@synoikia/core 0.1.0

package/dist/http/mcp/pages.js

@@ -0,0 +1,200 @@
+import { html, raw } from 'hono/html';
+// Synoikia tokens. The CSP allows no external fonts, so the brand faces apply only when installed
+// locally; the stacks fall back to the closest system faces.
+const STYLE = `
+:root { color-scheme:light; --surface-100:#f7f1e8; --surface-200:#eee4d3; --surface-300:#e4d6bf; --border:#d9c9ab; --border-strong:#c2ac82;
+  --ink:#241b12; --ink-muted:#5c5044; --brand:#b5502f; --brand-strong:#8f3d22; --accent:#4f6b52; --on-brand:#fff;
+  --link:#8f3d22; --danger:#b23b3b; --danger-text:#9a2f2f; --danger-subtle:#f0dcda;
+  --font-display:"Fraunces", Georgia, "Times New Roman", serif; --font-sans:"IBM Plex Sans", system-ui, -apple-system, sans-serif;
+  --font-mono:"IBM Plex Mono", ui-monospace, "SF Mono", monospace; }
+@media (prefers-color-scheme: dark) { :root { color-scheme:dark; --surface-100:#14110e; --surface-200:#1d1914; --surface-300:#262019;
+  --border:#3a3026; --border-strong:#4d4030; --ink:#f2e9db; --ink-muted:#b8ab98; --brand:#d97250; --brand-strong:#e88a63; --accent:#8fae8a;
+  --on-brand:#14110e; --link:#d97250; --danger:#e8685f; --danger-text:#e8685f; --danger-subtle:#2e1c1b; } }
+* { box-sizing: border-box; }
+body { margin:0; min-height:100vh; display:flex; flex-direction:column; align-items:center; justify-content:center; gap:20px;
+  background:var(--surface-100); color:var(--ink); font:15px/1.45 var(--font-sans); padding:16px; }
+.brand { display:flex; align-items:center; gap:10px; font-family:var(--font-display); font-weight:600; font-size:23px; line-height:1;
+  letter-spacing:-0.01em; } .brand .root { color:var(--brand); } .brand svg { display:block; }
+.brand .frame { stroke:var(--ink-muted); } .brand .paths { stroke:var(--brand-strong); } .brand .dwellings { fill:var(--accent); }
+.brand .hearth { fill:var(--brand); }
+main { width:100%; max-width:460px; background:var(--surface-200); border:1px solid var(--border); border-radius:14px; padding:24px;
+  box-shadow:0 1px 2px rgb(36 27 18 / 8%); }
+h1 { font-size:22px; line-height:28px; margin:0 0 4px; } p.sub { margin:0 0 18px; color:var(--ink-muted); }
+a { color:var(--link); }
+label { display:block; font-size:12px; line-height:16px; font-weight:600; color:var(--ink-muted); margin:14px 0 6px; }
+input[type=text], input[type=password] { width:100%; padding:8px 12px; border:1px solid var(--border-strong); border-radius:8px; font:inherit;
+  background:var(--surface-100); color:inherit; }
+input:focus { outline:2px solid var(--brand); outline-offset:-1px; border-color:var(--brand); }
+input[type=checkbox], input[type=radio] { accent-color:var(--brand); }
+:focus-visible { outline:2px solid var(--brand); outline-offset:2px; }
+.row { display:flex; gap:8px; margin-top:18px; } .row > * { flex:1; }
+button, a.btn { display:inline-block; text-align:center; padding:8px 16px; border-radius:8px; border:1px solid var(--border-strong);
+  background:var(--surface-200); color:var(--ink); font:inherit; font-weight:600; cursor:pointer; text-decoration:none; }
+button:hover, a.btn:hover { background:var(--surface-300); }
+button.primary { background:var(--brand); border-color:var(--brand); color:var(--on-brand); }
+button.primary:hover { background:var(--brand-strong); border-color:var(--brand-strong); } button.danger { color:var(--danger-text); }
+.error { color:var(--danger-text); margin:12px 0 0; } .muted { color:var(--ink-muted); font-size:13px; }
+ul.endpoints { list-style:none; padding:0; margin:8px 0 0; } ul.endpoints li { padding:8px 0; border-top:1px solid var(--border); }
+code, pre { font-family:var(--font-mono); font-size:12px; } pre { white-space:pre-wrap; word-break:break-word; background:var(--surface-100);
+  border:1px solid var(--border); border-radius:8px; padding:12px; max-height:260px; overflow:auto; }
+.badge { font-size:12px; font-weight:600; padding:2px 10px; border-radius:999px; background:var(--danger-subtle); color:var(--danger-text);
+  vertical-align:middle; }
+hr { border:none; border-top:1px solid var(--border); margin:18px 0; }
+`;
+/** The Synoikia mark (design system assets/Logo/synoikia-mark.svg), themed through the classes above. */
+const BRAND = `<div class="brand"><svg viewBox="0 0 120 120" width="36" height="36" aria-hidden="true" focusable="false">
+<rect class="frame" x="4" y="4" width="112" height="112" rx="24" fill="none" stroke-width="3" opacity="0.32"/>
+<g class="paths" stroke-width="4" stroke-linecap="round" opacity="0.55"><line x1="60" y1="60" x2="60" y2="25"/>
+<line x1="60" y1="60" x2="95" y2="60"/><line x1="60" y1="60" x2="60" y2="95"/><line x1="60" y1="60" x2="25" y2="60"/></g>
+<g class="dwellings"><rect x="52" y="8" width="16" height="16" rx="4"/><rect x="96" y="52" width="16" height="16" rx="4"/>
+<rect x="52" y="96" width="16" height="16" rx="4"/><rect x="8" y="52" width="16" height="16" rx="4"/></g>
+<rect class="hearth" x="48" y="48" width="24" height="24" rx="6"/></svg><span>Syn<span class="root">oikia</span></span></div>`;
+export function page(c, title, body, status = 200) {
+    c.header('Content-Security-Policy', "default-src 'none'; style-src 'unsafe-inline'; img-src data:; frame-ancestors 'none'; base-uri 'none'");
+    c.header('X-Frame-Options', 'DENY');
+    c.header('Referrer-Policy', 'no-referrer');
+    c.header('Cache-Control', 'no-store');
+    return c.html(html `<!doctype html>
+      <html lang="en">
+        <head>
+          <meta charset="utf-8" />
+          <meta name="viewport" content="width=device-width, initial-scale=1" />
+          <title>${title} · Synoikia</title>
+          <style>
+            ${raw(STYLE)}
+          </style>
+        </head>
+        <body>
+          ${raw(BRAND)}
+          <main>${body}</main>
+        </body>
+      </html>`, status);
+}
+export function errorPage(c, title, message, status = 400) {
+    return page(c, title, html `<h1>${title}</h1>
+      <p class="sub">${message}</p>`, status);
+}
+export function loginPage(c, v, status = 200) {
+    return page(c, 'Sign in', html `<h1>Sign in</h1>
+      <p class="sub">${v.purpose}</p>
+      ${v.localLogin
+        ? html `<form method="post" action="/oauth/login">
+              <input type="hidden" name="csrf" value="${v.csrf}" />
+              <input type="hidden" name="continue" value="${v.continueTo}" />
+              <label for="u">Username</label
+              ><input id="u" type="text" name="username" autocomplete="username" autofocus required />
+              <label for="p">Password</label
+              ><input id="p" type="password" name="password" autocomplete="current-password" required />
+              <div class="row"><button class="primary" type="submit">Sign in</button></div>
+            </form>`
+        : ''}
+      ${v.oidc
+        ? html `${v.localLogin ? html `<hr />` : ''}
+              <a class="btn" style="width:100%" href="/oauth/login/oidc?continue=${encodeURIComponent(v.continueTo)}"
+                >Sign in with ${v.oidc.label}</a
+              >`
+        : ''}
+      ${v.error ? html `<p class="error" role="alert">${v.error}</p>` : ''}`, status);
+}
+export function totpPage(c, v, status = 200) {
+    return page(c, 'Two-factor code', html `<h1>Two-factor code</h1>
+      <p class="sub">Enter the code from your authenticator app, or a recovery code.</p>
+      <form method="post" action="/oauth/login/totp">
+        <input type="hidden" name="csrf" value="${v.csrf}" />
+        <input type="hidden" name="mfa" value="${v.mfa}" />
+        <input type="hidden" name="continue" value="${v.continueTo}" />
+        <label for="code">Code</label
+        ><input id="code" type="text" name="code" inputmode="numeric" autocomplete="one-time-code" autofocus required />
+        <div class="row"><button class="primary" type="submit">Continue</button></div>
+      </form>
+      ${v.error ? html `<p class="error" role="alert">${v.error}</p>` : ''}`, status);
+}
+export function consentPage(c, v) {
+    return page(c, 'Authorize access', html `<h1>Authorize ${v.clientName}</h1>
+      <p class="sub">
+        Signed in as <strong>${v.username}</strong>. After you approve, you'll be sent to
+        <code>${v.redirectHost}</code>.
+      </p>
+      <form method="post" action="/oauth/consent">
+        <input type="hidden" name="form" value="${v.formToken}" />
+        <label>Endpoints this client may use</label>
+        <ul class="endpoints">
+          ${v.endpoints.map((e) => html `<li>
+                <label style="display:flex;gap:8px;align-items:center;margin:0;color:inherit;font-weight:500">
+                  <input type="checkbox" name="resource" value="${e.resource}" ${e.checked ? 'checked' : ''} />
+                  <span><code>/${e.slug}</code> · ${e.name}</span>
+                </label>
+              </li>`)}
+        </ul>
+        <label>Access</label>
+        <ul class="endpoints">
+          <li>
+            <label style="display:flex;gap:8px;align-items:center;margin:0;color:inherit;font-weight:500">
+              <input type="radio" name="access" value="read" ${v.access === 'write' ? '' : 'checked'} />
+              <span><strong>Read only</strong> · this client can never call a write operation</span>
+            </label>
+          </li>
+          <li>
+            <label style="display:flex;gap:8px;align-items:center;margin:0;color:inherit;font-weight:500">
+              <input type="radio" name="access" value="write" ${v.access === 'write' ? 'checked' : ''} />
+              <span
+                ><strong>Read &amp; write</strong> · writes allowed where the endpoint's access levels allow them</span
+              >
+            </label>
+          </li>
+        </ul>
+        <p class="muted">
+          Tools still go through the endpoint's access levels and approvals. To change this later, revoke the client
+          under Clients & Tokens and connect again.
+        </p>
+        ${v.error ? html `<p class="error" role="alert">${v.error}</p>` : ''}
+        <div class="row">
+          <button class="danger" type="submit" name="decision" value="deny">Deny</button>
+          <button class="primary" type="submit" name="decision" value="approve">Approve</button>
+        </div>
+      </form>`);
+}
+const pretty = (v) => JSON.stringify(v, null, 2);
+export function approvalPage(c, v, status = 200) {
+    const open = v.status === 'pending';
+    return page(c, 'Approval request', html `<h1>${v.operationKey} ${v.locked ? html `<span class="badge">locked</span>` : ''}</h1>
+      <p class="sub"><code>/${v.slug}</code> · ${v.instanceName}</p>
+      <p>${v.summary}</p>
+      ${v.targets != null
+        ? html `<label>Targets</label>
+              <pre>${pretty(v.targets)}</pre>`
+        : ''}
+      ${v.diff != null
+        ? html `<label>Changes</label>
+              <pre>${pretty(v.diff)}</pre>`
+        : ''}
+      <label>Parameters (secrets redacted)</label>
+      <pre>${pretty(v.params ?? {})}</pre>
+      ${open
+        ? html `<p class="muted">Signed in as <strong>${v.username}</strong> · expires ${v.expiresAt.toISOString()}</p>
+              <form method="post" action="/a/${v.token}">
+                <input type="hidden" name="csrf" value="${v.csrf}" />
+                ${v.confirmLiteral
+            ? html `<label for="confirm">Type <code>${v.confirmLiteral}</code> to approve</label
+                        ><input id="confirm" type="text" name="confirm" autocomplete="off" />`
+            : ''}
+                ${v.needsTotp
+            ? html `<label for="totp">Authenticator code (required to approve a locked operation)</label
+                        ><input
+                          id="totp"
+                          type="text"
+                          name="totp"
+                          inputmode="numeric"
+                          autocomplete="one-time-code"
+                          pattern="[0-9]{6}"
+                        />`
+            : ''}
+                ${v.error ? html `<p class="error" role="alert">${v.error}</p>` : ''}
+                <div class="row">
+                  <button class="danger" type="submit" name="decision" value="deny">Deny</button>
+                  <button class="primary" type="submit" name="decision" value="approve">Approve</button>
+                </div>
+              </form>`
+        : html `<p class="error" role="status">This request is ${v.status.replace('_', ' ')}.</p>`}`, status);
+}
+//# sourceMappingURL=pages.js.map

package/dist/http/mcp/pages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pages.js","sourceRoot":"","sources":["../../../src/http/mcp/pages.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAUtC,kGAAkG;AAClG,6DAA6D;AAC7D,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuCb,CAAC;AAEF,yGAAyG;AACzG,MAAM,KAAK,GAAG;;;;;;8HAMgH,CAAC;AAE/H,MAAM,UAAU,IAAI,CAAC,CAAU,EAAE,KAAa,EAAE,IAAU,EAAE,SAA4C,GAAG;IACzG,CAAC,CAAC,MAAM,CACN,yBAAyB,EACzB,uGAAuG,CACxG,CAAC;IACF,CAAC,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC,CAAC,MAAM,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC3C,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IACtC,OAAO,CAAC,CAAC,IAAI,CACX,IAAI,CAAA;;;;;mBAKW,KAAK;;cAEV,GAAG,CAAC,KAAK,CAAC;;;;YAIZ,GAAG,CAAC,KAAK,CAAC;kBACJ,IAAI;;cAER,EACV,MAAM,CACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,CAAU,EAAE,KAAa,EAAE,OAAe,EAAE,SAAgC,GAAG;IACvG,OAAO,IAAI,CACT,CAAC,EACD,KAAK,EACL,IAAI,CAAA,OAAO,KAAK;uBACG,OAAO,MAAM,EAChC,MAAM,CACP,CAAC;AACJ,CAAC;AAWD,MAAM,UAAU,SAAS,CAAC,CAAU,EAAE,CAAY,EAAE,SAAgC,GAAG;IACrF,OAAO,IAAI,CACT,CAAC,EACD,SAAS,EACT,IAAI,CAAA;uBACe,CAAC,CAAC,OAAO;QAExB,CAAC,CAAC,UAAU;QACV,CAAC,CAAC,IAAI,CAAA;wDACwC,CAAC,CAAC,IAAI;4DACF,CAAC,CAAC,UAAU;;;;;;oBAMpD;QACV,CAAC,CAAC,EACN;QAEE,CAAC,CAAC,IAAI;QACJ,CAAC,CAAC,IAAI,CAAA,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAA,QAAQ,CAAC,CAAC,CAAC,EAAE;mFACgC,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC;gCACnF,CAAC,CAAC,IAAI,CAAC,KAAK;gBAC5B;QACN,CAAC,CAAC,EACN;QACE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA,iCAAiC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EACvE,MAAM,CACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,CAAU,EACV,CAAoE,EACpE,SAAoB,GAAG;IAEvB,OAAO,IAAI,CACT,CAAC,EACD,iBAAiB,EACjB,IAAI,CAAA;;;kDAG0C,CAAC,CAAC,IAAI;iDACP,CAAC,CAAC,GAAG;sDACA,CAAC,CAAC,UAAU;;;;;QAK1D,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA,iCAAiC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EACvE,MAAM,CACP,CAAC;AACJ,CAAC;AAaD,MAAM,UAAU,WAAW,CAAC,CAAU,EAAE,CAAc;IACpD,OAAO,IAAI,CACT,CAAC,EACD,kBAAkB,EAClB,IAAI,CAAA,iBAAiB,CAAC,CAAC,UAAU;;+BAEN,CAAC,CAAC,QAAQ;gBACzB,CAAC,CAAC,YAAY;;;kDAGoB,CAAC,CAAC,SAAS;;;YAGjD,CAAC,CAAC,SAAS,CAAC,GAAG,CACf,CAAC,CAAC,EAAE,EAAE,CACJ,IAAI,CAAA;;kEAEgD,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;iCAC1E,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,IAAI;;oBAEtC,CACT;;;;;;+DAMoD,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;;;;;;gEAMpC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;;;;;;;;;;;UAW3F,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA,iCAAiC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE;;;;;cAK7D,CACX,CAAC;AACJ,CAAC;AAsBD,MAAM,MAAM,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAE1D,MAAM,UAAU,YAAY,CAAC,CAAU,EAAE,CAAe,EAAE,SAAoB,GAAG;IAC/E,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC;IACpC,OAAO,IAAI,CACT,CAAC,EACD,kBAAkB,EAClB,IAAI,CAAA,OAAO,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA,mCAAmC,CAAC,CAAC,CAAC,EAAE;8BAC1D,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,YAAY;WACpD,CAAC,CAAC,OAAO;QAEZ,CAAC,CAAC,OAAO,IAAI,IAAI;QACf,CAAC,CAAC,IAAI,CAAA;qBACK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ;QACpC,CAAC,CAAC,EACN;QAEE,CAAC,CAAC,IAAI,IAAI,IAAI;QACZ,CAAC,CAAC,IAAI,CAAA;qBACK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ;QACjC,CAAC,CAAC,EACN;;aAEO,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;QAE3B,IAAI;QACF,CAAC,CAAC,IAAI,CAAA,yCAAyC,CAAC,CAAC,QAAQ,uBAAuB,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;+CACpE,CAAC,CAAC,KAAK;0DACI,CAAC,CAAC,IAAI;kBAE9C,CAAC,CAAC,cAAc;YACd,CAAC,CAAC,IAAI,CAAA,mCAAmC,CAAC,CAAC,cAAc;8FACiB;YAC1E,CAAC,CAAC,EACN;kBAEE,CAAC,CAAC,SAAS;YACT,CAAC,CAAC,IAAI,CAAA;;;;;;;;2BAQC;YACP,CAAC,CAAC,EACN;kBACE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA,iCAAiC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE;;;;;sBAK7D;QACZ,CAAC,CAAC,IAAI,CAAA,kDAAkD,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,OACtF,EAAE,EACJ,MAAM,CACP,CAAC;AACJ,CAAC"}

package/dist/http/mcp-app.d.ts

@@ -0,0 +1,7 @@
+import { Hono } from 'hono';
+import type { AppContext } from '../app.js';
+/**
+ * The public MCP listener (design §2.1): `/{slug}` endpoints, OAuth metadata/flows and approval-link
+ * pages. Nothing from the Admin API is mounted here.
+ */
+export declare function createMcpApp(ctx: AppContext): Hono;

package/dist/http/mcp-app.js

@@ -0,0 +1,30 @@
+import { Hono } from 'hono';
+import { errorResponse } from './common.js';
+import { McpEndpoints } from './mcp/endpoint.js';
+import { registerApprovalRoutes } from './mcp/approval-routes.js';
+import { registerOAuthRoutes } from './mcp/oauth-routes.js';
+const jsonRpcError = (code, message) => ({
+    jsonrpc: '2.0',
+    id: null,
+    error: { code, message },
+});
+/**
+ * The public MCP listener (design §2.1): `/{slug}` endpoints, OAuth metadata/flows and approval-link
+ * pages. Nothing from the Admin API is mounted here.
+ */
+export function createMcpApp(ctx) {
+    const app = new Hono();
+    app.onError(errorResponse);
+    const endpoints = new McpEndpoints(ctx, ctx.oauth);
+    ctx.onStop(() => endpoints.closeAll());
+    // Aggregate status only; per-instance detail lives on the admin port (design §11).
+    app.get('/healthz', (c) => c.json({ status: 'ok' }));
+    registerOAuthRoutes(app, ctx, ctx.oauth);
+    registerApprovalRoutes(app, ctx);
+    app.all('/.well-known/*', (c) => c.json({ error: 'not_found' }, 404));
+    app.all('/oauth/*', (c) => c.json({ error: 'not_found' }, 404));
+    app.all('/:slug', (c) => endpoints.handle(c, c.req.param('slug')));
+    app.notFound((c) => c.json(jsonRpcError(-32001, 'Not found'), 404));
+    return app;
+}
+//# sourceMappingURL=mcp-app.js.map

package/dist/http/mcp-app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-app.js","sourceRoot":"","sources":["../../src/http/mcp-app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE,CAAC,CAAC;IACvD,OAAO,EAAE,KAAc;IACvB,EAAE,EAAE,IAAI;IACR,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;CACzB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,GAAe;IAC1C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3B,MAAM,SAAS,GAAG,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACnD,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;IAEvC,mFAAmF;IACnF,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAErD,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACzC,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IACtE,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IAEhE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAEnE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACpE,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/instances/connection.d.ts

@@ -0,0 +1,37 @@
+import type { Manifest } from '@synoikia/plugin-sdk';
+/**
+ * Connection config handling (design §7.2, §8.3). Fields marked `writeOnly` in the plugin's
+ * connection schema are secrets: stored encrypted, passed to the plugin only via `init`, and never
+ * returned by the API — only a `{ set, hint }` summary.
+ */
+export declare function secretFieldNames(manifest: Manifest): string[];
+/** Validates the merged config + secrets against the plugin's schema and splits them again. */
+export declare function validateConnection(manifest: Manifest, input: Record<string, unknown>): {
+    config: Record<string, unknown>;
+    secrets: Record<string, string>;
+};
+/**
+ * Applies a secrets patch: a provided non-empty value replaces, `null` clears, an omitted key keeps
+ * the stored value. Unknown keys are rejected so typos don't silently drop a credential.
+ */
+export declare function mergeSecrets(manifest: Manifest, current: Record<string, string>, patch: Record<string, string | null | undefined>): Record<string, string>;
+export interface SecretSummary {
+    set: boolean;
+    /** Last 4 characters, only for values long enough that this reveals little. */
+    hint?: string;
+}
+export declare function summarizeSecrets(manifest: Manifest, secrets: Record<string, string>): Record<string, SecretSummary>;
+/** Non-secret fields that say where the upstream is: changing one decides where the secrets are sent. */
+export declare function addressFieldNames(manifest: Manifest): string[];
+/**
+ * The stored secrets a candidate connection may use (design §7.2). If the candidate changes where the
+ * upstream is, stored secrets are not carried over: otherwise "Test connection" or a save with an
+ * attacker's URL would send the stored API key there. The caller must enter them again.
+ */
+export declare function storedSecretsFor(manifest: Manifest, current: {
+    config: Record<string, unknown>;
+    secrets: Record<string, string>;
+}, candidate: {
+    config: Record<string, unknown>;
+    secrets?: Record<string, string | null>;
+}): Record<string, string>;

package/dist/instances/connection.js

@@ -0,0 +1,109 @@
+import { Ajv } from 'ajv';
+import * as ajvFormats from 'ajv-formats';
+import { ValidationError } from '../errors.js';
+const addFormats = (ajvFormats.default
+    .default ?? ajvFormats.default);
+const ajv = new Ajv({ allErrors: true, strict: false, useDefaults: true });
+addFormats(ajv);
+/**
+ * Compiled validators by schema content: compiled once per plugin version, not per request (ajv keeps
+ * every compiled schema, and a second compile of a schema with an `$id` throws).
+ */
+const compiled = new Map();
+const MAX_COMPILED = 200;
+function validatorFor(schema) {
+    const key = JSON.stringify(schema);
+    let validate = compiled.get(key);
+    if (!validate) {
+        validate = ajv.compile(schema);
+        // Unregister the `$id` so another version of the same plugin can compile its own schema under it.
+        const id = schema.$id;
+        if (typeof id === 'string')
+            ajv.removeSchema(id);
+        if (compiled.size >= MAX_COMPILED)
+            compiled.delete(compiled.keys().next().value);
+        compiled.set(key, validate);
+    }
+    return validate;
+}
+/**
+ * Connection config handling (design §7.2, §8.3). Fields marked `writeOnly` in the plugin's
+ * connection schema are secrets: stored encrypted, passed to the plugin only via `init`, and never
+ * returned by the API — only a `{ set, hint }` summary.
+ */
+export function secretFieldNames(manifest) {
+    const props = (manifest.connection.schema.properties ?? {});
+    return Object.entries(props)
+        .filter(([, p]) => p?.writeOnly === true)
+        .map(([k]) => k);
+}
+const describeErrors = (errors) => (errors ?? []).map((e) => `${e.instancePath || '(connection)'} ${e.message ?? 'is invalid'}`.trim());
+/** Validates the merged config + secrets against the plugin's schema and splits them again. */
+export function validateConnection(manifest, input) {
+    const validate = validatorFor(manifest.connection.schema);
+    const candidate = structuredClone(input);
+    if (!validate(candidate)) {
+        throw new ValidationError('invalid_connection', 'Connection settings are invalid', describeErrors(validate.errors));
+    }
+    const secretNames = new Set(secretFieldNames(manifest));
+    const config = {};
+    const secrets = {};
+    for (const [k, v] of Object.entries(candidate)) {
+        if (secretNames.has(k)) {
+            if (v !== undefined && v !== null && v !== '')
+                secrets[k] = String(v);
+        }
+        else {
+            config[k] = v;
+        }
+    }
+    return { config, secrets };
+}
+/**
+ * Applies a secrets patch: a provided non-empty value replaces, `null` clears, an omitted key keeps
+ * the stored value. Unknown keys are rejected so typos don't silently drop a credential.
+ */
+export function mergeSecrets(manifest, current, patch) {
+    const names = new Set(secretFieldNames(manifest));
+    const next = { ...current };
+    for (const [k, v] of Object.entries(patch)) {
+        if (!names.has(k))
+            throw new ValidationError('unknown_secret', `"${k}" is not a secret field of this plugin`);
+        if (v === null)
+            delete next[k];
+        else if (v !== undefined && v !== '')
+            next[k] = v;
+    }
+    return next;
+}
+export function summarizeSecrets(manifest, secrets) {
+    return Object.fromEntries(secretFieldNames(manifest).map((name) => {
+        const v = secrets[name];
+        return [name, v ? { set: true, ...(v.length >= 12 ? { hint: `…${v.slice(-4)}` } : {}) } : { set: false }];
+    }));
+}
+const ADDRESS_FORMATS = new Set(['uri', 'url', 'hostname', 'ipv4', 'ipv6', 'idn-hostname', 'iri']);
+const ADDRESS_NAME = /(url|uri|host|server|endpoint|address|domain|origin)/i;
+/** Non-secret fields that say where the upstream is: changing one decides where the secrets are sent. */
+export function addressFieldNames(manifest) {
+    const props = (manifest.connection.schema.properties ?? {});
+    return Object.entries(props)
+        .filter(([k, p]) => p?.writeOnly !== true && (ADDRESS_FORMATS.has(p?.format ?? '') || ADDRESS_NAME.test(k)))
+        .map(([k]) => k);
+}
+/**
+ * The stored secrets a candidate connection may use (design §7.2). If the candidate changes where the
+ * upstream is, stored secrets are not carried over: otherwise "Test connection" or a save with an
+ * attacker's URL would send the stored API key there. The caller must enter them again.
+ */
+export function storedSecretsFor(manifest, current, candidate) {
+    const moved = addressFieldNames(manifest).filter((k) => JSON.stringify(candidate.config[k] ?? null) !== JSON.stringify(current.config[k] ?? null));
+    if (moved.length === 0)
+        return current.secrets;
+    const missing = Object.keys(current.secrets).filter((k) => !candidate.secrets?.[k]);
+    if (missing.length > 0) {
+        throw new ValidationError('secrets_required', `Changing ${moved.join(', ')} changes where credentials are sent: enter ${missing.join(', ')} again`, missing);
+    }
+    return {};
+}
+//# sourceMappingURL=connection.js.map

package/dist/instances/connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../src/instances/connection.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC;AAE1B,OAAO,KAAK,UAAU,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAI/C,MAAM,UAAU,GAAG,CAAE,UAAkF,CAAC,OAAO;KAC5G,OAAO,IAAK,UAAoD,CAAC,OAAO,CAAkB,CAAC;AAE9F,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3E,UAAU,CAAC,GAAG,CAAC,CAAC;AAEhB;;;GAGG;AACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA4B,CAAC;AACrD,MAAM,YAAY,GAAG,GAAG,CAAC;AAEzB,SAAS,YAAY,CAAC,MAAwC;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/B,kGAAkG;QAClG,MAAM,EAAE,GAAI,MAA4B,CAAC,GAAG,CAAC;QAC7C,IAAI,OAAO,EAAE,KAAK,QAAQ;YAAE,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACjD,IAAI,QAAQ,CAAC,IAAI,IAAI,YAAY;YAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAC;QAClF,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AAEH,MAAM,UAAU,gBAAgB,CAAC,QAAkB;IACjD,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAA4C,CAAC;IACvG,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SACzB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,KAAK,IAAI,CAAC;SACxC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,MAAwC,EAAE,EAAE,CAClE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,YAAY,IAAI,cAAc,IAAI,CAAC,CAAC,OAAO,IAAI,YAAY,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;AAEvG,+FAA+F;AAC/F,MAAM,UAAU,kBAAkB,CAChC,QAAkB,EAClB,KAA8B;IAE9B,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,eAAe,CAAC,oBAAoB,EAAE,iCAAiC,EAAE,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACtH,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE;gBAAE,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,QAAkB,EAClB,OAA+B,EAC/B,KAAgD;IAEhD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,IAAI,CAAC,wCAAwC,CAAC,CAAC;QAC9G,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;aAC1B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;YAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAQD,MAAM,UAAU,gBAAgB,CAAC,QAAkB,EAAE,OAA+B;IAClF,OAAO,MAAM,CAAC,WAAW,CACvB,gBAAgB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACtC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5G,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;AACnG,MAAM,YAAY,GAAG,uDAAuD,CAAC;AAE7E,yGAAyG;AACzG,MAAM,UAAU,iBAAiB,CAAC,QAAkB;IAClD,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAGzD,CAAC;IACF,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SACzB,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;SAC3G,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAkB,EAClB,OAA6E,EAC7E,SAAuF;IAEvF,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAC9C,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CACjG,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC;IAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,YAAY,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,8CAA8C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EACpG,OAAO,CACR,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}