aiquila-mcp 0.4.3 → 0.4.5

package/README.md

@@ -92,6 +92,8 @@ See the [Docker setup guide](https://github.com/elgorro/aiquila/blob/main/docs/m
 | `MCP_AUTH_ENABLED`   | No       | `true` to enable OAuth for remote clients     |
 | `MCP_AUTH_SECRET`    | If auth  | `openssl rand -hex 32`                        |
 | `MCP_AUTH_ISSUER`    | If auth  | public HTTPS URL of this server               |
+| `MCP_ALLOWED_HOSTS`  | No       | extra hostnames for DNS rebinding protection  |
+| `MCP_CORS_ORIGINS`   | No       | extra browser origins allowed via CORS        |
 | `LOG_LEVEL`          | No       | `trace`/`debug`/`info`/`warn`/`error`/`fatal` |
 
 ## Requirements

package/dist/auth/login-page-css.js

@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: MIT
+/**
+ * Stylesheet for the OAuth login page.
+ *
+ * Served as a standalone document at LOGIN_STYLESHEET_PATH rather than inlined
+ * in a <style> block, so the login page's CSP can drop 'unsafe-inline' entirely.
+ * Keep this free of any interpolated/user-supplied value — it is served verbatim.
+ */
+export const LOGIN_STYLESHEET = `body { font-family: sans-serif; background: #f4f6f8; display: flex; justify-content: center; align-items: center; min-height: 100vh; margin: 0; }
+.card { background: #fff; border-radius: 8px; box-shadow: 0 2px 12px rgba(0,0,0,.12); padding: 2rem; width: 100%; max-width: 360px; }
+h1 { font-size: 1.3rem; margin: 0 0 .25rem; }
+.consent-banner { background: #eef6fc; border: 1px solid #b3d7f0; border-radius: 4px; padding: .75rem 1rem; margin-bottom: 1.25rem; font-size: .85rem; color: #333; line-height: 1.6; }
+.consent-banner strong { color: #0082c9; }
+.consent-banner .detail { display: block; margin-top: .25rem; }
+.consent-banner code { background: #d6ecf9; border-radius: 3px; padding: 0 .3em; font-size: .85em; word-break: break-all; }
+label { display: block; font-size: .85rem; font-weight: 600; margin-bottom: .25rem; }
+input[type=text], input[type=password] { width: 100%; box-sizing: border-box; padding: .55rem .75rem; border: 1px solid #ccc; border-radius: 4px; font-size: 1rem; margin-bottom: 1rem; }
+button { width: 100%; padding: .65rem; background: #0082c9; color: #fff; border: none; border-radius: 4px; font-size: 1rem; cursor: pointer; }
+button:hover { background: #006fa3; }
+.error { background: #fdecea; color: #c0392b; border-radius: 4px; padding: .6rem .9rem; margin-bottom: 1rem; font-size: .9rem; }
+`;
+/** Public path the login page links its stylesheet from. */
+export const LOGIN_STYLESHEET_PATH = '/auth/login.css';

package/dist/auth/login.js

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-import { renderLoginForm } from './provider.js';
+import { renderLoginForm, applySecurityHeaders } from './provider.js';
 import { logger } from '../logger.js';
 export function loginHandler(provider) {
     return async (req, res) => {
@@ -11,7 +11,7 @@ export function loginHandler(provider) {
             return;
         }
         if (!username || !password || !client_id || !redirect_uri || !code_challenge) {
-            res
+            applySecurityHeaders(res)
                 .status(400)
                 .type('html')
                 .send(renderLoginForm({
@@ -26,7 +26,7 @@ export function loginHandler(provider) {
         }
         const client = await provider.clientsStore.getClient(client_id);
         if (!client) {
-            res
+            applySecurityHeaders(res)
                 .status(400)
                 .type('html')
                 .send(renderLoginForm({
@@ -40,7 +40,7 @@ export function loginHandler(provider) {
             return;
         }
         if (!client.redirect_uris.map(String).includes(redirect_uri)) {
-            res
+            applySecurityHeaders(res)
                 .status(400)
                 .type('html')
                 .send(renderLoginForm({
@@ -64,7 +64,7 @@ export function loginHandler(provider) {
             });
             if (!ncResp.ok) {
                 logger.warn({ user: username, status: ncResp.status }, '[auth] Login failed');
-                res
+                applySecurityHeaders(res)
                     .status(200)
                     .type('html')
                     .send(renderLoginForm({
@@ -95,7 +95,7 @@ export function loginHandler(provider) {
         }
         catch (err) {
             logger.error({ user: username, err }, '[auth] Login error');
-            res
+            applySecurityHeaders(res)
                 .status(200)
                 .type('html')
                 .send(renderLoginForm({

package/dist/auth/provider.js

@@ -3,6 +3,7 @@ import { createHash, timingSafeEqual } from 'node:crypto';
 import { SignJWT, jwtVerify } from 'jose';
 import { InvalidGrantError, InvalidTokenError, } from '@modelcontextprotocol/sdk/server/auth/errors.js';
 import { ClientsStore, CodeStore, RefreshStore } from './store.js';
+import { LOGIN_STYLESHEET_PATH } from './login-page-css.js';
 import { logger } from '../logger.js';
 // --- JWT helpers (HMAC-SHA256 via jose) ---
 async function signJwt(payload, secret, expiresInSecs) {
@@ -37,6 +38,22 @@ function escapeHtml(s) {
         .replace(/"/g, '"')
         .replace(/'/g, ''');
 }
+/**
+ * Security headers for every HTML response served by the OAuth login flow.
+ *
+ * The page has no inline <script> and no inline styles (the stylesheet is served
+ * separately from LOGIN_STYLESHEET_PATH), so the policy can deny everything by
+ * default and allow only same-origin styles.
+ */
+export const LOGIN_PAGE_CSP = "frame-ancestors 'none'; default-src 'none'; style-src 'self'; form-action 'self'; base-uri 'none'";
+/** Applies the login-flow security headers to a response. Returns the response for chaining. */
+export function applySecurityHeaders(res) {
+    return res
+        .set('X-Frame-Options', 'DENY')
+        .set('X-Content-Type-Options', 'nosniff')
+        .set('Referrer-Policy', 'no-referrer')
+        .set('Content-Security-Policy', LOGIN_PAGE_CSP);
+}
 export function renderLoginForm(opts) {
     return `<!DOCTYPE html>
 <html lang="en">
@@ -44,21 +61,7 @@ export function renderLoginForm(opts) {
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>AIquila – Sign in with Nextcloud</title>
-  <style>
-    body { font-family: sans-serif; background: #f4f6f8; display: flex; justify-content: center; align-items: center; min-height: 100vh; margin: 0; }
-    .card { background: #fff; border-radius: 8px; box-shadow: 0 2px 12px rgba(0,0,0,.12); padding: 2rem; width: 100%; max-width: 360px; }
-    h1 { font-size: 1.3rem; margin: 0 0 .25rem; }
-    p.sub { color: #555; font-size: .9rem; margin: 0 0 1.5rem; }
-    .consent-banner { background: #eef6fc; border: 1px solid #b3d7f0; border-radius: 4px; padding: .75rem 1rem; margin-bottom: 1.25rem; font-size: .85rem; color: #333; line-height: 1.6; }
-    .consent-banner strong { color: #0082c9; }
-    .consent-banner .detail { display: block; margin-top: .25rem; }
-    .consent-banner code { background: #d6ecf9; border-radius: 3px; padding: 0 .3em; font-size: .85em; word-break: break-all; }
-    label { display: block; font-size: .85rem; font-weight: 600; margin-bottom: .25rem; }
-    input[type=text], input[type=password] { width: 100%; box-sizing: border-box; padding: .55rem .75rem; border: 1px solid #ccc; border-radius: 4px; font-size: 1rem; margin-bottom: 1rem; }
-    button { width: 100%; padding: .65rem; background: #0082c9; color: #fff; border: none; border-radius: 4px; font-size: 1rem; cursor: pointer; }
-    button:hover { background: #006fa3; }
-    .error { background: #fdecea; color: #c0392b; border-radius: 4px; padding: .6rem .9rem; margin-bottom: 1rem; font-size: .9rem; }
-  </style>
+  <link rel="stylesheet" href="${LOGIN_STYLESHEET_PATH}">
 </head>
 <body>
   <div class="card">
@@ -96,9 +99,7 @@ export class NextcloudOAuthProvider {
         return this._clientsStore;
     }
     async authorize(client, params, res) {
-        res
-            .set('X-Frame-Options', 'DENY')
-            .set('Content-Security-Policy', "frame-ancestors 'none'; default-src 'self'; style-src 'unsafe-inline'")
+        applySecurityHeaders(res)
             .status(200)
             .type('html')
             .send(renderLoginForm({

package/dist/client/maps.js

@@ -32,33 +32,9 @@ function buildHeaders(auth, hasBody) {
     }
     return headers;
 }
-/**
- * Fetch from the CORS-enabled external Maps API.
- * Base: /apps/maps/api/1.0
- * Used for: favorites, devices
- */
-export async function fetchMapsExternalAPI(endpoint, options = {}) {
-    const config = getNextcloudConfig();
-    const auth = Buffer.from(`${config.user}:${config.password}`).toString('base64');
-    const url = buildUrl(`${config.url}/apps/maps/api/1.0`, endpoint, options.queryParams);
-    const body = options.body ? JSON.stringify(options.body) : undefined;
-    const t0 = Date.now();
-    const response = await fetch(url, {
-        method: options.method || 'GET',
-        headers: buildHeaders(auth, !!options.body),
-        body,
-    });
-    logger.trace({ method: options.method || 'GET', url, status: response.status, ms: Date.now() - t0 }, '[nc] HTTP');
-    if (!response.ok) {
-        const text = await response.text().catch(() => '');
-        throw new Error(`Maps API ${response.status}: ${text || response.statusText}`);
-    }
-    return (await response.json());
-}
 /**
  * Fetch from the internal Maps controller endpoints.
  * Base: /apps/maps
- * Used for: tracks, photos, my maps, routing, import/export
  */
 export async function fetchMapsAPI(endpoint, options = {}) {
     const config = getNextcloudConfig();

package/dist/tools/apps/maps.js

@@ -1,6 +1,29 @@
 // SPDX-License-Identifier: MIT
 import { z } from 'zod';
-import { fetchMapsExternalAPI, fetchMapsAPI } from '../../client/maps.js';
+import { fetchMapsAPI } from '../../client/maps.js';
+import { handleAppError } from '../error-utils.js';
+/**
+ * Nextcloud Maps App Tools
+ * Manages favorites, favorite/device sharing, devices, tracks, photos, contacts,
+ * custom maps, routing, and import/export.
+ *
+ * Verified against Nextcloud Maps 1.8.0.
+ */
+// ── Shared helpers ──────────────────────────────────────────────────────────
+/**
+ * Most Maps controller methods accept an optional myMapId to operate on a custom
+ * "My Map" (a folder holding JSON files) instead of the user's default DB store.
+ */
+const MY_MAP_ID_SCHEMA = z
+    .number()
+    .optional()
+    .describe("ID of a custom map to scope the operation to; omit for the user's default map");
+function myMapIdQuery(myMapId) {
+    return myMapId === undefined ? {} : { myMapId: String(myMapId) };
+}
+function errorResult(what, error) {
+    return handleAppError(error, `Error ${what}`);
+}
 // ── Formatters ──────────────────────────────────────────────────────────────
 function formatFavorite(f) {
     const lines = [`- **${f.name || '(unnamed)'}** (ID: ${f.id})`];
@@ -9,8 +32,9 @@ function formatFavorite(f) {
         lines.push(`  Category: ${f.category}`);
     if (f.comment)
         lines.push(`  Comment: ${f.comment}`);
-    if (f.extensions)
-        lines.push(`  Extensions: ${f.extensions}`);
+    const extensions = Array.isArray(f.extensions) ? f.extensions.join(', ') : f.extensions;
+    if (extensions)
+        lines.push(`  Extensions: ${extensions}`);
     lines.push(`  Created: ${new Date(f.date_created * 1000).toISOString()}`);
     return lines.join('\n');
 }
@@ -23,11 +47,11 @@ function formatDevice(d) {
 function formatDevicePoint(p) {
     const parts = [`  ${p.lat}, ${p.lng}`];
     parts.push(`@ ${new Date(p.timestamp * 1000).toISOString()}`);
-    if (p.altitude !== undefined)
+    if (p.altitude != null)
         parts.push(`alt: ${p.altitude}m`);
-    if (p.accuracy !== undefined)
+    if (p.accuracy != null)
         parts.push(`acc: ${p.accuracy}m`);
-    if (p.battery !== undefined)
+    if (p.battery != null)
         parts.push(`bat: ${p.battery}%`);
     return `- ${parts.join(' | ')}`;
 }
@@ -53,13 +77,45 @@ function formatNonLocalizedPhoto(p) {
         lines.push(`  Taken: ${new Date(p.dateTaken * 1000).toISOString()}`);
     return lines.join('\n');
 }
+function formatFavoriteShare(s) {
+    const lines = [`- **${s.category}**`];
+    lines.push(`  Token: ${s.token}`);
+    if (s.owner)
+        lines.push(`  Owner: ${s.owner}`);
+    return lines.join('\n');
+}
+function formatDeviceShare(s) {
+    const deviceId = s.deviceId ?? s.device_id;
+    const lines = [`- Share token: ${s.token}`];
+    if (deviceId !== undefined)
+        lines.push(`  Device ID: ${deviceId}`);
+    if (s.timestampFrom !== undefined) {
+        lines.push(`  From: ${new Date(s.timestampFrom * 1000).toISOString()}`);
+    }
+    if (s.timestampTo !== undefined) {
+        lines.push(`  To: ${new Date(s.timestampTo * 1000).toISOString()}`);
+    }
+    return lines.join('\n');
+}
+function formatContact(c) {
+    const lines = [`- **${c.FN || '(unnamed)'}**`];
+    lines.push(`  Book ID: ${c.BOOKID} | URI: ${c.URI}`);
+    if (c.GEO)
+        lines.push(`  Coords: ${c.GEO}`);
+    const adrType = Array.isArray(c.ADRTYPE) ? c.ADRTYPE.join('/') : c.ADRTYPE;
+    if (c.ADR)
+        lines.push(`  Address: ${c.ADR}${adrType ? ` (${adrType})` : ''}`);
+    if (c.GROUPS)
+        lines.push(`  Groups: ${c.GROUPS}`);
+    return lines.join('\n');
+}
 function formatMyMap(m) {
     const entries = Object.entries(m)
         .filter(([k]) => k !== 'id')
-        .map(([k, v]) => `  ${k}: ${v}`);
+        .map(([k, v]) => `  ${k}: ${typeof v === 'object' && v !== null ? JSON.stringify(v) : v}`);
     return [`- Map ID: ${m.id}`, ...entries].join('\n');
 }
-// ── Favorites Tools (External API) ──────────────────────────────────────────
+// ── Favorites Tools ─────────────────────────────────────────────────────────
 export const listMapFavoritesTool = {
     name: 'list_map_favorites',
     title: 'List Map Favorites',
@@ -69,19 +125,23 @@ export const listMapFavoritesTool = {
         idempotentHint: true,
         openWorldHint: false,
     },
-    description: 'List map favorites (saved locations/pins) from Nextcloud Maps. Optionally filter by modification time.',
+    description: 'List map favorites (saved locations/pins) from Nextcloud Maps. Optionally filter by modification time or scope to a custom map.',
     inputSchema: z.object({
         pruneBefore: z
             .number()
             .optional()
             .describe('Unix timestamp — only return favorites modified after this time'),
+        myMapId: MY_MAP_ID_SCHEMA,
     }),
     handler: async (args) => {
         try {
-            const queryParams = {};
-            if (args.pruneBefore !== undefined)
-                queryParams['pruneBefore'] = String(args.pruneBefore);
-            const result = await fetchMapsExternalAPI('/favorites', { queryParams });
+            let result = await fetchMapsAPI('/favorites', {
+                queryParams: myMapIdQuery(args.myMapId),
+            });
+            if (args.pruneBefore !== undefined) {
+                const cutoff = args.pruneBefore;
+                result = result.filter((f) => (f.date_modified ?? 0) > cutoff);
+            }
             if (result.length === 0) {
                 return { content: [{ type: 'text', text: 'No map favorites found.' }] };
             }
@@ -93,15 +153,7 @@ export const listMapFavoritesTool = {
             };
         }
         catch (error) {
-            return {
-                content: [
-                    {
-                        type: 'text',
-                        text: `Error listing map favorites: ${error instanceof Error ? error.message : String(error)}`,
-                    },
-                ],
-                isError: true,
-            };
+            return errorResult('listing map favorites', error);
         }
     },
 };
@@ -122,6 +174,7 @@ export const createMapFavoriteTool = {
         category: z.string().optional().describe("Category name (e.g. 'Restaurant', 'Home')"),
         comment: z.string().optional().describe('A comment or note'),
         extensions: z.string().optional().describe('Extra data as a string'),
+        myMapId: MY_MAP_ID_SCHEMA,
     }),
     handler: async (args) => {
         try {
@@ -134,7 +187,10 @@ export const createMapFavoriteTool = {
                 body.comment = args.comment;
             if (args.extensions !== undefined)
                 body.extensions = args.extensions;
-            const result = await fetchMapsExternalAPI('/favorites', {
+            if (args.myMapId !== undefined)
+                body.myMapId = args.myMapId;
+            // Note: the create route is /favorite (singular); /favorites is the batch route.
+            const result = await fetchMapsAPI('/favorite', {
                 method: 'POST',
                 body,
             });
@@ -148,15 +204,7 @@ export const createMapFavoriteTool = {
             };
         }
         catch (error) {
-            return {
-                content: [
-                    {
-                        type: 'text',
-                        text: `Error creating map favorite: ${error instanceof Error ? error.message : String(error)}`,
-                    },
-                ],
-                isError: true,
-            };
+            return errorResult('creating map favorite', error);
         }
     },
 };
@@ -178,23 +226,37 @@ export const updateMapFavoriteTool = {
         category: z.string().optional().describe('New category'),
         comment: z.string().optional().describe('New comment'),
         extensions: z.string().optional().describe('New extensions data'),
+        myMapId: MY_MAP_ID_SCHEMA,
     }),
     handler: async (args) => {
         try {
-            const body = {};
+            // The controller types lat/lng as non-nullable floats, so they must always be
+            // sent — look up the current coordinates when the caller omits either one.
+            let lat = args.lat;
+            let lng = args.lng;
+            if (lat === undefined || lng === undefined) {
+                const existing = await fetchMapsAPI('/favorites', {
+                    queryParams: myMapIdQuery(args.myMapId),
+                });
+                const current = existing.find((f) => f.id === args.id);
+                if (!current) {
+                    throw new Error(`No favorite with ID ${args.id}`);
+                }
+                lat = lat ?? current.lat;
+                lng = lng ?? current.lng;
+            }
+            const body = { lat, lng };
             if (args.name !== undefined)
                 body.name = args.name;
-            if (args.lat !== undefined)
-                body.lat = args.lat;
-            if (args.lng !== undefined)
-                body.lng = args.lng;
             if (args.category !== undefined)
                 body.category = args.category;
             if (args.comment !== undefined)
                 body.comment = args.comment;
             if (args.extensions !== undefined)
                 body.extensions = args.extensions;
-            const result = await fetchMapsExternalAPI(`/favorites/${args.id}`, {
+            if (args.myMapId !== undefined)
+                body.myMapId = args.myMapId;
+            const result = await fetchMapsAPI(`/favorites/${args.id}`, {
                 method: 'PUT',
                 body,
             });
@@ -208,52 +270,209 @@ export const updateMapFavoriteTool = {
             };
         }
         catch (error) {
+            return errorResult(`updating map favorite ${args.id}`, error);
+        }
+    },
+};
+export const deleteMapFavoriteTool = {
+    name: 'delete_map_favorite',
+    title: 'Delete Map Favorite',
+    annotations: {
+        readOnlyHint: false,
+        destructiveHint: true,
+        idempotentHint: true,
+        openWorldHint: false,
+    },
+    description: 'Delete a map favorite by its ID. This action is irreversible.',
+    inputSchema: z.object({
+        id: z.number().describe('Favorite ID to delete'),
+        myMapId: MY_MAP_ID_SCHEMA,
+    }),
+    handler: async (args) => {
+        try {
+            await fetchMapsAPI(`/favorites/${args.id}`, {
+                method: 'DELETE',
+                queryParams: myMapIdQuery(args.myMapId),
+            });
+            return {
+                content: [{ type: 'text', text: `Favorite ${args.id} deleted.` }],
+            };
+        }
+        catch (error) {
+            return errorResult(`deleting map favorite ${args.id}`, error);
+        }
+    },
+};
+export const renameMapFavoriteCategoryTool = {
+    name: 'rename_map_favorite_category',
+    title: 'Rename Map Favorite Category',
+    annotations: {
+        readOnlyHint: false,
+        destructiveHint: true,
+        idempotentHint: true,
+        openWorldHint: false,
+    },
+    description: 'Rename one or more favorite categories. All favorites in the listed categories are moved to the new name.',
+    inputSchema: z.object({
+        categories: z.array(z.string()).min(1).describe('Existing category names to rename'),
+        newName: z.string().describe('New category name'),
+        myMapId: MY_MAP_ID_SCHEMA,
+    }),
+    handler: async (args) => {
+        try {
+            const body = {
+                categories: args.categories,
+                newName: args.newName,
+            };
+            if (args.myMapId !== undefined)
+                body.myMapId = args.myMapId;
+            await fetchMapsAPI('/favorites-category', { method: 'PUT', body });
             return {
                 content: [
                     {
                         type: 'text',
-                        text: `Error updating map favorite ${args.id}: ${error instanceof Error ? error.message : String(error)}`,
+                        text: `Renamed ${args.categories.length} categor${args.categories.length === 1 ? 'y' : 'ies'} (${args.categories.join(', ')}) to "${args.newName}".`,
                     },
                 ],
-                isError: true,
             };
         }
+        catch (error) {
+            return errorResult('renaming favorite categories', error);
+        }
     },
 };
-export const deleteMapFavoriteTool = {
-    name: 'delete_map_favorite',
-    title: 'Delete Map Favorite',
+// ── Favorite Category Sharing Tools ─────────────────────────────────────────
+export const listSharedMapCategoriesTool = {
+    name: 'list_shared_map_categories',
+    title: 'List Shared Map Categories',
+    annotations: {
+        readOnlyHint: true,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false,
+    },
+    description: 'List favorite categories that are shared via a public link.',
+    inputSchema: z.object({
+        myMapId: MY_MAP_ID_SCHEMA,
+    }),
+    handler: async (args) => {
+        try {
+            const result = await fetchMapsAPI('/favorites-category/shared', {
+                queryParams: myMapIdQuery(args.myMapId),
+            });
+            if (result.length === 0) {
+                return { content: [{ type: 'text', text: 'No shared favorite categories.' }] };
+            }
+            const formatted = result.map(formatFavoriteShare).join('\n');
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: `Shared favorite categories (${result.length}):\n\n${formatted}`,
+                    },
+                ],
+            };
+        }
+        catch (error) {
+            return errorResult('listing shared favorite categories', error);
+        }
+    },
+};
+export const shareMapCategoryTool = {
+    name: 'share_map_category',
+    title: 'Share Map Category',
+    annotations: {
+        readOnlyHint: false,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false,
+    },
+    description: 'Share a favorite category via a public link. The category must already contain at least one favorite.',
+    inputSchema: z.object({
+        category: z.string().describe('Category name to share'),
+    }),
+    handler: async (args) => {
+        try {
+            const result = await fetchMapsAPI(`/favorites-category/${encodeURIComponent(args.category)}/share`, { method: 'POST' });
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: `Category "${args.category}" shared.\n\n${formatFavoriteShare(result)}`,
+                    },
+                ],
+            };
+        }
+        catch (error) {
+            return errorResult(`sharing category "${args.category}"`, error);
+        }
+    },
+};
+export const unshareMapCategoryTool = {
+    name: 'unshare_map_category',
+    title: 'Unshare Map Category',
     annotations: {
         readOnlyHint: false,
         destructiveHint: true,
         idempotentHint: true,
         openWorldHint: false,
     },
-    description: 'Delete a map favorite by its ID. This action is irreversible.',
+    description: 'Remove the public link share from a favorite category.',
     inputSchema: z.object({
-        id: z.number().describe('Favorite ID to delete'),
+        category: z.string().describe('Category name to unshare'),
     }),
     handler: async (args) => {
         try {
-            await fetchMapsExternalAPI(`/favorites/${args.id}`, { method: 'DELETE' });
+            const result = await fetchMapsAPI(`/favorites-category/${encodeURIComponent(args.category)}/un-share`, { method: 'POST' });
             return {
-                content: [{ type: 'text', text: `Favorite ${args.id} deleted.` }],
+                content: [
+                    {
+                        type: 'text',
+                        text: result.did_exist
+                            ? `Category "${args.category}" unshared.`
+                            : `Category "${args.category}" was not shared.`,
+                    },
+                ],
             };
         }
         catch (error) {
+            return errorResult(`unsharing category "${args.category}"`, error);
+        }
+    },
+};
+export const addSharedCategoryToMapTool = {
+    name: 'add_shared_category_to_map',
+    title: 'Add Shared Category To Map',
+    annotations: {
+        readOnlyHint: false,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false,
+    },
+    description: 'Add a shared favorite category to a custom map so its favorites show up there.',
+    inputSchema: z.object({
+        category: z.string().describe('Shared category name'),
+        targetMapId: z.number().describe('ID of the custom map to add the shared category to'),
+        myMapId: MY_MAP_ID_SCHEMA,
+    }),
+    handler: async (args) => {
+        try {
+            const result = await fetchMapsAPI(`/favorites-category/${encodeURIComponent(args.category)}/add-to-map/${args.targetMapId}`, { method: 'PUT', queryParams: myMapIdQuery(args.myMapId) });
             return {
                 content: [
                     {
                         type: 'text',
-                        text: `Error deleting map favorite ${args.id}: ${error instanceof Error ? error.message : String(error)}`,
+                        text: `Category "${args.category}" added to map ${args.targetMapId} (${result}).`,
                     },
                 ],
-                isError: true,
             };
         }
+        catch (error) {
+            return errorResult(`adding category "${args.category}" to map ${args.targetMapId}`, error);
+        }
     },
 };
-// ── Devices Tools (External API) ────────────────────────────────────────────
+// ── Devices Tools ───────────────────────────────────────────────────────────
 export const listMapDevicesTool = {
     name: 'list_map_devices',
     title: 'List Map Devices',
@@ -264,10 +483,14 @@ export const listMapDevicesTool = {
         openWorldHint: false,
     },
     description: 'List GPS tracking devices registered in Nextcloud Maps.',
-    inputSchema: z.object({}),
-    handler: async () => {
+    inputSchema: z.object({
+        myMapId: MY_MAP_ID_SCHEMA,
+    }),
+    handler: async (args) => {
         try {
-            const result = await fetchMapsExternalAPI('/devices');
+            const result = await fetchMapsAPI('/devices', {
+                queryParams: myMapIdQuery(args.myMapId),
+            });
             if (result.length === 0) {
                 return { content: [{ type: 'text', text: 'No map devices found.' }] };
             }
@@ -279,15 +502,7 @@ export const listMapDevicesTool = {
             };
         }
         catch (error) {
-            return {
-                content: [
-                    {
-                        type: 'text',
-                        text: `Error listing map devices: ${error instanceof Error ? error.message : String(error)}`,
-                    },
-                ],
-                isError: true,
-            };
+            return errorResult('listing map devices', error);
         }
     },
 };
@@ -307,13 +522,19 @@ export const getMapDevicePointsTool = {
             .number()
             .optional()
             .describe('Unix timestamp — only return points after this time'),
+        limit: z.number().optional().describe('Maximum number of points to return (default 10000)'),
+        offset: z.number().optional().describe('Number of points to skip (default 0)'),
     }),
     handler: async (args) => {
         try {
             const queryParams = {};
             if (args.pruneBefore !== undefined)
                 queryParams['pruneBefore'] = String(args.pruneBefore);
-            const result = await fetchMapsExternalAPI(`/devices/${args.id}`, {
+            if (args.limit !== undefined)
+                queryParams['limit'] = String(args.limit);
+            if (args.offset !== undefined)
+                queryParams['offset'] = String(args.offset);
+            const result = await fetchMapsAPI(`/devices/${args.id}`, {
                 queryParams,
             });
             if (result.length === 0) {
@@ -332,15 +553,7 @@ export const getMapDevicePointsTool = {
             };
         }
         catch (error) {
-            return {
-                content: [
-                    {
-                        type: 'text',
-                        text: `Error getting device points: ${error instanceof Error ? error.message : String(error)}`,
-                    },
-                ],
-                isError: true,
-            };
+            return errorResult('getting device points', error);
         }
     },
 };
@@ -376,7 +589,7 @@ export const addMapDevicePointTool = {
                 body.battery = args.battery;
             if (args.accuracy !== undefined)
                 body.accuracy = args.accuracy;
-            const result = await fetchMapsExternalAPI('/devices', {
+            const result = await fetchMapsAPI('/devices', {
                 method: 'POST',
                 body,
             });
@@ -390,15 +603,7 @@ export const addMapDevicePointTool = {
             };
         }
         catch (error) {
-            return {
-                content: [
-                    {
-                        type: 'text',
-                        text: `Error adding device point: ${error instanceof Error ? error.message : String(error)}`,
-                    },
-                ],
-                isError: true,
-            };
+            return errorResult('adding device point', error);
         }
     },
 };
@@ -411,16 +616,19 @@ export const updateMapDeviceTool = {
         idempotentHint: true,
         openWorldHint: false,
     },
-    description: "Update a device's display color.",
+    description: "Update a device's display color and/or name. At least one must be provided.",
     inputSchema: z.object({
         id: z.number().describe('Device ID'),
-        color: z.string().describe("New color (e.g. '#ff0000')"),
+        color: z.string().optional().describe("New color (e.g. '#ff0000')"),
+        name: z.string().optional().describe('New device name (user agent)'),
     }),
     handler: async (args) => {
         try {
-            const result = await fetchMapsExternalAPI(`/devices/${args.id}`, {
+            // The controller types both as non-nullable strings and ignores empty ones,
+            // so always send both and let it skip whatever the caller left out.
+            const result = await fetchMapsAPI(`/devices/${args.id}`, {
                 method: 'PUT',
-                body: { color: args.color },
+                body: { color: args.color ?? '', name: args.name ?? '' },
             });
             return {
                 content: [
@@ -429,52 +637,166 @@ export const updateMapDeviceTool = {
             };
         }
         catch (error) {
+            return errorResult(`updating device ${args.id}`, error);
+        }
+    },
+};
+export const deleteMapDeviceTool = {
+    name: 'delete_map_device',
+    title: 'Delete Map Device',
+    annotations: {
+        readOnlyHint: false,
+        destructiveHint: true,
+        idempotentHint: true,
+        openWorldHint: false,
+    },
+    description: 'Delete a GPS tracking device and all its location points. This action is irreversible.',
+    inputSchema: z.object({
+        id: z.number().describe('Device ID to delete'),
+    }),
+    handler: async (args) => {
+        try {
+            await fetchMapsAPI(`/devices/${args.id}`, { method: 'DELETE' });
+            return {
+                content: [{ type: 'text', text: `Device ${args.id} deleted.` }],
+            };
+        }
+        catch (error) {
+            return errorResult(`deleting device ${args.id}`, error);
+        }
+    },
+};
+// ── Device Sharing Tools ────────────────────────────────────────────────────
+export const shareMapDeviceTool = {
+    name: 'share_map_device',
+    title: 'Share Map Device',
+    annotations: {
+        readOnlyHint: false,
+        destructiveHint: false,
+        idempotentHint: false,
+        openWorldHint: false,
+    },
+    description: 'Share a GPS device via a public link, limited to a time window. Returns the share token.',
+    inputSchema: z.object({
+        id: z.number().describe('Device ID to share'),
+        timestampFrom: z.number().describe('Unix timestamp — start of the shared time window'),
+        timestampTo: z.number().describe('Unix timestamp — end of the shared time window'),
+    }),
+    handler: async (args) => {
+        try {
+            const result = await fetchMapsAPI(`/devices/${args.id}/share`, {
+                method: 'POST',
+                body: { timestampFrom: args.timestampFrom, timestampTo: args.timestampTo },
+            });
             return {
                 content: [
                     {
                         type: 'text',
-                        text: `Error updating device ${args.id}: ${error instanceof Error ? error.message : String(error)}`,
+                        text: `Device ${args.id} shared.\n\n${formatDeviceShare(result)}`,
                     },
                 ],
-                isError: true,
             };
         }
+        catch (error) {
+            return errorResult(`sharing device ${args.id}`, error);
+        }
     },
 };
-export const deleteMapDeviceTool = {
-    name: 'delete_map_device',
-    title: 'Delete Map Device',
+export const listSharedMapDevicesTool = {
+    name: 'list_shared_map_devices',
+    title: 'List Shared Map Devices',
+    annotations: {
+        readOnlyHint: true,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false,
+    },
+    description: 'List device shares that have been added to a custom map. Requires myMapId — the default map holds no device shares.',
+    inputSchema: z.object({
+        myMapId: z.number().describe('Custom map ID to list device shares from'),
+    }),
+    handler: async (args) => {
+        try {
+            const result = await fetchMapsAPI('/devices/s/', {
+                queryParams: { myMapId: String(args.myMapId) },
+            });
+            if (result.length === 0) {
+                return {
+                    content: [{ type: 'text', text: `No shared devices on map ${args.myMapId}.` }],
+                };
+            }
+            const formatted = result.map(formatDeviceShare).join('\n');
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: `Shared devices on map ${args.myMapId} (${result.length}):\n\n${formatted}`,
+                    },
+                ],
+            };
+        }
+        catch (error) {
+            return errorResult('listing shared devices', error);
+        }
+    },
+};
+export const removeMapDeviceShareTool = {
+    name: 'remove_map_device_share',
+    title: 'Remove Map Device Share',
     annotations: {
         readOnlyHint: false,
         destructiveHint: true,
         idempotentHint: true,
         openWorldHint: false,
     },
-    description: 'Delete a GPS tracking device and all its location points. This action is irreversible.',
+    description: 'Revoke a device share by its token.',
     inputSchema: z.object({
-        id: z.number().describe('Device ID to delete'),
+        token: z.string().describe('Share token to revoke'),
     }),
     handler: async (args) => {
         try {
-            await fetchMapsExternalAPI(`/devices/${args.id}`, { method: 'DELETE' });
+            await fetchMapsAPI(`/devices/s/${encodeURIComponent(args.token)}`, { method: 'DELETE' });
             return {
-                content: [{ type: 'text', text: `Device ${args.id} deleted.` }],
+                content: [{ type: 'text', text: `Device share ${args.token} removed.` }],
             };
         }
         catch (error) {
+            return errorResult(`removing device share ${args.token}`, error);
+        }
+    },
+};
+export const addSharedDeviceToMapTool = {
+    name: 'add_shared_device_to_map',
+    title: 'Add Shared Device To Map',
+    annotations: {
+        readOnlyHint: false,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false,
+    },
+    description: 'Add a shared device (by token) to a custom map so its track shows up there.',
+    inputSchema: z.object({
+        token: z.string().describe('Device share token'),
+        targetMapId: z.number().describe('ID of the custom map to add the shared device to'),
+    }),
+    handler: async (args) => {
+        try {
+            const result = await fetchMapsAPI(`/devices/s/${encodeURIComponent(args.token)}/map-link/${args.targetMapId}`, { method: 'POST' });
             return {
                 content: [
                     {
                         type: 'text',
-                        text: `Error deleting device ${args.id}: ${error instanceof Error ? error.message : String(error)}`,
+                        text: `Shared device added to map ${args.targetMapId} (${result}).`,
                     },
                 ],
-                isError: true,
             };
         }
+        catch (error) {
+            return errorResult(`adding shared device to map ${args.targetMapId}`, error);
+        }
     },
 };
-// ── Tracks Tools (Internal API) ─────────────────────────────────────────────
+// ── Tracks Tools ─────────────────────────────────────────────
 export const listMapTracksTool = {
     name: 'list_map_tracks',
     title: 'List Map Tracks',
@@ -601,7 +923,7 @@ export const updateMapTrackTool = {
         }
     },
 };
-// ── Photos Tools (Internal API) ─────────────────────────────────────────────
+// ── Photos Tools ─────────────────────────────────────────────
 export const listMapPhotosTool = {
     name: 'list_map_photos',
     title: 'List Map Photos',
@@ -787,7 +1109,236 @@ export const resetMapPhotoCoordsTool = {
         }
     },
 };
-// ── My Maps Tools (Internal API) ────────────────────────────────────────────
+export const getMapPhotoJobStatusTool = {
+    name: 'get_map_photo_job_status',
+    title: 'Get Map Photo Job Status',
+    annotations: {
+        readOnlyHint: true,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false,
+    },
+    description: 'Get the status of the background job that scans photos for GPS coordinates. Useful after uploading photos to see whether geolocation has finished.',
+    inputSchema: z.object({}),
+    handler: async () => {
+        try {
+            const result = await fetchMapsAPI('/photos/backgroundJobStatus');
+            const lines = Object.entries(result).map(([k, v]) => `- ${k}: ${JSON.stringify(v)}`);
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: lines.length > 0
+                            ? `Photo background job status:\n\n${lines.join('\n')}`
+                            : 'No photo background job status reported.',
+                    },
+                ],
+            };
+        }
+        catch (error) {
+            return errorResult('getting photo background job status', error);
+        }
+    },
+};
+// ── Contacts Tools ──────────────────────────────────────────────────────────
+export const listMapContactsTool = {
+    name: 'list_map_contacts',
+    title: 'List Map Contacts',
+    annotations: {
+        readOnlyHint: true,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false,
+    },
+    description: 'List address book contacts that carry a geographic address, as shown on the map.',
+    inputSchema: z.object({
+        myMapId: MY_MAP_ID_SCHEMA,
+    }),
+    handler: async (args) => {
+        try {
+            const result = await fetchMapsAPI('/contacts', {
+                queryParams: myMapIdQuery(args.myMapId),
+            });
+            if (result.length === 0) {
+                return { content: [{ type: 'text', text: 'No contacts with addresses found.' }] };
+            }
+            const formatted = result.map(formatContact).join('\n');
+            return {
+                content: [
+                    { type: 'text', text: `Map contacts (${result.length}):\n\n${formatted}` },
+                ],
+            };
+        }
+        catch (error) {
+            return errorResult('listing map contacts', error);
+        }
+    },
+};
+export const searchMapContactsTool = {
+    name: 'search_map_contacts',
+    title: 'Search Map Contacts',
+    annotations: {
+        readOnlyHint: true,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false,
+    },
+    description: 'Search address book contacts by name, to find the bookid/uri/uid needed to place a contact on the map.',
+    inputSchema: z.object({
+        query: z.string().describe('Search term matched against contact display names'),
+    }),
+    handler: async (args) => {
+        try {
+            const result = await fetchMapsAPI('/contacts-search', {
+                queryParams: { query: args.query },
+            });
+            if (result.length === 0) {
+                return {
+                    content: [{ type: 'text', text: `No contacts matching "${args.query}".` }],
+                };
+            }
+            const formatted = result
+                .map((c) => `- **${c.FN}** — UID: ${c.UID} | Book ID: ${c.BOOKID} | URI: ${c.URI}`)
+                .join('\n');
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: `Contacts matching "${args.query}" (${result.length}):\n\n${formatted}`,
+                    },
+                ],
+            };
+        }
+        catch (error) {
+            return errorResult(`searching contacts for "${args.query}"`, error);
+        }
+    },
+};
+export const placeMapContactTool = {
+    name: 'place_map_contact',
+    title: 'Place Map Contact',
+    annotations: {
+        readOnlyHint: false,
+        destructiveHint: true,
+        idempotentHint: true,
+        openWorldHint: false,
+    },
+    description: "Set a contact's geographic address and coordinates so it appears on the map. Use search_map_contacts to look up bookid, uri and uid.",
+    inputSchema: z.object({
+        bookid: z.string().describe('Address book ID'),
+        uri: z.string().describe('Contact URI (e.g. "abc123.vcf")'),
+        uid: z.string().describe('Contact UID'),
+        lat: z.number().optional().describe('Latitude'),
+        lng: z.number().optional().describe('Longitude'),
+        address_string: z
+            .string()
+            .optional()
+            .describe('Full address as a single string, used instead of the individual fields'),
+        attraction: z.string().optional().describe('Point of interest name'),
+        house_number: z.string().optional().describe('House number'),
+        road: z.string().optional().describe('Street'),
+        postcode: z.string().optional().describe('Postal code'),
+        city: z.string().optional().describe('City'),
+        state: z.string().optional().describe('State or region'),
+        country: z.string().optional().describe('Country'),
+        type: z.string().optional().describe("Address type (e.g. 'HOME', 'WORK')"),
+        myMapId: MY_MAP_ID_SCHEMA,
+    }),
+    handler: async (args) => {
+        try {
+            const { bookid, uri, ...rest } = args;
+            const body = {};
+            for (const [key, value] of Object.entries(rest)) {
+                if (value !== undefined)
+                    body[key] = value;
+            }
+            const result = await fetchMapsAPI(`/contacts/${encodeURIComponent(bookid)}/${encodeURIComponent(uri)}`, { method: 'PUT', body });
+            if (result !== 'EDITED') {
+                return errorResult(`placing contact ${args.uid}`, new Error(result));
+            }
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: `Contact ${args.uid} placed${args.lat !== undefined && args.lng !== undefined ? ` at ${args.lat}, ${args.lng}` : ''}.`,
+                    },
+                ],
+            };
+        }
+        catch (error) {
+            return errorResult(`placing contact ${args.uid}`, error);
+        }
+    },
+};
+export const addContactToMapTool = {
+    name: 'add_contact_to_map',
+    title: 'Add Contact To Map',
+    annotations: {
+        readOnlyHint: false,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false,
+    },
+    description: 'Copy a contact into a custom map so it shows up as a pin on that map.',
+    inputSchema: z.object({
+        bookid: z.string().describe('Address book ID'),
+        uri: z.string().describe('Contact URI (e.g. "abc123.vcf")'),
+        myMapId: z.number().describe('ID of the custom map to add the contact to'),
+    }),
+    handler: async (args) => {
+        try {
+            const result = await fetchMapsAPI(`/contacts/${encodeURIComponent(args.bookid)}/${encodeURIComponent(args.uri)}/add-to-map/`, { method: 'PUT', body: { myMapId: args.myMapId } });
+            if (result !== 'DONE') {
+                return errorResult(`adding contact to map ${args.myMapId}`, new Error(result));
+            }
+            return {
+                content: [
+                    { type: 'text', text: `Contact ${args.uri} added to map ${args.myMapId}.` },
+                ],
+            };
+        }
+        catch (error) {
+            return errorResult(`adding contact to map ${args.myMapId}`, error);
+        }
+    },
+};
+export const deleteMapContactAddressTool = {
+    name: 'delete_map_contact_address',
+    title: 'Delete Map Contact Address',
+    annotations: {
+        readOnlyHint: false,
+        destructiveHint: true,
+        idempotentHint: true,
+        openWorldHint: false,
+    },
+    description: 'Remove an address and its coordinates from a contact, taking it off the map. The contact itself is kept. Use list_map_contacts to get the exact ADR and GEO values.',
+    inputSchema: z.object({
+        bookid: z.string().describe('Address book ID'),
+        uri: z.string().describe('Contact URI (e.g. "abc123.vcf")'),
+        uid: z.string().describe('Contact UID'),
+        adr: z.string().describe('The ADR value to remove, exactly as returned by list_map_contacts'),
+        geo: z.string().describe('The GEO value to remove, exactly as returned by list_map_contacts'),
+        myMapId: MY_MAP_ID_SCHEMA,
+    }),
+    handler: async (args) => {
+        try {
+            const body = { uid: args.uid, adr: args.adr, geo: args.geo };
+            if (args.myMapId !== undefined)
+                body.myMapId = args.myMapId;
+            const result = await fetchMapsAPI(`/contacts/${encodeURIComponent(args.bookid)}/${encodeURIComponent(args.uri)}`, { method: 'DELETE', body });
+            if (result !== 'DELETED') {
+                return errorResult(`deleting address of contact ${args.uid}`, new Error(result));
+            }
+            return {
+                content: [{ type: 'text', text: `Address removed from contact ${args.uid}.` }],
+            };
+        }
+        catch (error) {
+            return errorResult(`deleting address of contact ${args.uid}`, error);
+        }
+    },
+};
+// ── My Maps Tools ────────────────────────────────────────────
 export const listMapsTool = {
     name: 'list_maps',
     title: 'List Maps',
@@ -938,7 +1489,7 @@ export const deleteMapTool = {
         }
     },
 };
-// ── Routing Tool (Internal API) ─────────────────────────────────────────────
+// ── Routing Tool ─────────────────────────────────────────────
 export const exportMapRouteTool = {
     name: 'export_map_route',
     title: 'Export Map Route',
@@ -1003,7 +1554,7 @@ export const exportMapRouteTool = {
         }
     },
 };
-// ── Import/Export Tools (Internal API) ───────────────────────────────────────
+// ── Import/Export Tools ───────────────────────────────────────
 export const exportMapFavoritesTool = {
     name: 'export_map_favorites',
     title: 'Export Map Favorites',
@@ -1188,12 +1739,23 @@ export const mapsTools = [
     createMapFavoriteTool,
     updateMapFavoriteTool,
     deleteMapFavoriteTool,
+    renameMapFavoriteCategoryTool,
+    // Favorite category sharing
+    listSharedMapCategoriesTool,
+    shareMapCategoryTool,
+    unshareMapCategoryTool,
+    addSharedCategoryToMapTool,
     // Devices
     listMapDevicesTool,
     getMapDevicePointsTool,
     addMapDevicePointTool,
     updateMapDeviceTool,
     deleteMapDeviceTool,
+    // Device sharing
+    shareMapDeviceTool,
+    listSharedMapDevicesTool,
+    removeMapDeviceShareTool,
+    addSharedDeviceToMapTool,
     // Tracks
     listMapTracksTool,
     getMapTrackTool,
@@ -1203,6 +1765,13 @@ export const mapsTools = [
     listMapPhotosNonlocalizedTool,
     placeMapPhotosTool,
     resetMapPhotoCoordsTool,
+    getMapPhotoJobStatusTool,
+    // Contacts
+    listMapContactsTool,
+    searchMapContactsTool,
+    placeMapContactTool,
+    addContactToMapTool,
+    deleteMapContactAddressTool,
     // My Maps
     listMapsTool,
     createMapTool,

package/dist/transports/http.js

@@ -9,6 +9,7 @@ import { createServer, SERVER_VERSION } from '../server.js';
 import { NextcloudOAuthProvider } from '../auth/provider.js';
 import { probeStateDir, StateDirNotWritableError, stateUnwritableMessage, markStateUnwritableWarned, } from '../auth/store.js';
 import { loginHandler } from '../auth/login.js';
+import { LOGIN_STYLESHEET, LOGIN_STYLESHEET_PATH } from '../auth/login-page-css.js';
 import { isPublicRequest } from './lazy-auth.js';
 import { logger } from '../logger.js';
 import { fetchStatus } from '../client/ocs.js';
@@ -133,7 +134,70 @@ export async function startHttp() {
             allowedHosts = [...new Set(['localhost', '127.0.0.1', ...extras])];
         }
     }
+    // Explicit CORS. Browser-based MCP clients need these headers; previously the
+    // server sent none and relied entirely on the reverse proxy. The issuer origin
+    // is trusted by default (it serves the login page), and MCP_CORS_ORIGINS adds
+    // extra origins — comma-separated, whitespace-trimmed, same idiom as
+    // MCP_ALLOWED_HOSTS. Origins are matched exactly and echoed back; the wildcard
+    // '*' is never sent, since these endpoints are credentialed.
+    const allowedOrigins = new Set();
+    const issuerForCors = process.env.MCP_AUTH_ISSUER;
+    if (authEnabled && issuerForCors) {
+        try {
+            allowedOrigins.add(new URL(issuerForCors).origin);
+        }
+        catch {
+            // Malformed issuer URL — the validation below will throw a clear error.
+        }
+    }
+    const extraOrigins = process.env.MCP_CORS_ORIGINS;
+    if (extraOrigins) {
+        for (const raw of extraOrigins.split(',')) {
+            const trimmed = raw.trim();
+            if (!trimmed)
+                continue;
+            try {
+                allowedOrigins.add(new URL(trimmed).origin);
+            }
+            catch {
+                logger.warn({ origin: trimmed }, '[startup] Ignoring malformed MCP_CORS_ORIGINS entry');
+            }
+        }
+    }
     const app = createMcpExpressApp({ host, allowedHosts });
+    // Mounted ahead of every other route so that preflights are answered before
+    // the auth chain runs — an OPTIONS request carries no Authorization header
+    // and would otherwise be rejected with 401 by requireBearerAuth.
+    app.use((req, res, next) => {
+        const origin = req.headers?.origin;
+        if (typeof origin === 'string' && allowedOrigins.has(origin)) {
+            res.setHeader('Access-Control-Allow-Origin', origin);
+            res.setHeader('Access-Control-Allow-Credentials', 'true');
+            res.setHeader('Access-Control-Allow-Headers', 'Authorization, Content-Type, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID');
+            res.setHeader('Access-Control-Expose-Headers', 'Mcp-Session-Id, WWW-Authenticate');
+            res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');
+            res.setHeader('Access-Control-Max-Age', '86400');
+        }
+        // Always vary on Origin: the response differs per origin even when no
+        // headers are added, so a shared cache must not reuse one for another.
+        res.setHeader('Vary', 'Origin');
+        if (req.method === 'OPTIONS') {
+            res.status(204).end();
+            return;
+        }
+        next();
+    });
+    // Stylesheet for the OAuth login page. Served as its own document so the page
+    // needs no inline <style>, which lets its CSP drop 'unsafe-inline'. Must stay
+    // ahead of the auth middleware — the login page is shown to anonymous users.
+    app.get(LOGIN_STYLESHEET_PATH, (_req, res) => {
+        res
+            .set('Content-Type', 'text/css; charset=utf-8')
+            .set('Cache-Control', 'public, max-age=86400')
+            .set('X-Content-Type-Options', 'nosniff')
+            .status(200)
+            .send(LOGIN_STYLESHEET);
+    });
     // Simple health check — bypasses all auth middleware so Docker health checks
     // work even before OAuth is fully configured or TLS is verified.
     app.get('/health', (_req, res) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aiquila-mcp",
-  "version": "0.4.3",
+  "version": "0.4.5",
   "description": "Nextcloud MCP server — files, calendar, contacts, mail, maps, notes, tasks & 120+ more tools",
   "type": "module",
   "main": "dist/index.js",