feat(items): add item stat profiles as configuration data

AGENTS.md

@@ -90,6 +90,5 @@ Don't perform large retroactive cleanups of existing code to fit the rules unles
 the user explicitly asks for it. Apply the rules going forward; pre-existing code
 can be refactored opportunistically when you're already touching it.
 
-Some parts of the codebase knowingly violate the rules and say so in a comment
-(for example `ItemPriceCalculator`). Leave them alone unless fixing them is the
-task.
+Some parts of the codebase knowingly violate the rules and say so in a comment.
+Leave them alone unless fixing them is the task.

deploy/all-in-one/docker-compose.override.yml

@@ -6,7 +6,7 @@ services:
       dockerfile: Startup/Dockerfile
     restart: "no"
     ports:
-      - "8081:8080"
+      - "127.0.0.1:8081:8080"
 
   database:
     ports:

deploy/all-in-one/docker-compose.yml

@@ -13,7 +13,7 @@ services:
     image: munique/openmu
     container_name: openmu-startup
     ports:
-      - "8080"
+      - "127.0.0.1::8080"
       - "45901:45901"
       - "45902:45902"
       - "45903:45903"

deploy/all-in-one/nginx/nginx.prod443.conf

@@ -90,6 +90,10 @@ http {
         }
 
         location / {
+           # Defining headers here replaces the server-level header configuration.
+           proxy_set_header Upgrade $http_upgrade;
+           proxy_set_header Connection "upgrade";
+           proxy_set_header X-Forwarded-Proto $scheme;
            proxy_pass http://openmu-startup:8080;
         }
     }

deploy/distributed/docker-compose.override.yml

@@ -32,4 +32,4 @@ services:
     environment:
       ASPNETCORE_ENVIRONMENT: Development
     ports:
-      - "88:8080"
+      - "127.0.0.1:88:8080"

deploy/distributed/docker-compose.yml

@@ -182,7 +182,7 @@ services:
       database:
         condition: service_healthy
     ports:
-      - "8080"
+      - "127.0.0.1::8080"
     environment:
       DAPR_HTTP_ENDPOINT: http://adminPanel-dapr:3500
       DAPR_GRPC_ENDPOINT: http://adminPanel-dapr:50001

deploy/distributed/nginx.prod443.conf

@@ -85,6 +85,10 @@ http {
         }
 
         location ~ (/admin)(.*) {
+           # Defining headers here replaces the server-level header configuration.
+           proxy_set_header Upgrade $http_upgrade;
+           proxy_set_header Connection "upgrade";
+           proxy_set_header X-Forwarded-Proto $scheme;
            proxy_pass http://adminPanel:8080/admin$2;
            # The login cookie has to be sent along with the requests of the other applications, like Grafana, too.
            proxy_cookie_path ~^/admin /;

docs-website/docs/admin-panel/authentication.md

@@ -181,15 +181,16 @@ application's configuration yet. **Delete** removes it for good.
 ### What a key may do
 
 A key has the same [roles](#roles) as a user, and defaults to **Viewer**. A key
-can also get the role **Cash shop coins only**, which allows nothing but the cash
+can also get the role **Cash shop coins only**, which allows nothing but the
+cash
 shop endpoints — that's the right one for a payment provider. Administrators
 have this role implicitly.
 
 | Endpoint | Needs |
 |---|---|
 | `GET /api/status` | Viewer |
 | `GET /api/is-online/{account}` | Viewer |
-| `GET /api/send/{server}?msg=` | Operator |
+| `POST /api/send/{server}?msg=` | Operator |
 | `POST /api/accounts` | Operator |
 | `GET /api/accounts/{account}/cash-shop` | Cash shop |
 | `POST /api/accounts/{account}/cash-shop/grants` | Cash shop |
@@ -258,10 +259,12 @@ grant the coins twice. The answer is:
 
 The game server applies the grant to the balance the next time the player opens
 the cash shop, even when the player is online at that moment.
-`GET /api/accounts/{account}/cash-shop` returns the saved balances and the latest
+`GET /api/accounts/{account}/cash-shop` returns the saved balances and the
+latest
 grants, where `appliedAt` is empty for the pending ones.
 
-Like the panel itself, the API is open as long as [no user exists at all](#the-first-user).
+Like the panel itself, the API is open as long as [no user exists at
+all](#the-first-user).
 
 ## Keeping the sessions alive across restarts
 
@@ -287,3 +290,44 @@ The location can be changed with `AdminPanel:Auth:DataProtectionKeyPath`.
   through a VPN or an SSH tunnel instead.
 * Remember that admin panel access means full access to your players' account
   data.
+
+## AI agents through MCP
+
+API keys with the Viewer role can also access the optional read-only
+[MCP endpoint](mcp.md). It is disabled by default and accepts API keys only.
+
+### Phase two MCP and API upgrade notes
+
+The panel still permits anonymous initial setup until the first admin user
+exists or a bootstrap user is configured. Setup operations are attributed to
+`setup`; when admin audit storage is unavailable they use sanitized log-only
+auditing.
+
+If the host restarts while the admin database is unreachable, it cannot
+distinguish a previous installation from initial setup and may allow anonymous
+setup actions with log-only auditing. Configure a bootstrap user with
+`OPENMU_ADMIN_USER` and `OPENMU_ADMIN_PASSWORD` to prevent that fallback.
+
+Explicit `-demo` mode also uses log-only panel auditing. MCP and API
+writes always require authentication and durable admin audit storage.
+
+Outside demo mode and initial setup, panel operations including **Stop** require
+the admin audit database. An outage blocks the action and displays an error. Use
+the host's service manager or orchestrator for emergency shutdown during an
+audit outage.
+
+External applications must update announcement requests from GET to
+`POST /api/send/{id}?msg=...`. The identifier is now the actual game server ID,
+rather than its position in a list. Operational APIs no longer allow anonymous
+requests during initial setup. See [MCP](mcp.md#phase-two-upgrade-notes) for the
+operational HTTP error statuses and uncertain-outcome handling.
+
+### Restrict MCP tools per key
+
+The optional **Allowed MCP tools** field accepts comma-separated exact names
+or area wildcards, such as `accounts_search,players_*,server_overview`.
+Empty keeps the key's existing role-based access. The allowlist further limits
+MCP discovery and direct calls; it never grants a tool beyond the key's role
+and does not alter REST API permissions. See
+[MCP configuration changes](mcp.md#configuration-and-offline-character-changes)
+for the preview/apply workflow.

docs-website/docs/admin-panel/configuration-updates.md

@@ -39,6 +39,33 @@ The updates take effect after a restart of the server process. Until then, the
 running server still works with the configuration it loaded at startup.
 :::
 
+Some updates are required before the game servers can run. For example, a game
+server doesn't start without the item price definitions, which the update *Add
+item price definitions* adds to databases from before they existed. Otherwise
+it would sell special items like jewels at the price of equipment. The game
+server logs the reason and stays stopped, while the admin panel keeps running,
+so you can apply the update here. Then use **Reload configuration and restart
+all game servers** on the [Servers page](servers.md), or restart the server
+process.
+
+## On a new database
+
+A new database already contains the changes of OpenMU's own updates, because the
+initialization creates the current configuration. It therefore marks them as
+applied, and this page starts empty.
+
+Plugins can bring configuration updates too, for example one which adds the
+plugin's own item. Their changes are not part of OpenMU's initialization, so such
+an update declares `RunsOnNewDatabase`, and a new database applies it right away,
+after the updates it depends on. On an existing database it is listed here like
+any other update.
+
+An optional update of that kind is not applied on a new database: it is listed
+here as pending, as on an existing database, so you decide whether to apply it.
+The same goes for the updates which would be applied and depend on it. Their
+dependencies are checked when you apply them, so an optional plugin update with a
+missing dependency doesn't stop the creation of a new database.
+
 ## Preconditions
 
 If the database is not installed yet, or a schema update is pending, this page

docs-website/docs/admin-panel/game-configuration.md

@@ -104,6 +104,31 @@ Item definitions with their requirements, level tables, possible options, socket
 and the classes which may equip them. Items use a dedicated editor with a
 graphical representation instead of the plain generic form.
 
+### Item prices
+
+The price of an item is used by the NPC merchants (buying, selling, repairing)
+and by the success rate of some crafting recipes. By default, an item gets the
+price of usual equipment: a base price from its drop level, increased by its
+skill and options. Items with a different price reference a *price definition*
+(the `PriceDefinition` of the item). The price definitions are in the full
+configuration tree (`ItemPriceDefinitions` of the game configuration), and one
+can be shared by several items.
+
+| Setting | Meaning |
+|---|---|
+| Base price formula | The price of one unit, for example `9000000`, or `(level + 1) * 200000`. Without a formula, the equipment price is used. |
+| Price per level | Fixed prices for specific item levels. They take precedence over the formula. |
+| Quantity scaling | `PerPiece` multiplies the price by the number of pieces (potions), `ByFillRatio` by the fill ratio (arrows). |
+| Modifiers | Which options increase the price, like for equipment: skill, luck, option, wing option, excellent. |
+| Selling price rounding | `Tens` rounds the selling price to tens and ignores the durability, like for potions. |
+| Crafting reference price | A different price for the success rate of crafting (e.g. the jewels). |
+
+The formula can use the variables `level`, `durability`, `maxDurability`,
+`value` (the value of the item), `dropLevel`, `optionLevel`, `optionCount`,
+`healthRecoveryOptionLevel` and `automaticPrice` (the equipment price). The game
+client calculates the prices it shows by itself, so changed prices only show up
+correctly in clients which calculate them the same way.
+
 ## Item options, option types and item sets
 
 The game configuration menu provides separate entries for these lists:
@@ -174,10 +199,77 @@ Route `edit-config-grid/…JewelMix/`
 
 The jewel stacking (mix/unmix) definitions.
 
+## Content activation
+
+Route `content-activation`
+
+Maps, character classes, monsters, items and mini games can be deactivated
+without deleting them from the configuration. This is how a server can be
+restricted to the content of a certain season: deactivate everything which was
+introduced later, and activate it again when you want to offer it.
+
+Each entry knows in which version of the original game it was introduced, from
+the early version numbers before Season 1 (like 0.34, 0.95k or 0.99G+, as listed
+by the [MU Online history](https://github.com/Khdoop/mu-online-history)) up to
+Season 6 Episode 3. Content of patches without a known version number counts
+as introduced in the next version with a known number.
+Select a version at the top and click **Restrict to game version** to activate
+all content up to this version and to deactivate everything which was
+introduced later — for example *Season 2* for a server without Summoners,
+Raklion, socket items and the other later content. Entries with an unknown
+version are left unchanged, so check them afterwards with the version column.
+The page shows how many entries will be activated and deactivated, and changes
+them after you confirm.
+
+:::note[The versions are best effort]
+The versions were compiled from the original patch notes and OpenMU's data of
+the older versions. Some entries, like a few event items, are *Unknown*. You can
+correct the version of an entry with *Introduced In* on its edit page.
+:::
+
+Pick the kind of content in the second row. The list can be narrowed down
+by its active state and by a search text (which also matches the version),
+and **Activate all shown** / **Deactivate all shown** change all entries of
+the narrowed list at once — for example, search for `Kanturu` and deactivate
+all shown entries. The changes are only stored after **Save changes** and the
+confirmation; **Discard changes** drops them. Save or discard them before
+restricting to a game version.
+
+Both actions are recorded in the
+[audit history](mcp.md#operational-safety-and-audit-history), and they are
+the same operations which agents use through the
+[MCP tools](mcp.md#configuration-and-offline-character-changes)
+`content_restrict_to_version` and `content_set_active`. Like other configuration
+changes, they require the *Administrator* role.
+
+What an inactive entry means in the game:
+
+| Content | Effect when inactive |
+|---|---|
+| Map | It can't be entered by warps or gates, no instance of it is created, and invasions skip it. A character which logs in on an inactive map is moved to the safezone map of it, or to the home map of its class. |
+| Character class | No new character of this class can be created, and its creation isn't unlocked on the character selection screen. Quests which would evolve a character into it aren't offered and can't be completed. Existing characters stay playable. |
+| Monster / NPC | It isn't spawned on the maps, also not by invasions. Monsters which are already spawned remain until the game server is restarted. |
+| Item | Monsters and item boxes don't drop it, and merchants don't offer it. Existing items stay usable. |
+| Mini game | It can't be entered, and its periodic start doesn't open it. |
+
+Entries are active by default, also after updating an existing installation;
+the configuration update *Set the game versions of the content* adds the versions
+to an existing installation. The settings are also available as *Is Active* and
+*Introduced In* on the edit page of each entry.
+
+:::tip[Deactivate the plugins, too]
+Invasions and the periodic starts of the mini games skip inactive content and
+don't announce an event when nothing of it is active. Other features are
+implemented as plugins without such content, for example the chat commands or
+the custom gameplay plugins. Deactivate them on the [Plugins](plugins.md) page
+if they don't fit the season of your server.
+:::
+
 ## Plugins, chat commands, map editor
 
-The lower part of the drop-down leads to [Plugins](plugins.md),
-[Chat commands](chat-commands.md) and the [Map editor](map-editor.md).
+The lower part of the drop-down leads to [Content activation](#content-activation),
+[Plugins](plugins.md), [Chat commands](chat-commands.md) and the
+[Map editor](map-editor.md).
 
 ## Full configuration
 
@@ -210,6 +302,9 @@ actions per row:
 A form with one input per property of the object, grouped by category. Referenced
 objects are shown as drop-downs, collections as editable sub-lists which lead
 deeper into the tree. The breadcrumb at the top is how you find your way back.
+The sub-lists of items, monsters, skills and maps additionally show their number
+(and the group of an item) next to the name, so that entries with similar
+names are easy to tell apart.
 
 Some types have a specialized editor instead of (or in addition to) the generic
 form — items, item storages and maps.