donguri-journal 0.1.0

package/dist/management/server.js

@@ -0,0 +1,216 @@
+/**
+ * Management UI host.
+ *
+ * A small, opt-in HTTP server (started only when the owner calls the
+ * open_management_ui tool) that serves a local, browser-based console over the
+ * existing JournalStore. It is the owner's direct, non-LLM window onto the
+ * journal — the counterpart to the LLM-mediated MCP tools.
+ *
+ * SECURITY (this is a plain HTTP server on the owner's machine):
+ *  - Binds to localhost only (config.uiHost, default 127.0.0.1).
+ *  - Every /api/* request must present a per-session token (random, generated at
+ *    startup) via the `x-donguri-token` header or `?token=`. The token is
+ *    compared in constant time.
+ *  - The Host header is pinned to a loopback name, so a remote page cannot use
+ *    DNS rebinding to reach the API through the victim's browser.
+ *  - Read-only in this first slice: only GET, no mutations, and the entry data
+ *    it serves never includes filesystem paths.
+ */
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { statSync } from "node:fs";
+import { createServer } from "node:http";
+import { isIP } from "node:net";
+import { z } from "zod";
+import { renderApp } from "./ui.js";
+const LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "[::1]", "::1"]);
+const entriesQuerySchema = z.object({
+    since: z.string().datetime({ offset: true }).optional(),
+    until: z.string().datetime({ offset: true }).optional(),
+    source_kind: z.string().min(1).optional(),
+    tag: z.string().min(1).optional(),
+    time_field: z.enum(["created_at", "occurred_at"]).optional(),
+    limit: z.coerce.number().int().optional(),
+    include_deleted: z
+        .enum(["true", "false"])
+        .optional()
+        .transform((v) => v === "true"),
+});
+const recallQuerySchema = z.object({
+    q: z.string().min(1),
+    k: z.coerce.number().int().optional(),
+});
+/** Constant-time token comparison that never throws on length mismatch. */
+function tokenMatches(expected, provided) {
+    if (!provided)
+        return false;
+    const a = Buffer.from(expected);
+    const b = Buffer.from(provided);
+    if (a.length !== b.length)
+        return false;
+    return timingSafeEqual(a, b);
+}
+/**
+ * Is this a host we're willing to bind to? Loopback only — the Host-header check
+ * is a browser-side DNS-rebinding guard, NOT a substitute for the bind range, so
+ * we refuse to expose the socket on an external interface (e.g. 0.0.0.0).
+ */
+function isBindableLoopback(host) {
+    // `host` is the bare literal (brackets already stripped by the caller), since
+    // Node's listen() takes a raw IP, not the URL/bracketed form.
+    const h = host.toLowerCase();
+    if (h === "localhost" || h === "::1")
+        return true;
+    // Any real IPv4 literal in 127.0.0.0/8. isIP() rejects malformed octets (e.g.
+    // 127.999.999.999) that a loose regex would wrongly accept.
+    return isIP(h) === 4 && h.startsWith("127.");
+}
+/** Reject requests whose Host header isn't a loopback name (DNS-rebinding guard). */
+function hostIsLoopback(hostHeader) {
+    if (!hostHeader)
+        return false;
+    // Strip the port; keep bracketed IPv6 intact.
+    const host = hostHeader.startsWith("[")
+        ? hostHeader.slice(0, hostHeader.indexOf("]") + 1)
+        : (hostHeader.split(":")[0] ?? "");
+    return LOOPBACK_HOSTS.has(host);
+}
+/**
+ * Build (but do not start) the management HTTP server. Exposed for tests, which
+ * drive it on an ephemeral port. Production goes through startManagementUi.
+ */
+export function createManagementServer(ctx, token) {
+    const { store, originals, config } = ctx;
+    const sendJson = (res, status, body) => {
+        // no-store: responses can carry journal bodies; keep them out of any cache.
+        res.writeHead(status, {
+            "content-type": "application/json; charset=utf-8",
+            "cache-control": "no-store",
+        });
+        res.end(JSON.stringify(body));
+    };
+    return createServer(async (req, res) => {
+        try {
+            if (!hostIsLoopback(req.headers.host)) {
+                sendJson(res, 421, { error: "Misdirected request" });
+                return;
+            }
+            const url = new URL(req.url ?? "/", "http://localhost");
+            const method = req.method ?? "GET";
+            const provided = req.headers["x-donguri-token"] ?? url.searchParams.get("token");
+            const authorized = tokenMatches(token, provided ?? null);
+            // The shell itself is token-gated so a co-resident local process can't load
+            // it, read a baked-in token, and reach the API. The page then reuses the
+            // ?token= from its own URL for /api/* calls.
+            if (url.pathname === "/" && method === "GET") {
+                if (!authorized) {
+                    res.writeHead(401, { "content-type": "text/plain; charset=utf-8" });
+                    res.end("Unauthorized: open the URL printed by open_management_ui (it carries the token).");
+                    return;
+                }
+                res.writeHead(200, {
+                    "content-type": "text/html; charset=utf-8",
+                    "cache-control": "no-store",
+                });
+                res.end(renderApp());
+                return;
+            }
+            if (url.pathname.startsWith("/api/")) {
+                if (method !== "GET") {
+                    sendJson(res, 405, { error: "Method not allowed" });
+                    return;
+                }
+                if (!authorized) {
+                    sendJson(res, 401, { error: "Unauthorized" });
+                    return;
+                }
+                if (url.pathname === "/api/entries") {
+                    const parsed = entriesQuerySchema.safeParse(Object.fromEntries(url.searchParams));
+                    if (!parsed.success) {
+                        sendJson(res, 400, { error: "Invalid query", issues: parsed.error.issues });
+                        return;
+                    }
+                    const entries = store.query(parsed.data);
+                    sendJson(res, 200, { count: entries.length, entries });
+                    return;
+                }
+                if (url.pathname === "/api/recall") {
+                    const parsed = recallQuerySchema.safeParse(Object.fromEntries(url.searchParams));
+                    if (!parsed.success) {
+                        sendJson(res, 400, { error: "Invalid query", issues: parsed.error.issues });
+                        return;
+                    }
+                    const hits = await store.recall(parsed.data.q, parsed.data.k);
+                    sendJson(res, 200, { count: hits.length, hits });
+                    return;
+                }
+                if (url.pathname === "/api/stats") {
+                    let dbBytes = null;
+                    try {
+                        dbBytes = statSync(config.dbPath).size;
+                    }
+                    catch {
+                        dbBytes = null;
+                    }
+                    sendJson(res, 200, {
+                        entries: store.entryStats(),
+                        originals: await originals.stats(),
+                        db_bytes: dbBytes,
+                    });
+                    return;
+                }
+                sendJson(res, 404, { error: "Not found" });
+                return;
+            }
+            sendJson(res, 404, { error: "Not found" });
+        }
+        catch (err) {
+            ctx.log("management UI request failed:", err);
+            if (!res.headersSent) {
+                sendJson(res, 500, { error: "Internal error" });
+            }
+            else {
+                res.end();
+            }
+        }
+    });
+}
+/**
+ * Start the management UI on config.uiHost:uiPort (an ephemeral port by
+ * default). Returns the URL (with the session token) to hand to the owner.
+ */
+export function startManagementUi(ctx) {
+    const token = randomBytes(24).toString("base64url");
+    const server = createManagementServer(ctx, token);
+    const { uiPort } = ctx.config;
+    // Node's listen() wants a raw IP literal (`::1`), not the bracketed URL form
+    // (`[::1]`); strip brackets before validating/binding.
+    const configured = ctx.config.uiHost;
+    const bareHost = configured.startsWith("[") && configured.endsWith("]") ? configured.slice(1, -1) : configured;
+    // Enforce localhost-only at the bind boundary; a non-loopback config value is
+    // refused (not silently honored) so the journal can't be exposed on the LAN.
+    const uiHost = isBindableLoopback(bareHost) ? bareHost : "127.0.0.1";
+    if (uiHost !== bareHost) {
+        ctx.log(`refusing to bind management UI to non-loopback host "${configured}"; using 127.0.0.1 (localhost-only by design)`);
+    }
+    return new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(uiPort, uiHost, () => {
+            server.removeListener("error", reject);
+            const address = server.address();
+            const port = typeof address === "object" && address ? address.port : uiPort;
+            // Bracket IPv6 hosts for the URL authority.
+            const hostForUrl = uiHost.includes(":") ? `[${uiHost}]` : uiHost;
+            const url = `http://${hostForUrl}:${port}/?token=${token}`;
+            resolve({
+                url,
+                port,
+                token,
+                close: () => new Promise((res, rej) => {
+                    server.closeAllConnections();
+                    server.close((err) => (err ? rej(err) : res()));
+                }),
+            });
+        });
+    });
+}
+//# sourceMappingURL=server.js.map

package/dist/management/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/management/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAoC,YAAY,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AASpC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAE3E,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5D,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACzC,eAAe,EAAE,CAAC;SACf,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACvB,QAAQ,EAAE;SACV,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC;CAClC,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpB,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,2EAA2E;AAC3E,SAAS,YAAY,CAAC,QAAgB,EAAE,QAAuB;IAC7D,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,8EAA8E;IAC9E,8DAA8D;IAC9D,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,8EAA8E;IAC9E,4DAA4D;IAC5D,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,qFAAqF;AACrF,SAAS,cAAc,CAAC,UAA8B;IACpD,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,8CAA8C;IAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;QACrC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrC,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAmB,EAAE,KAAa;IACvE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IAEzC,MAAM,QAAQ,GAAG,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa,EAAQ,EAAE;QAC5E,4EAA4E;QAC5E,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;YACpB,cAAc,EAAE,iCAAiC;YACjD,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC;IAEF,OAAO,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACrC,IAAI,CAAC;YACH,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;YACnC,MAAM,QAAQ,GACX,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAwB,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1F,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC;YAEzD,4EAA4E;YAC5E,yEAAyE;YACzE,6CAA6C;YAC7C,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;oBACpE,GAAG,CAAC,GAAG,CACL,kFAAkF,CACnF,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBACjB,cAAc,EAAE,0BAA0B;oBAC1C,eAAe,EAAE,UAAU;iBAC5B,CAAC,CAAC;gBACH,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrC,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;oBACrB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;oBACpD,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;oBAC9C,OAAO;gBACT,CAAC;gBAED,IAAI,GAAG,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;oBACpC,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;oBAClF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;wBACpB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;wBAC5E,OAAO;oBACT,CAAC;oBACD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;oBACzC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;oBACvD,OAAO;gBACT,CAAC;gBAED,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;oBACnC,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;oBACjF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;wBACpB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;wBAC5E,OAAO;oBACT,CAAC;oBACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC9D,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;oBACjD,OAAO;gBACT,CAAC;gBAED,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;oBAClC,IAAI,OAAO,GAAkB,IAAI,CAAC;oBAClC,IAAI,CAAC;wBACH,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;oBACzC,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,GAAG,IAAI,CAAC;oBACjB,CAAC;oBACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;wBACjB,OAAO,EAAE,KAAK,CAAC,UAAU,EAAE;wBAC3B,SAAS,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE;wBAClC,QAAQ,EAAE,OAAO;qBAClB,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,GAAG,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAmB;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClD,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;IAC9B,6EAA6E;IAC7E,uDAAuD;IACvD,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IACrC,MAAM,QAAQ,GACZ,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAChG,8EAA8E;IAC9E,6EAA6E;IAC7E,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;IACrE,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,GAAG,CAAC,GAAG,CACL,wDAAwD,UAAU,+CAA+C,CAClH,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,OAAO,CAAe,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE;YACjC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YAC5E,4CAA4C;YAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YACjE,MAAM,GAAG,GAAG,UAAU,UAAU,IAAI,IAAI,WAAW,KAAK,EAAE,CAAC;YAC3D,OAAO,CAAC;gBACN,GAAG;gBACH,IAAI;gBACJ,KAAK;gBACL,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;oBAC7B,MAAM,CAAC,mBAAmB,EAAE,CAAC;oBAC7B,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAClD,CAAC,CAAC;aACL,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/management/ui.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The management console SPA, as a single self-contained HTML document
+ * (inline CSS + vanilla JS, no framework, no build step — consistent with the
+ * dependency-free approach used elsewhere, e.g. the SVG charts).
+ *
+ * It reads the session token from its own URL (`?token=`) and sends it as the
+ * `x-donguri-token` header on every /api/* fetch. It renders data only; it holds
+ * no secrets beyond that token and performs no mutations in this slice.
+ */
+export declare function renderApp(): string;

package/dist/management/ui.js

@@ -0,0 +1,159 @@
+/**
+ * The management console SPA, as a single self-contained HTML document
+ * (inline CSS + vanilla JS, no framework, no build step — consistent with the
+ * dependency-free approach used elsewhere, e.g. the SVG charts).
+ *
+ * It reads the session token from its own URL (`?token=`) and sends it as the
+ * `x-donguri-token` header on every /api/* fetch. It renders data only; it holds
+ * no secrets beyond that token and performs no mutations in this slice.
+ */
+// Kept static and data-free so the served bytes never embed anything sensitive.
+export function renderApp() {
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<meta name="referrer" content="no-referrer" />
+<title>donguri-journal</title>
+<style>
+  :root { color-scheme: light dark; --gap: 12px; }
+  * { box-sizing: border-box; }
+  body { margin: 0; font: 14px/1.5 system-ui, -apple-system, "Segoe UI", sans-serif; }
+  header { display: flex; align-items: baseline; gap: 10px; padding: 14px 18px; border-bottom: 1px solid #8883; }
+  header h1 { font-size: 16px; margin: 0; }
+  header .sub { opacity: 0.6; font-size: 12px; }
+  main { display: grid; grid-template-columns: minmax(0, 1fr) 300px; gap: 18px; padding: 18px; align-items: start; }
+  @media (max-width: 820px) { main { grid-template-columns: 1fr; } }
+  .controls { display: flex; flex-wrap: wrap; gap: 8px; margin-bottom: var(--gap); }
+  .controls input, .controls select, .controls button {
+    font: inherit; padding: 6px 9px; border: 1px solid #8886; border-radius: 6px; background: transparent; color: inherit;
+  }
+  .controls button { cursor: pointer; }
+  .controls input[type="search"] { flex: 1 1 220px; }
+  .entry { border: 1px solid #8883; border-radius: 8px; padding: 10px 12px; margin-bottom: 10px; }
+  .entry.deleted { opacity: 0.55; }
+  .entry .body { white-space: pre-wrap; word-break: break-word; }
+  .entry .meta { display: flex; flex-wrap: wrap; gap: 8px; margin-top: 6px; font-size: 12px; opacity: 0.7; }
+  .tag { font-size: 11px; padding: 1px 7px; border: 1px solid #8886; border-radius: 999px; }
+  .badge { font-size: 11px; padding: 1px 7px; border-radius: 999px; background: #8882; }
+  aside { border: 1px solid #8883; border-radius: 8px; padding: 12px 14px; position: sticky; top: 18px; }
+  aside h2 { font-size: 13px; margin: 0 0 8px; text-transform: uppercase; letter-spacing: 0.04em; opacity: 0.7; }
+  aside dl { display: grid; grid-template-columns: 1fr auto; gap: 2px 10px; margin: 0; }
+  aside dt { opacity: 0.7; } aside dd { margin: 0; text-align: right; font-variant-numeric: tabular-nums; }
+  .muted { opacity: 0.6; }
+  .status { padding: 10px 0; }
+</style>
+</head>
+<body>
+<header>
+  <h1>🐿️ donguri-journal</h1>
+  <span class="sub">management console</span>
+</header>
+<main>
+  <section>
+    <form class="controls" id="controls">
+      <input type="search" id="q" placeholder="Semantic recall (leave blank to browse)…" />
+      <input type="text" id="tag" placeholder="tag" size="8" />
+      <input type="text" id="source_kind" placeholder="source kind" size="10" />
+      <select id="time_field" title="timestamp field">
+        <option value="created_at">created_at</option>
+        <option value="occurred_at">occurred_at</option>
+      </select>
+      <label class="badge"><input type="checkbox" id="include_deleted" /> show deleted</label>
+      <button type="submit">Search</button>
+    </form>
+    <div class="status muted" id="status">Loading…</div>
+    <div id="list"></div>
+  </section>
+  <aside>
+    <h2>Storage</h2>
+    <dl id="stats"><dd class="muted">…</dd></dl>
+  </aside>
+</main>
+<script>
+(() => {
+  const TOKEN = new URLSearchParams(location.search).get("token") || "";
+  const $ = (id) => document.getElementById(id);
+
+  async function api(path, params) {
+    const url = new URL(path, location.origin);
+    if (params) for (const [k, v] of Object.entries(params)) {
+      if (v !== "" && v != null && v !== false) url.searchParams.set(k, v);
+    }
+    const res = await fetch(url, { headers: { "x-donguri-token": TOKEN } });
+    if (!res.ok) throw new Error("HTTP " + res.status);
+    return res.json();
+  }
+
+  const fmt = (iso) => { try { return new Date(iso).toLocaleString(); } catch { return iso; } };
+  const esc = (s) => s.replace(/[&<>]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;" }[c]));
+
+  function renderEntries(data) {
+    const list = $("list");
+    if (!data.entries || data.entries.length === 0) {
+      list.innerHTML = '<p class="muted">No entries.</p>';
+      return;
+    }
+    list.innerHTML = data.entries.map((e) => {
+      const tags = (e.tags || []).map((t) => '<span class="tag">' + esc(String(t)) + "</span>").join(" ");
+      const deleted = e.deleted_at ? " deleted" : "";
+      const delBadge = e.deleted_at ? '<span class="badge">deleted</span>' : "";
+      const dist = typeof e.distance === "number" ? '<span class="badge">d=' + e.distance.toFixed(3) + "</span>" : "";
+      return '<div class="entry' + deleted + '">' +
+        '<div class="body">' + esc(String(e.body || "")) + "</div>" +
+        '<div class="meta"><span>#' + esc(String(e.id)) + "</span>" +
+        "<span>" + esc(String(e.source_kind || "")) + "</span>" +
+        "<span>" + esc(fmt(e.occurred_at)) + "</span>" +
+        (e.original_ref ? '<span class="badge">original</span>' : "") +
+        delBadge + dist + " " + tags + "</div></div>";
+    }).join("");
+  }
+
+  function renderStats(s) {
+    const rows = [];
+    rows.push(["Active", s.entries.active]);
+    rows.push(["Soft-deleted", s.entries.soft_deleted]);
+    rows.push(["Vectors", s.entries.vectors]);
+    rows.push(["Originals", s.originals.count]);
+    if (s.db_bytes != null) rows.push(["DB size", (s.db_bytes / 1024 / 1024).toFixed(2) + " MB"]);
+    if (s.originals.bytes != null) rows.push(["Originals size", (s.originals.bytes / 1024 / 1024).toFixed(2) + " MB"]);
+    $("stats").innerHTML = rows
+      .map(([k, v]) => "<dt>" + esc(String(k)) + "</dt><dd>" + esc(String(v)) + "</dd>")
+      .join("");
+  }
+
+  async function search() {
+    const status = $("status");
+    status.textContent = "Loading…";
+    try {
+      const q = $("q").value.trim();
+      let data;
+      if (q) {
+        data = await api("/api/recall", { q, k: 50 });
+        data = { entries: data.hits, count: data.count };
+      } else {
+        data = await api("/api/entries", {
+          tag: $("tag").value.trim(),
+          source_kind: $("source_kind").value.trim(),
+          time_field: $("time_field").value,
+          include_deleted: $("include_deleted").checked,
+          limit: 200,
+        });
+      }
+      renderEntries(data);
+      status.textContent = data.count + " " + (q ? "match(es) by meaning" : "ent"+"ries");
+    } catch (err) {
+      status.textContent = "Error: " + err.message;
+    }
+  }
+
+  $("controls").addEventListener("submit", (ev) => { ev.preventDefault(); search(); });
+  api("/api/stats").then(renderStats).catch(() => {});
+  search();
+})();
+</script>
+</body>
+</html>`;
+}
+//# sourceMappingURL=ui.js.map

package/dist/management/ui.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui.js","sourceRoot":"","sources":["../../src/management/ui.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,gFAAgF;AAChF,MAAM,UAAU,SAAS;IACvB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAiJD,CAAC;AACT,CAAC"}

package/dist/modules/core.d.ts

@@ -0,0 +1,2 @@
+import type { JournalModule } from "../kernel/module.js";
+export declare const coreModule: JournalModule;