mcpmake 0.1.0 → 0.2.0

package/dist/cloud/server.js

@@ -1,1079 +0,0 @@
-/**
- * Hosting backend HTTP server.
- *
- * A minimal Node.js HTTP server (no Express) that accepts spec uploads,
- * generates MCP servers, and manages Docker container lifecycles.
- *
- * Endpoints:
- *   POST   /api/servers          — Create a new hosted MCP server
- *   GET    /api/servers          — List servers
- *   GET    /api/servers/:slug    — Get server status
- *   DELETE /api/servers/:slug    — Stop and remove server
- *   PUT    /api/servers/:slug    — Re-deploy with updated spec
- *   GET    /api/servers/:slug/logs — Tail container logs (SSE)
- *   GET    /health               — Health check
- */
-import http from 'node:http';
-import { writeFile, mkdir, unlink, rm } from 'node:fs/promises';
-import { join } from 'node:path';
-import { randomBytes, timingSafeEqual, createHash } from 'node:crypto';
-import { logger } from '../utils/logger.js';
-import { buildFromSpec, detectFormat, detectFormatFromContent } from './build-pipeline.js';
-import { getContainerBackend } from './container-backend.js';
-import { generateBearerToken, hashToken, verifyToken, hashSpec } from './security.js';
-import { IdleMonitor } from './idle-monitor.js';
-import { parseMultipart, isAllowedSpecFile, getSafeExtension } from './multipart.js';
-import { handleWebRequest, render500Page } from './web/router.js';
-import { getSessionToken, getSession, getUserById, countUsers } from './web/auth.js';
-import { getClientIp } from './request-security.js';
-import { handleWebhookEvent, isStripeConfigured } from './stripe.js';
-import { extractSlug, authorizeBearer, readBoundedBody, inspectMcpBody, proxyToUpstream, } from './mcp-proxy.js';
-import { checkCallQuota } from './billing/billing-engine.js';
-import { FAMILY_A_PRICING } from '../pricing.js';
-import { getBillingPeriod } from './billing/usage-store.js';
-import { buildQueue } from './build-queue.js';
-import { reportError, installGlobalErrorHandlers, validateStartupConfig } from './observability.js';
-import { ResourceMonitor, gatherResourceReading, } from './resource-monitor.js';
-import { store, ports, uploadLimiter, loginLimiter, telemetryLimiter, metrics, usageTracker, failureTracker, getUsageStore, getCreditStore, getMetricSampleStore, getTelemetryStore, MAX_SPEC_SIZE, MAX_NAME_LENGTH, UPLOAD_DIR, getPgServerStore, getSecretStore, initStores, } from './shared-state.js';
-const DEFAULT_PORT = 3001;
-const DEFAULT_DOMAIN = 'mcpmake.dev';
-/** Active host resource monitor, exposed so /health can report the gauges. */
-let resourceMonitor = null;
-/**
- * Start the hosting backend server.
- */
-export async function startServer(port = DEFAULT_PORT, domain = DEFAULT_DOMAIN) {
-    // Fail fast on missing production secrets; report crashes instead of dying.
-    validateStartupConfig();
-    installGlobalErrorHandlers();
-    // Initialise Pg-backed stores when DATABASE_URL is set
-    await initStores();
-    // Start idle monitor
-    const idleMonitor = new IdleMonitor(store, (p) => ports.release(p), {
-        idleThresholdMs: parseInt(process.env.IDLE_THRESHOLD_MS ?? '3600000', 10),
-        domain,
-    });
-    idleMonitor.start();
-    // Monitor host resource pressure (disk / RAM / active containers) and alert
-    // via the observability hook before the single host runs out of headroom.
-    // The same 5-min tick also persists a time-series sample for the admin charts.
-    const dataDir = process.env.DATA_DIR ?? '/';
-    resourceMonitor = new ResourceMonitor(async () => {
-        // Prefer the Pg store: the in-memory `store` is empty after a restart in
-        // Pg mode, which would under-report active containers.
-        const pg = getPgServerStore();
-        const all = pg ? await pg.list() : store.list();
-        const running = all.filter((s) => s.status === 'running').length;
-        return gatherResourceReading(running, dataDir);
-    }, {
-        onSample: (reading) => {
-            void persistMetricSample(reading);
-        },
-    });
-    resourceMonitor.start();
-    // Periodic cleanup of rate limiters and expired sessions
-    const cleanupTimer = setInterval(() => {
-        uploadLimiter.cleanup();
-        loginLimiter.cleanup();
-        telemetryLimiter.cleanup();
-        // cleanupSessions is async (handles Pg + in-memory) — fire and forget
-        import('./web/auth.js').then(({ cleanupSessions }) => cleanupSessions().catch(() => { }));
-    }, 3_600_000);
-    cleanupTimer.unref();
-    const server = http.createServer(async (req, res) => {
-        // Count every completed response by status class for the API failure rate.
-        // Registered here (the one entry point for all responses) rather than in
-        // sendJson/sendHtml, which miss the proxy, redirect, and SSE paths.
-        // 'finish' = response fully sent; 'close' without writableFinished = the
-        // socket was aborted before the response completed.
-        res.on('finish', () => failureTracker.record(res.statusCode));
-        res.on('close', () => {
-            if (!res.writableFinished)
-                failureTracker.recordAborted();
-        });
-        try {
-            await handleRequest(req, res, domain);
-        }
-        catch (err) {
-            reportError(err, { method: req.method, url: req.url });
-            if (res.headersSent) {
-                res.destroy();
-                return;
-            }
-            const accept = req.headers.accept ?? '';
-            if (accept.includes('text/html') && !accept.includes('application/json')) {
-                render500Page(res);
-            }
-            else {
-                sendJson(res, 500, { error: 'Internal server error' });
-            }
-        }
-    });
-    server.listen(port, () => {
-        logger.info(`Hosting backend listening on http://localhost:${port}`);
-    });
-    server.on('close', () => {
-        idleMonitor.stop();
-        resourceMonitor?.stop();
-        clearInterval(cleanupTimer);
-    });
-    return server;
-}
-// ---------------------------------------------------------------------------
-// Router
-// ---------------------------------------------------------------------------
-export async function handleRequest(req, res, domain) {
-    const method = req.method ?? 'GET';
-    const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
-    const path = url.pathname;
-    logger.info(`${method} ${path}`);
-    // Served MCP traffic arrives on a per-server subdomain ({slug}.{domain}).
-    // The backend is the authoritative entry point: validate the token, enforce
-    // quota, meter usage, then stream-proxy to the container. This is wired
-    // before all apex routes because subdomains are a separate virtual host.
-    const proxySlug = extractSlug(req.headers.host, domain);
-    if (proxySlug) {
-        await handleMcpSubdomain(req, res, proxySlug);
-        return;
-    }
-    // HEAD probes from monitors / uptime tools. Mirror the GET 200 for the apex
-    // landing and health endpoints (headers only, no body per the HTTP spec) so
-    // a HEAD check doesn't read as an outage while GET returns 200.
-    if (method === 'HEAD' && (path === '/' || path === '/health')) {
-        res.writeHead(200, {
-            'Content-Type': path === '/health' ? 'application/json' : 'text/html; charset=utf-8',
-        });
-        res.end();
-        return;
-    }
-    // Stripe webhook — must be handled before anything that consumes the body,
-    // and must NOT go through CSRF validation (Stripe cannot send CSRF tokens).
-    // Requires the raw body as a Buffer for signature verification.
-    if (method === 'POST' && path === '/api/webhooks/stripe') {
-        await handleStripeWebhook(req, res);
-        return;
-    }
-    // Web routes (HTML pages, static files) — skip for API and health paths
-    if (!path.startsWith('/api/') && path !== '/health') {
-        const handled = await handleWebRequest(req, res, { domain, store, ports, metrics });
-        if (handled)
-            return;
-    }
-    // Health check
-    if (method === 'GET' && path === '/health') {
-        const pgStore = getPgServerStore();
-        const serverCount = pgStore ? (await pgStore.list()).length : store.list().length;
-        const reading = resourceMonitor?.lastReading();
-        const fw = failureTracker.window(60);
-        sendJson(res, 200, {
-            status: 'ok',
-            servers: serverCount,
-            ports: ports.allocatedCount,
-            requestsLastHour: fw.total,
-            serverErrorRatePct: Math.round(fw.serverErrorRatePct * 10) / 10,
-            ...(reading
-                ? {
-                    activeContainers: reading.activeContainers,
-                    memUsedPct: Math.round(reading.memUsedPct),
-                    diskUsedPct: Math.round(reading.diskUsedPct),
-                }
-                : {}),
-        });
-        return;
-    }
-    // GET /api/pricing — Public pricing (the source of truth for the CLI).
-    // The installed CLI fetches this so an old binary never prints stale prices;
-    // it falls back to its bundled copy only when the backend is unreachable.
-    if (method === 'GET' && path === '/api/pricing') {
-        sendJson(res, 200, { familyA: FAMILY_A_PRICING });
-        return;
-    }
-    // POST /api/telemetry/report — Receive opt-in CLI crash reports.
-    // Unauthenticated (no secrets, no PII) but heavily rate-limited and size-
-    // capped; see handleTelemetryReport for the abuse hardening.
-    if (method === 'POST' && path === '/api/telemetry/report') {
-        await handleTelemetryReport(req, res);
-        return;
-    }
-    // POST /api/servers — Create
-    if (method === 'POST' && path === '/api/servers') {
-        await handleCreateServer(req, res, domain);
-        return;
-    }
-    // GET /api/servers — List (requires admin token)
-    if (method === 'GET' && path === '/api/servers') {
-        if (!authenticateAdmin(req, res))
-            return;
-        await handleListServers(res);
-        return;
-    }
-    // Match /api/servers/:slug routes (slugs: alphanumeric + hyphens only, no dots)
-    const slugMatch = path.match(/^\/api\/servers\/([a-z0-9][a-z0-9-]*)$/);
-    if (slugMatch) {
-        const slug = slugMatch[1];
-        if (method === 'GET') {
-            if (!(await authenticateRequest(req, res, slug)))
-                return;
-            await handleGetServer(res, slug);
-            return;
-        }
-        if (method === 'DELETE') {
-            if (!(await authenticateRequest(req, res, slug)))
-                return;
-            await handleDeleteServer(res, slug, domain);
-            return;
-        }
-        if (method === 'PUT') {
-            if (!(await authenticateRequest(req, res, slug)))
-                return;
-            await handleUpdateServer(req, res, slug, domain);
-            return;
-        }
-    }
-    // Match /api/servers/:slug/logs
-    const logsMatch = path.match(/^\/api\/servers\/([a-z0-9][a-z0-9-]*)\/logs$/);
-    if (logsMatch && method === 'GET') {
-        if (!(await authenticateRequest(req, res, logsMatch[1])))
-            return;
-        await handleGetLogs(res, logsMatch[1]);
-        return;
-    }
-    // Match /api/servers/:slug/metrics
-    const metricsMatch = path.match(/^\/api\/servers\/([a-z0-9][a-z0-9-]*)\/metrics$/);
-    if (metricsMatch && method === 'GET') {
-        if (!(await authenticateRequest(req, res, metricsMatch[1])))
-            return;
-        await handleGetMetrics(res, metricsMatch[1]);
-        return;
-    }
-    sendJson(res, 404, { error: 'Not found' });
-}
-/**
- * Handle served MCP traffic for a single hosted server (subdomain request).
- *
- * Validates the bearer token against the server's stored hash, enforces the
- * owner's monthly tool-call quota, meters usage, keeps the server marked
- * active, and stream-proxies the request to the container.
- */
-async function handleMcpSubdomain(req, res, slug) {
-    const pgStore = getPgServerStore();
-    const record = pgStore ? await pgStore.get(slug) : store.get(slug);
-    if (!record) {
-        sendJson(res, 404, { error: 'Server not found' });
-        return;
-    }
-    // 1. Authenticate against the stored token hash.
-    const auth = authorizeBearer(req, record.bearerToken);
-    if (!auth.ok) {
-        sendJson(res, auth.status, { error: auth.error });
-        return;
-    }
-    if (record.status !== 'running') {
-        sendJson(res, 503, { error: 'Server is not running. It may be sleeping or rebuilding.' });
-        return;
-    }
-    // 2. Buffer the body (bounded) so we can meter tool calls and enforce quota.
-    const body = await readBoundedBody(req);
-    if (body === null) {
-        sendJson(res, 413, { error: 'Request body too large' });
-        return;
-    }
-    const { toolCalls, primaryTool } = inspectMcpBody(body, req.headers['content-type']);
-    // 3. Enforce the owner's monthly tool-call quota before forwarding. When the
-    //    plan quota is exhausted, fall back to any promotional credit balance
-    //    (all-or-nothing for this request) before returning 429.
-    const billable = !!record.userId && toolCalls > 0;
-    let period;
-    let coveredByCredits = false;
-    if (billable) {
-        const user = await getUserById(record.userId);
-        const plan = (user?.plan ?? 'free');
-        period = getBillingPeriod(new Date(), user?.subscriptionPeriodEnd);
-        const used = await getUsageStore().getToolCalls(record.userId, period);
-        const quota = checkCallQuota(plan, used);
-        if (!quota.allowed) {
-            // Atomic consume — never read-modify-write (lost-update would leak credits).
-            const credit = await getCreditStore()
-                .consume(record.userId, toolCalls)
-                .catch(() => ({ consumed: false, balance: 0 }));
-            if (!credit.consumed) {
-                sendJson(res, 429, {
-                    error: `Monthly tool-call quota exceeded (${quota.limit}). Upgrade your plan or ask for promotional credits.`,
-                });
-                return;
-            }
-            coveredByCredits = true;
-        }
-    }
-    // 4. Meter: per-server metrics, keep-alive timestamp, and durable usage.
-    // Persist the tool-call count BEFORE the (slow, streaming) proxy call and
-    // await it, so a concurrent request for the same user reads the incremented
-    // counter when checking quota. The DB upsert is atomic, so counts never get
-    // lost; this only narrows the read-before-write window to a single round trip
-    // (rather than the full proxy duration). A metering failure must not block
-    // serving, so we log and continue.
-    const now = new Date().toISOString();
-    metrics.recordRequest(slug, primaryTool);
-    store.update(slug, { lastActiveAt: now });
-    if (pgStore) {
-        pgStore.update(slug, { lastActiveAt: now }).catch(() => { });
-    }
-    // Credit-covered calls are NOT counted against the plan's monthly quota — the
-    // user paid for them with promotional credits, which were already decremented.
-    if (billable && period && !coveredByCredits) {
-        const meta = primaryTool ? { tool: primaryTool } : undefined;
-        for (let i = 0; i < toolCalls; i++) {
-            usageTracker.recordToolCall(record.userId, slug, meta);
-        }
-        try {
-            await getUsageStore().record(record.userId, period, toolCalls, 1);
-        }
-        catch (err) {
-            logger.warn(`Failed to persist usage for ${slug}: ${err}`);
-        }
-    }
-    // 5. Stream-proxy to the container.
-    await proxyToUpstream(req, res, record.port, body);
-}
-// ---------------------------------------------------------------------------
-// Endpoint Handlers
-// ---------------------------------------------------------------------------
-/**
- * POST /api/servers — Create a new hosted MCP server.
- * Accepts multipart form data with a spec file and optional name field.
- */
-async function handleCreateServer(req, res, domain) {
-    // Gate the unauthenticated JSON API. When ADMIN_TOKEN is configured (the
-    // production default), creating servers via the API requires it — otherwise
-    // anyone could spin up containers. In dev / self-host (no ADMIN_TOKEN set)
-    // the path stays open for the CLI.
-    if (process.env.ADMIN_TOKEN && !authenticateAdmin(req, res))
-        return;
-    // Rate limiting by IP. Trust X-Forwarded-For only when TRUST_PROXY=true.
-    const clientIp = getClientIp(req);
-    const rateCheck = uploadLimiter.check(clientIp);
-    if (!rateCheck.allowed) {
-        res.setHeader('Retry-After', String(Math.ceil((rateCheck.resetAt - Date.now()) / 1000)));
-        sendJson(res, 429, {
-            error: 'Rate limit exceeded. Try again later.',
-            remaining: 0,
-            resetAt: new Date(rateCheck.resetAt).toISOString(),
-        });
-        return;
-    }
-    // Parse multipart form data
-    const contentType = req.headers['content-type'] ?? '';
-    if (!contentType.includes('multipart/form-data')) {
-        sendJson(res, 400, { error: 'Content-Type must be multipart/form-data' });
-        return;
-    }
-    const parsed = await parseMultipart(req, contentType);
-    if (!parsed) {
-        sendJson(res, 400, { error: 'Failed to parse multipart body' });
-        return;
-    }
-    const specFile = parsed.files.get('spec');
-    if (!specFile) {
-        sendJson(res, 400, { error: 'Missing "spec" file field' });
-        return;
-    }
-    // Validate file size
-    if (specFile.data.length > MAX_SPEC_SIZE) {
-        sendJson(res, 400, {
-            error: `Spec file too large (${Math.round(specFile.data.length / 1024)}KB). Maximum is 5MB.`,
-        });
-        return;
-    }
-    // Validate file type by name extension
-    const fileName = specFile.filename ?? 'spec';
-    if (!isAllowedSpecFile(fileName)) {
-        sendJson(res, 400, {
-            error: 'Invalid file type. Accepted: .yaml, .yml, .json, .har',
-        });
-        return;
-    }
-    let name = parsed.fields.get('name') ?? undefined;
-    if (name && name.length > MAX_NAME_LENGTH) {
-        name = name.slice(0, MAX_NAME_LENGTH);
-    }
-    // Strip non-printable characters from name
-    if (name) {
-        name = name.replace(/[^\x20-\x7E]/g, '');
-    }
-    // Save uploaded file to temp dir
-    await mkdir(UPLOAD_DIR, { recursive: true });
-    const tempId = randomBytes(8).toString('hex');
-    const safeExtension = getSafeExtension(fileName);
-    const specPath = join(UPLOAD_DIR, `${tempId}${safeExtension}`);
-    await writeFile(specPath, specFile.data);
-    try {
-        // Detect format
-        let format = detectFormat(specPath);
-        if (safeExtension === '.json') {
-            // Ambiguous — inspect content
-            format = await detectFormatFromContent(specPath);
-        }
-        // Build pipeline: generate project from spec
-        logger.info(`Building from ${format} spec: ${fileName}`);
-        const buildResult = await buildFromSpec(specPath, { name, format });
-        // Allocate port and generate bearer token
-        const port = ports.allocate();
-        const bearerToken = generateBearerToken();
-        const tokenHash = hashToken(bearerToken);
-        const specHash = hashSpec(specFile.data);
-        // Build Docker image
-        await buildQueue.run(() => getContainerBackend().buildImage(buildResult.buildDir, buildResult.imageName, buildResult.imageTag));
-        // Clean up build directory — image is built, source no longer needed
-        try {
-            await rm(buildResult.buildDir, { recursive: true, force: true });
-        }
-        catch {
-            // Non-critical: log and continue
-            logger.warn(`Failed to clean up build directory: ${buildResult.buildDir}`);
-        }
-        // Retrieve any stored secrets for this slug to inject as env vars
-        const secrets = await getSecretStore().getSecretsAsEnv(buildResult.slug);
-        // Start container (Playwright servers get more resources).
-        // Inject the raw bearer token so the container authenticates /mcp traffic
-        // with the same token shown to the user in the dashboard config.
-        const containerId = await getContainerBackend().startContainer({
-            slug: buildResult.slug,
-            imageName: buildResult.imageName,
-            imageTag: buildResult.imageTag,
-            envVars: { MCP_AUTH_TOKEN: bearerToken },
-            port,
-            serverType: buildResult.serverType,
-            secrets,
-        });
-        // No per-container Caddy route: routing is backend-authoritative. The Caddy
-        // wildcard sends {slug}.{domain} to this backend, which authenticates,
-        // meters, and proxies to the container. Adding a direct route here would
-        // let traffic bypass auth/quota/metering.
-        const now = new Date().toISOString();
-        const endpoint = `https://${buildResult.slug}.${domain}`;
-        const serverRecord = {
-            slug: buildResult.slug,
-            specHash,
-            containerId,
-            port,
-            bearerToken: tokenHash,
-            status: 'running',
-            toolCount: buildResult.toolCount,
-            serverType: buildResult.serverType,
-            createdAt: now,
-            lastActiveAt: now,
-        };
-        // Persist to Pg when available, always keep in-memory copy
-        store.create(serverRecord);
-        const pgStore = getPgServerStore();
-        if (pgStore) {
-            await pgStore.create(serverRecord);
-        }
-        // Initialize metrics tracking
-        metrics.init(buildResult.slug);
-        sendJson(res, 201, {
-            slug: buildResult.slug,
-            endpoint,
-            bearerToken, // Return raw token once; it's stored hashed
-            status: 'running',
-            toolCount: buildResult.toolCount,
-            claudeDesktopConfig: {
-                mcpServers: {
-                    [buildResult.slug]: {
-                        url: `${endpoint}/mcp`,
-                        headers: {
-                            Authorization: `Bearer ${bearerToken}`,
-                        },
-                    },
-                },
-            },
-        });
-    }
-    catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        logger.error(`Build failed: ${message}`);
-        sendJson(res, 500, { error: 'Build failed. Check server logs for details.' });
-    }
-    finally {
-        // Clean up uploaded file
-        try {
-            await unlink(specPath);
-        }
-        catch {
-            // Ignore cleanup errors
-        }
-    }
-}
-/**
- * GET /api/servers — List all servers.
- */
-async function handleListServers(res) {
-    const pgStore = getPgServerStore();
-    const allServers = pgStore ? await pgStore.list() : store.list();
-    const servers = allServers.map((s) => ({
-        slug: s.slug,
-        status: s.status,
-        toolCount: s.toolCount,
-        createdAt: s.createdAt,
-        lastActiveAt: s.lastActiveAt,
-    }));
-    sendJson(res, 200, { servers });
-}
-/**
- * GET /api/servers/:slug — Get server status.
- */
-async function handleGetServer(res, slug) {
-    const pgStore = getPgServerStore();
-    const record = pgStore ? await pgStore.get(slug) : store.get(slug);
-    if (!record) {
-        sendJson(res, 404, { error: `Server "${slug}" not found` });
-        return;
-    }
-    // Check live container status
-    let liveStatus = record.status;
-    if (record.containerId && record.status === 'running') {
-        try {
-            liveStatus = await getContainerBackend().getContainerStatus(record.containerId);
-            if (liveStatus !== record.status) {
-                if (pgStore) {
-                    await pgStore.update(slug, { status: liveStatus });
-                }
-                store.update(slug, { status: liveStatus });
-            }
-        }
-        catch {
-            // Docker might not be reachable; use stored status
-        }
-    }
-    sendJson(res, 200, {
-        slug: record.slug,
-        status: liveStatus,
-        toolCount: record.toolCount,
-        createdAt: record.createdAt,
-        lastActiveAt: record.lastActiveAt,
-    });
-}
-/**
- * DELETE /api/servers/:slug — Stop and remove a server.
- */
-async function handleDeleteServer(res, slug, domain) {
-    const pgStore = getPgServerStore();
-    const record = pgStore ? await pgStore.get(slug) : store.get(slug);
-    if (!record) {
-        sendJson(res, 404, { error: `Server "${slug}" not found` });
-        return;
-    }
-    // Stop container
-    if (record.containerId) {
-        try {
-            await getContainerBackend().stopContainer(record.containerId);
-        }
-        catch (err) {
-            logger.warn(`Failed to stop container for ${slug}: ${err}`);
-        }
-    }
-    // No Caddy route to remove — routing is backend-authoritative (wildcard).
-    // Release port
-    ports.release(record.port);
-    // Remove from store + metrics
-    if (pgStore) {
-        await pgStore.delete(slug);
-    }
-    store.delete(slug);
-    metrics.delete(slug);
-    sendJson(res, 200, { slug, status: 'deleted' });
-}
-/**
- * PUT /api/servers/:slug — Re-deploy with an updated spec.
- */
-async function handleUpdateServer(req, res, slug, domain) {
-    const pgStore = getPgServerStore();
-    const record = pgStore ? await pgStore.get(slug) : store.get(slug);
-    if (!record) {
-        sendJson(res, 404, { error: `Server "${slug}" not found` });
-        return;
-    }
-    // Parse multipart (same as create)
-    const contentType = req.headers['content-type'] ?? '';
-    if (!contentType.includes('multipart/form-data')) {
-        sendJson(res, 400, { error: 'Content-Type must be multipart/form-data' });
-        return;
-    }
-    const parsed = await parseMultipart(req, contentType);
-    if (!parsed) {
-        sendJson(res, 400, { error: 'Failed to parse multipart body' });
-        return;
-    }
-    const specFile = parsed.files.get('spec');
-    if (!specFile) {
-        sendJson(res, 400, { error: 'Missing "spec" file field' });
-        return;
-    }
-    if (specFile.data.length > MAX_SPEC_SIZE) {
-        sendJson(res, 400, { error: 'Spec file too large. Maximum is 5MB.' });
-        return;
-    }
-    const fileName = specFile.filename ?? 'spec';
-    if (!isAllowedSpecFile(fileName)) {
-        sendJson(res, 400, { error: 'Invalid file type. Accepted: .yaml, .yml, .json, .har' });
-        return;
-    }
-    // Check if spec actually changed
-    const newSpecHash = hashSpec(specFile.data);
-    if (newSpecHash === record.specHash) {
-        sendJson(res, 200, { slug, status: record.status, message: 'No changes detected' });
-        return;
-    }
-    if (pgStore) {
-        await pgStore.update(slug, { status: 'building' });
-    }
-    store.update(slug, { status: 'building' });
-    // Save uploaded file
-    await mkdir(UPLOAD_DIR, { recursive: true });
-    const tempId = randomBytes(8).toString('hex');
-    const safeExtension = getSafeExtension(fileName);
-    const specPath = join(UPLOAD_DIR, `${tempId}${safeExtension}`);
-    await writeFile(specPath, specFile.data);
-    try {
-        let format = detectFormat(specPath);
-        if (safeExtension === '.json') {
-            format = await detectFormatFromContent(specPath);
-        }
-        // Rebuild
-        const buildResult = await buildFromSpec(specPath, {
-            name: slug.replace(/-[a-f0-9]{4}$/, ''),
-            format,
-        });
-        // Build new image
-        await buildQueue.run(() => getContainerBackend().buildImage(buildResult.buildDir, buildResult.imageName, buildResult.imageTag));
-        // Clean up build directory
-        try {
-            await rm(buildResult.buildDir, { recursive: true, force: true });
-        }
-        catch {
-            logger.warn(`Failed to clean up build directory: ${buildResult.buildDir}`);
-        }
-        // Stop old container
-        if (record.containerId) {
-            try {
-                await getContainerBackend().stopContainer(record.containerId);
-            }
-            catch (err) {
-                logger.warn(`Failed to stop old container: ${err}`);
-            }
-        }
-        // Retrieve stored secrets for the slug
-        const secrets = await getSecretStore().getSecretsAsEnv(slug);
-        // Rotate the bearer token on re-deploy. We only store the token's hash, so
-        // the old raw token cannot be recovered to re-inject into the new container.
-        // A fresh token keeps the container authenticating and is returned below.
-        const newBearerToken = generateBearerToken();
-        const newTokenHash = hashToken(newBearerToken);
-        // Start new container on the same port (Playwright servers get more resources)
-        const containerId = await getContainerBackend().startContainer({
-            slug: buildResult.slug,
-            imageName: buildResult.imageName,
-            imageTag: buildResult.imageTag,
-            envVars: { MCP_AUTH_TOKEN: newBearerToken },
-            port: record.port,
-            serverType: buildResult.serverType,
-            secrets,
-        });
-        const updateFields = {
-            containerId,
-            specHash: newSpecHash,
-            bearerToken: newTokenHash,
-            status: 'running',
-            toolCount: buildResult.toolCount,
-            serverType: buildResult.serverType,
-            lastActiveAt: new Date().toISOString(),
-        };
-        if (pgStore) {
-            await pgStore.update(slug, updateFields);
-        }
-        store.update(slug, updateFields);
-        // The re-deploy reused the image tag, so the previous build is now dangling.
-        // Reclaim it (best-effort, non-blocking) to keep the host disk from filling.
-        void getContainerBackend().pruneDanglingImages();
-        sendJson(res, 200, {
-            slug,
-            status: 'running',
-            toolCount: buildResult.toolCount,
-            bearerToken: newBearerToken, // Rotated — update your client config
-            message: 'Re-deployed successfully. Bearer token was rotated.',
-        });
-    }
-    catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        if (pgStore) {
-            await pgStore.update(slug, { status: 'error' }).catch(() => { });
-        }
-        store.update(slug, { status: 'error' });
-        logger.error(`Re-deploy failed for ${slug}: ${message}`);
-        sendJson(res, 500, { error: 'Re-deploy failed. Check server logs for details.' });
-    }
-    finally {
-        try {
-            await unlink(specPath);
-        }
-        catch {
-            // Ignore
-        }
-    }
-}
-/**
- * GET /api/servers/:slug/logs — Stream container logs via SSE.
- */
-async function handleGetLogs(res, slug) {
-    const pgStore = getPgServerStore();
-    const record = pgStore ? await pgStore.get(slug) : store.get(slug);
-    if (!record) {
-        sendJson(res, 404, { error: `Server "${slug}" not found` });
-        return;
-    }
-    if (!record.containerId) {
-        sendJson(res, 400, { error: 'No container associated with this server' });
-        return;
-    }
-    // Set up SSE headers
-    res.writeHead(200, {
-        'Content-Type': 'text/event-stream',
-        'Cache-Control': 'no-cache',
-        Connection: 'keep-alive',
-        'X-Content-Type-Options': 'nosniff',
-        'X-Frame-Options': 'DENY',
-    });
-    try {
-        const logStream = getContainerBackend().getContainerLogs(record.containerId);
-        for await (const line of logStream) {
-            if (res.destroyed)
-                break;
-            res.write(`data: ${JSON.stringify(line)}\n\n`);
-        }
-    }
-    catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        res.write(`event: error\ndata: ${JSON.stringify({ error: message })}\n\n`);
-    }
-    res.end();
-}
-/**
- * GET /api/servers/:slug/metrics — Get usage metrics.
- */
-async function handleGetMetrics(res, slug) {
-    const pgStore = getPgServerStore();
-    const record = pgStore ? await pgStore.get(slug) : store.get(slug);
-    if (!record) {
-        sendJson(res, 404, { error: `Server "${slug}" not found` });
-        return;
-    }
-    const serverMetrics = metrics.get(slug);
-    const topTools = metrics.getTopTools(slug);
-    sendJson(res, 200, {
-        slug,
-        totalRequests: serverMetrics?.totalRequests ?? 0,
-        topTools,
-        lastActiveAt: serverMetrics?.lastActiveAt ?? record.lastActiveAt,
-        createdAt: record.createdAt,
-    });
-}
-/**
- * POST /api/webhooks/stripe — Receive Stripe webhook events.
- *
- * Reads the raw request body as a Buffer (required for signature verification),
- * then delegates to the stripe module's handleWebhookEvent.
- */
-async function handleStripeWebhook(req, res) {
-    if (!isStripeConfigured()) {
-        sendJson(res, 404, { error: 'Not found' });
-        return;
-    }
-    const signature = req.headers['stripe-signature'];
-    if (!signature || typeof signature !== 'string') {
-        sendJson(res, 400, { error: 'Missing stripe-signature header' });
-        return;
-    }
-    // Read raw body as Buffer for signature verification
-    const MAX_WEBHOOK_BODY = 1024 * 1024; // 1 MB
-    const chunks = [];
-    let totalSize = 0;
-    try {
-        for await (const chunk of req) {
-            totalSize += chunk.length;
-            if (totalSize > MAX_WEBHOOK_BODY) {
-                sendJson(res, 413, { error: 'Payload too large' });
-                return;
-            }
-            chunks.push(chunk);
-        }
-    }
-    catch {
-        sendJson(res, 400, { error: 'Failed to read request body' });
-        return;
-    }
-    const payload = Buffer.concat(chunks);
-    try {
-        await handleWebhookEvent(payload, signature);
-        sendJson(res, 200, { received: true });
-    }
-    catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        logger.error(`[stripe] Webhook error: ${message}`);
-        sendJson(res, 400, { error: 'Webhook processing failed' });
-    }
-}
-// Multipart parser and file validation re-exported from shared module
-// (used by both server.ts and web/router.ts)
-// ---------------------------------------------------------------------------
-// Time-series sampling
-// ---------------------------------------------------------------------------
-/**
- * Persist one time-series sample for the admin charts. The request/error counts
- * are PER-INTERVAL deltas read from the rolling failure tracker (last ~5 min),
- * not cumulative totals. Best-effort: a metrics write must never disrupt the
- * sampler or serving.
- */
-async function persistMetricSample(reading) {
-    try {
-        const fw = failureTracker.window(5); // ~one sampler interval
-        const pg = getPgServerStore();
-        const totalServers = pg ? (await pg.list()).length : store.list().length;
-        let totalUsers = 0;
-        try {
-            totalUsers = await countUsers();
-        }
-        catch {
-            // best-effort; leave at 0 if the count query fails
-        }
-        const samples = getMetricSampleStore();
-        await samples.record({
-            sampledAt: new Date().toISOString(),
-            requests: fw.total,
-            errors4xx: fw.c4xx,
-            errors5xx: fw.c5xx + fw.aborted,
-            activeContainers: reading.activeContainers,
-            memUsedPct: Math.round(reading.memUsedPct * 10) / 10,
-            diskUsedPct: Math.round(reading.diskUsedPct * 10) / 10,
-            totalUsers,
-            totalServers,
-        });
-        // Retain 30 days of history.
-        await samples.prune(30 * 24 * 3_600_000);
-    }
-    catch (err) {
-        logger.warn(`Failed to persist metric sample: ${err}`);
-    }
-}
-// ---------------------------------------------------------------------------
-// CLI telemetry endpoint
-// ---------------------------------------------------------------------------
-/**
- * A crash report is tiny — cap it far below the 5MB spec ceiling so a hostile
- * client can't stream junk at us.
- */
-const MAX_TELEMETRY_BODY = 64 * 1024; // 64 KB
-const TELEMETRY_FIELD_CAPS = {
-    command: 200,
-    errorMessage: 2_000,
-    stack: 16_000,
-    cliVersion: 40,
-    platform: 60,
-    nodeVersion: 40,
-};
-/**
- * POST /api/telemetry/report — Receive an opt-in CLI crash report.
- *
- * Unauthenticated by design (no secrets, no PII — the CLI redacts home-dir
- * paths and tokens before sending), but hardened against abuse:
- *   - rejects any Content-Encoding (we never decompress → no decompression bomb)
- *   - rejects oversized bodies by declared length, then again while streaming
- *   - per-IP rate limit
- *   - strict JSON whitelist with per-field truncation; unknown fields dropped
- *   - groups duplicates by a fingerprint; never logs the raw body
- */
-async function handleTelemetryReport(req, res) {
-    // These early rejections return WITHOUT draining the request body. On a
-    // keep-alive connection the unread bytes would desync the next request on the
-    // socket, so close the connection instead of trying to drain (draining the
-    // oversized case would mean reading the very body we're rejecting).
-    const rejectClosing = (status, body) => {
-        res.setHeader('Connection', 'close');
-        sendJson(res, status, body);
-    };
-    // 1. Never decompress untrusted input. Reject any encoded body outright.
-    if (req.headers['content-encoding']) {
-        rejectClosing(415, { error: 'Content-Encoding is not supported' });
-        return;
-    }
-    // 2. Reject oversized bodies up front using the (untrusted) Content-Length.
-    const declared = Number(req.headers['content-length']);
-    if (Number.isFinite(declared) && declared > MAX_TELEMETRY_BODY) {
-        rejectClosing(413, { error: 'Payload too large' });
-        return;
-    }
-    // 3. Per-IP flood cap.
-    const rate = telemetryLimiter.check(getClientIp(req));
-    if (!rate.allowed) {
-        res.setHeader('Retry-After', String(Math.ceil((rate.resetAt - Date.now()) / 1000)));
-        rejectClosing(429, { error: 'Rate limit exceeded. Try again later.' });
-        return;
-    }
-    // 4. Read the body, hard-capped regardless of the declared length.
-    let raw = '';
-    let total = 0;
-    try {
-        for await (const chunk of req) {
-            total += chunk.length;
-            if (total > MAX_TELEMETRY_BODY) {
-                rejectClosing(413, { error: 'Payload too large' });
-                return;
-            }
-            raw += chunk.toString('utf-8');
-        }
-    }
-    catch {
-        sendJson(res, 400, { error: 'Failed to read request body' });
-        return;
-    }
-    // 5. Strict parse + whitelist + per-field truncation. Unknown fields dropped.
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        sendJson(res, 400, { error: 'Invalid JSON' });
-        return;
-    }
-    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
-        sendJson(res, 400, { error: 'Invalid report' });
-        return;
-    }
-    const src = parsed;
-    const str = (v, cap) => (typeof v === 'string' ? v.slice(0, cap) : '');
-    const command = str(src.command, TELEMETRY_FIELD_CAPS.command);
-    const errorMessage = str(src.errorMessage, TELEMETRY_FIELD_CAPS.errorMessage);
-    const stack = str(src.stack, TELEMETRY_FIELD_CAPS.stack);
-    const cliVersion = str(src.cliVersion, TELEMETRY_FIELD_CAPS.cliVersion);
-    const platform = str(src.platform, TELEMETRY_FIELD_CAPS.platform);
-    const nodeVersion = str(src.nodeVersion, TELEMETRY_FIELD_CAPS.nodeVersion);
-    if (!command && !errorMessage) {
-        sendJson(res, 400, { error: 'Report must include a command or error message' });
-        return;
-    }
-    // 6. Fingerprint = command + normalized message (digits/hex collapsed) so
-    //    identical failures cluster together in the admin view.
-    const normalized = errorMessage
-        .toLowerCase()
-        .replace(/0x[0-9a-f]+/g, '')
-        .replace(/[0-9a-f]{8,}/g, '')
-        .replace(/\d+/g, 'n');
-    const fingerprint = createHash('sha256')
-        .update(`${command}|${normalized}`)
-        .digest('hex')
-        .slice(0, 16);
-    // Hash the client IP for abuse correlation without storing the raw address.
-    const clientIp = createHash('sha256').update(getClientIp(req)).digest('hex').slice(0, 16);
-    try {
-        await getTelemetryStore().save({
-            receivedAt: new Date().toISOString(),
-            clientIp,
-            cliVersion,
-            platform,
-            nodeVersion,
-            command,
-            errorMessage,
-            stack,
-            fingerprint,
-        });
-    }
-    catch (err) {
-        // Never echo the body back; just log that a save failed.
-        logger.warn(`Failed to store telemetry report: ${err}`);
-    }
-    sendJson(res, 202, { received: true });
-}
-// ---------------------------------------------------------------------------
-// Utilities
-// ---------------------------------------------------------------------------
-function sendJson(res, status, body) {
-    const payload = JSON.stringify(body);
-    res.writeHead(status, {
-        'Content-Type': 'application/json',
-        'Content-Length': Buffer.byteLength(payload),
-        'X-Content-Type-Options': 'nosniff',
-        'X-Frame-Options': 'DENY',
-    });
-    res.end(payload);
-}
-/**
- * Authenticate a request using bearer token for a specific server slug.
- * Falls back to cookie-based session auth if no Authorization header is present.
- * This fallback is needed because EventSource (used by htmx SSE) cannot set custom headers.
- */
-async function authenticateRequest(req, res, slug) {
-    const pgStore = getPgServerStore();
-    const record = pgStore ? await pgStore.get(slug) : store.get(slug);
-    if (!record) {
-        sendJson(res, 404, { error: 'Server not found' });
-        return false;
-    }
-    // Try bearer token auth first
-    const authHeader = req.headers.authorization;
-    if (authHeader && authHeader.startsWith('Bearer ')) {
-        const token = authHeader.slice(7);
-        if (verifyToken(token, record.bearerToken)) {
-            return true;
-        }
-        sendJson(res, 403, { error: 'Invalid bearer token' });
-        return false;
-    }
-    // Fallback: cookie-based session auth (uses Pg-aware helpers)
-    const sessionToken = getSessionToken(req);
-    if (sessionToken) {
-        const session = await getSession(sessionToken);
-        if (session && session.userId !== '__anon__') {
-            const user = await getUserById(session.userId);
-            if (user && record.userId && record.userId === user.id) {
-                return true;
-            }
-        }
-    }
-    sendJson(res, 401, { error: 'Missing or invalid Authorization header' });
-    return false;
-}
-/**
- * Authenticate admin requests using ADMIN_TOKEN environment variable.
- */
-function authenticateAdmin(req, res) {
-    const adminToken = process.env.ADMIN_TOKEN;
-    if (!adminToken) {
-        sendJson(res, 403, { error: 'Admin access not configured (set ADMIN_TOKEN)' });
-        return false;
-    }
-    const authHeader = req.headers.authorization;
-    if (!authHeader || !authHeader.startsWith('Bearer ')) {
-        sendJson(res, 401, { error: 'Missing or invalid Authorization header' });
-        return false;
-    }
-    const token = authHeader.slice(7);
-    const tokenBuf = Buffer.from(token);
-    const adminBuf = Buffer.from(adminToken);
-    if (tokenBuf.length !== adminBuf.length || !timingSafeEqual(tokenBuf, adminBuf)) {
-        sendJson(res, 403, { error: 'Invalid admin token' });
-        return false;
-    }
-    return true;
-}
-// File validation functions from shared module
-// ---------------------------------------------------------------------------
-// CLI entry point (when run directly)
-// ---------------------------------------------------------------------------
-const isDirectRun = process.argv[1]?.endsWith('cloud/server.js') || process.argv[1]?.endsWith('cloud/server.ts');
-if (isDirectRun) {
-    const port = parseInt(process.env.PORT ?? String(DEFAULT_PORT), 10);
-    const domain = process.env.DOMAIN ?? DEFAULT_DOMAIN;
-    startServer(port, domain).catch((err) => {
-        logger.error(`Failed to start server: ${err}`);
-        process.exit(1);
-    });
-}