feat(apps): добавить MikrotikManager app id mm

Регистрация mm в каталоге приложений, permissions mm:*, target-app и docs. Co-authored-by: Cursor <cursoragent@cursor.com>
test(app-switcher): add tests for CDN app integration
2026-09-04 20:38:27 +07:00 · 2026-09-04 14:18:00 +07:00 · 2026-09-04 14:11:34 +07:00 · 2026-08-19 20:03:54 +07:00
26 changed files with 557 additions and 57 deletions
@@ -5,7 +5,7 @@ user-invocable: false
 allowed-tools: Bash(npx shadcn@latest *), Bash(pnpm dlx shadcn@latest *), Bash(bunx --bun shadcn@latest *)
 ---

-> **ReUI skill version `668fb463eb`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
+> **ReUI skill version `3bdbad788a`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.

 # ReUI for Agents

@@ -1,6 +1,6 @@
 # ReUI components

-The 20 ReUI building blocks: `alert`, `autocomplete`, `badge`, `data-grid`, `date-selector`, `event-calendar`, `filters`, `frame`, `gantt`, `icon-stack`, `icon-tile`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.
+The 21 ReUI building blocks: `alert`, `autocomplete`, `badge`, `cascader`, `data-grid`, `date-selector`, `event-calendar`, `filters`, `frame`, `gantt`, `icon-stack`, `icon-tile`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.

 **Rule one: never guess a component's API. Read it first.** Call **`get_component(name)`** for its inline `api` (props + usage, no web fetch), and **share the result's `docsUrl`** (the component's API documentation page) with the user whenever you work with that component's API, so they have the full reference (the `/llms.txt` index is a further fallback). Then call **`get_examples(name)`** to install a worked example and copy real composition. The contracts below are first-try orientation (required props, composition shape, the one gotcha); the inline `api` is the full reference. No single block fits? Compose: search the components you need, read each `get_component`, install a `get_examples` example per component, and adapt.

@@ -106,22 +106,60 @@ Common mistakes:

 ## filters

-**Required:** `filters` (`Filter[]`), `fields` (`FilterFieldConfig[]`), `onChange`
+**Required:** `fields` (`FilterField[]`). The value is ONE `FilterQuery` tree - `query` + `onQueryChange`, or uncontrolled `defaultQuery`.
 **Shape:**

 ```tsx
-const [filters, setFilters] = useState<Filter[]>([
-  createFilter("priority", "is_any_of", ["low"]),
-])
-const fields: FilterFieldConfig[] = [
-  { key: "priority", label: "Priority", type: "multiselect",
-    options: [{ value: "low", label: "Low" }, { value: "high", label: "High" }] },
+const fields: FilterField[] = [
+  { id: "title", label: "Title", type: "text" },
+  {
+    id: "status",
+    label: "Status",
+    type: "select",
+    options: [
+      { value: "active", label: "Active" },
+      { value: "archived", label: "Archived" },
+    ],
+  },
 ]
+const [query, setQuery] = useState<FilterQuery>(() => createFilterQuery())

-<Filters filters={filters} fields={fields} onChange={setFilters} />
+<Filters fields={fields} query={query} onQueryChange={setQuery} />
 ```

-**Gotcha:** always build initial filters with `createFilter(field, operator, values)` - it generates the required `id`. Never hand-construct a `Filter` object. Pairs naturally with `data-grid`.
+**Gotcha:** the state is a TREE, not a list of chips. `FilterQuery` is a group of rules joined by `and`/`or` and a group may hold another group, so `(A and B) or C` is expressible; a rule is `{ id, type: "rule", path: ["status"], operator, value }` and `path` is the whole nested attribute path, root first. The pre-rewrite API is GONE: there is no `filters`/`onChange` prop, no `FilterFieldConfig` (fields are `FilterField`, nested through their own `fields`, keyed `id` not `key`), and no `createFilter()` - it minted ids inside a pure function and broke hydration, so ids now come from `createFilterIdFactory(seed)` seeded off `useId`, and `createFilterQuery()` / `createFilterRule()` take one. Read the query back with `flattenFilterConditions` (`{ path, field, operator, values, negated }` per rule, incomplete rules skipped) and walk the tree yourself when the parentheses carry meaning - the primitive compiles nothing, no SQL, no query string.
+
+`variant` picks the chrome over that one query: `"basic"`, the default, is the flat chip row for a toolbar over a table; `"advanced"` is the condition builder, hung off a trigger or rendered in place with `advancedMode="inline"`. Both read and write the same tree, so a saved view built in one opens in the other. Other props worth knowing before you hand-roll them: `size` is two rungs, `"sm" | "default"`, resolved per style (there is no `lg`); `reorderable` turns on drag and Alt+Arrow row moves in the builder; `onBeforeQueryChange` is the ONE veto point for every write (return `false` to refuse, it cannot rewrite); `editors` registers custom value editors a field selects by `editor` name; `labels` / `operatorLabels` own every rendered string; `pathCollapse` + `maxPathSegments` shorten deep attribute paths; `renderChip` / `renderValue` / `renderEmpty` replace rendered parts. On a field, `loadOptions` supplies async options with paging and `resolveValues` renders a chip restored from a saved view whose option was never loaded. Pairs naturally with `data-grid`.
+
+## cascader
+
+**Required:** `items` (a tree of `{ value, label, children? }`), plus the panel parts inside `CascaderContent`.
+**Shape:**
+
+```tsx
+<Cascader items={items} value={value} onValueChange={setValue}>
+  <CascaderTrigger render={<Button variant="outline" />}>
+    <CascaderValue placeholder="Select an attribute" />
+  </CascaderTrigger>
+  <CascaderContent className="w-80">
+    <CascaderPanel>
+      <CascaderNav>
+        <CascaderBreadcrumb />
+        <CascaderInput />
+      </CascaderNav>
+      <CascaderEmpty />
+      <CascaderList maxHeight={288}>
+        <CascaderItems />
+      </CascaderList>
+      <CascaderStatus />
+    </CascaderPanel>
+  </CascaderContent>
+</Cascader>
+```
+
+**Gotcha:** pressing a branch NAVIGATES, it does not select - only leaves are selectable until you pass `selectable="any"` or a predicate, and once a branch is selectable its chevron becomes the only way to open it. `CascaderInput` must stay inside `CascaderContent` (Base UI refills the query from the selection when the input sits outside the popup). Always include `CascaderStatus`: it is the live region announcing level changes, which the visual breadcrumb does not provide to screen readers. Accepts a flat adjacency list via `getParent` as well as nested `children`. `searchScope="deep"` searches every level and annotates results with their path; `multiple` gives checkbox rows; `inline` + a bare `CascaderPanel` embeds it with no popover.
+
+The shape above is `mode="drill"`, the default. `mode="tree"` keeps the same parts (drop `CascaderBreadcrumb`, pass `showBack={false}`, drive expansion with `expanded`/`onExpandedChange`); `mode="columns"` REPLACES `CascaderList` + `CascaderItems` with a single `CascaderColumns`, and has no breadcrumb. Other props worth knowing before you hand-roll them: `cascade` (multi-select only, parent/child selection with indeterminate branches - pair it with `selectable="any"`, since a leaf-only tree can never cascade), `indicator={false}` to drop the single-select check and its gutter (visual only, no-op with `multiple`), `virtualize`/`virtualizeThreshold` plus `CascaderVirtualItems` for long levels, and `getChildren` for async levels with cursor paging, retry on failure and optional `prefetch`. `CascaderFooter` pins commands below the list (`actions` is the quick path) and `CascaderSubmenu` opens one as a side-anchored flyout with the full menu keyboard model. To head a run of rows use `CascaderGroup` wrapping a `CascaderLabel` - a bare label inside a listbox names nothing and is dropped from the accessibility tree - and `CascaderSeparator` for the rule between runs. Every rendered string comes from `labels`, and the panel is RTL-correct under a `DirectionProvider` or `dir="rtl"`.

 ## date-selector

@@ -5,7 +5,7 @@ user-invocable: false
 allowed-tools: Bash(npx shadcn@latest *), Bash(pnpm dlx shadcn@latest *), Bash(bunx --bun shadcn@latest *)
 ---

-> **ReUI skill version `668fb463eb`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
+> **ReUI skill version `3bdbad788a`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.

 # ReUI for Agents

@@ -1,6 +1,6 @@
 # ReUI components

-The 20 ReUI building blocks: `alert`, `autocomplete`, `badge`, `data-grid`, `date-selector`, `event-calendar`, `filters`, `frame`, `gantt`, `icon-stack`, `icon-tile`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.
+The 21 ReUI building blocks: `alert`, `autocomplete`, `badge`, `cascader`, `data-grid`, `date-selector`, `event-calendar`, `filters`, `frame`, `gantt`, `icon-stack`, `icon-tile`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.

 **Rule one: never guess a component's API. Read it first.** Call **`get_component(name)`** for its inline `api` (props + usage, no web fetch), and **share the result's `docsUrl`** (the component's API documentation page) with the user whenever you work with that component's API, so they have the full reference (the `/llms.txt` index is a further fallback). Then call **`get_examples(name)`** to install a worked example and copy real composition. The contracts below are first-try orientation (required props, composition shape, the one gotcha); the inline `api` is the full reference. No single block fits? Compose: search the components you need, read each `get_component`, install a `get_examples` example per component, and adapt.

@@ -106,22 +106,60 @@ Common mistakes:

 ## filters

-**Required:** `filters` (`Filter[]`), `fields` (`FilterFieldConfig[]`), `onChange`
+**Required:** `fields` (`FilterField[]`). The value is ONE `FilterQuery` tree - `query` + `onQueryChange`, or uncontrolled `defaultQuery`.
 **Shape:**

 ```tsx
-const [filters, setFilters] = useState<Filter[]>([
-  createFilter("priority", "is_any_of", ["low"]),
-])
-const fields: FilterFieldConfig[] = [
-  { key: "priority", label: "Priority", type: "multiselect",
-    options: [{ value: "low", label: "Low" }, { value: "high", label: "High" }] },
+const fields: FilterField[] = [
+  { id: "title", label: "Title", type: "text" },
+  {
+    id: "status",
+    label: "Status",
+    type: "select",
+    options: [
+      { value: "active", label: "Active" },
+      { value: "archived", label: "Archived" },
+    ],
+  },
 ]
+const [query, setQuery] = useState<FilterQuery>(() => createFilterQuery())

-<Filters filters={filters} fields={fields} onChange={setFilters} />
+<Filters fields={fields} query={query} onQueryChange={setQuery} />
 ```

-**Gotcha:** always build initial filters with `createFilter(field, operator, values)` - it generates the required `id`. Never hand-construct a `Filter` object. Pairs naturally with `data-grid`.
+**Gotcha:** the state is a TREE, not a list of chips. `FilterQuery` is a group of rules joined by `and`/`or` and a group may hold another group, so `(A and B) or C` is expressible; a rule is `{ id, type: "rule", path: ["status"], operator, value }` and `path` is the whole nested attribute path, root first. The pre-rewrite API is GONE: there is no `filters`/`onChange` prop, no `FilterFieldConfig` (fields are `FilterField`, nested through their own `fields`, keyed `id` not `key`), and no `createFilter()` - it minted ids inside a pure function and broke hydration, so ids now come from `createFilterIdFactory(seed)` seeded off `useId`, and `createFilterQuery()` / `createFilterRule()` take one. Read the query back with `flattenFilterConditions` (`{ path, field, operator, values, negated }` per rule, incomplete rules skipped) and walk the tree yourself when the parentheses carry meaning - the primitive compiles nothing, no SQL, no query string.
+
+`variant` picks the chrome over that one query: `"basic"`, the default, is the flat chip row for a toolbar over a table; `"advanced"` is the condition builder, hung off a trigger or rendered in place with `advancedMode="inline"`. Both read and write the same tree, so a saved view built in one opens in the other. Other props worth knowing before you hand-roll them: `size` is two rungs, `"sm" | "default"`, resolved per style (there is no `lg`); `reorderable` turns on drag and Alt+Arrow row moves in the builder; `onBeforeQueryChange` is the ONE veto point for every write (return `false` to refuse, it cannot rewrite); `editors` registers custom value editors a field selects by `editor` name; `labels` / `operatorLabels` own every rendered string; `pathCollapse` + `maxPathSegments` shorten deep attribute paths; `renderChip` / `renderValue` / `renderEmpty` replace rendered parts. On a field, `loadOptions` supplies async options with paging and `resolveValues` renders a chip restored from a saved view whose option was never loaded. Pairs naturally with `data-grid`.
+
+## cascader
+
+**Required:** `items` (a tree of `{ value, label, children? }`), plus the panel parts inside `CascaderContent`.
+**Shape:**
+
+```tsx
+<Cascader items={items} value={value} onValueChange={setValue}>
+  <CascaderTrigger render={<Button variant="outline" />}>
+    <CascaderValue placeholder="Select an attribute" />
+  </CascaderTrigger>
+  <CascaderContent className="w-80">
+    <CascaderPanel>
+      <CascaderNav>
+        <CascaderBreadcrumb />
+        <CascaderInput />
+      </CascaderNav>
+      <CascaderEmpty />
+      <CascaderList maxHeight={288}>
+        <CascaderItems />
+      </CascaderList>
+      <CascaderStatus />
+    </CascaderPanel>
+  </CascaderContent>
+</Cascader>
+```
+
+**Gotcha:** pressing a branch NAVIGATES, it does not select - only leaves are selectable until you pass `selectable="any"` or a predicate, and once a branch is selectable its chevron becomes the only way to open it. `CascaderInput` must stay inside `CascaderContent` (Base UI refills the query from the selection when the input sits outside the popup). Always include `CascaderStatus`: it is the live region announcing level changes, which the visual breadcrumb does not provide to screen readers. Accepts a flat adjacency list via `getParent` as well as nested `children`. `searchScope="deep"` searches every level and annotates results with their path; `multiple` gives checkbox rows; `inline` + a bare `CascaderPanel` embeds it with no popover.
+
+The shape above is `mode="drill"`, the default. `mode="tree"` keeps the same parts (drop `CascaderBreadcrumb`, pass `showBack={false}`, drive expansion with `expanded`/`onExpandedChange`); `mode="columns"` REPLACES `CascaderList` + `CascaderItems` with a single `CascaderColumns`, and has no breadcrumb. Other props worth knowing before you hand-roll them: `cascade` (multi-select only, parent/child selection with indeterminate branches - pair it with `selectable="any"`, since a leaf-only tree can never cascade), `indicator={false}` to drop the single-select check and its gutter (visual only, no-op with `multiple`), `virtualize`/`virtualizeThreshold` plus `CascaderVirtualItems` for long levels, and `getChildren` for async levels with cursor paging, retry on failure and optional `prefetch`. `CascaderFooter` pins commands below the list (`actions` is the quick path) and `CascaderSubmenu` opens one as a side-anchored flyout with the full menu keyboard model. To head a run of rows use `CascaderGroup` wrapping a `CascaderLabel` - a bare label inside a listbox names nothing and is dropped from the accessibility tree - and `CascaderSeparator` for the rule between runs. Every rendered string comes from `labels`, and the panel is RTL-correct under a `DirectionProvider` or `dir="rtl"`.

 ## date-selector

@@ -6,18 +6,18 @@ alwaysApply: false

 ---
 name: reui
-description: Use the ReUI registry from your AI agent - find, install, and correctly use ReUI components (the 17 free building blocks like data-grid, kanban, filters), their free examples, premium blocks, and Motion Icons. Applies in any project using ReUI, the @reui registry, REUI_LICENSE_KEY, or any shadcn project where the user asks for premium blocks, data grids, kanban boards, dashboards, or full pages. Pairs with the free ReUI MCP server for live, scored registry search and inline component APIs.
+description: Use the ReUI registry from your AI agent - find, install, and correctly use ReUI components (the 20 free building blocks like data-grid, kanban, filters), their free examples, premium blocks, and Motion Icons. Applies in any project using ReUI, the @reui registry, REUI_LICENSE_KEY, or any shadcn project where the user asks for premium blocks, data grids, kanban boards, dashboards, or full pages. Pairs with the free ReUI MCP server for live, scored registry search and inline component APIs.
 user-invocable: false
 allowed-tools: Bash(npx shadcn@latest *), Bash(pnpm dlx shadcn@latest *), Bash(bunx --bun shadcn@latest *)
 ---

-> **ReUI skill version `42d70dcc3d`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
+> **ReUI skill version `3bdbad788a`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.

 # ReUI for Agents

 ReUI is a shadcn-compatible registry. It ships four things you **reuse** - never redesign:

- **components** - the 17 ReUI building blocks with real APIs: `data-grid`, `kanban`, `filters`, `date-selector`, `tree`, `stepper`, ... (free)
+- **components** - the 20 ReUI building blocks with real APIs: `data-grid`, `kanban`, `filters`, `date-selector`, `tree`, `stepper`, ... (free)
 - **examples** - free `c-*` single-pattern use-cases of a component (`c-kanban-1`); install one and read it to see exact composition
 - **blocks** - premium full-page sections that compose components (`data-grid-2`, `pricing-page-1`); Pro or Ultimate license at install
 - **icons** - Motion Icons in 4 styles, static + hover-animated variants; Ultimate license at install
@@ -64,7 +64,7 @@ Invocation differs slightly per agent (`/mcp__reui__build` in Claude Code/Cursor

 - [rules/registry.md](./rules/registry.md) - the four types, the @reui registry, base/radix, free vs premium + license
 - [rules/workflow.md](./rules/workflow.md) - the find -> install -> read-API -> adapt loop (most important)
- [rules/components.md](./rules/components.md) - the 17 components, the data-grid contract, base vs radix
+- [rules/components.md](./rules/components.md) - the 20 components, the data-grid contract, base vs radix
 - [rules/adapting.md](./rules/adapting.md) - reuse-first: preserve the design (no over-customizing), reuse examples + a block's own elements, real data, don't invent APIs
 - [rules/craft.md](./rules/craft.md) - make it exceptional: point of view, hierarchy, density, states, responsive, motion, the bar
 - [rules/quality.md](./rules/quality.md) - security, accessibility, and scroll gates (the done gate)
@@ -5,7 +5,7 @@ user-invocable: false
 allowed-tools: Bash(npx shadcn@latest *), Bash(pnpm dlx shadcn@latest *), Bash(bunx --bun shadcn@latest *)
 ---

-> **ReUI skill version `668fb463eb`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
+> **ReUI skill version `3bdbad788a`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.

 # ReUI for Agents

@@ -1,6 +1,6 @@
 # ReUI components

-The 20 ReUI building blocks: `alert`, `autocomplete`, `badge`, `data-grid`, `date-selector`, `event-calendar`, `filters`, `frame`, `gantt`, `icon-stack`, `icon-tile`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.
+The 21 ReUI building blocks: `alert`, `autocomplete`, `badge`, `cascader`, `data-grid`, `date-selector`, `event-calendar`, `filters`, `frame`, `gantt`, `icon-stack`, `icon-tile`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.

 **Rule one: never guess a component's API. Read it first.** Call **`get_component(name)`** for its inline `api` (props + usage, no web fetch), and **share the result's `docsUrl`** (the component's API documentation page) with the user whenever you work with that component's API, so they have the full reference (the `/llms.txt` index is a further fallback). Then call **`get_examples(name)`** to install a worked example and copy real composition. The contracts below are first-try orientation (required props, composition shape, the one gotcha); the inline `api` is the full reference. No single block fits? Compose: search the components you need, read each `get_component`, install a `get_examples` example per component, and adapt.

@@ -106,22 +106,60 @@ Common mistakes:

 ## filters

-**Required:** `filters` (`Filter[]`), `fields` (`FilterFieldConfig[]`), `onChange`
+**Required:** `fields` (`FilterField[]`). The value is ONE `FilterQuery` tree - `query` + `onQueryChange`, or uncontrolled `defaultQuery`.
 **Shape:**

 ```tsx
-const [filters, setFilters] = useState<Filter[]>([
-  createFilter("priority", "is_any_of", ["low"]),
-])
-const fields: FilterFieldConfig[] = [
-  { key: "priority", label: "Priority", type: "multiselect",
-    options: [{ value: "low", label: "Low" }, { value: "high", label: "High" }] },
+const fields: FilterField[] = [
+  { id: "title", label: "Title", type: "text" },
+  {
+    id: "status",
+    label: "Status",
+    type: "select",
+    options: [
+      { value: "active", label: "Active" },
+      { value: "archived", label: "Archived" },
+    ],
+  },
 ]
+const [query, setQuery] = useState<FilterQuery>(() => createFilterQuery())

-<Filters filters={filters} fields={fields} onChange={setFilters} />
+<Filters fields={fields} query={query} onQueryChange={setQuery} />
 ```

-**Gotcha:** always build initial filters with `createFilter(field, operator, values)` - it generates the required `id`. Never hand-construct a `Filter` object. Pairs naturally with `data-grid`.
+**Gotcha:** the state is a TREE, not a list of chips. `FilterQuery` is a group of rules joined by `and`/`or` and a group may hold another group, so `(A and B) or C` is expressible; a rule is `{ id, type: "rule", path: ["status"], operator, value }` and `path` is the whole nested attribute path, root first. The pre-rewrite API is GONE: there is no `filters`/`onChange` prop, no `FilterFieldConfig` (fields are `FilterField`, nested through their own `fields`, keyed `id` not `key`), and no `createFilter()` - it minted ids inside a pure function and broke hydration, so ids now come from `createFilterIdFactory(seed)` seeded off `useId`, and `createFilterQuery()` / `createFilterRule()` take one. Read the query back with `flattenFilterConditions` (`{ path, field, operator, values, negated }` per rule, incomplete rules skipped) and walk the tree yourself when the parentheses carry meaning - the primitive compiles nothing, no SQL, no query string.
+
+`variant` picks the chrome over that one query: `"basic"`, the default, is the flat chip row for a toolbar over a table; `"advanced"` is the condition builder, hung off a trigger or rendered in place with `advancedMode="inline"`. Both read and write the same tree, so a saved view built in one opens in the other. Other props worth knowing before you hand-roll them: `size` is two rungs, `"sm" | "default"`, resolved per style (there is no `lg`); `reorderable` turns on drag and Alt+Arrow row moves in the builder; `onBeforeQueryChange` is the ONE veto point for every write (return `false` to refuse, it cannot rewrite); `editors` registers custom value editors a field selects by `editor` name; `labels` / `operatorLabels` own every rendered string; `pathCollapse` + `maxPathSegments` shorten deep attribute paths; `renderChip` / `renderValue` / `renderEmpty` replace rendered parts. On a field, `loadOptions` supplies async options with paging and `resolveValues` renders a chip restored from a saved view whose option was never loaded. Pairs naturally with `data-grid`.
+
+## cascader
+
+**Required:** `items` (a tree of `{ value, label, children? }`), plus the panel parts inside `CascaderContent`.
+**Shape:**
+
+```tsx
+<Cascader items={items} value={value} onValueChange={setValue}>
+  <CascaderTrigger render={<Button variant="outline" />}>
+    <CascaderValue placeholder="Select an attribute" />
+  </CascaderTrigger>
+  <CascaderContent className="w-80">
+    <CascaderPanel>
+      <CascaderNav>
+        <CascaderBreadcrumb />
+        <CascaderInput />
+      </CascaderNav>
+      <CascaderEmpty />
+      <CascaderList maxHeight={288}>
+        <CascaderItems />
+      </CascaderList>
+      <CascaderStatus />
+    </CascaderPanel>
+  </CascaderContent>
+</Cascader>
+```
+
+**Gotcha:** pressing a branch NAVIGATES, it does not select - only leaves are selectable until you pass `selectable="any"` or a predicate, and once a branch is selectable its chevron becomes the only way to open it. `CascaderInput` must stay inside `CascaderContent` (Base UI refills the query from the selection when the input sits outside the popup). Always include `CascaderStatus`: it is the live region announcing level changes, which the visual breadcrumb does not provide to screen readers. Accepts a flat adjacency list via `getParent` as well as nested `children`. `searchScope="deep"` searches every level and annotates results with their path; `multiple` gives checkbox rows; `inline` + a bare `CascaderPanel` embeds it with no popover.
+
+The shape above is `mode="drill"`, the default. `mode="tree"` keeps the same parts (drop `CascaderBreadcrumb`, pass `showBack={false}`, drive expansion with `expanded`/`onExpandedChange`); `mode="columns"` REPLACES `CascaderList` + `CascaderItems` with a single `CascaderColumns`, and has no breadcrumb. Other props worth knowing before you hand-roll them: `cascade` (multi-select only, parent/child selection with indeterminate branches - pair it with `selectable="any"`, since a leaf-only tree can never cascade), `indicator={false}` to drop the single-select check and its gutter (visual only, no-op with `multiple`), `virtualize`/`virtualizeThreshold` plus `CascaderVirtualItems` for long levels, and `getChildren` for async levels with cursor paging, retry on failure and optional `prefetch`. `CascaderFooter` pins commands below the list (`actions` is the quick path) and `CascaderSubmenu` opens one as a side-anchored flyout with the full menu keyboard model. To head a run of rows use `CascaderGroup` wrapping a `CascaderLabel` - a bare label inside a listbox names nothing and is dropped from the accessibility tree - and `CascaderSeparator` for the rule between runs. Every rendered string comes from `labels`, and the panel is RTL-correct under a `DirectionProvider` or `dir="rtl"`.

 ## date-selector

@@ -16,7 +16,7 @@ ADMIN_PASSWORD=admin
 ADMIN_NAME=Admin

 # Allowed return_to hosts (comma-separated), e.g. .shnt.top or full origins
-RETURN_TO_ALLOWLIST=.shnt.top,localhost,private,http://localhost:5173,http://localhost:5174
+RETURN_TO_ALLOWLIST=.shnt.top,localhost,private,http://localhost:5173,http://localhost:5174,http://localhost:5176

 # ReUI PRO (apps/web/components.json → @reui Authorization)
 # Ключ: https://reui.io/docs/license-setup — класть в apps/web/.env.local (gitignored)
@@ -24,7 +24,8 @@ REUI_LICENSE_KEY=

 # Local app URLs for SSO Open (apps/web/.env.local)
 # VITE_VPS_APP_URL=http://localhost:5173
-# VITE_RETURN_TO_ALLOWLIST=.shnt.top,localhost,http://localhost:5173
+# VITE_CDN_APP_URL=http://localhost:5176
+# VITE_RETURN_TO_ALLOWLIST=.shnt.top,localhost,http://localhost:5173,http://localhost:5176

 # Server
 SERVER_PORT=8080
@@ -5,7 +5,7 @@ user-invocable: false
 allowed-tools: Bash(npx shadcn@latest *), Bash(pnpm dlx shadcn@latest *), Bash(bunx --bun shadcn@latest *)
 ---

-> **ReUI skill version `668fb463eb`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
+> **ReUI skill version `3bdbad788a`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.

 # ReUI for Agents

@@ -1,6 +1,6 @@
 # ReUI components

-The 20 ReUI building blocks: `alert`, `autocomplete`, `badge`, `data-grid`, `date-selector`, `event-calendar`, `filters`, `frame`, `gantt`, `icon-stack`, `icon-tile`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.
+The 21 ReUI building blocks: `alert`, `autocomplete`, `badge`, `cascader`, `data-grid`, `date-selector`, `event-calendar`, `filters`, `frame`, `gantt`, `icon-stack`, `icon-tile`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.

 **Rule one: never guess a component's API. Read it first.** Call **`get_component(name)`** for its inline `api` (props + usage, no web fetch), and **share the result's `docsUrl`** (the component's API documentation page) with the user whenever you work with that component's API, so they have the full reference (the `/llms.txt` index is a further fallback). Then call **`get_examples(name)`** to install a worked example and copy real composition. The contracts below are first-try orientation (required props, composition shape, the one gotcha); the inline `api` is the full reference. No single block fits? Compose: search the components you need, read each `get_component`, install a `get_examples` example per component, and adapt.

@@ -106,22 +106,60 @@ Common mistakes:

 ## filters

-**Required:** `filters` (`Filter[]`), `fields` (`FilterFieldConfig[]`), `onChange`
+**Required:** `fields` (`FilterField[]`). The value is ONE `FilterQuery` tree - `query` + `onQueryChange`, or uncontrolled `defaultQuery`.
 **Shape:**

 ```tsx
-const [filters, setFilters] = useState<Filter[]>([
-  createFilter("priority", "is_any_of", ["low"]),
-])
-const fields: FilterFieldConfig[] = [
-  { key: "priority", label: "Priority", type: "multiselect",
-    options: [{ value: "low", label: "Low" }, { value: "high", label: "High" }] },
+const fields: FilterField[] = [
+  { id: "title", label: "Title", type: "text" },
+  {
+    id: "status",
+    label: "Status",
+    type: "select",
+    options: [
+      { value: "active", label: "Active" },
+      { value: "archived", label: "Archived" },
+    ],
+  },
 ]
+const [query, setQuery] = useState<FilterQuery>(() => createFilterQuery())

-<Filters filters={filters} fields={fields} onChange={setFilters} />
+<Filters fields={fields} query={query} onQueryChange={setQuery} />
 ```

-**Gotcha:** always build initial filters with `createFilter(field, operator, values)` - it generates the required `id`. Never hand-construct a `Filter` object. Pairs naturally with `data-grid`.
+**Gotcha:** the state is a TREE, not a list of chips. `FilterQuery` is a group of rules joined by `and`/`or` and a group may hold another group, so `(A and B) or C` is expressible; a rule is `{ id, type: "rule", path: ["status"], operator, value }` and `path` is the whole nested attribute path, root first. The pre-rewrite API is GONE: there is no `filters`/`onChange` prop, no `FilterFieldConfig` (fields are `FilterField`, nested through their own `fields`, keyed `id` not `key`), and no `createFilter()` - it minted ids inside a pure function and broke hydration, so ids now come from `createFilterIdFactory(seed)` seeded off `useId`, and `createFilterQuery()` / `createFilterRule()` take one. Read the query back with `flattenFilterConditions` (`{ path, field, operator, values, negated }` per rule, incomplete rules skipped) and walk the tree yourself when the parentheses carry meaning - the primitive compiles nothing, no SQL, no query string.
+
+`variant` picks the chrome over that one query: `"basic"`, the default, is the flat chip row for a toolbar over a table; `"advanced"` is the condition builder, hung off a trigger or rendered in place with `advancedMode="inline"`. Both read and write the same tree, so a saved view built in one opens in the other. Other props worth knowing before you hand-roll them: `size` is two rungs, `"sm" | "default"`, resolved per style (there is no `lg`); `reorderable` turns on drag and Alt+Arrow row moves in the builder; `onBeforeQueryChange` is the ONE veto point for every write (return `false` to refuse, it cannot rewrite); `editors` registers custom value editors a field selects by `editor` name; `labels` / `operatorLabels` own every rendered string; `pathCollapse` + `maxPathSegments` shorten deep attribute paths; `renderChip` / `renderValue` / `renderEmpty` replace rendered parts. On a field, `loadOptions` supplies async options with paging and `resolveValues` renders a chip restored from a saved view whose option was never loaded. Pairs naturally with `data-grid`.
+
+## cascader
+
+**Required:** `items` (a tree of `{ value, label, children? }`), plus the panel parts inside `CascaderContent`.
+**Shape:**
+
+```tsx
+<Cascader items={items} value={value} onValueChange={setValue}>
+  <CascaderTrigger render={<Button variant="outline" />}>
+    <CascaderValue placeholder="Select an attribute" />
+  </CascaderTrigger>
+  <CascaderContent className="w-80">
+    <CascaderPanel>
+      <CascaderNav>
+        <CascaderBreadcrumb />
+        <CascaderInput />
+      </CascaderNav>
+      <CascaderEmpty />
+      <CascaderList maxHeight={288}>
+        <CascaderItems />
+      </CascaderList>
+      <CascaderStatus />
+    </CascaderPanel>
+  </CascaderContent>
+</Cascader>
+```
+
+**Gotcha:** pressing a branch NAVIGATES, it does not select - only leaves are selectable until you pass `selectable="any"` or a predicate, and once a branch is selectable its chevron becomes the only way to open it. `CascaderInput` must stay inside `CascaderContent` (Base UI refills the query from the selection when the input sits outside the popup). Always include `CascaderStatus`: it is the live region announcing level changes, which the visual breadcrumb does not provide to screen readers. Accepts a flat adjacency list via `getParent` as well as nested `children`. `searchScope="deep"` searches every level and annotates results with their path; `multiple` gives checkbox rows; `inline` + a bare `CascaderPanel` embeds it with no popover.
+
+The shape above is `mode="drill"`, the default. `mode="tree"` keeps the same parts (drop `CascaderBreadcrumb`, pass `showBack={false}`, drive expansion with `expanded`/`onExpandedChange`); `mode="columns"` REPLACES `CascaderList` + `CascaderItems` with a single `CascaderColumns`, and has no breadcrumb. Other props worth knowing before you hand-roll them: `cascade` (multi-select only, parent/child selection with indeterminate branches - pair it with `selectable="any"`, since a leaf-only tree can never cascade), `indicator={false}` to drop the single-select check and its gutter (visual only, no-op with `multiple`), `virtualize`/`virtualizeThreshold` plus `CascaderVirtualItems` for long levels, and `getChildren` for async levels with cursor paging, retry on failure and optional `prefetch`. `CascaderFooter` pins commands below the list (`actions` is the quick path) and `CascaderSubmenu` opens one as a side-anchored flyout with the full menu keyboard model. To head a run of rows use `CascaderGroup` wrapping a `CascaderLabel` - a bare label inside a listbox names nothing and is dropped from the accessibility tree - and `CascaderSeparator` for the rule between runs. Every rendered string comes from `labels`, and the panel is RTL-correct under a `DirectionProvider` or `dir="rtl"`.

 ## date-selector

@@ -29,6 +29,8 @@ pnpm --filter web dev               # :5175

 См. [`docs/integrate-evobgp.md`](docs/integrate-evobgp.md) — EvoBGP (`bgp:*`).
 См. [`docs/integrate-evofirewall.md`](docs/integrate-evofirewall.md) — EvoFirewall (`fw:*`).
+См. [`docs/integrate-cdnmanager.md`](docs/integrate-cdnmanager.md) — CDN Manager (`cdn:*`, порт Vite `5176`).
+См. [`docs/integrate-mikrotikmanager.md`](docs/integrate-mikrotikmanager.md) — MikrotikManager (`mm:*`).
 См. [`docs/integrate-technitium.md`](docs/integrate-technitium.md) — Technitium DNS (`dns:*`, OIDC IdP).

 Корень:
@@ -51,6 +51,20 @@ export function targetAppFromReturnTo(
  ) {
    return 'dns'
  }
+  if (
+    /\bcdn\b/.test(hay) ||
+    host.includes('cdnmanager') ||
+    host.includes('cdn-manager')
+  ) {
+    return 'cdn'
+  }
+  if (
+    /\bmm\b/.test(hay) ||
+    host.includes('mikrotik') ||
+    host.includes('mmapp')
+  ) {
+    return 'mm'
+  }
  return 'portal'
 }

@@ -18,11 +18,19 @@ describe('app-switcher API', () => {
    expect(body.menuLabel).toBeTruthy()
    expect(body.apps.map((a) => a.id).sort()).toEqual([
      'bgp',
+      'cdn',
      'cfdm',
      'dns',
      'fw',
+      'mm',
      'vps',
    ])
+    expect(body.apps.find((a) => a.id === 'cdn')).toMatchObject({
+      authMode: 'jwt',
+    })
+    expect(body.apps.find((a) => a.id === 'mm')).toMatchObject({
+      authMode: 'jwt',
+    })
    expect(body.apps.find((a) => a.id === 'dns')).toMatchObject({
      authMode: 'oidc',
    })
@@ -21,4 +21,16 @@ describe('targetAppFromReturnTo', () => {
      targetAppFromReturnTo('https://auth.shnt.top/oauth/authorize'),
    ).toBe('portal')
  })
+
+  it('maps cdn host', () => {
+    expect(targetAppFromReturnTo('https://cdn.shnt.top/auth/callback')).toBe(
+      'cdn',
+    )
+  })
+
+  it('maps mm host', () => {
+    expect(targetAppFromReturnTo('https://mm.shnt.top/auth/callback')).toBe(
+      'mm',
+    )
+  })
 })
@@ -7,6 +7,7 @@ import {
  NetworkIcon,
  ShieldIcon,
  GlobeIcon,
+  LayoutDashboardIcon,
 } from 'lucide-react'
 import { APPS, type AppId } from '@authportal/shared'
 import { Button } from '@authportal/ui/components/button'
@@ -28,6 +29,8 @@ const APP_ICONS: Record<
  bgp: NetworkIcon,
  fw: ShieldIcon,
  dns: GlobeIcon,
+  cdn: CloudIcon,
+  mm: LayoutDashboardIcon,
 }

 export function AppsMenu() {
@@ -43,6 +43,8 @@ export const SOURCE_APP_OPTIONS: {
  { value: 'bgp', label: 'EvoBGP' },
  { value: 'fw', label: 'EvoFirewall' },
  { value: 'dns', label: 'Technitium DNS' },
+  { value: 'cdn', label: 'CDN Manager' },
+  { value: 'mm', label: 'MikrotikManager' },
 ]

 export const severityVariant: Record<AuditSeverity, BadgeProps['variant']> = {
@@ -3,6 +3,7 @@ import { useQuery } from '@tanstack/react-query'
 import {
  CloudIcon,
  GlobeIcon,
+  LayoutDashboardIcon,
  LayoutGridIcon,
  ServerIcon,
  ShieldIcon,
@@ -30,6 +31,8 @@ const APP_ICONS: Record<AppId, typeof CloudIcon> = {
  bgp: GlobeIcon,
  fw: ShieldIcon,
  dns: GlobeIcon,
+  cdn: CloudIcon,
+  mm: LayoutDashboardIcon,
 }

 async function openApp(
@@ -24,7 +24,7 @@ ADMIN_EMAIL=admin@shnt.top
 ADMIN_PASSWORD=
 ADMIN_NAME=Admin
 # Include Technitium origin if used (e.g. https://dns.shnt.top)
-RETURN_TO_ALLOWLIST=.shnt.top,https://vps.shnt.top,https://cfdm.shnt.top,https://bgp.shnt.top,https://fw.shnt.top,https://dns.shnt.top
+RETURN_TO_ALLOWLIST=.shnt.top,https://vps.shnt.top,https://cfdm.shnt.top,https://bgp.shnt.top,https://fw.shnt.top,https://dns.shnt.top,https://cdn.shnt.top
 LOG_LEVEL=info
 NODE_ENV=production
 # WebAuthn / passkeys (defaults from ISSUER hostname + origin)
@@ -179,7 +179,7 @@ VITE_AUTH_ENABLED=true
 VITE_AUTH_PORTAL_URL=https://auth.shnt.top
 ```

-См. [integrate-vps-tracker.md](integrate-vps-tracker.md), [integrate-cfdm.md](integrate-cfdm.md), [integrate-evobgp.md](integrate-evobgp.md), [integrate-evofirewall.md](integrate-evofirewall.md).  
+См. [integrate-vps-tracker.md](integrate-vps-tracker.md), [integrate-cfdm.md](integrate-cfdm.md), [integrate-evobgp.md](integrate-evobgp.md), [integrate-evofirewall.md](integrate-evofirewall.md), [integrate-cdnmanager.md](integrate-cdnmanager.md), [integrate-mikrotikmanager.md](integrate-mikrotikmanager.md).  
 Logout SSO: `https://auth.shnt.top/logout`.

 ### Technitium DNS (OIDC)
@@ -36,7 +36,7 @@ Content-Type: application/json
 ```

 - `events`: 1–50 за запрос  
- `source_app`: `vps` | `cfdm` | `bgp` | `fw` (не `portal`)  
+- `source_app`: `vps` | `cfdm` | `bgp` | `fw` | `dns` | `cdn` | `mm` (не `portal`)  
 - `event_id`: идемпотентность (дубликаты → `duplicates++`)  
 - Ответ: `{ "accepted": N, "duplicates": M }`

@@ -45,7 +45,7 @@ Content-Type: application/json
 | Где | Переменная |
 |-----|------------|
 | auth-portal | `AUDIT_INGEST_SECRET` |
-| apps (vps / cfdm / bgp / fw) | `AUTH_PORTAL_URL` + `AUTH_AUDIT_INGEST_SECRET` (тот же секрет) |
+| apps (vps / cfdm / bgp / fw / cdn) | `AUTH_PORTAL_URL` + `AUTH_AUDIT_INGEST_SECRET` (тот же секрет) |

 Dev default secret: `dev-audit-ingest-secret`.

@@ -0,0 +1,141 @@
+# Интеграция auth-portal ↔ CDN Manager
+
+Единый вход: пользователь логинится на auth-portal, получает JWT, переходит в CDNManager с токеном в URL fragment. CDNManager API проверяет JWT и права `cdn:*`.
+
+## Архитектура
+
+```
+Browser → CDNManager UI (нет token)
+       → redirect AUTH_PORTAL_URL/?return_to=…/auth/callback
+       → login
+       → redirect return_to#access_token=…
+       → CDNManager /auth/callback сохраняет token (cdnmanager_token)
+       → API Authorization: Bearer …
+```
+
+Общий секрет: `JWT_SECRET` / `AUTH_JWT_SECRET` (HS256). Issuer: `ISSUER` / `AUTH_ISSUER`.
+
+App id в портале: **`cdn`** (каталог permissions).
+
+## Локальный запуск
+
+### 1. auth-portal
+
+```bash
+cd auth-portal
+pnpm install
+# JWT_SECRET=dev-secret-change-me
+# RETURN_TO_ALLOWLIST=.shnt.top,localhost,http://localhost:5173,…,http://localhost:5176
+pnpm --filter @authportal/api dev   # :8080
+pnpm --filter web dev               # :5175
+```
+
+В `apps/web/.env.local` (опционально для App Switcher / SSO open):
+
+```env
+VITE_CDN_APP_URL=http://localhost:5176
+```
+
+Bootstrap: `admin@shnt.top` / `admin`. В админке выдайте app **cdn** и permissions `cdn:*`.
+
+### 2. CDNManager
+
+```bash
+cd CDNManager
+pnpm install
+```
+
+Корень / API:
+
+```env
+AUTH_REQUIRED=true
+AUTH_JWT_SECRET=dev-secret-change-me
+AUTH_ISSUER=https://auth.shnt.top
+AUTH_PORTAL_URL=http://localhost:5175
+CLOUDFLARE_API_TOKEN=
+```
+
+`apps/web/.env.local`:
+
+```env
+VITE_AUTH_ENABLED=true
+VITE_AUTH_PORTAL_URL=http://localhost:5175
+```
+
+Порт Vite web — `5176` (`apps/web/vite.config.ts`). Добавьте origin в `RETURN_TO_ALLOWLIST` портала.
+
+```bash
+pnpm --filter @cdnmanager/api dev
+pnpm --filter web dev
+```
+
+Откройте CDNManager → редирект на portal → после логина NavUser показывает имя/email.
+
+## Permissions ↔ API / UI
+
+Иерархия: `admin` ⊃ `write` ⊃ `read` в рамках одной секции.
+
+| Permission | API | UI |
+|------------|-----|-----|
+| `cdn:dashboard:read` | GET `/api/v1/dashboard/*`, `/topology` | `/` |
+| `cdn:nodes:read` | GET `/api/v1/nodes*`, `/locations` | `/nodes` |
+| `cdn:nodes:write` | POST/PATCH/DELETE nodes | create/edit нод |
+| `cdn:aliases:read` | GET `/api/v1/aliases*` | `/aliases` |
+| `cdn:aliases:write` | POST/PATCH aliases, retarget | create / Retarget |
+| `cdn:zones:read` | GET `/api/v1/zones*` | `/zones` |
+| `cdn:zones:write` | POST/PATCH zones, BIND export | создать зону |
+| `cdn:sync:write` | POST `…/sync`, `…/apply` | Sync / Apply |
+| `cdn:topology:read` | GET `/api/v1/topology` | `/topology` |
+| `cdn:settings:admin` | GET/PATCH `/api/v1/settings` | `/settings/*` |
+
+Без app `cdn` в JWT `apps` → **403** на защищённые `/api/v1/*`.
+
+`AUTH_REQUIRED=false` — локальный login (`ADMIN_*`) для тестов/dev без portal; UI `/login`.
+
+## App Switcher
+
+Публичный конфиг: `GET {AUTH_PORTAL_URL}/api/v1/app-switcher` (CORS open). CDNManager chrome (`AppSwitcher` / `AppsMenu`) читает его через `ensureAuthConfig().portalUrl`.
+
+Редактор только на портале: **Админка → Ссылки приложений** (`/admin/apps`). В CDNManager Settings → Интеграции — read-only ссылка на портал.
+
+`CURRENT_APP_ID = cdn`. Если в JWT есть `apps[]` — в меню только пересечение с каталогом.
+
+## Audit ingest
+
+Dual-write локального журнала в portal: [`integrate-audit-ingest.md`](./integrate-audit-ingest.md) (`source_app: cdn`).
+
+## UI аккаунта
+
+SidebarFooter → **NavUser**: Настройки, Тема, Выйти → `AUTH_PORTAL_URL/logout`.
+
+## Logout (SSO)
+
+Очистить `cdnmanager_token` → редирект на **`/logout`** портала (не на `/?return_to=…` — иначе portal сразу выдаст новый SSO-токен).
+
+## Production (Docker)
+
+Рекомендуется Traefik-стек в репозитории CDNManager: `docs/deploy-traefik.md`  
+(`deploy/docker-compose.traefik.yml` + `deploy/env.traefik.example`).
+
+Ключевые env контейнера:
+
+```env
+AUTH_REQUIRED=true
+AUTH_JWT_SECRET=<тот же JWT_SECRET портала>
+AUTH_ISSUER=https://auth.shnt.top
+AUTH_PORTAL_URL=https://auth.shnt.top
+AUTH_AUDIT_INGEST_SECRET=<AUDIT_INGEST_SECRET портала>
+CLOUDFLARE_API_TOKEN=<Zone DNS Edit + Zone Read>
+```
+
+В portal: `RETURN_TO_ALLOWLIST` включает `https://cdn.shnt.top` (или ваш origin).
+
+## Troubleshooting
+
+| Симптом | Причина |
+|---------|---------|
+| SSO loop / «Сессия не принята» | разный `JWT_SECRET` или `ISSUER` у portal и CDNManager |
+| 403 «Нет доступа к приложению» | у пользователя нет app `cdn` в portal |
+| 403 «Недостаточно прав» | нет нужного `cdn:…` permission |
+| return_to rejected | origin CDNManager не в `RETURN_TO_ALLOWLIST` |
+| «Выйти» сразу возвращает в CDNManager | клиент должен открывать `/logout`, не login с `return_to` |
@@ -0,0 +1,112 @@
+# Интеграция auth-portal ↔ MikrotikManager
+
+Единый вход: пользователь логинится на auth-portal, получает JWT, переходит в MikrotikManager с токеном в URL fragment. Backend MM проверяет JWT и права `mm:*`.
+
+## Архитектура
+
+```
+Browser → MikrotikManager UI (нет token)
+       → redirect AUTH_PORTAL_URL/?return_to=…/auth/callback
+       → login
+       → redirect return_to#access_token=…
+       → MM /auth/callback сохраняет token (mmapp_token)
+       → API Authorization: Bearer …
+```
+
+Общий секрет: `JWT_SECRET` / `AUTH_JWT_SECRET` (HS256). Issuer: `ISSUER` / `AUTH_ISSUER`.
+
+App id в портале: **`mm`** (каталог permissions).
+
+## Локальный запуск
+
+### 1. auth-portal
+
+```bash
+cd auth-portal
+pnpm install
+# JWT_SECRET=dev-secret-change-me
+# RETURN_TO_ALLOWLIST=.shnt.top,localhost,http://localhost:3000
+pnpm --filter @authportal/api dev   # :8080
+pnpm --filter web dev               # :5175
+```
+
+Bootstrap: `admin@shnt.top` / `admin`. В админке выдайте app **mm** и permissions `mm:*`.
+
+### 2. MikrotikManager
+
+```bash
+cd MikrotikManager
+npm install
+```
+
+Backend `backend/.env`:
+
+```env
+AUTH_REQUIRED=true
+AUTH_JWT_SECRET=dev-secret-change-me
+AUTH_ISSUER=https://auth.shnt.top
+AUTH_PORTAL_URL=http://localhost:5175
+CORS_ORIGIN=http://localhost:3000
+```
+
+Frontend: `NEXT_PUBLIC_AUTH_PORTAL_URL=http://localhost:5175` (или runtime `GET /api/auth/config` через proxy).
+
+```bash
+npm --prefix backend run dev
+npm run dev
+```
+
+Откройте `http://localhost:3000` → редирект на portal → после логина NavUser показывает имя/email.
+
+## Permissions ↔ API / UI
+
+Иерархия: `admin` ⊃ `write` ⊃ `read` в рамках одной секции.
+
+| Permission | API (prefix) | UI |
+|------------|--------------|-----|
+| `mm:dashboard:read` | sidebar-counts, events (GET) | `/dashboard` |
+| `mm:servers:read` / `write` | `/api/servers*` | `/servers` |
+| `mm:filters:read` / `write` | `/api/filters*` | `/filters`, GRE |
+| `mm:bgp:read` / `write` | `/api/bgp*` | BGP |
+| `mm:uptime:read` / `write` | `/api/uptime*` | `/uptime` |
+| `mm:traffic:read` / `write` | `/api/traffic*` | `/traffic` |
+| `mm:alerts:read` / `write` | `/api/alerts*` | `/alerts` |
+| `mm:backups:read` / `write` | `/api/backups*` | `/backups` |
+| `mm:certificates:read` / `write` | `/api/certificates*` | certificates |
+| `mm:network:read` / `write` | `/api/network*`, OSPF, recursive, probes | network |
+| `mm:settings:admin` | `/api/system/*`, scheduler, evobgp settings | `/settings` |
+
+Без app `mm` в JWT `apps` → **403** на защищённые `/api/*`.
+
+`AUTH_REQUIRED=false` — API открыт (dev без portal).
+
+## App Switcher
+
+`CURRENT_APP_ID = mm`. Публичный конфиг: `GET {AUTH_PORTAL_URL}/api/v1/app-switcher`.
+
+## Logout (SSO)
+
+Очистить `mmapp_token` → редирект на **`{AUTH_PORTAL_URL}/logout`**.
+
+## Production
+
+См. общий стек CDN+MM: `deploy/docker-compose.cdn-mm.yml` / `deploy/env.cdn-mm.example`.
+
+```env
+AUTH_REQUIRED=true
+AUTH_JWT_SECRET=<тот же JWT_SECRET портала>
+AUTH_ISSUER=https://auth.shnt.top
+AUTH_PORTAL_URL=https://auth.shnt.top
+CORS_ORIGIN=https://mm.shnt.top
+```
+
+В portal: `RETURN_TO_ALLOWLIST` включает `https://mm.shnt.top` (или `.shnt.top`).
+
+## Troubleshooting
+
+| Симптом | Причина |
+|---------|---------|
+| SSO loop | разный `JWT_SECRET` или `ISSUER` |
+| 403 «Нет доступа к приложению» | нет app `mm` у пользователя |
+| 403 «Недостаточно прав» | нет нужного `mm:…` |
+| return_to rejected | origin MM не в `RETURN_TO_ALLOWLIST` |
@@ -43,7 +43,7 @@ Nav groups Auth Portal:
 - **Портал:** Приложения (`/apps`)
 - **Админ** (только `is_admin`): Пользователи (`/admin`), Журнал (`/admin/audit`), Ссылки приложений (`/admin/apps`)

-App Switcher: `portal_settings.app_switcher_json` → public `GET /api/v1/app-switcher`, admin `GET/PUT /api/v1/admin/app-switcher`. Ids: `cfdm` · `vps` · `bgp` · `fw` · `dns`.
+App Switcher: `portal_settings.app_switcher_json` → public `GET /api/v1/app-switcher`, admin `GET/PUT /api/v1/admin/app-switcher`. Ids: `cfdm` · `vps` · `bgp` · `fw` · `dns` · `cdn`.

 ## MCP workflow

@@ -47,6 +47,8 @@ const DEFAULT_ICONS: Record<AppId, AppSwitcherIconName> = {
  bgp: 'globe',
  fw: 'server',
  dns: 'globe',
+  cdn: 'cloud',
+  mm: 'dashboard',
 }

 const DEFAULT_AUTH_MODE: Record<AppId, AppAuthMode> = {
@@ -55,6 +57,8 @@ const DEFAULT_AUTH_MODE: Record<AppId, AppAuthMode> = {
  bgp: 'jwt',
  fw: 'jwt',
  dns: 'oidc',
+  cdn: 'jwt',
+  mm: 'jwt',
 }

 /** Seed / fallback when DB is empty. */
@@ -11,6 +11,8 @@ export const AUDIT_SOURCE_APPS = [
  'bgp',
  'fw',
  'dns',
+  'cdn',
+  'mm',
 ] as const
 export type AuditSourceApp = (typeof AUDIT_SOURCE_APPS)[number]
 export const auditSourceAppSchema = z.enum(AUDIT_SOURCE_APPS)
@@ -106,7 +108,7 @@ export type AuditPurgeResponse = z.infer<typeof auditPurgeResponseSchema>

 export const ingestAuditEventSchema = z.object({
  event_id: z.string().min(1).max(128),
-  source_app: z.enum(['vps', 'cfdm', 'bgp', 'fw', 'dns']),
+  source_app: z.enum(['vps', 'cfdm', 'bgp', 'fw', 'dns', 'cdn', 'mm']),
  action: z.string().min(1).max(200),
  severity: auditSeveritySchema.optional(),
  actor_user_id: z.string().nullable().optional(),
@@ -1,6 +1,6 @@
 import { z } from 'zod'

-export const APP_IDS = ['cfdm', 'vps', 'bgp', 'fw', 'dns'] as const
+export const APP_IDS = ['cfdm', 'vps', 'bgp', 'fw', 'dns', 'cdn', 'mm'] as const
 export type AppId = (typeof APP_IDS)[number]
 export const appIdSchema = z.enum(APP_IDS)

@@ -57,6 +57,20 @@ export const APPS: AppMeta[] = [
    url: 'https://dns.shnt.top',
    authMode: 'oidc',
  },
+  {
+    id: 'cdn',
+    title: 'CDN Manager',
+    description: 'Флот DNS: ноды, алиасы, sync Cloudflare',
+    url: 'https://cdn.shnt.top',
+    authMode: 'jwt',
+  },
+  {
+    id: 'mm',
+    title: 'MikrotikManager',
+    description: 'MikroTik: серверы, фильтры, BGP, uptime',
+    url: 'https://mm.shnt.top',
+    authMode: 'jwt',
+  },
 ]

 export type CatalogSection = {
@@ -154,6 +168,36 @@ export const PERMISSION_CATALOG: AppPermissionCatalog[] = [
      section('settings', 'Настройки', 'SSO и системные настройки', ['admin']),
    ],
  },
+  {
+    appId: 'cdn',
+    title: 'CDN Manager',
+    sections: [
+      section('dashboard', 'Панель', 'KPI и обзор', ['read']),
+      section('nodes', 'Ноды', 'Канонические хосты A/AAAA'),
+      section('aliases', 'Алиасы', 'CNAME и retarget'),
+      section('zones', 'Зоны', 'Cloudflare zones и BIND export'),
+      section('sync', 'Синхронизация', 'Pull/diff/apply DNS', ['write']),
+      section('topology', 'Топология', 'Схема флота', ['read']),
+      section('settings', 'Настройки', 'Naming, TTL, Cloudflare', ['admin']),
+    ],
+  },
+  {
+    appId: 'mm',
+    title: 'MikrotikManager',
+    sections: [
+      section('dashboard', 'Дашборд', 'Обзор и KPI', ['read']),
+      section('servers', 'Серверы', 'MikroTik / CHR хосты'),
+      section('filters', 'Фильтры', 'Firewall и address-list'),
+      section('bgp', 'BGP', 'BGP-сессии и префиксы'),
+      section('uptime', 'Uptime', 'Пинги и speed-probes'),
+      section('traffic', 'Трафик', 'Интерфейсы и графики'),
+      section('alerts', 'Алерты', 'Правила и Telegram'),
+      section('backups', 'Бэкапы', 'Конфиги и расписание'),
+      section('certificates', 'Сертификаты', 'ACME / TLS'),
+      section('network', 'Сеть', 'GRE, OSPF, пути'),
+      section('settings', 'Настройки', 'Настройки приложения', ['admin']),
+    ],
+  },
 ]

 export function permissionKey(
Author	SHA1	Message	Date
DenozordecandCursor	fd7d9fd13c	feat(apps): добавить MikrotikManager app id mm quality / commitlint (push) Skipped Details quality / changes (push) Successful in 7s Details quality / docker-check (push) Skipped Details quality / web (push) Successful in 40s Details quality / api (push) Successful in 36s Details CD / quality (push) Successful in 1m37s Details CD / publish (push) Successful in 1m40s Details Регистрация mm в каталоге приложений, permissions mm:*, target-app и docs. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-04 20:38:27 +07:00
DenozordecandCursor	01d3a79e13	test(app-switcher): add tests for CDN app integration quality / commitlint (push) Skipped Details quality / changes (push) Successful in 5s Details quality / web (push) Skipped Details quality / docker-check (push) Skipped Details quality / api (push) Successful in 34s Details CD / quality (push) Successful in 43s Details CD / publish (push) Successful in 1m25s Details - Updated app-switcher tests to include verification for the newly integrated CDN app. - Added assertions to check the presence and authentication mode of the CDN app in the response. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-04 14:18:00 +07:00
DenozordecandCursor	0f1f89776b	feat(cdn): integrate CDN Manager into the application quality / commitlint (push) Skipped Details quality / changes (push) Successful in 5s Details quality / docker-check (push) Skipped Details quality / web (push) Successful in 57s Details quality / api (push) Failing after 30s Details CD / quality (push) Failing after 1m36s Details CD / publish (push) Skipped Details - Updated environment configurations to include CDN Manager in the RETURN_TO_ALLOWLIST. - Enhanced target app resolution to recognize CDN-related hosts. - Added CDN Manager to the application switcher and updated relevant documentation. - Included tests to verify the correct mapping of CDN hosts. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-04 14:11:34 +07:00
DenozordecandCursor	a591d12c69	chore(reui): обновить ReUI agent skill до актуальной версии quality / changes (push) Successful in 6s Details quality / web (push) Skipped Details quality / api (push) Skipped Details quality / commitlint (push) Skipped Details quality / docker-check (push) Skipped Details CD / quality (push) Successful in 8s Details CD / publish (push) Successful in 33s Details Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-19 20:03:54 +07:00