@zhanguym/chatroom 1.0.0

package/dist/infrastructure/http/http-server.d.ts

@@ -0,0 +1,28 @@
+import type { AddressInfo } from "node:net";
+import type { McpHttpHandler } from "@modelcontextprotocol/server";
+import type { ChatRoomConfig } from "#config/types";
+import type { WebRuntime } from "#plugins/web/runtime";
+import type { RuntimeEventBus } from "#app/event-bus";
+import type { ExternalAccessRegistry } from "#app/external-access-registry";
+import type { AuthService } from "#auth/auth-service";
+import type { PasskeyService } from "#auth/passkey-service";
+import type { CloudController } from "#plugins/cloud/controller";
+import type { LogService } from "#core/logging/types";
+export declare class HttpServer {
+    private readonly config;
+    private readonly application;
+    private readonly eventBus;
+    private readonly auth;
+    private readonly passkeys;
+    private readonly mcp;
+    private readonly cloud;
+    private readonly logs;
+    private server;
+    private readonly ingress;
+    private readonly startedAt;
+    private mcpRequestCount;
+    constructor(config: ChatRoomConfig, application: WebRuntime, eventBus: RuntimeEventBus, auth: AuthService, passkeys: PasskeyService, mcp: McpHttpHandler, externalAccess: ExternalAccessRegistry, cloud: CloudController, logs: LogService);
+    start(): Promise<void>;
+    address(): AddressInfo | null;
+    close(): Promise<void>;
+}

package/dist/infrastructure/http/http-server.js

@@ -0,0 +1,146 @@
+import { createServer } from "node:http";
+import path from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import express from "express";
+import compression from "compression";
+import { toNodeHandler } from "@modelcontextprotocol/node";
+import { createApiRouter } from "#plugins/web/http/api-router";
+import { createOAuthRouter } from "#presentation/http/oauth-router";
+import { errorMiddleware } from "#presentation/http/http-utils";
+import { IngressPolicy } from "#auth/ingress-policy";
+import { CHATROOM_VERSION } from "#core/runtime/identity";
+import { runWithMcpAccessScope } from "#mcp/server/request-context";
+import { hostValidation, mcpAuthentication, webMutationOrigin, } from "./ingress-middleware.js";
+const WEB_UI_RESERVED_PREFIXES = [
+    "/api",
+    "/mcp",
+    "/oauth",
+    "/.well-known",
+    "/assets",
+];
+export class HttpServer {
+    config;
+    application;
+    eventBus;
+    auth;
+    passkeys;
+    mcp;
+    cloud;
+    logs;
+    server = null;
+    ingress;
+    startedAt = Date.now();
+    mcpRequestCount = 0;
+    constructor(config, application, eventBus, auth, passkeys, mcp, externalAccess, cloud, logs) {
+        this.config = config;
+        this.application = application;
+        this.eventBus = eventBus;
+        this.auth = auth;
+        this.passkeys = passkeys;
+        this.mcp = mcp;
+        this.cloud = cloud;
+        this.logs = logs;
+        this.ingress = new IngressPolicy(config, externalAccess);
+    }
+    async start() {
+        const app = express();
+        app.disable("x-powered-by");
+        app.set("trust proxy", false);
+        app.use(hostValidation(this.ingress));
+        app.use(compression({ threshold: 1024 }));
+        app.use(express.json({ limit: "2mb" }));
+        app.use(express.urlencoded({ extended: false, limit: "64kb" }));
+        app.use(createOAuthRouter(this.auth, this.ingress, this.logs));
+        app.use("/api", webMutationOrigin(this.ingress));
+        app.use("/api", createApiRouter(this.application, this.eventBus, this.auth, this.passkeys, this.ingress, this.cloud, this.logs, () => ({
+            version: CHATROOM_VERSION,
+            mcpRequests: this.mcpRequestCount,
+            uptimeMinutes: Math.floor((Date.now() - this.startedAt) / 60000),
+        })));
+        const nodeMcp = toNodeHandler(this.mcp, {
+            onerror: (error) => this.logs.error("mcp", "mcp.error", "MCP request failed", { error }),
+        });
+        app.all("/mcp", (_req, _res, next) => {
+            this.mcpRequestCount += 1;
+            next();
+        }, mcpAuthentication(this.auth, this.ingress), (req, res) => {
+            const scope = this.ingress.isExternalMcp(req) ? "remote" : "local";
+            runWithMcpAccessScope(scope, () => {
+                void nodeMcp(req, res, req.body);
+            });
+        });
+        const webRoot = fileURLToPath(new URL("../../web/", import.meta.url));
+        const webIndexPath = path.join(webRoot, "index.html");
+        if (existsSync(webIndexPath)) {
+            const webIndex = readFileSync(webIndexPath, "utf8");
+            app.use("/assets", express.static(path.join(webRoot, "assets"), {
+                index: false,
+                maxAge: "1y",
+                immutable: true,
+            }));
+            app.use((req, res, next) => {
+                const isReserved = WEB_UI_RESERVED_PREFIXES.some((prefix) => req.path === prefix || req.path.startsWith(`${prefix}/`));
+                if (req.method !== "GET" || isReserved || !req.accepts("html")) {
+                    next();
+                    return;
+                }
+                res.setHeader("Cache-Control", "no-cache");
+                res.status(200).type("html").send(webIndex);
+            });
+        }
+        app.use(errorMiddleware);
+        this.server = createServer(app);
+        try {
+            await new Promise((resolve, reject) => {
+                this.server.once("error", reject);
+                this.server.listen(this.config.server.port, this.config.server.host, () => {
+                    this.server.off("error", reject);
+                    resolve();
+                });
+            });
+            this.logs.info("http", "http.started", "HTTP server started", {
+                host: this.config.server.host,
+                port: this.config.server.port,
+            });
+        }
+        catch (error) {
+            this.logs.error("http", "http.start_failed", "HTTP server failed to start", {
+                error,
+            });
+            throw error;
+        }
+    }
+    address() {
+        const value = this.server?.address();
+        return value && typeof value === "object" ? value : null;
+    }
+    async close() {
+        const server = this.server;
+        if (!server)
+            return;
+        this.server = null;
+        const errors = [];
+        const closed = server.listening
+            ? new Promise((resolve, reject) => server.close((error) => (error ? reject(error) : resolve())))
+            : Promise.resolve();
+        try {
+            await this.mcp.close();
+        }
+        catch (error) {
+            errors.push(error);
+        }
+        server.closeAllConnections();
+        try {
+            await closed;
+        }
+        catch (error) {
+            errors.push(error);
+        }
+        if (errors.length === 1)
+            throw errors[0];
+        if (errors.length > 1)
+            throw new AggregateError(errors, "HTTP server shutdown encountered errors");
+        this.logs.info("http", "http.stopped", "HTTP server stopped");
+    }
+}

package/dist/infrastructure/http/ingress-middleware.d.ts

@@ -0,0 +1,6 @@
+import type { RequestHandler } from "express";
+import type { AuthService } from "#auth/auth-service";
+import type { IngressPolicy } from "#auth/ingress-policy";
+export declare function webMutationOrigin(ingress: IngressPolicy): RequestHandler;
+export declare function hostValidation(ingress: IngressPolicy): RequestHandler;
+export declare function mcpAuthentication(auth: AuthService, ingress: IngressPolicy): RequestHandler;

package/dist/infrastructure/http/ingress-middleware.js

@@ -0,0 +1,58 @@
+export function webMutationOrigin(ingress) {
+    return (req, res, next) => {
+        if (req.method === "GET" ||
+            req.method === "HEAD" ||
+            req.method === "OPTIONS") {
+            next();
+            return;
+        }
+        const expectedOrigin = ingress.expectedWebOrigin(req);
+        if (!expectedOrigin) {
+            next();
+            return;
+        }
+        if (req.headers.origin !== expectedOrigin) {
+            res.status(403).json({
+                error: {
+                    code: "FORBIDDEN",
+                    message: "Request origin is not allowed",
+                },
+            });
+            return;
+        }
+        next();
+    };
+}
+export function hostValidation(ingress) {
+    return (req, res, next) => {
+        const hostname = req.hostname;
+        if (!hostname || !ingress.allowsHost(hostname)) {
+            res.status(403).json({
+                error: { code: "FORBIDDEN", message: "Host header is not allowed" },
+            });
+            return;
+        }
+        next();
+    };
+}
+export function mcpAuthentication(auth, ingress) {
+    return (req, res, next) => {
+        if (!ingress.requiresMcpAuth(req)) {
+            next();
+            return;
+        }
+        const header = req.headers.authorization;
+        const token = typeof header === "string" && header.startsWith("Bearer ")
+            ? header.slice(7)
+            : null;
+        const info = token ? auth.verifyMcpToken(token) : null;
+        if (!info) {
+            const base = ingress.mcpBaseUrl(req);
+            res.setHeader("WWW-Authenticate", `Bearer resource_metadata="${base}/.well-known/oauth-protected-resource/mcp"`);
+            res.status(401).json({ error: "invalid_token" });
+            return;
+        }
+        req.auth = info;
+        next();
+    };
+}

package/dist/infrastructure/logging/file-log-store.d.ts

@@ -0,0 +1,9 @@
+import type { LogPage, LogQuery, LogRecord } from "#core/logging/types";
+export declare class FileLogStore {
+    readonly filePath: string;
+    private currentBytes;
+    constructor(dataDir: string);
+    append(record: LogRecord): Promise<void>;
+    list(query: LogQuery): Promise<LogPage>;
+    private rotate;
+}

package/dist/infrastructure/logging/file-log-store.js

@@ -0,0 +1,173 @@
+import { appendFile, mkdir, open, rename, rm, stat } from "node:fs/promises";
+import path from "node:path";
+import { ChatRoomError } from "#core/errors/chatroom-error";
+const MAX_FILE_BYTES = 10 * 1024 * 1024;
+const MAX_FILES = 5;
+const READ_CHUNK_BYTES = 64 * 1024;
+export class FileLogStore {
+    filePath;
+    currentBytes = null;
+    constructor(dataDir) {
+        this.filePath = path.join(dataDir, "logs", "chatroom.log");
+    }
+    async append(record) {
+        const line = `${JSON.stringify(record)}\n`;
+        await mkdir(path.dirname(this.filePath), { recursive: true });
+        if (this.currentBytes === null) {
+            this.currentBytes = await stat(this.filePath)
+                .then((value) => value.size)
+                .catch((error) => {
+                if (error.code === "ENOENT")
+                    return 0;
+                throw error;
+            });
+        }
+        const bytes = Buffer.byteLength(line);
+        if (this.currentBytes > 0 && this.currentBytes + bytes > MAX_FILE_BYTES) {
+            await this.rotate();
+            this.currentBytes = 0;
+        }
+        await appendFile(this.filePath, line, { encoding: "utf8", mode: 0o600 });
+        this.currentBytes += bytes;
+    }
+    async list(query) {
+        const cursor = query.cursor ? decodeCursor(query.cursor) : null;
+        let cursorPassed = cursor === null;
+        const matches = [];
+        const wanted = query.limit + 1;
+        for (let index = 0; index < MAX_FILES && matches.length < wanted; index += 1) {
+            const file = index === 0 ? this.filePath : `${this.filePath}.${index}`;
+            for await (const line of readLinesReverse(file)) {
+                const record = parseRecord(line);
+                if (!record)
+                    continue;
+                if (!cursorPassed && cursor) {
+                    if (record.id === cursor.id &&
+                        record.timestamp === cursor.timestamp) {
+                        cursorPassed = true;
+                        continue;
+                    }
+                    if (record.timestamp < cursor.timestamp)
+                        cursorPassed = true;
+                    else
+                        continue;
+                }
+                if (query.levels && !query.levels.has(record.level))
+                    continue;
+                if (query.modules && !query.modules.has(record.module))
+                    continue;
+                matches.push(record);
+                if (matches.length >= wanted)
+                    break;
+            }
+        }
+        const hasMore = matches.length > query.limit;
+        const items = hasMore ? matches.slice(0, query.limit) : matches;
+        const last = items.at(-1);
+        return {
+            items,
+            nextCursor: hasMore && last ? encodeCursor(last) : null,
+        };
+    }
+    async rotate() {
+        await rm(`${this.filePath}.${MAX_FILES - 1}`, { force: true });
+        for (let index = MAX_FILES - 2; index >= 1; index -= 1) {
+            await renameIfExists(`${this.filePath}.${index}`, `${this.filePath}.${index + 1}`);
+        }
+        await renameIfExists(this.filePath, `${this.filePath}.1`);
+    }
+}
+async function* readLinesReverse(file) {
+    const handle = await open(file, "r").catch((error) => {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    });
+    if (!handle)
+        return;
+    try {
+        const { size } = await handle.stat();
+        let position = size;
+        let remainder = Buffer.alloc(0);
+        while (position > 0) {
+            const length = Math.min(READ_CHUNK_BYTES, position);
+            position -= length;
+            const buffer = Buffer.allocUnsafe(length);
+            let offset = 0;
+            while (offset < length) {
+                const { bytesRead } = await handle.read(buffer, offset, length - offset, position + offset);
+                if (bytesRead === 0)
+                    break;
+                offset += bytesRead;
+            }
+            const chunk = Buffer.concat([buffer.subarray(0, offset), remainder]);
+            let end = chunk.length;
+            for (let index = chunk.length - 1; index >= 0; index -= 1) {
+                if (chunk[index] !== 0x0a)
+                    continue;
+                const line = chunk
+                    .subarray(index + 1, end)
+                    .toString("utf8")
+                    .trim();
+                if (line)
+                    yield line;
+                end = index;
+            }
+            remainder = chunk.subarray(0, end);
+        }
+        const firstLine = remainder.toString("utf8").trim();
+        if (firstLine)
+            yield firstLine;
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function renameIfExists(from, to) {
+    try {
+        await rename(from, to);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+}
+function parseRecord(line) {
+    try {
+        const value = JSON.parse(line);
+        if (typeof value.id !== "string" ||
+            typeof value.timestamp !== "string" ||
+            !isLevel(value.level) ||
+            typeof value.module !== "string" ||
+            typeof value.event !== "string" ||
+            typeof value.message !== "string")
+            return null;
+        return value;
+    }
+    catch {
+        return null;
+    }
+}
+function isLevel(value) {
+    return (value === "debug" ||
+        value === "info" ||
+        value === "warn" ||
+        value === "error");
+}
+function encodeCursor(record) {
+    return Buffer.from(JSON.stringify({ timestamp: record.timestamp, id: record.id }), "utf8").toString("base64url");
+}
+function decodeCursor(cursor) {
+    try {
+        const value = JSON.parse(Buffer.from(cursor, "base64url").toString("utf8"));
+        if (typeof value.timestamp !== "string" ||
+            Number.isNaN(Date.parse(value.timestamp)) ||
+            typeof value.id !== "string" ||
+            !value.id)
+            throw new Error();
+        return { timestamp: value.timestamp, id: value.id };
+    }
+    catch {
+        throw new ChatRoomError("INVALID_INPUT", "Invalid log cursor");
+    }
+}

package/dist/infrastructure/logging/system-log.d.ts

@@ -0,0 +1,22 @@
+import type { LogPage, LogQuery, LogRecord, LogService } from "#core/logging/types";
+import { FileLogStore } from "./file-log-store.js";
+export declare class SystemLog implements LogService {
+    private readonly store;
+    private readonly redactor;
+    private readonly listeners;
+    private queue;
+    private persistenceDisabled;
+    private lastTimestampMs;
+    constructor(store: FileLogStore);
+    debug(module: string, event: string, message: string, data?: Record<string, unknown>): void;
+    info(module: string, event: string, message: string, data?: Record<string, unknown>): void;
+    warn(module: string, event: string, message: string, data?: Record<string, unknown>): void;
+    error(module: string, event: string, message: string, data?: Record<string, unknown>): void;
+    list(query: LogQuery): Promise<LogPage>;
+    subscribe(listener: (record: LogRecord) => void): () => void;
+    flush(): Promise<void>;
+    private write;
+    private nextTimestamp;
+    private writeConsole;
+    private disablePersistence;
+}

package/dist/infrastructure/logging/system-log.js

@@ -0,0 +1,117 @@
+import { randomUUID } from "node:crypto";
+import { SecretRedactor } from "#core/operations/redactor";
+export class SystemLog {
+    store;
+    redactor = new SecretRedactor();
+    listeners = new Set();
+    queue = Promise.resolve();
+    persistenceDisabled = false;
+    lastTimestampMs = 0;
+    constructor(store) {
+        this.store = store;
+    }
+    debug(module, event, message, data) {
+        this.write("debug", module, event, message, data);
+    }
+    info(module, event, message, data) {
+        this.write("info", module, event, message, data);
+    }
+    warn(module, event, message, data) {
+        this.write("warn", module, event, message, data);
+    }
+    error(module, event, message, data) {
+        this.write("error", module, event, message, data);
+    }
+    async list(query) {
+        await this.flush();
+        return this.store.list(query);
+    }
+    subscribe(listener) {
+        this.listeners.add(listener);
+        return () => this.listeners.delete(listener);
+    }
+    async flush() {
+        await this.queue;
+    }
+    write(level, module, event, message, data) {
+        const redacted = this.redactor.redact({
+            message,
+            ...(data ? { data: normalizeValue(data) } : {}),
+        });
+        const record = {
+            id: randomUUID(),
+            timestamp: this.nextTimestamp(),
+            level,
+            module,
+            event,
+            message: redacted.message,
+            ...(redacted.data && Object.keys(redacted.data).length
+                ? { data: redacted.data }
+                : {}),
+        };
+        this.writeConsole(record);
+        for (const listener of this.listeners) {
+            try {
+                listener(record);
+            }
+            catch {
+                this.listeners.delete(listener);
+                console.warn("[WARN] [logging] Log subscriber removed after failure");
+            }
+        }
+        if (this.persistenceDisabled)
+            return;
+        this.queue = this.queue
+            .then(() => this.store.append(record))
+            .catch((error) => this.disablePersistence(error));
+    }
+    nextTimestamp() {
+        const now = Date.now();
+        this.lastTimestampMs = Math.max(now, this.lastTimestampMs + 1);
+        return new Date(this.lastTimestampMs).toISOString();
+    }
+    writeConsole(record) {
+        const suffix = record.data ? ` ${JSON.stringify(record.data)}` : "";
+        const line = `[${record.level.toUpperCase()}] [${record.module}] ${record.message}${suffix}`;
+        if (record.level === "error")
+            console.error(line);
+        else if (record.level === "warn")
+            console.warn(line);
+        else
+            console.log(line);
+    }
+    disablePersistence(error) {
+        if (this.persistenceDisabled)
+            return;
+        this.persistenceDisabled = true;
+        const message = error instanceof Error ? error.message : String(error);
+        console.warn(`[WARN] [logging] File logging unavailable: ${message}`);
+    }
+}
+function normalizeValue(value, seen = new WeakSet()) {
+    if (typeof value === "bigint")
+        return value.toString();
+    if (value === null || typeof value !== "object")
+        return value;
+    if (seen.has(value))
+        return "[circular]";
+    seen.add(value);
+    try {
+        if (value instanceof Error) {
+            return {
+                name: value.name,
+                message: value.message,
+                ...(value.cause ? { cause: normalizeValue(value.cause, seen) } : {}),
+            };
+        }
+        if (Array.isArray(value))
+            return value.map((item) => normalizeValue(item, seen));
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+            key,
+            normalizeValue(item, seen),
+        ]));
+    }
+    finally {
+        seen.delete(value);
+    }
+}

package/dist/mcp/server/create-mcp-server.d.ts

@@ -0,0 +1,3 @@
+import { type McpHttpHandler } from "@modelcontextprotocol/server";
+import type { PluginManager } from "#plugins/plugin-manager";
+export declare function createChatRoomMcpHandler(plugins: PluginManager): McpHttpHandler;

package/dist/mcp/server/create-mcp-server.js

@@ -0,0 +1,16 @@
+import { createMcpHandler, McpServer, } from "@modelcontextprotocol/server";
+import { CHATROOM_NAME, CHATROOM_VERSION } from "#core/runtime/identity";
+export function createChatRoomMcpHandler(plugins) {
+    return createMcpHandler(() => createServer(plugins), {
+        legacy: "stateless",
+        responseMode: "auto",
+    });
+}
+function createServer(plugins) {
+    const server = new McpServer({
+        name: CHATROOM_NAME,
+        version: CHATROOM_VERSION,
+    });
+    plugins.registerMcp(server);
+    return server;
+}

package/dist/mcp/server/plugin-mcp-registrar.d.ts

@@ -0,0 +1,31 @@
+import type { McpServer, StandardSchemaWithJSON, ToolAnnotations, CallToolResult } from "@modelcontextprotocol/server";
+import type { OperationLog } from "#operations/operation-log";
+import type { McpToolControl } from "./tool-control.js";
+type PluginToolInput<Schema extends StandardSchemaWithJSON> = StandardSchemaWithJSON.InferOutput<Schema>;
+type PluginToolAction<Input> = string | ((input: Input) => string);
+export interface PluginToolExecution {
+    readonly operationId: string;
+    deferCompletion(): void;
+}
+export interface PluginToolConfig<InputSchema extends StandardSchemaWithJSON, OutputSchema extends StandardSchemaWithJSON> {
+    title: string;
+    description: string;
+    inputSchema: InputSchema;
+    outputSchema: OutputSchema;
+    annotations: ToolAnnotations;
+    action: PluginToolAction<PluginToolInput<InputSchema>>;
+    audit?: {
+        input?: (input: PluginToolInput<InputSchema>) => unknown;
+        output?: (output: unknown) => unknown;
+    };
+    present?: (output: unknown) => CallToolResult;
+}
+export declare class PluginMcpRegistrar {
+    private readonly server;
+    private readonly operations;
+    private readonly pluginId;
+    private readonly toolControl;
+    constructor(server: McpServer | null, operations: OperationLog, pluginId: string, toolControl: McpToolControl);
+    registerTool<InputSchema extends StandardSchemaWithJSON, OutputSchema extends StandardSchemaWithJSON>(name: string, config: PluginToolConfig<InputSchema, OutputSchema>, handler: (input: PluginToolInput<InputSchema>, execution: PluginToolExecution) => Promise<unknown> | unknown): void;
+}
+export {};