appilot-mcp 0.0.1 → 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+/**
+ * Appilot MCP server entry point.
+ *
+ * Two transports, one tool surface (see server.ts):
+ *
+ *   stdio (default)  The operator runs the process on their own machine or
+ *                    inside their network, and it carries their credentials in
+ *                    its environment. This is what Claude Code, Codex, Claude
+ *                    Desktop, Cursor and Antigravity launch, and the only shape
+ *                    that works air-gapped.
+ *
+ *   http (--http)    A deployed service speaking Streamable HTTP with OAuth,
+ *                    for the clients that cannot launch a local process:
+ *                    ChatGPT and claude.ai. It holds no credential of its own.
+ *
+ * Contract: docs/content-model/config-health-contract.md.
+ * Server:   docs/architecture/appilot-mcp.md.
+ */
+export {};

package/dist/index.js

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+/**
+ * Appilot MCP server entry point.
+ *
+ * Two transports, one tool surface (see server.ts):
+ *
+ *   stdio (default)  The operator runs the process on their own machine or
+ *                    inside their network, and it carries their credentials in
+ *                    its environment. This is what Claude Code, Codex, Claude
+ *                    Desktop, Cursor and Antigravity launch, and the only shape
+ *                    that works air-gapped.
+ *
+ *   http (--http)    A deployed service speaking Streamable HTTP with OAuth,
+ *                    for the clients that cannot launch a local process:
+ *                    ChatGPT and claude.ai. It holds no credential of its own.
+ *
+ * Contract: docs/content-model/config-health-contract.md.
+ * Server:   docs/architecture/appilot-mcp.md.
+ */
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { loadConnection, loadRemoteConfig, resolveTransport, RemoteConfigError } from './config.js';
+import { createAppilotServer } from './server.js';
+async function runStdio() {
+    const conn = loadConnection();
+    const server = createAppilotServer(conn);
+    await server.connect(new StdioServerTransport());
+    // stderr is safe for logs; stdout is the MCP transport.
+    process.stderr.write(`[appilot-mcp] connected · base=${conn.baseUrl ?? 'not-configured'} · token=${conn.token ? 'set' : 'none'}\n`);
+}
+async function runHttp() {
+    const { startRemote } = await import('./remote/httpServer.js');
+    await startRemote(loadRemoteConfig());
+}
+async function main() {
+    if (resolveTransport() === 'http') {
+        await runHttp();
+        return;
+    }
+    await runStdio();
+}
+main().catch(err => {
+    // Name the missing variable and stop. A stack trace tells the operator
+    // nothing they can act on.
+    if (err instanceof RemoteConfigError) {
+        process.stderr.write(`[appilot-mcp] ${err.message}\n`);
+        process.exit(2);
+    }
+    process.stderr.write(`[appilot-mcp] fatal: ${err instanceof Error ? err.stack : String(err)}\n`);
+    process.exit(1);
+});

package/dist/manifest.d.ts

@@ -0,0 +1,93 @@
+/**
+ * The app manifest: one declarative file that describes a whole Appilot tenant,
+ * living in the customer's repository and versioned by git.
+ *
+ * It deliberately does not invent a new format for the content model. The
+ * ConfigBundle already carries semantic identity, deterministic serialization,
+ * a content hash, secret exclusion, and a negotiated format version, and those
+ * were expensive to get right. The manifest wraps it with the three things a
+ * bundle cannot carry because they are not content: the app, its domains, and
+ * its widget keys.
+ *
+ * ```jsonc
+ * {
+ *   "kind": "appilot.app-manifest",
+ *   "formatVersion": "1.0",
+ *   "app":     { "name": "Acme Booking" },
+ *   "domains": [{ "domain": "app.acme.com" }],
+ *   "widgetKeys": [{ "name": "production" }],
+ *   "config": { "kind": "appilot.config-bundle", ... }
+ * }
+ * ```
+ *
+ * Plan before apply is structural, not advisory. `planManifest` returns a
+ * `planToken` derived from the manifest's own bytes, and `applyManifest`
+ * refuses without a matching one. A model that skips the plan step cannot
+ * produce the token by guessing, and a manifest edited between the two calls
+ * produces a different token, so the apply fails rather than committing
+ * something nobody previewed.
+ */
+import type { AppilotClient, ProvisionAppResponse } from './client.js';
+export declare const MANIFEST_KIND = "appilot.app-manifest";
+export declare const MANIFEST_FORMAT_VERSION = "1.0";
+export interface AppManifest {
+    kind?: string;
+    formatVersion?: string;
+    app: {
+        name: string;
+        description?: string;
+    };
+    domains?: Array<{
+        domain: string;
+        name?: string;
+        default_language?: string | null;
+        configured_languages?: string[];
+    }>;
+    widgetKeys?: Array<{
+        name?: string;
+        allowedDomains?: string[];
+        isTest?: boolean;
+    }>;
+    /** A ConfigBundle, verbatim. Optional: provisioning alone is a valid manifest. */
+    config?: Record<string, unknown>;
+}
+export interface ManifestPlan {
+    planToken: string;
+    provisioning: ProvisionAppResponse;
+    config?: {
+        /** The import dry-run diff, including the health findings and currentHash. */
+        diff: unknown;
+        /** Pass this back on apply so a concurrent edit is a 409, not a silent overwrite. */
+        expectedCurrentHash?: string;
+    };
+    notes: string[];
+}
+/** The token that binds an apply to the plan that previewed it. */
+export declare function manifestDigest(manifest: AppManifest): string;
+export declare function parseManifest(input: Record<string, unknown> | string): AppManifest;
+/**
+ * Preview everything the manifest would change. Writes nothing.
+ *
+ * Both halves run in dry-run: provisioning reports created/reused/updated per
+ * entity, and the config import returns its per-entity diff plus the health
+ * findings over the PROSPECTIVE post-apply state.
+ */
+export declare function planManifest(client: AppilotClient, manifest: AppManifest, resolveAppId: (id?: number) => number | null): Promise<ManifestPlan>;
+/**
+ * Apply a previously planned manifest.
+ *
+ * `planToken` must match the manifest being applied. This is the structural
+ * version of "always dry-run first": the guidance cannot be skipped, because
+ * the token is unobtainable without the plan call and changes with the
+ * manifest.
+ */
+export declare function applyManifest(client: AppilotClient, manifest: AppManifest, options: {
+    planToken: string;
+    mode?: 'merge' | 'replace';
+    expectedCurrentHash?: string;
+    allowUnhealthy?: boolean;
+}): Promise<{
+    provisioning: ProvisionAppResponse;
+    config?: unknown;
+    notes: string[];
+}>;

package/dist/manifest.js

@@ -0,0 +1,147 @@
+/**
+ * The app manifest: one declarative file that describes a whole Appilot tenant,
+ * living in the customer's repository and versioned by git.
+ *
+ * It deliberately does not invent a new format for the content model. The
+ * ConfigBundle already carries semantic identity, deterministic serialization,
+ * a content hash, secret exclusion, and a negotiated format version, and those
+ * were expensive to get right. The manifest wraps it with the three things a
+ * bundle cannot carry because they are not content: the app, its domains, and
+ * its widget keys.
+ *
+ * ```jsonc
+ * {
+ *   "kind": "appilot.app-manifest",
+ *   "formatVersion": "1.0",
+ *   "app":     { "name": "Acme Booking" },
+ *   "domains": [{ "domain": "app.acme.com" }],
+ *   "widgetKeys": [{ "name": "production" }],
+ *   "config": { "kind": "appilot.config-bundle", ... }
+ * }
+ * ```
+ *
+ * Plan before apply is structural, not advisory. `planManifest` returns a
+ * `planToken` derived from the manifest's own bytes, and `applyManifest`
+ * refuses without a matching one. A model that skips the plan step cannot
+ * produce the token by guessing, and a manifest edited between the two calls
+ * produces a different token, so the apply fails rather than committing
+ * something nobody previewed.
+ */
+import { createHash } from 'node:crypto';
+export const MANIFEST_KIND = 'appilot.app-manifest';
+export const MANIFEST_FORMAT_VERSION = '1.0';
+/**
+ * Canonical JSON: object keys sorted at every level, so two manifests that
+ * differ only in key order produce the same token. Arrays keep their order,
+ * because in a manifest order is meaning (the first widget key is the one the
+ * snippets use).
+ */
+function canonicalize(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalize);
+    if (value && typeof value === 'object') {
+        const source = value;
+        const out = {};
+        for (const key of Object.keys(source).sort()) {
+            if (source[key] === undefined)
+                continue;
+            out[key] = canonicalize(source[key]);
+        }
+        return out;
+    }
+    return value;
+}
+/** The token that binds an apply to the plan that previewed it. */
+export function manifestDigest(manifest) {
+    return createHash('sha256').update(JSON.stringify(canonicalize(manifest))).digest('hex');
+}
+export function parseManifest(input) {
+    const raw = typeof input === 'string' ? JSON.parse(input) : input;
+    const kind = raw.kind;
+    if (kind !== undefined && kind !== MANIFEST_KIND) {
+        throw new Error(`Not an Appilot app manifest (kind: ${String(kind)}).`);
+    }
+    const app = raw.app;
+    if (!app || typeof app.name !== 'string' || app.name.trim() === '') {
+        throw new Error('The manifest needs an app with a name.');
+    }
+    return raw;
+}
+/** The provisioning request the manifest's first widget key describes. */
+function provisionRequest(manifest, dryRun) {
+    return {
+        app: manifest.app,
+        domains: manifest.domains ?? [],
+        widgetKey: manifest.widgetKeys?.[0],
+        dryRun,
+    };
+}
+/**
+ * Preview everything the manifest would change. Writes nothing.
+ *
+ * Both halves run in dry-run: provisioning reports created/reused/updated per
+ * entity, and the config import returns its per-entity diff plus the health
+ * findings over the PROSPECTIVE post-apply state.
+ */
+export async function planManifest(client, manifest, resolveAppId) {
+    const notes = [];
+    const provisioning = await client.provisionApp(provisionRequest(manifest, true));
+    let config;
+    if (manifest.config) {
+        // The config half needs a real app id. On a first run the app does not
+        // exist yet, so there is nothing to diff against and the config lands on
+        // the apply pass instead. Say so rather than reporting an empty diff.
+        const appId = provisioning.app.id ?? resolveAppId(undefined);
+        if (appId == null) {
+            notes.push('The app does not exist yet, so the config bundle could not be diffed. It will be imported on apply, and the health gate still runs there.');
+        }
+        else {
+            const diff = (await client.importConfig(appId, {
+                mode: 'merge',
+                dryRun: true,
+                bundle: manifest.config,
+            }));
+            config = { diff, expectedCurrentHash: diff?.currentHash };
+        }
+    }
+    return { planToken: manifestDigest(manifest), provisioning, config, notes };
+}
+/**
+ * Apply a previously planned manifest.
+ *
+ * `planToken` must match the manifest being applied. This is the structural
+ * version of "always dry-run first": the guidance cannot be skipped, because
+ * the token is unobtainable without the plan call and changes with the
+ * manifest.
+ */
+export async function applyManifest(client, manifest, options) {
+    const expected = manifestDigest(manifest);
+    if (options.planToken !== expected) {
+        throw new Error('planToken does not match this manifest. Run plan_manifest on the exact manifest you intend to apply, then pass the planToken it returns. A mismatch means the manifest changed after it was previewed.');
+    }
+    const notes = [];
+    const provisioning = await client.provisionApp(provisionRequest(manifest, false));
+    let config;
+    if (manifest.config) {
+        const appId = provisioning.app.id;
+        if (appId == null) {
+            throw new Error('Provisioning returned no app id, so the config bundle cannot be imported.');
+        }
+        config = await client.importConfig(appId, {
+            mode: options.mode ?? 'merge',
+            dryRun: false,
+            bundle: manifest.config,
+            expectedCurrentHash: options.expectedCurrentHash,
+            allowUnhealthy: options.allowUnhealthy,
+        });
+    }
+    if (provisioning.widgetKey?.rawSecret) {
+        notes.push('A widget key and secret were minted and are shown exactly once. Store the secret in the host backend only; it must never reach a browser.');
+    }
+    for (const domain of provisioning.domains) {
+        if (domain.dns_record_name) {
+            notes.push(`${domain.domain} is unverified. Publish TXT ${domain.dns_record_name} = ${domain.dns_record_value}, then verify it.`);
+        }
+    }
+    return { provisioning, config, notes };
+}

package/dist/redaction.d.ts

@@ -0,0 +1,30 @@
+/**
+ * What a tool result may carry, per transport.
+ *
+ * The tool surface is identical across stdio and the remote HTTP service by
+ * design: one factory, one registration, both transports. What differs is where
+ * a result lands. Over stdio it stays on the operator's own machine. Over the
+ * remote transport it lands in a third party's conversation (ChatGPT,
+ * claude.ai), where it is stored, summarized, and outside the operator's
+ * control.
+ *
+ * Only one value in the whole surface is affected: the widget SECRET minted
+ * during provisioning. The widget KEY beside it is a publishable identifier
+ * that is meant to sit in public HTML, so it travels either way.
+ */
+export declare const SECRET_WITHHELD_NOTICE = "The widget secret is not returned over the remote transport, because a tool result here is stored in this conversation. Read it once from the Backoffice widget-keys page, or run the Appilot MCP server locally over stdio.";
+interface ProvisionLike {
+    widgetKey?: {
+        rawSecret?: string;
+    };
+}
+/**
+ * Strip the minted widget secret from a provisioning result when the result is
+ * about to cross the remote transport, replacing it with a note saying where to
+ * get it instead.
+ *
+ * Returns the input unchanged over stdio, and unchanged when no secret was
+ * minted (a converging run never mints one).
+ */
+export declare function redactForTransport<T extends ProvisionLike>(result: T, transport: 'stdio' | 'http' | undefined): T;
+export {};

package/dist/redaction.js

@@ -0,0 +1,33 @@
+/**
+ * What a tool result may carry, per transport.
+ *
+ * The tool surface is identical across stdio and the remote HTTP service by
+ * design: one factory, one registration, both transports. What differs is where
+ * a result lands. Over stdio it stays on the operator's own machine. Over the
+ * remote transport it lands in a third party's conversation (ChatGPT,
+ * claude.ai), where it is stored, summarized, and outside the operator's
+ * control.
+ *
+ * Only one value in the whole surface is affected: the widget SECRET minted
+ * during provisioning. The widget KEY beside it is a publishable identifier
+ * that is meant to sit in public HTML, so it travels either way.
+ */
+export const SECRET_WITHHELD_NOTICE = 'The widget secret is not returned over the remote transport, because a tool result here is stored in this conversation. Read it once from the Backoffice widget-keys page, or run the Appilot MCP server locally over stdio.';
+/**
+ * Strip the minted widget secret from a provisioning result when the result is
+ * about to cross the remote transport, replacing it with a note saying where to
+ * get it instead.
+ *
+ * Returns the input unchanged over stdio, and unchanged when no secret was
+ * minted (a converging run never mints one).
+ */
+export function redactForTransport(result, transport) {
+    if (transport !== 'http')
+        return result;
+    if (!result.widgetKey?.rawSecret)
+        return result;
+    const widgetKey = { ...result.widgetKey };
+    delete widgetKey.rawSecret;
+    widgetKey.secretWithheld = SECRET_WITHHELD_NOTICE;
+    return { ...result, widgetKey };
+}

package/dist/remote/consent.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The consent screen of the remote MCP service.
+ *
+ * This is the one page a person sees when connecting ChatGPT or Claude to their
+ * Appilot instance. It asks for a service token rather than an Appilot password
+ * on purpose: the connector needs a long-lived, scoped, revocable credential,
+ * which is exactly what a service token is and exactly what a password is not.
+ * A password would also make this host a credential-collection surface for the
+ * whole account, and it can grant no less than everything.
+ *
+ * Plain server-rendered HTML with no external assets, so it renders inside the
+ * in-app browsers ChatGPT and Claude use for the OAuth hop.
+ */
+export interface ConsentPageOptions {
+    /** Sealed authorization request, round-tripped through the form. */
+    request: string;
+    /** Where the form posts. */
+    action: string;
+    /** Display name of the MCP client asking for access. */
+    clientName: string;
+    /** The Appilot backend this deployment serves, shown so the person can check it. */
+    baseUrl: string;
+    /** Scopes the client asked for. */
+    scopes: string[];
+    /** Set after a failed attempt so the person can correct it in place. */
+    error?: string;
+}
+export declare function renderConsentPage(opts: ConsentPageOptions): string;
+export declare function renderErrorPage(title: string, detail: string): string;

package/dist/remote/consent.js

@@ -0,0 +1,99 @@
+/**
+ * The consent screen of the remote MCP service.
+ *
+ * This is the one page a person sees when connecting ChatGPT or Claude to their
+ * Appilot instance. It asks for a service token rather than an Appilot password
+ * on purpose: the connector needs a long-lived, scoped, revocable credential,
+ * which is exactly what a service token is and exactly what a password is not.
+ * A password would also make this host a credential-collection surface for the
+ * whole account, and it can grant no less than everything.
+ *
+ * Plain server-rendered HTML with no external assets, so it renders inside the
+ * in-app browsers ChatGPT and Claude use for the OAuth hop.
+ */
+const STYLE = `
+:root { color-scheme: light dark; }
+* { box-sizing: border-box; }
+body { margin: 0; padding: 2rem 1rem; font: 15px/1.55 ui-sans-serif, system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
+	background: #f6f7f9; color: #14161a; display: flex; justify-content: center; }
+main { width: 100%; max-width: 30rem; background: #fff; border: 1px solid #e3e6ea; border-radius: 12px; padding: 1.75rem; }
+h1 { font-size: 1.25rem; margin: 0 0 .35rem; }
+p { margin: 0 0 1rem; color: #52585f; }
+label { display: block; font-weight: 600; margin: 1rem 0 .35rem; }
+input[type=text], input[type=password], input[type=number] { width: 100%; padding: .6rem .7rem; font: inherit;
+	border: 1px solid #c8cdd3; border-radius: 8px; background: #fff; color: inherit; }
+input:focus-visible { outline: 2px solid #2f6feb; outline-offset: 1px; }
+small { display: block; color: #6b7280; margin-top: .3rem; }
+.scopes { list-style: none; padding: 0; margin: .5rem 0 0; }
+.scopes li { padding: .35rem 0; border-top: 1px solid #eef0f3; }
+.client { background: #f2f4f7; border-radius: 8px; padding: .75rem .9rem; margin-bottom: 1rem; }
+.actions { display: flex; gap: .6rem; margin-top: 1.5rem; }
+button { flex: 1; padding: .65rem 1rem; font: inherit; font-weight: 600; border-radius: 8px; cursor: pointer; border: 1px solid transparent; }
+button.approve { background: #14161a; color: #fff; }
+button.deny { background: #fff; border-color: #c8cdd3; color: #14161a; }
+.error { background: #fdecec; border: 1px solid #f3bcbc; color: #8a1c1c; border-radius: 8px; padding: .7rem .9rem; margin-bottom: 1rem; }
+@media (prefers-color-scheme: dark) {
+	body { background: #0f1115; color: #e8eaed; }
+	main { background: #171a1f; border-color: #2a2f36; }
+	p { color: #a4abb5; }
+	input[type=text], input[type=password], input[type=number] { background: #0f1115; border-color: #363c45; }
+	.client { background: #12151a; }
+	.scopes li { border-top-color: #2a2f36; }
+	button.approve { background: #e8eaed; color: #14161a; }
+	button.deny { background: #171a1f; border-color: #363c45; color: #e8eaed; }
+	.error { background: #2a1416; border-color: #5c2226; color: #f4b8bb; }
+}
+`;
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+function page(title, body) {
+    return `<!doctype html>
+<html lang="en"><head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escapeHtml(title)}</title>
+<style>${STYLE}</style>
+</head><body><main>${body}</main></body></html>`;
+}
+const SCOPE_COPY = {
+    'config:read': 'Read this app\'s configuration: views, controls, forms, action plans, knowledge.',
+    'config:write': 'Change that configuration, including importing a whole bundle.',
+};
+export function renderConsentPage(opts) {
+    const scopes = opts.scopes.length ? opts.scopes : ['config:read'];
+    const items = scopes
+        .map(s => `<li><strong>${escapeHtml(s)}</strong><br><small>${escapeHtml(SCOPE_COPY[s] ?? 'Unknown scope.')}</small></li>`)
+        .join('');
+    return page('Connect to Appilot', `
+<h1>Connect to Appilot</h1>
+<p>Give <strong>${escapeHtml(opts.clientName)}</strong> access to your Appilot configuration.</p>
+${opts.error ? `<div class="error">${escapeHtml(opts.error)}</div>` : ''}
+<div class="client">
+	<small>Instance</small>
+	<div>${escapeHtml(opts.baseUrl)}</div>
+</div>
+<form method="post" action="${escapeHtml(opts.action)}">
+	<input type="hidden" name="request" value="${escapeHtml(opts.request)}">
+	<label for="pat">Service token</label>
+	<input id="pat" name="pat" type="password" autocomplete="off" spellcheck="false" required
+		placeholder="appilot_pat_..." aria-describedby="pat-help">
+	<small id="pat-help">Create one in the Backoffice under Settings, Service Tokens. Revoking it there cuts this connection off.</small>
+	<label for="app_id">Default app ID <span style="font-weight:400">(optional)</span></label>
+	<input id="app_id" name="app_id" type="number" min="1" inputmode="numeric" aria-describedby="app-help">
+	<small id="app-help">Used when a tool call does not name an app. An app-scoped token supplies its own.</small>
+	<ul class="scopes">${items}</ul>
+	<div class="actions">
+		<button class="deny" type="submit" name="action" value="deny">Cancel</button>
+		<button class="approve" type="submit" name="action" value="approve">Connect</button>
+	</div>
+</form>`);
+}
+export function renderErrorPage(title, detail) {
+    return page(title, `<h1>${escapeHtml(title)}</h1><div class="error">${escapeHtml(detail)}</div>`);
+}

package/dist/remote/httpServer.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The remote Appilot MCP service: Streamable HTTP transport plus the OAuth
+ * authorization server that fronts it.
+ *
+ * Stateless by construction. Each request builds its own MCP server bound to the
+ * caller's own service token, which arrives sealed inside the bearer token and
+ * never crosses between callers. Nothing is retained between requests, so a
+ * second instance behaves exactly like the first and a cold start loses nothing.
+ *
+ * Deployment: docs/architecture/appilot-mcp.md, section "Remote deployment".
+ */
+import { type Express } from 'express';
+import type { RemoteConfig } from '../config.js';
+import { AppilotOAuthProvider } from './oauth.js';
+export interface RemoteAppOptions {
+    /** Swappable in tests so no real instance is contacted. */
+    provider?: AppilotOAuthProvider;
+}
+export declare function createRemoteApp(config: RemoteConfig, options?: RemoteAppOptions): Express;
+export declare function startRemote(config: RemoteConfig): Promise<void>;

package/dist/remote/httpServer.js

@@ -0,0 +1,125 @@
+/**
+ * The remote Appilot MCP service: Streamable HTTP transport plus the OAuth
+ * authorization server that fronts it.
+ *
+ * Stateless by construction. Each request builds its own MCP server bound to the
+ * caller's own service token, which arrives sealed inside the bearer token and
+ * never crosses between callers. Nothing is retained between requests, so a
+ * second instance behaves exactly like the first and a cold start loses nothing.
+ *
+ * Deployment: docs/architecture/appilot-mcp.md, section "Remote deployment".
+ */
+import express from 'express';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { mcpAuthRouter, getOAuthProtectedResourceMetadataUrl } from '@modelcontextprotocol/sdk/server/auth/router.js';
+import { requireBearerAuth } from '@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js';
+import { createAppilotServer } from '../server.js';
+import { AppilotOAuthProvider, SUPPORTED_SCOPES } from './oauth.js';
+/** Where the docs root lands a person who follows the OAuth metadata. */
+const CONFIGURE_WITH_AI_PATH = '/docs/developers/configure-with-ai/overview';
+/** Body cap for a JSON-RPC request. A ConfigBundle import is the large one. */
+const MAX_BODY = '32mb';
+export function createRemoteApp(config, options = {}) {
+    const provider = options.provider ??
+        new AppilotOAuthProvider({
+            publicUrl: config.publicUrl,
+            baseUrl: config.baseUrl,
+            secret: config.secret,
+        });
+    const mcpUrl = new URL('/mcp', config.publicUrl);
+    const app = express();
+    app.disable('x-powered-by');
+    // Liveness for the platform. Deliberately says nothing a caller could not
+    // already learn from the instance's own public capabilities endpoint.
+    // Two paths for one probe. Cloud Run's frontend swallows /healthz before it
+    // reaches the container (it answers with Google's own 404 page), so a
+    // deployment there can only be probed at /health. /healthz stays for
+    // on-premise and Kubernetes, where it is the conventional name.
+    app.get(['/health', '/healthz'], (_req, res) => {
+        res.json({ status: 'ok', transport: 'http', instance: config.baseUrl });
+    });
+    // /.well-known/oauth-authorization-server, /authorize, /token, /register.
+    // Must be mounted at the application root.
+    app.use(mcpAuthRouter({
+        provider,
+        issuerUrl: config.publicUrl,
+        baseUrl: config.publicUrl,
+        resourceServerUrl: mcpUrl,
+        resourceName: 'Appilot configuration',
+        scopesSupported: [...SUPPORTED_SCOPES],
+        serviceDocumentationUrl: new URL(CONFIGURE_WITH_AI_PATH, config.docsUrl),
+    }));
+    // The consent screen posts here. Form-encoded, same-origin, no JSON.
+    app.post('/consent', express.urlencoded({ extended: false, limit: '64kb' }), async (req, res) => {
+        try {
+            const outcome = await provider.handleConsent(req.body);
+            if ('redirect' in outcome) {
+                res.redirect(302, outcome.redirect);
+                return;
+            }
+            res.status(outcome.status).set('Content-Type', 'text/html; charset=utf-8').send(outcome.html);
+        }
+        catch (err) {
+            // The consent screen is person-facing, so a failure renders as a page.
+            res.status(500).set('Content-Type', 'text/html; charset=utf-8').send(`<!doctype html><meta charset="utf-8"><title>Connection failed</title><p>The connection could not be completed: ${err instanceof Error ? err.message.replace(/[<>&]/g, '') : 'unknown error'}</p>`);
+        }
+    });
+    const requireAuth = requireBearerAuth({
+        verifier: provider,
+        resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(mcpUrl),
+    });
+    app.post('/mcp', requireAuth, express.json({ limit: MAX_BODY }), async (req, res) => {
+        const auth = req.auth;
+        const extra = (auth?.extra ?? {});
+        // One server and one transport per request. The connection profile is the
+        // caller's own: the deployment's fixed instance URL, their service token.
+        const server = createAppilotServer({
+            baseUrl: config.baseUrl,
+            token: extra.pat,
+            defaultAppId: extra.appId,
+            transport: 'http',
+        });
+        const transport = new StreamableHTTPServerTransport({
+            sessionIdGenerator: undefined,
+            enableDnsRebindingProtection: true,
+            allowedHosts: config.allowedHosts,
+        });
+        res.on('close', () => {
+            void transport.close();
+            void server.close();
+        });
+        try {
+            await server.connect(transport);
+            await transport.handleRequest(req, res, req.body);
+        }
+        catch (err) {
+            if (!res.headersSent) {
+                res.status(500).json({
+                    jsonrpc: '2.0',
+                    error: { code: -32603, message: err instanceof Error ? err.message : 'Internal error' },
+                    id: null,
+                });
+            }
+        }
+    });
+    // Stateless: there is no stream to resume and no session to delete.
+    const methodNotAllowed = (_req, res) => {
+        res.status(405).set('Allow', 'POST').json({
+            jsonrpc: '2.0',
+            error: { code: -32000, message: 'This endpoint is stateless: use POST.' },
+            id: null,
+        });
+    };
+    app.get('/mcp', methodNotAllowed);
+    app.delete('/mcp', methodNotAllowed);
+    return app;
+}
+export function startRemote(config) {
+    const app = createRemoteApp(config);
+    return new Promise(resolve => {
+        app.listen(config.port, () => {
+            process.stderr.write(`[appilot-mcp] http transport on :${config.port} · public=${config.publicUrl.origin} · instance=${config.baseUrl}\n`);
+            resolve();
+        });
+    });
+}