syndes 0.1.0

package/dashboard/auth.mjs

@@ -0,0 +1,235 @@
+/**
+ * Who may open the dashboard.
+ *
+ * Three modes, in order of how much they ask of the user:
+ *
+ *   open    (default) Nothing to remember. `syndes dashboard` mints a
+ *           launch token, opens the browser with it, and the token is exchanged
+ *           for a session cookie on first load. Anyone who did not run the
+ *           command does not have the token — the same model Jupyter uses.
+ *   system  The OS asks. Touch ID on a Mac, falling back to the login password.
+ *   pin     A short PIN the user sets, for machines with no biometric.
+ *
+ * A password nobody chose is not security, it is friction, so there is no
+ * password mode at all. What actually keeps this port private is that it binds
+ * loopback and refuses any request whose Host is not a literal loopback address
+ * — see security.mjs. Auth is the second lock, for other users on a shared machine.
+ */
+
+import { scryptSync, randomBytes, timingSafeEqual, createHmac } from 'node:crypto';
+import { readFileSync, writeFileSync, existsSync, mkdirSync, renameSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { authFile } from '../runtime/paths.mjs';
+import * as systemAuth from '../src/systemauth.mjs';
+
+const PARAMS = { N: 16384, r: 8, p: 1, keylen: 64, maxmem: 64 * 1024 * 1024 };
+const SESSION_MS = 12 * 60 * 60 * 1000;
+const FREE_ATTEMPTS = 5;
+const MAX_LOCKOUT_MS = 10 * 60 * 1000;
+
+export const MODES = ['open', 'system', 'pin'];
+
+/** Lives only in this process: a launch token dies with the server that made it. */
+let launchToken = null;
+
+// ── Stored state ───────────────────────────────────────────────────────────
+
+export function loadAuth() {
+  try {
+    return JSON.parse(readFileSync(authFile, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function saveAuth(auth) {
+  mkdirSync(dirname(authFile), { recursive: true });
+  const staging = `${authFile}.tmp`;
+  writeFileSync(staging, `${JSON.stringify(auth, null, 2)}\n`, { mode: 0o600 });
+  renameSync(staging, authFile);
+  return auth;
+}
+
+/** Every install has a cookie secret, whatever the mode. */
+function ensureAuth() {
+  const existing = loadAuth();
+  if (existing?.secret) return existing;
+  return saveAuth({
+    mode: existing?.mode ?? 'open',
+    secret: randomBytes(32).toString('hex'),
+    sessionEpoch: (existing?.sessionEpoch ?? 0) + 1,
+    attempts: { count: 0, until: 0 },
+    ...(existing?.pin ? { pin: existing.pin } : {}),
+  });
+}
+
+export function mode() {
+  return loadAuth()?.mode ?? 'open';
+}
+
+/**
+ * @param {'open'|'system'|'pin'} next
+ * @param {{pin?: string}} options
+ */
+export function setMode(next, { pin } = {}) {
+  if (!MODES.includes(next)) throw new Error(`unknown mode: ${next}`);
+
+  const auth = ensureAuth();
+
+  if (next === 'system') {
+    // Build now, not at first unlock: a ninety-second compile in front of the
+    // unlock screen is indistinguishable from a hang.
+    const ready = systemAuth.prepare();
+    if (!ready.ok) throw new Error(ready.reason);
+  }
+
+  if (next === 'pin') {
+    if (!/^\d{4,12}$/.test(String(pin ?? ''))) throw new Error('a PIN must be 4 to 12 digits');
+    const salt = randomBytes(16);
+    auth.pin = {
+      salt: salt.toString('hex'),
+      hash: scryptSync(String(pin), salt, PARAMS.keylen, PARAMS).toString('hex'),
+      params: { N: PARAMS.N, r: PARAMS.r, p: PARAMS.p, keylen: PARAMS.keylen },
+    };
+  } else {
+    delete auth.pin;
+  }
+
+  auth.mode = next;
+  // Changing how the door locks signs out everyone already inside.
+  auth.sessionEpoch = (auth.sessionEpoch ?? 0) + 1;
+  auth.secret = randomBytes(32).toString('hex');
+  auth.attempts = { count: 0, until: 0 };
+  saveAuth(auth);
+  return auth.mode;
+}
+
+// ── Launch token ───────────────────────────────────────────────────────────
+
+/** Minted per server start. Printed by the CLI and put in the opened URL. */
+export function mintLaunchToken() {
+  ensureAuth();
+  launchToken = randomBytes(24).toString('base64url');
+  return launchToken;
+}
+
+/**
+ * Exchange the launch token for a session.
+ *
+ * Only valid in `open` mode: in system or pin mode the user asked to be asked,
+ * and a URL that walks straight past that would quietly undo their choice.
+ */
+export function consumeLaunchToken(candidate) {
+  if (mode() !== 'open') return false;
+  if (!launchToken || typeof candidate !== 'string') return false;
+  if (candidate.length !== launchToken.length) return false;
+  return timingSafeEqual(Buffer.from(candidate), Buffer.from(launchToken));
+}
+
+// ── Unlocking ──────────────────────────────────────────────────────────────
+
+/** @returns {{ok: boolean, reason: string|null, retryAfterMs: number}} */
+export function verifyPin(candidate) {
+  const auth = loadAuth();
+  if (!auth?.pin) return { ok: false, reason: 'no PIN set', retryAfterMs: 0 };
+
+  const now = Date.now();
+  const until = auth.attempts?.until ?? 0;
+  if (now < until) return { ok: false, reason: 'too many attempts', retryAfterMs: until - now };
+
+  const params = { ...PARAMS, ...(auth.pin.params ?? {}) };
+  let matches = false;
+  try {
+    const attempt = scryptSync(String(candidate ?? ''), Buffer.from(auth.pin.salt, 'hex'), params.keylen, params);
+    const stored = Buffer.from(auth.pin.hash, 'hex');
+    matches = attempt.length === stored.length && timingSafeEqual(attempt, stored);
+  } catch {
+    matches = false;
+  }
+
+  if (matches) {
+    auth.attempts = { count: 0, until: 0 };
+    saveAuth(auth);
+    return { ok: true, reason: null, retryAfterMs: 0 };
+  }
+
+  const count = (auth.attempts?.count ?? 0) + 1;
+  const over = Math.max(0, count - FREE_ATTEMPTS);
+  const lockout = over ? Math.min(MAX_LOCKOUT_MS, 1000 * 2 ** over) : 0;
+  auth.attempts = { count, until: lockout ? now + lockout : 0 };
+  saveAuth(auth);
+  return { ok: false, reason: 'wrong PIN', retryAfterMs: lockout };
+}
+
+export async function verifySystem() {
+  return systemAuth.authenticate('open your dashboard');
+}
+
+export function systemAvailable() {
+  return systemAuth.available();
+}
+
+// ── Session cookie ─────────────────────────────────────────────────────────
+
+export function issueToken(now = Date.now()) {
+  const auth = ensureAuth();
+  const payload = { exp: now + SESSION_MS, epoch: auth.sessionEpoch ?? 0, nonce: randomBytes(9).toString('base64url') };
+  const body = Buffer.from(JSON.stringify(payload)).toString('base64url');
+  return `${body}.${sign(body, auth.secret)}`;
+}
+
+export function verifyToken(token) {
+  const auth = loadAuth();
+  if (!auth?.secret) return { ok: false, reason: 'not initialised' };
+  if (typeof token !== 'string' || !token.includes('.')) return { ok: false, reason: 'malformed' };
+
+  const [body, signature] = token.split('.');
+  if (!safeEqual(signature, sign(body, auth.secret))) return { ok: false, reason: 'bad signature' };
+
+  let payload;
+  try {
+    payload = JSON.parse(Buffer.from(body, 'base64url').toString('utf8'));
+  } catch {
+    return { ok: false, reason: 'malformed' };
+  }
+
+  if (Date.now() > (payload.exp ?? 0)) return { ok: false, reason: 'expired' };
+  if ((payload.epoch ?? -1) !== (auth.sessionEpoch ?? 0)) return { ok: false, reason: 'revoked' };
+  return { ok: true, reason: null };
+}
+
+export function revokeSessions() {
+  const auth = ensureAuth();
+  auth.sessionEpoch = (auth.sessionEpoch ?? 0) + 1;
+  saveAuth(auth);
+  return true;
+}
+
+export function lockoutState() {
+  const auth = loadAuth();
+  const until = auth?.attempts?.until ?? 0;
+  return { attempts: auth?.attempts?.count ?? 0, lockedFor: Math.max(0, until - Date.now()) };
+}
+
+/** What the unlock screen needs to know before it renders anything. */
+export function describe() {
+  const current = mode();
+  const probe = systemAuth.available();
+  return {
+    mode: current,
+    system: { available: probe.available, method: probe.method, reason: probe.reason },
+    locked: current !== 'open',
+    lockout: lockoutState(),
+  };
+}
+
+function sign(body, secret) {
+  return createHmac('sha256', Buffer.from(secret, 'hex')).update(body).digest('base64url');
+}
+
+function safeEqual(a, b) {
+  if (typeof a !== 'string' || typeof b !== 'string' || a.length !== b.length) return false;
+  return timingSafeEqual(Buffer.from(a), Buffer.from(b));
+}
+
+export { SESSION_MS, ensureAuth };

package/dashboard/router.mjs

@@ -0,0 +1,55 @@
+/**
+ * Method + path → handler.
+ *
+ * The default is DENY: a route is authenticated unless it explicitly opts out.
+ * The alternative — listing what to protect — means every new endpoint is public
+ * until someone remembers, and someone eventually does not.
+ */
+
+import { verifyToken } from './auth.mjs';
+import { parseCookies, COOKIE_NAME } from './security.mjs';
+import * as api from './api/index.mjs';
+
+/** The only routes reachable without a session. */
+const PUBLIC = new Set([
+  'GET /api/status',      // the unlock screen needs to know which lock it is
+  'GET /api/unlock',      // what unlock methods exist
+  'POST /api/unlock',     // perform the unlock
+  'POST /api/logout',
+]);
+
+export const ROUTES = {
+  'GET /api/unlock': api.unlockOptions,
+  'POST /api/unlock': api.unlock,
+  'POST /api/logout': api.logout,
+  'GET /api/status': api.status,
+  'GET /api/overview': api.overview,
+  'GET /api/sessions': api.sessions,
+  'GET /api/session': api.sessionDetail,
+  'GET /api/tools': api.tools,
+  'GET /api/projects': api.projects,
+  'GET /api/timeline': api.timeline,
+  'GET /api/practices': api.practices,
+  'POST /api/practices': api.practiceAction,
+  'GET /api/ledger': api.ledger,
+  'GET /api/verify': api.verifyChain,
+  'GET /api/config': api.readConfig,
+  'POST /api/config': api.writeConfig,
+  'POST /api/auth': api.setAuthMode,
+  'GET /api/export': api.exportData,
+};
+
+export function isPublic(key) {
+  return PUBLIC.has(key);
+}
+
+export function authenticate(req) {
+  const token = parseCookies(req)[COOKIE_NAME];
+  if (!token) return { ok: false, reason: 'no session' };
+  return verifyToken(token);
+}
+
+export function resolveRoute(method, pathname) {
+  const key = `${method} ${pathname}`;
+  return { key, handler: ROUTES[key] ?? null };
+}

package/dashboard/security.mjs

@@ -0,0 +1,95 @@
+/**
+ * The checks that run before the router sees a request.
+ *
+ * The one that matters most is the Host check. A page on any website can make
+ * requests to 127.0.0.1 — and with a DNS rebinding trick, can do it with its own
+ * origin attached. Binding to loopback is not, by itself, a security boundary.
+ * Requiring the Host header to be a literal loopback address closes it, because
+ * a rebound name arrives with the attacker's hostname in Host.
+ */
+
+const LOOPBACK = new Set(['127.0.0.1', 'localhost', '[::1]', '::1']);
+
+export function hostAllowed(req, port) {
+  const host = req.headers.host;
+  if (!host) return false;
+
+  const index = host.lastIndexOf(':');
+  const name = index > 0 && !host.endsWith(']') ? host.slice(0, index) : host;
+  const declared = index > 0 && !host.endsWith(']') ? host.slice(index + 1) : '';
+
+  if (!LOOPBACK.has(name)) return false;
+  return declared === '' || declared === String(port);
+}
+
+/**
+ * Cross-origin requests are refused outright.
+ *
+ * Nothing legitimate reaches this server from another origin: the UI is served
+ * from the same port and there is no public API to embed.
+ */
+export function originAllowed(req, port) {
+  const origin = req.headers.origin;
+  if (!origin) return true; // same-origin navigations and curl send none
+
+  try {
+    const url = new URL(origin);
+    return LOOPBACK.has(url.hostname) && (url.port === String(port) || url.port === '');
+  } catch {
+    return false;
+  }
+}
+
+/** Applied to every response, including errors. */
+export function securityHeaders(extra = {}) {
+  return {
+    'Content-Security-Policy': [
+      "default-src 'self'",
+      "script-src 'self'",
+      "style-src 'self' 'unsafe-inline'",
+      "img-src 'self' data:",
+      "font-src 'self'",
+      "connect-src 'self'",
+      "frame-ancestors 'none'",
+      "base-uri 'none'",
+      "form-action 'self'",
+    ].join('; '),
+    'X-Content-Type-Options': 'nosniff',
+    'X-Frame-Options': 'DENY',
+    'Referrer-Policy': 'no-referrer',
+    'Cross-Origin-Opener-Policy': 'same-origin',
+    'Cross-Origin-Resource-Policy': 'same-origin',
+    // No caching of metrics: a payload cached past a logout is a leak, and this
+    // is a loopback server where caching buys nothing anyway.
+    'Cache-Control': 'no-store, no-cache, must-revalidate',
+    ...extra,
+  };
+}
+
+export function parseCookies(req) {
+  const header = req.headers.cookie;
+  if (!header) return {};
+
+  const out = {};
+  for (const part of header.split(';')) {
+    const index = part.indexOf('=');
+    if (index === -1) continue;
+    out[part.slice(0, index).trim()] = decodeURIComponent(part.slice(index + 1).trim());
+  }
+  return out;
+}
+
+/**
+ * The session cookie.
+ *
+ * No `Secure`: this is http on loopback, and setting it would make the cookie
+ * silently never sent, which is a worse failure than the one it guards against.
+ * SameSite=Strict is what actually protects it here.
+ */
+export function sessionCookie(token, { clear = false } = {}) {
+  const attributes = ['Path=/', 'HttpOnly', 'SameSite=Strict'];
+  if (clear) attributes.push('Max-Age=0');
+  return `syndes_session=${clear ? '' : encodeURIComponent(token)}; ${attributes.join('; ')}`;
+}
+
+export const COOKIE_NAME = 'syndes_session';

package/dashboard/server.mjs

@@ -0,0 +1,156 @@
+/**
+ * `syndes dashboard` — node:http on 127.0.0.1, zero dependencies.
+ *
+ * Binds the literal 127.0.0.1, never the string "localhost": on some Windows
+ * setups that resolves to ::1 first, and the listener then silently misses every
+ * request while appearing to have started fine.
+ *
+ * The server is READ-ONLY over the ledger. It can write config and coach state.
+ * It can never append a record — one writer, forever, and that writer is the
+ * worker. See CLAUDE.md rule 3.
+ */
+
+import { createServer } from 'node:http';
+import { loadConfig } from '../runtime/config.mjs';
+import { mintLaunchToken, consumeLaunchToken, issueToken, mode as authMode } from './auth.mjs';
+import { hostAllowed, originAllowed, securityHeaders, sessionCookie } from './security.mjs';
+import { resolveRoute, isPublic, authenticate } from './router.mjs';
+import { serveStatic } from './static.mjs';
+import { debug } from '../runtime/log.mjs';
+
+const HOST = '127.0.0.1';
+/** A request body larger than this is not a request we serve. */
+const MAX_BODY = 256 * 1024;
+
+/**
+ * @returns {Promise<{url, port, close, server}>}
+ */
+export async function startServer({ port, idleTimeoutMinutes } = {}) {
+  const config = loadConfig();
+  const chosen = port ?? config.dashboard.port;
+  const idleMs = (idleTimeoutMinutes ?? config.dashboard.idleTimeoutMinutes) * 60_000;
+
+  // The port the handler validates against must be the port actually BOUND, not
+  // the one requested. They differ whenever 0 is passed to get an ephemeral
+  // port, and using the requested one makes every Host check fail with a 403
+  // that looks exactly like an attack being blocked.
+  let boundPort = chosen;
+
+  const server = createServer((req, res) => { handle(req, res, boundPort).catch((error) => {
+    debug('request failed', error?.stack ?? String(error));
+    send(res, 500, { error: 'internal error' });
+  }); });
+
+  let idleTimer = null;
+  const touch = () => {
+    if (!idleMs) return;
+    clearTimeout(idleTimer);
+    // A forgotten dashboard should not be left listening for a week.
+    idleTimer = setTimeout(() => { server.close(); }, idleMs);
+    idleTimer.unref();
+  };
+  server.on('request', touch);
+
+  await new Promise((resolve, reject) => {
+    server.once('error', reject);
+    server.listen(chosen, HOST, resolve);
+  });
+  boundPort = server.address().port;
+  touch();
+
+  const token = mintLaunchToken();
+  const base = `http://${HOST}:${server.address().port}`;
+  const url = authMode() === 'open' ? `${base}/?t=${token}` : base;
+  return {
+    url,
+    base,
+    port: server.address().port,
+    server,
+    close: () => new Promise((resolve) => { clearTimeout(idleTimer); server.close(resolve); }),
+  };
+}
+
+async function handle(req, res, port) {
+  // Rebinding defence first, before anything reads the path or a cookie.
+  if (!hostAllowed(req, port)) return send(res, 403, { error: 'host not allowed' });
+  if (!originAllowed(req, port)) return send(res, 403, { error: 'cross-origin request refused' });
+
+  const url = new URL(req.url, `http://${HOST}:${port}`);
+
+  // `?t=` is the launch token the CLI put in the URL it opened. Exchange it for
+  // a cookie and redirect, so the token never survives in the address bar, in
+  // history, or in a screenshot of the browser.
+  const launch = url.searchParams.get('t');
+  if (launch && consumeLaunchToken(launch)) {
+    res.writeHead(302, {
+      ...securityHeaders(),
+      'Set-Cookie': sessionCookie(issueToken()),
+      Location: url.pathname + url.hash,
+    });
+    res.end();
+    return undefined;
+  }
+
+  const { key, handler } = resolveRoute(req.method, url.pathname);
+
+  if (handler) {
+    if (!isPublic(key)) {
+      const session = authenticate(req);
+      if (!session.ok) return send(res, 401, { error: 'not signed in', reason: session.reason });
+    }
+
+    const body = req.method === 'POST' ? await readBody(req) : null;
+    if (body === undefined) return send(res, 413, { error: 'body too large' });
+
+    const result = await handler({ req, res, url, body, port });
+    if (res.writableEnded) return undefined;
+    return send(res, result?.status ?? 200, result?.data ?? result, result?.headers);
+  }
+
+  if (url.pathname.startsWith('/api/')) return send(res, 404, { error: 'no such endpoint' });
+
+  // Everything else is the UI. An unknown path falls back to the shell so the
+  // client-side router owns its own history.
+  const file = (await serveStatic(url.pathname)) ?? (await serveStatic('/index.html'));
+  if (!file) {
+    return send(res, 503, { error: 'the dashboard UI is missing', hint: 'reinstall with: syndes install' });
+  }
+
+  res.writeHead(200, { ...securityHeaders(), 'Content-Type': file.type });
+  res.end(file.body);
+  return undefined;
+}
+
+function readBody(req) {
+  return new Promise((resolve) => {
+    const chunks = [];
+    let size = 0;
+    req.on('data', (chunk) => {
+      size += chunk.length;
+      if (size > MAX_BODY) { resolve(undefined); req.destroy(); return; }
+      chunks.push(chunk);
+    });
+    req.on('end', () => {
+      if (!chunks.length) return resolve({});
+      try {
+        resolve(JSON.parse(Buffer.concat(chunks).toString('utf8')));
+      } catch {
+        resolve({});
+      }
+    });
+    req.on('error', () => resolve({}));
+  });
+}
+
+function send(res, status, data, extra = {}) {
+  if (res.writableEnded) return;
+  const body = JSON.stringify(data ?? {});
+  res.writeHead(status, {
+    ...securityHeaders(extra),
+    'Content-Type': 'application/json; charset=utf-8',
+    'Content-Length': Buffer.byteLength(body),
+  });
+  res.end(body);
+}
+
+export { HOST };

package/dashboard/static.mjs

@@ -0,0 +1,47 @@
+/**
+ * Serves dashboard/web from disk.
+ *
+ * The path check resolves first and confirms containment before opening
+ * anything: a URL like /../../../.claude/ledger/keys/chain.key must not resolve
+ * to a file, and checking the raw string for ".." is not sufficient because
+ * encodings and symlinks get around it.
+ */
+
+import { readFile, stat } from 'node:fs/promises';
+import { join, resolve, extname, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { dirname } from 'node:path';
+
+const WEB_ROOT = resolve(join(dirname(fileURLToPath(import.meta.url)), 'web'));
+
+const TYPES = {
+  '.html': 'text/html; charset=utf-8',
+  '.js': 'text/javascript; charset=utf-8',
+  '.mjs': 'text/javascript; charset=utf-8',
+  '.css': 'text/css; charset=utf-8',
+  '.json': 'application/json; charset=utf-8',
+  '.svg': 'image/svg+xml',
+  '.png': 'image/png',
+  '.woff2': 'font/woff2',
+  '.ico': 'image/x-icon',
+};
+
+/** @returns {Promise<{body: Buffer, type: string}|null>} */
+export async function serveStatic(pathname) {
+  const relative = pathname === '/' ? 'index.html' : decodeURIComponent(pathname).replace(/^\/+/, '');
+  const target = resolve(join(WEB_ROOT, relative));
+
+  // Containment: the resolved path must sit inside WEB_ROOT, not merely start
+  // with a string that looks like it (WEB_ROOT + separator, not WEB_ROOT).
+  if (target !== WEB_ROOT && !target.startsWith(WEB_ROOT + sep)) return null;
+
+  try {
+    const info = await stat(target);
+    if (!info.isFile()) return null;
+    return { body: await readFile(target), type: TYPES[extname(target)] ?? 'application/octet-stream' };
+  } catch {
+    return null;
+  }
+}
+
+export { WEB_ROOT };

package/dashboard/web/api.js

@@ -0,0 +1,80 @@
+/**
+ * The fetch wrapper. One place for auth handling, errors and the in-flight flag.
+ *
+ * `credentials: 'same-origin'` is explicit rather than assumed: the session
+ * cookie is the entire authentication story, and a default that changes between
+ * browsers would silently log everyone out.
+ */
+
+const listeners = new Set();
+let inFlight = 0;
+
+export function onBusy(callback) {
+  listeners.add(callback);
+  return () => listeners.delete(callback);
+}
+
+function setBusy(delta) {
+  inFlight = Math.max(0, inFlight + delta);
+  for (const listener of listeners) listener(inFlight > 0);
+}
+
+/** Thrown for any non-2xx, carrying the status so callers can act on 401. */
+export class ApiError extends Error {
+  constructor(status, body) {
+    super(body?.error ?? `request failed (${status})`);
+    this.status = status;
+    this.body = body ?? {};
+  }
+}
+
+async function request(path, options = {}) {
+  setBusy(1);
+  try {
+    const response = await fetch(path, {
+      credentials: 'same-origin',
+      headers: options.body ? { 'content-type': 'application/json' } : undefined,
+      ...options,
+    });
+
+    const text = await response.text();
+    let body = null;
+    try { body = text ? JSON.parse(text) : null; } catch { body = { raw: text }; }
+
+    if (!response.ok) throw new ApiError(response.status, body);
+    return body;
+  } finally {
+    setBusy(-1);
+  }
+}
+
+export const get = (path) => request(path);
+export const post = (path, data) => request(path, { method: 'POST', body: JSON.stringify(data ?? {}) });
+
+// ── Endpoints, named so views never build URLs by hand ────────────────────
+
+export const api = {
+  status: () => get('/api/status'),
+  unlockOptions: () => get('/api/unlock'),
+  unlock: (pin) => post('/api/unlock', pin ? { pin } : {}),
+  logout: () => post('/api/logout'),
+  setAuth: (mode, pin) => post('/api/auth', { mode, pin }),
+
+  overview: (range) => get(`/api/overview?range=${encodeURIComponent(range)}`),
+  sessions: (range) => get(`/api/sessions?range=${encodeURIComponent(range)}`),
+  session: (id) => get(`/api/session?id=${encodeURIComponent(id)}`),
+  tools: (range) => get(`/api/tools?range=${encodeURIComponent(range)}`),
+  projects: (range) => get(`/api/projects?range=${encodeURIComponent(range)}`),
+  timeline: (range) => get(`/api/timeline?range=${encodeURIComponent(range)}`),
+
+  practices: () => get('/api/practices'),
+  practiceAction: (action, rule, ms) => post('/api/practices', { action, rule, ms }),
+
+  ledger: (params = {}) => get(`/api/ledger?${new URLSearchParams(params)}`),
+  verify: (full) => get(`/api/verify${full ? '?full=1' : ''}`),
+
+  config: () => get('/api/config'),
+  saveConfig: (updates) => post('/api/config', { updates }),
+
+  exportUrl: (format, range) => `/api/export?format=${format}&range=${encodeURIComponent(range)}`,
+};