eq } from 'drizzle-orm';
+import { operations, pendingApprovals, pluginInstances } from '../../db/schema.js';
+import { ServiceError } from '../../errors.js';
+import { clientIp } from '../common.js';
+import { checkUiCsrf, recordTotpProof, renderLogin, sinceTotpProof, uiCsrf, uiSession } from './oauth-routes.js';
+import { approvalPage, errorPage } from './pages.js';
+/** A locked operation needs a TOTP code proved this recently (design §5.3). */
+export const LOCKED_TOTP_MAX_AGE_MS = 5 * 60_000;
+/**
+ * The approval page (design §5.3). The MCP client is asked to open it (URL-mode elicitation); the
+ * link only opens this page. Deciding needs a signed-in user with TOTP enrolled, a TOTP proof in this
+ * session (a fresh one for locked operations) and a CSRF-protected POST, so neither the client that
+ * holds the link nor a prefetch can decide anything.
+ */
+export function registerApprovalRoutes(app, ctx) {
+    const gone = (c) => errorPage(c, 'Link expired', 'This approval request has expired or was already decided.', 404);
+    const load = (c, token) => {
+        const link = ctx.links.resolve(token);
+        if (!link) {
+            // Tokens are unguessable; this only slows down noisy scanners.
+            ctx.throttle.allowIp(clientIp(c, ctx.config.TRUST_PROXY));
+            return null;
+        }
+        const row = ctx.db
+            .select({ approval: pendingApprovals, op: operations, instance: pluginInstances })
+            .from(pendingApprovals)
+            .innerJoin(operations, eq(pendingApprovals.operationId, operations.id))
+            .innerJoin(pluginInstances, eq(pendingApprovals.instanceId, pluginInstances.id))
+            .where(eq(pendingApprovals.id, link.approvalId))
+            .get();
+        return row ? { link, ...row } : null;
+    };
+    /** Every approval needs a TOTP proof in this session (OIDC sign-ins have none); locked ops a fresh one. */
+    const needsTotp = (session, data) => {
+        const since = sinceTotpProof(ctx, session);
+        return data.op.locked ? since > LOCKED_TOTP_MAX_AGE_MS : since === Infinity;
+    };
+    const noTotp = (c) => errorPage(c, 'Two-factor authentication required', 'Approving calls needs an authenticator app on your account. Set it up in the admin portal under Profile, then open this link again.', 403);
+    const render = (c, token, data, session, error) => approvalPage(c, {
+        token,
+        csrf: uiCsrf(ctx, c),
+        username: session.user.username,
+        slug: data.instance.slug,
+        instanceName: data.instance.displayName,
+        operationKey: data.op.key,
+        locked: data.op.locked,
+        summary: data.approval.summary,
+        params: data.approval.paramsDisplay,
+        targets: data.approval.resolvedTargets,
+        diff: data.approval.diff,
+        expiresAt: data.approval.expiresAt,
+        confirmLiteral: data.approval.confirmLiteral,
+        needsTotp: needsTotp(session, data),
+        status: data.approval.status,
+        error,
+    }, error ? 400 : 200);
+    app.get('/a/:token', (c) => {
+        const token = c.req.param('token');
+        const data = load(c, token);
+        if (!data)
+            return gone(c);
+        const session = uiSession(ctx, c, 'approval');
+        if (!session)
+            return renderLogin(ctx, c, `/a/${token}`, 'Sign in to review this approval request.');
+        if (!session.user.totpEnabled)
+            return noTotp(c);
+        return render(c, token, data, session);
+    });
+    app.post('/a/:token', async (c) => {
+        const token = c.req.param('token');
+        const body = await c.req.parseBody();
+        const data = load(c, token);
+        if (!data)
+            return gone(c);
+        const session = uiSession(ctx, c, 'approval');
+        if (!session)
+            return renderLogin(ctx, c, `/a/${token}`, 'Your sign-in expired. Sign in again to decide.');
+        if (!session.user.totpEnabled)
+            return noTotp(c);
+        if (!checkUiCsrf(c, body.csrf))
+            return render(c, token, data, session, 'The form expired; try again.');
+        const approve = body.decision === 'approve';
+        if (!approve && body.decision !== 'deny')
+            return render(c, token, data, session, 'Choose approve or deny.');
+        if (approve && needsTotp(session, data)) {
+            const user = session.user;
+            if (ctx.throttle.lockedFor(user.username, 'mcp') > 0)
+                return render(c, token, data, session, 'Too many attempts; try again later.');
+            // TOTP only: a recovery code typed here must neither count nor be used up.
+            if (!ctx.users.verifyTotpCode(user.id, String(body.totp ?? ''))) {
+                if (ctx.throttle.fail(user.username, 'mcp'))
+                    ctx.events.emit('auth.lockout', {
+                        username: user.username,
+                        ip: clientIp(c, ctx.config.TRUST_PROXY),
+                        surface: 'mcp',
+                    });
+                return render(c, token, data, session, 'Enter a valid authenticator code to approve.');
+            }
+            ctx.throttle.succeed(user.username, 'mcp');
+            recordTotpProof(ctx, session.idHash);
+        }
+        try {
+            ctx.approvals.decide(data.approval.id, {
+                approve,
+                confirm: typeof body.confirm === 'string' ? body.confirm : undefined,
+                decidedBy: session.user.username,
+            });
+        }
+        catch (err) {
+            if (err instanceof ServiceError)
+                return render(c, token, data, session, err.message);
+            throw err;
+        }
+        return errorPage(c, approve ? 'Approved' : 'Denied', `${data.op.key} on /${data.instance.slug} was ${approve ? 'approved' : 'denied'}. You can close this page.`, 200);
+    });
+}
+//# sourceMappingURL=approval-routes.js.map

package/dist/http/mcp/approval-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-routes.js","sourceRoot":"","sources":["../../../src/http/mcp/approval-routes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAGjC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACjH,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAErD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAG,MAAM,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAS,EAAE,GAAe;IAC/D,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE,CAC1B,SAAS,CAAC,CAAC,EAAE,cAAc,EAAE,2DAA2D,EAAE,GAAG,CAAC,CAAC;IAEjG,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,KAAa,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,+DAA+D;YAC/D,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,EAAE;aACf,MAAM,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;aACjF,IAAI,CAAC,gBAAgB,CAAC;aACtB,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;aACtE,SAAS,CAAC,eAAe,EAAE,EAAE,CAAC,gBAAgB,CAAC,UAAU,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;aAC/E,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;aAC/C,GAAG,EAAE,CAAC;QACT,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC,CAAC;IAGF,2GAA2G;IAC3G,MAAM,SAAS,GAAG,CAAC,OAAqB,EAAE,IAAY,EAAE,EAAE;QACxD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,sBAAsB,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC;IAC9E,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,CAAU,EAAE,EAAE,CAC5B,SAAS,CACP,CAAC,EACD,oCAAoC,EACpC,qIAAqI,EACrI,GAAG,CACJ,CAAC;IAEJ,MAAM,MAAM,GAAG,CAAC,CAAU,EAAE,KAAa,EAAE,IAAY,EAAE,OAAqB,EAAE,KAAc,EAAE,EAAE,CAChG,YAAY,CACV,CAAC,EACD;QACE,KAAK;QACL,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACpB,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;QAC/B,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;QACxB,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW;QACvC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,GAAG;QACzB,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,MAAM;QACtB,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO;QAC9B,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa;QACnC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe;QACtC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;QACxB,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;QAClC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc;QAC5C,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC;QACnC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;QAC5B,KAAK;KACN,EACD,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAClB,CAAC;IAEJ,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE;QACzB,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,KAAK,EAAE,EAAE,0CAA0C,CAAC,CAAC;QACpG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;QAChD,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,KAAK,EAAE,EAAE,gDAAgD,CAAC,CAAC;QAC1G,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,8BAA8B,CAAC,CAAC;QACvG,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC;QAC5C,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,yBAAyB,CAAC,CAAC;QAE5G,IAAI,OAAO,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAC1B,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC;gBAClD,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,qCAAqC,CAAC,CAAC;YAChF,2EAA2E;YAC3E,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;gBAChE,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC;oBACzC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE;wBAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,EAAE,EAAE,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;wBACvC,OAAO,EAAE,KAAK;qBACf,CAAC,CAAC;gBACL,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,8CAA8C,CAAC,CAAC;YACzF,CAAC;YACD,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC3C,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,CAAC;YACH,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;gBACrC,OAAO;gBACP,OAAO,EAAE,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBACpE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;aACjC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,YAAY;gBAAE,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACrF,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,SAAS,CACd,CAAC,EACD,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAC/B,GAAG,IAAI,CAAC,EAAE,CAAC,GAAG,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,4BAA4B,EAC3G,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/http/mcp/endpoint.d.ts

@@ -0,0 +1,32 @@
+import type { Manifest } from '@synoikia/plugin-sdk';
+import type { Context } from 'hono';
+import type { AppContext } from '../../app.js';
+import type { Config } from '../../config/env.js';
+import type { OAuthService } from '../../auth/oauth.js';
+/** Open MCP sessions per authenticated principal; a new one past the cap closes that principal's oldest. */
+export declare const MAX_SESSIONS_PER_PRINCIPAL = 16;
+export declare function describeSearch(manifest: Manifest): string;
+export declare function describeExecute(manifest: Manifest): string;
+/**
+ * DNS-rebinding defence (MCP transport spec): a browser page can make its own domain resolve to this
+ * server, but it can't change the Host it sends, nor the Origin. Host must be a name this server was
+ * configured for (PUBLIC_MCP_URL, MCP_ALLOWED_HOSTS) or something that can't be rebound (localhost, an
+ * IP literal); an Origin, when present, must be one of those too.
+ */
+export declare function hostAllowed(config: Config, hostHeader: string | undefined): boolean;
+export declare function originAllowed(config: Config, origin: string | undefined): boolean;
+export declare class McpEndpoints {
+    private readonly ctx;
+    private readonly oauth;
+    private readonly sessions;
+    private readonly sweeper;
+    constructor(ctx: AppContext, oauth: OAuthService);
+    get sessionCount(): number;
+    private sweep;
+    private closeSession;
+    closeAll(): Promise<void>;
+    private buildServer;
+    /** The request carries a bearer or OAuth access token that is live somewhere on this server. */
+    private holdsLiveCredential;
+    handle(c: Context, slug: string): Promise<Response>;
+}