@ai-coders/installer 0.3.0

package/dist/products/second-brain/apply.d.ts

@@ -0,0 +1,86 @@
+/**
+ * The install pipelines. The first install runs entirely from the local
+ * machine: it uploads the source tree over SFTP and builds on the VPS, so no
+ * GitHub credential is involved. Every effect is injected so the sequences
+ * are unit-testable; the server wires real implementations.
+ */
+import type { DeployKeyPair } from "./keys.js";
+import type { InstallerLanguage } from "./i18n.js";
+import type { InstallerState } from "./state.js";
+import type { SshCommandResult } from "./ssh.js";
+import type { VerificationResult } from "./verify.js";
+export type InstallStepId = "generate-key" | "connect-vps" | "authorize-key" | "write-env" | "upload-source" | "build-deploy" | "verify-key" | "create-owner" | "verify-mcp" | "save-state";
+export declare const installStepIds: readonly InstallStepId[];
+export declare const localDeployStepIds: readonly InstallStepId[];
+export type InstallStepStatus = "pending" | "running" | "ok" | "failed" | "skipped";
+export interface InstallStepReport {
+    readonly id: InstallStepId;
+    status: InstallStepStatus;
+    note?: string;
+    link?: string;
+}
+export interface InstallInput {
+    readonly language: InstallerLanguage;
+    readonly repository?: {
+        readonly owner: string;
+        readonly repo: string;
+    } | undefined;
+    readonly vps: {
+        readonly host: string;
+        readonly port: number;
+        readonly username: string;
+    };
+    readonly vpsAuth: {
+        readonly kind: "password";
+        readonly password: string;
+    } | {
+        readonly kind: "key";
+        readonly privateKey: string;
+    };
+    readonly domain: string;
+    readonly openRouterApiKey: string;
+    readonly ownerEmail: string;
+    readonly ownerPassword: string;
+    readonly enableBearerToken: boolean;
+}
+export interface LocalDeployInput {
+    readonly vps: {
+        readonly host: string;
+        readonly port: number;
+        readonly username: string;
+    };
+    readonly privateKey: string;
+    readonly domain: string;
+}
+export interface SshLike {
+    exec(command: string, input?: string): Promise<SshCommandResult>;
+    readFileIfExists(path: string): Promise<string | null>;
+    writeFile(path: string, content: string | Buffer, mode?: number): Promise<void>;
+    close(): void;
+}
+export interface InstallDependencies {
+    readonly generateKey: () => Promise<DeployKeyPair>;
+    readonly connectSsh: (credentials: {
+        host: string;
+        port: number;
+        username: string;
+        auth: InstallInput["vpsAuth"];
+    }) => Promise<SshLike>;
+    readonly archiveSource: () => Promise<Buffer>;
+    readonly isSourceDirty?: (() => Promise<boolean>) | undefined;
+    readonly verifyDeployment: (publicUrl: string) => Promise<VerificationResult>;
+    readonly saveState: (state: InstallerState) => Promise<void>;
+    readonly now: () => Date;
+    readonly sleep: (ms: number) => Promise<void>;
+    readonly freshDatabasePassword?: string;
+    readonly freshBearerToken?: string;
+}
+export interface InstallOutcome {
+    readonly ok: boolean;
+    readonly steps: readonly InstallStepReport[];
+    readonly verification?: VerificationResult;
+    /** Present only when the install provisioned a static bearer token. */
+    readonly bearerToken?: string;
+}
+export declare function runInstall(input: InstallInput, deps: InstallDependencies, onProgress?: (steps: readonly InstallStepReport[]) => void): Promise<InstallOutcome>;
+export declare function runLocalDeploy(input: LocalDeployInput, deps: InstallDependencies, onProgress?: (steps: readonly InstallStepReport[]) => void): Promise<InstallOutcome>;

package/dist/products/second-brain/apply.js

@@ -0,0 +1,277 @@
+import { buildOwnerBootstrapInput, interpretBootstrapResult, ownerBootstrapCommand, waitEngineCommand, } from "./bootstrap.js";
+import { provisionBearerToken } from "./bearer.js";
+import { mergeVpsEnv, generateDatabasePassword, parseEnvContent, vpsEnvPath, } from "./envfile.js";
+import { chooseHostPorts, isDefaultHostPorts, parsePortProbe, portProbeCommand, } from "./ports.js";
+import { buildAuthorizedKeysCommand } from "./ssh.js";
+export const installStepIds = [
+    "generate-key",
+    "connect-vps",
+    "authorize-key",
+    "write-env",
+    "upload-source",
+    "build-deploy",
+    "verify-key",
+    "create-owner",
+    "verify-mcp",
+    "save-state",
+];
+export const localDeployStepIds = [
+    "connect-vps",
+    "upload-source",
+    "build-deploy",
+    "verify-mcp",
+];
+const envPath = vpsEnvPath;
+const tarballPath = "/opt/second-brain/source.tar.gz";
+const verifyAttempts = 6;
+const verifyDelayMs = 20_000;
+function createStepRunner(ids, onProgress) {
+    const steps = ids.map((id) => ({
+        id,
+        status: "pending",
+    }));
+    const report = () => onProgress?.(steps.map((item) => ({ ...item })));
+    const step = (id) => {
+        const found = steps.find((candidate) => candidate.id === id);
+        if (found === undefined)
+            throw new Error(`Unknown step ${id}`);
+        return found;
+    };
+    return {
+        steps,
+        step,
+        report,
+        fail(id, message, link) {
+            const failed = step(id);
+            failed.status = "failed";
+            failed.note = message;
+            if (link !== undefined)
+                failed.link = link;
+            for (const remaining of steps) {
+                if (remaining.status === "pending")
+                    remaining.status = "skipped";
+            }
+            report();
+            return { ok: false, steps };
+        },
+        async run(id, action) {
+            step(id).status = "running";
+            report();
+            try {
+                const value = await action();
+                step(id).status = "ok";
+                report();
+                return { ok: true, value };
+            }
+            catch (error) {
+                return {
+                    ok: false,
+                    message: error instanceof Error ? error.message : String(error),
+                    link: error instanceof Error
+                        ? error.link
+                        : undefined,
+                };
+            }
+        },
+    };
+}
+async function execOrThrow(ssh, command, fallbackMessage) {
+    const result = await ssh.exec(command);
+    if (result.code !== 0) {
+        throw new Error(result.stderr.trim() || fallbackMessage);
+    }
+}
+async function uploadSource(ssh, tarball) {
+    await execOrThrow(ssh, "mkdir -p /opt/second-brain", "mkdir failed.");
+    await ssh.writeFile(tarballPath, tarball, 0o600);
+    // Remove directories the repo owns before extracting so files deleted
+    // from the repo cannot linger and end up inside the next image build.
+    // The VPS .env is not in the tarball and is never touched.
+    await execOrThrow(ssh, "rm -rf /opt/second-brain/src /opt/second-brain/migrations /opt/second-brain/test /opt/second-brain/docs /opt/second-brain/deploy /opt/second-brain/installer" +
+        ` && tar -xzf ${tarballPath} -C /opt/second-brain && rm -f ${tarballPath}`, "The source upload could not be extracted.");
+}
+async function buildDeploy(ssh) {
+    const result = await ssh.exec("SECOND_BRAIN_DEPLOY_MODE=build bash /opt/second-brain/deploy/deploy.sh");
+    if (result.code !== 0) {
+        // deploy.sh dumps compose status and service logs to stdout on failure,
+        // while Docker's pull/build progress floods stderr. Keep the stdout tail
+        // (the diagnosis) large and the stderr tail (the compose error line)
+        // small so the progress panel shows what actually broke.
+        const tail = (text, max) => text.length > max ? text.slice(-max) : text;
+        const output = `${tail(result.stdout, 3400)}\n${tail(result.stderr, 600)}`.trim();
+        throw new Error(output || "The build on the server failed.");
+    }
+}
+async function waitForEngine(ssh) {
+    await execOrThrow(ssh, waitEngineCommand, "The engine did not become healthy after owner bootstrap.");
+}
+async function verifyWithRetries(deps, domain) {
+    let verification;
+    for (let attempt = 1; attempt <= verifyAttempts; attempt += 1) {
+        verification = await deps.verifyDeployment(`https://${domain}`);
+        if (verification.ready)
+            return verification;
+        if (attempt < verifyAttempts)
+            await deps.sleep(verifyDelayMs);
+    }
+    throw new Error(verification?.steps.find((item) => item.outcome === "failed")?.summary ??
+        "The server did not pass verification.");
+}
+export async function runInstall(input, deps, onProgress) {
+    const runner = createStepRunner(installStepIds, onProgress);
+    const generated = await runner.run("generate-key", () => deps.generateKey());
+    if (!generated.ok)
+        return runner.fail("generate-key", generated.message);
+    const keys = generated.value;
+    const connected = await runner.run("connect-vps", () => deps.connectSsh({ ...input.vps, auth: input.vpsAuth }));
+    if (!connected.ok)
+        return runner.fail("connect-vps", connected.message);
+    const ssh = connected.value;
+    try {
+        const authorized = await runner.run("authorize-key", () => execOrThrow(ssh, buildAuthorizedKeysCommand(keys.publicKey), "authorized_keys update failed."));
+        if (!authorized.ok)
+            return runner.fail("authorize-key", authorized.message);
+        const wroteEnv = await runner.run("write-env", async () => {
+            const existing = await ssh.readFileIfExists(envPath);
+            // Another product on the same VPS may hold the default loopback ports;
+            // probe the server and provision free ones before compose binds them.
+            const probe = await ssh.exec(portProbeCommand);
+            const hostPorts = chooseHostPorts({
+                existingEnv: existing === null ? {} : parseEnvContent(existing),
+                occupied: parsePortProbe(probe.stdout),
+            });
+            const merged = mergeVpsEnv({
+                existingContent: existing ?? undefined,
+                domain: input.domain,
+                openRouterApiKey: input.openRouterApiKey,
+                freshDatabasePassword: deps.freshDatabasePassword ?? generateDatabasePassword(),
+                hostPorts,
+            });
+            await execOrThrow(ssh, "mkdir -p /opt/second-brain", "mkdir failed.");
+            await ssh.writeFile(envPath, merged.content, 0o600);
+            if (!isDefaultHostPorts(hostPorts)) {
+                runner.step("write-env").note =
+                    `alternate-ports ${hostPorts.httpPort}/${hostPorts.oauthPort}`;
+            }
+            else if (merged.keptExistingDatabasePassword) {
+                runner.step("write-env").note = "kept-database-password";
+            }
+        });
+        if (!wroteEnv.ok)
+            return runner.fail("write-env", wroteEnv.message);
+        const uploaded = await runner.run("upload-source", async () => {
+            const tarball = await deps.archiveSource();
+            await uploadSource(ssh, tarball);
+            // The archive ships HEAD; uncommitted local edits stay behind. Warn so
+            // a member never wonders why a change did not reach the server.
+            if ((await deps.isSourceDirty?.()) === true) {
+                runner.step("upload-source").note = "uncommitted-changes";
+            }
+        });
+        if (!uploaded.ok)
+            return runner.fail("upload-source", uploaded.message);
+        const built = await runner.run("build-deploy", () => buildDeploy(ssh));
+        if (!built.ok)
+            return runner.fail("build-deploy", built.message);
+        const keyWorks = await runner.run("verify-key", async () => {
+            const session = await deps.connectSsh({
+                ...input.vps,
+                auth: { kind: "key", privateKey: keys.privateKey },
+            });
+            session.close();
+        });
+        if (!keyWorks.ok)
+            return runner.fail("verify-key", keyWorks.message);
+        let bearerToken;
+        const owner = await runner.run("create-owner", async () => {
+            const result = await ssh.exec(ownerBootstrapCommand, buildOwnerBootstrapInput(input.ownerEmail, input.ownerPassword));
+            const outcome = interpretBootstrapResult(result);
+            if (outcome.kind === "failed")
+                throw new Error(outcome.message);
+            if (outcome.kind === "already-exists") {
+                runner.step("create-owner").note = "already-exists";
+            }
+            if (input.enableBearerToken) {
+                bearerToken = await provisionBearerToken(ssh, input.ownerEmail, deps.freshBearerToken);
+            }
+            await waitForEngine(ssh);
+        });
+        if (!owner.ok)
+            return runner.fail("create-owner", owner.message);
+        let verification;
+        const verified = await runner.run("verify-mcp", async () => {
+            verification = await verifyWithRetries(deps, input.domain);
+        });
+        if (!verified.ok)
+            return runner.fail("verify-mcp", verified.message);
+        const saved = await runner.run("save-state", async () => {
+            const timestamp = deps.now().toISOString();
+            await deps.saveState({
+                version: 1,
+                language: input.language,
+                ...(input.repository === undefined
+                    ? {}
+                    : { repository: input.repository }),
+                vps: input.vps,
+                deployKey: keys,
+                domain: input.domain,
+                ownerEmail: input.ownerEmail,
+                installedAt: timestamp,
+                updatedAt: timestamp,
+            });
+        });
+        if (!saved.ok)
+            return runner.fail("save-state", saved.message);
+        runner.report();
+        return {
+            ok: true,
+            steps: runner.steps,
+            ...(verification === undefined ? {} : { verification }),
+            ...(bearerToken === undefined ? {} : { bearerToken }),
+        };
+    }
+    finally {
+        ssh.close();
+    }
+}
+export async function runLocalDeploy(input, deps, onProgress) {
+    const runner = createStepRunner(localDeployStepIds, onProgress);
+    const connected = await runner.run("connect-vps", () => deps.connectSsh({
+        ...input.vps,
+        auth: { kind: "key", privateKey: input.privateKey },
+    }));
+    if (!connected.ok)
+        return runner.fail("connect-vps", connected.message);
+    const ssh = connected.value;
+    try {
+        const uploaded = await runner.run("upload-source", async () => {
+            const tarball = await deps.archiveSource();
+            await uploadSource(ssh, tarball);
+            if ((await deps.isSourceDirty?.()) === true) {
+                runner.step("upload-source").note = "uncommitted-changes";
+            }
+        });
+        if (!uploaded.ok)
+            return runner.fail("upload-source", uploaded.message);
+        const built = await runner.run("build-deploy", () => buildDeploy(ssh));
+        if (!built.ok)
+            return runner.fail("build-deploy", built.message);
+        let verification;
+        const verified = await runner.run("verify-mcp", async () => {
+            await waitForEngine(ssh);
+            verification = await verifyWithRetries(deps, input.domain);
+        });
+        if (!verified.ok)
+            return runner.fail("verify-mcp", verified.message);
+        runner.report();
+        return {
+            ok: true,
+            steps: runner.steps,
+            ...(verification === undefined ? {} : { verification }),
+        };
+    }
+    finally {
+        ssh.close();
+    }
+}
+//# sourceMappingURL=apply.js.map

package/dist/products/second-brain/apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.js","sourceRoot":"","sources":["../../../packages/second-brain/src/apply.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,eAAe,EACf,UAAU,GACX,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AActD,MAAM,CAAC,MAAM,cAAc,GAA6B;IACtD,cAAc;IACd,aAAa;IACb,eAAe;IACf,WAAW;IACX,eAAe;IACf,cAAc;IACd,YAAY;IACZ,cAAc;IACd,YAAY;IACZ,YAAY;CACb,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAA6B;IAC1D,aAAa;IACb,eAAe;IACf,cAAc;IACd,YAAY;CACb,CAAC;AAmFF,MAAM,OAAO,GAAG,UAAU,CAAC;AAC3B,MAAM,WAAW,GAAG,iCAAiC,CAAC;AACtD,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,aAAa,GAAG,MAAM,CAAC;AAgB7B,SAAS,gBAAgB,CACvB,GAA6B,EAC7B,UAA0D;IAE1D,MAAM,KAAK,GAAwB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAClD,EAAE;QACF,MAAM,EAAE,SAAS;KAClB,CAAC,CAAC,CAAC;IACJ,MAAM,MAAM,GAAG,GAAS,EAAE,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,CAAC,EAAiB,EAAqB,EAAE;QACpD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAC/D,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,OAAO;QACL,KAAK;QACL,IAAI;QACJ,MAAM;QACN,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;YACxB,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC;YACzB,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC;YACtB,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;YAC3C,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;gBAC9B,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS;oBAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC;YACnE,CAAC;YACD,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM;YAClB,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,SAAS,CAAC;YAC5B,MAAM,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,MAAM,EAAE,CAAC;gBAC7B,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC;gBACvB,MAAM,EAAE,CAAC;gBACT,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YAC7B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBAC/D,IAAI,EACF,KAAK,YAAY,KAAK;wBACpB,CAAC,CAAE,KAAmC,CAAC,IAAI;wBAC3C,CAAC,CAAC,SAAS;iBAChB,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,GAAY,EACZ,OAAe,EACf,eAAuB;IAEvB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,eAAe,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,GAAY,EAAE,OAAe;IACvD,MAAM,WAAW,CAAC,GAAG,EAAE,4BAA4B,EAAE,eAAe,CAAC,CAAC;IACtE,MAAM,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACjD,sEAAsE;IACtE,sEAAsE;IACtE,2DAA2D;IAC3D,MAAM,WAAW,CACf,GAAG,EACH,8JAA8J;QAC5J,gBAAgB,WAAW,kCAAkC,WAAW,EAAE,EAC5E,2CAA2C,CAC5C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAY;IACrC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAC3B,wEAAwE,CACzE,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,yDAAyD;QACzD,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,GAAW,EAAU,EAAE,CACjD,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9C,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,iCAAiC,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAY;IACvC,MAAM,WAAW,CACf,GAAG,EACH,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;AACJ,CAAC;AAGD,KAAK,UAAU,iBAAiB,CAC9B,IAAyB,EACzB,MAAc;IAEd,IAAI,YAA4C,CAAC;IACjD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,cAAc,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAC9D,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC;QAChE,IAAI,YAAY,CAAC,KAAK;YAAE,OAAO,YAAY,CAAC;QAC5C,IAAI,OAAO,GAAG,cAAc;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,IAAI,KAAK,CACb,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,EAAE,OAAO;QACpE,uCAAuC,CAC1C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,KAAmB,EACnB,IAAyB,EACzB,UAA0D;IAE1D,MAAM,MAAM,GAAG,gBAAgB,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IAE5D,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC;IAE7B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,EAAE,CACrD,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CACvD,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC;IAE5B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,EAAE,CACxD,WAAW,CACT,GAAG,EACH,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,EAC1C,gCAAgC,CACjC,CACF,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;QAE5E,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE;YACxD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACrD,uEAAuE;YACvE,sEAAsE;YACtE,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC/C,MAAM,SAAS,GAAG,eAAe,CAAC;gBAChC,WAAW,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC;gBAC/D,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC;aACvC,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,WAAW,CAAC;gBACzB,eAAe,EAAE,QAAQ,IAAI,SAAS;gBACtC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,qBAAqB,EACnB,IAAI,CAAC,qBAAqB,IAAI,wBAAwB,EAAE;gBAC1D,SAAS;aACV,CAAC,CAAC;YACH,MAAM,WAAW,CAAC,GAAG,EAAE,4BAA4B,EAAE,eAAe,CAAC,CAAC;YACtE,MAAM,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACpD,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI;oBAC3B,mBAAmB,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;YACnE,CAAC;iBAAM,IAAI,MAAM,CAAC,4BAA4B,EAAE,CAAC;gBAC/C,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,GAAG,wBAAwB,CAAC;YAC3D,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAEpE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3C,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACjC,uEAAuE;YACvE,gEAAgE;YAChE,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC5C,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,GAAG,qBAAqB,CAAC;YAC5D,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAExE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAEjE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC;gBACpC,GAAG,KAAK,CAAC,GAAG;gBACZ,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;aACnD,CAAC,CAAC;YACH,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAErE,IAAI,WAA+B,CAAC;QACpC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE;YACxD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAC3B,qBAAqB,EACrB,wBAAwB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,CAChE,CAAC;YACF,MAAM,OAAO,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAChE,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACtC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,GAAG,gBAAgB,CAAC;YACtD,CAAC;YACD,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;gBAC5B,WAAW,GAAG,MAAM,oBAAoB,CACtC,GAAG,EACH,KAAK,CAAC,UAAU,EAChB,IAAI,CAAC,gBAAgB,CACtB,CAAC;YACJ,CAAC;YACD,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAEjE,IAAI,YAA4C,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;YACzD,YAAY,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAErE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;YAC3C,MAAM,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,CAAC;gBACV,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS;oBAChC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;gBACrC,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,WAAW,EAAE,SAAS;gBACtB,SAAS,EAAE,SAAS;aACrB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAE/D,MAAM,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO;YACL,EAAE,EAAE,IAAI;YACR,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;YACvD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;SACtD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,KAAK,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAuB,EACvB,IAAyB,EACzB,UAA0D;IAE1D,MAAM,MAAM,GAAG,gBAAgB,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;IAEhE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,EAAE,CACrD,IAAI,CAAC,UAAU,CAAC;QACd,GAAG,KAAK,CAAC,GAAG;QACZ,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE;KACpD,CAAC,CACH,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC;IAE5B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3C,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACjC,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC5C,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,GAAG,qBAAqB,CAAC;YAC5D,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAExE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAEjE,IAAI,YAA4C,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;YACzB,YAAY,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAErE,MAAM,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO;YACL,EAAE,EAAE,IAAI;YACR,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;SACxD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,KAAK,EAAE,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/products/second-brain/bearer.d.ts

@@ -0,0 +1,29 @@
+import type { SshCommandResult } from "./ssh.js";
+export declare function generateBearerToken(): string;
+/**
+ * Runs psql inside the postgres container, which owns the credentials as
+ * POSTGRES_USER/POSTGRES_DB environment variables. The query arrives on
+ * stdin via buildAccountIdLookupInput.
+ */
+export declare const accountIdLookupCommand: string;
+export declare function buildAccountIdLookupInput(email: string): string;
+export type AccountIdLookupOutcome = {
+    readonly kind: "found";
+    readonly accountId: string;
+} | {
+    readonly kind: "failed";
+    readonly message: string;
+};
+/** The SSH surface bearer provisioning needs; SshLike satisfies it. */
+export interface BearerSsh {
+    exec(command: string, input?: string): Promise<SshCommandResult>;
+    readFileIfExists(path: string): Promise<string | null>;
+    writeFile(path: string, content: string | Buffer, mode?: number): Promise<void>;
+}
+/**
+ * Looks up the owner's account id and stores a fresh bearer credential in
+ * the VPS .env. The caller must restart the engine afterwards (wait-engine
+ * mode does) so the stored credential becomes active.
+ */
+export declare function provisionBearerToken(ssh: BearerSsh, ownerEmail: string, freshToken?: string): Promise<string>;
+export declare function interpretAccountIdLookup(result: SshCommandResult): AccountIdLookupOutcome;

package/dist/products/second-brain/bearer.js

@@ -0,0 +1,78 @@
+/**
+ * Optional static bearer credential provisioning. The engine accepts a
+ * static token alongside OAuth when INVOKTA_HTTP_BEARER_TOKEN and
+ * INVOKTA_HTTP_PRINCIPAL_ID are both present in /opt/second-brain/.env (see
+ * the engine's src/http-auth.ts). The principal must be the owner's account
+ * id, which exists only after owner bootstrap, so provisioning runs inside
+ * the create-owner step. The lookup SQL travels on stdin — the command line
+ * never carries the owner's email — and the email is escaped into a SQL
+ * literal so it cannot break out of the query.
+ */
+import { randomBytes } from "node:crypto";
+import { vpsEnvPath, withBearerCredentials } from "./envfile.js";
+export function generateBearerToken() {
+    // 32 bytes → 43 base64url characters, above the engine's 32-character
+    // minimum and safe for parseEnv.
+    return randomBytes(32).toString("base64url");
+}
+/**
+ * Runs psql inside the postgres container, which owns the credentials as
+ * POSTGRES_USER/POSTGRES_DB environment variables. The query arrives on
+ * stdin via buildAccountIdLookupInput.
+ */
+export const accountIdLookupCommand = "cd /opt/second-brain && docker compose exec -T postgres " +
+    'sh -c \'exec psql -U "$POSTGRES_USER" -d "$POSTGRES_DB" -tAq -v ON_ERROR_STOP=1\'';
+export function buildAccountIdLookupInput(email) {
+    if (/[\r\n\0]/u.test(email)) {
+        throw new Error("The owner email must not contain line breaks.");
+    }
+    // Doubling single quotes is complete escaping for a standard-conforming
+    // Postgres string literal. The column stores lower(btrim(email)).
+    const literal = email.replaceAll("'", "''");
+    return `select id from accounts where email = lower(btrim('${literal}'));\n`;
+}
+const uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * Looks up the owner's account id and stores a fresh bearer credential in
+ * the VPS .env. The caller must restart the engine afterwards (wait-engine
+ * mode does) so the stored credential becomes active.
+ */
+export async function provisionBearerToken(ssh, ownerEmail, freshToken) {
+    const lookup = await ssh.exec(accountIdLookupCommand, buildAccountIdLookupInput(ownerEmail));
+    const outcome = interpretAccountIdLookup(lookup);
+    if (outcome.kind === "failed")
+        throw new Error(outcome.message);
+    const token = freshToken ?? generateBearerToken();
+    const existing = await ssh.readFileIfExists(vpsEnvPath);
+    if (existing === null) {
+        throw new Error("The server configuration went missing before the bearer token could be stored.");
+    }
+    await ssh.writeFile(vpsEnvPath, withBearerCredentials(existing, {
+        token,
+        principalId: outcome.accountId,
+    }), 0o600);
+    return token;
+}
+export function interpretAccountIdLookup(result) {
+    if (result.code === 0) {
+        const value = result.stdout.trim();
+        if (uuidPattern.test(value))
+            return { kind: "found", accountId: value };
+        if (value === "") {
+            return {
+                kind: "failed",
+                message: "The owner account was not found for the provided email.",
+            };
+        }
+    }
+    const lastLine = result.stderr
+        .split("\n")
+        .map((line) => line.trim())
+        .filter((line) => line !== "")
+        .at(-1);
+    return {
+        kind: "failed",
+        message: lastLine ?? "The owner account id could not be read.",
+    };
+}
+//# sourceMappingURL=bearer.js.map

package/dist/products/second-brain/bearer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.js","sourceRoot":"","sources":["../../../packages/second-brain/src/bearer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAGjE,MAAM,UAAU,mBAAmB;IACjC,sEAAsE;IACtE,iCAAiC;IACjC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GACjC,0DAA0D;IAC1D,mFAAmF,CAAC;AAEtF,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,wEAAwE;IACxE,kEAAkE;IAClE,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5C,OAAO,sDAAsD,OAAO,QAAQ,CAAC;AAC/E,CAAC;AAMD,MAAM,WAAW,GACf,iEAAiE,CAAC;AAapE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAc,EACd,UAAkB,EAClB,UAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAC3B,sBAAsB,EACtB,yBAAyB,CAAC,UAAU,CAAC,CACtC,CAAC;IACF,MAAM,OAAO,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,UAAU,IAAI,mBAAmB,EAAE,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,gFAAgF,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,CAAC,SAAS,CACjB,UAAU,EACV,qBAAqB,CAAC,QAAQ,EAAE;QAC9B,KAAK;QACL,WAAW,EAAE,OAAO,CAAC,SAAS;KAC/B,CAAC,EACF,KAAK,CACN,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,MAAwB;IAExB,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACxE,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACjB,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,yDAAyD;aACnE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM;SAC3B,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;SAC7B,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACV,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,QAAQ,IAAI,yCAAyC;KAC/D,CAAC;AACJ,CAAC"}

package/dist/products/second-brain/bootstrap.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Remote owner-account creation.
+ *
+ * The engine reads the credentials from standard input, so nothing secret
+ * reaches the command line: the password never appears in `ps`, in the
+ * server's shell history, or in a container's environment. `-T` keeps compose
+ * off a TTY, which is what lets the engine read the piped credentials.
+ *
+ * The stderr sentences below match the stable messages surfaced by the
+ * engine's src/oauth/bootstrap-failure.ts.
+ */
+import type { SshCommandResult } from "./ssh.js";
+export declare const ownerBootstrapCommand: string;
+/**
+ * Engine and worker fail closed until embedding spaces exist. Call this after
+ * owner bootstrap so crash-looping containers pick up the new spaces.
+ */
+export declare const waitEngineCommand: string;
+/**
+ * Builds the two credential lines. A line break in either field would shift
+ * the password onto a line the engine does not read, so it is refused rather
+ * than escaped.
+ */
+export declare function buildOwnerBootstrapInput(email: string, password: string): string;
+export type BootstrapOutcome = {
+    readonly kind: "created";
+} | {
+    readonly kind: "already-exists";
+} | {
+    readonly kind: "failed";
+    readonly message: string;
+};
+export declare function interpretBootstrapResult(result: SshCommandResult): BootstrapOutcome;

package/dist/products/second-brain/bootstrap.js

@@ -0,0 +1,39 @@
+export const ownerBootstrapCommand = "cd /opt/second-brain && docker compose run --rm -T " +
+    "auth node dist/oauth/bootstrap-noninteractive.js";
+/**
+ * Engine and worker fail closed until embedding spaces exist. Call this after
+ * owner bootstrap so crash-looping containers pick up the new spaces.
+ */
+export const waitEngineCommand = "cd /opt/second-brain && SECOND_BRAIN_DEPLOY_MODE=wait-engine " +
+    "bash /opt/second-brain/deploy/deploy.sh";
+/**
+ * Builds the two credential lines. A line break in either field would shift
+ * the password onto a line the engine does not read, so it is refused rather
+ * than escaped.
+ */
+export function buildOwnerBootstrapInput(email, password) {
+    for (const value of [email, password]) {
+        if (/[\r\n]/u.test(value)) {
+            throw new Error("Bootstrap credentials must not contain line breaks.");
+        }
+    }
+    return `${email}\n${password}\n`;
+}
+export function interpretBootstrapResult(result) {
+    if (result.code === 0 && result.stdout.includes("OAuth owner created:")) {
+        return { kind: "created" };
+    }
+    if (result.stderr.includes("The OAuth owner account already exists.")) {
+        return { kind: "already-exists" };
+    }
+    const lastLine = result.stderr
+        .split("\n")
+        .map((line) => line.trim())
+        .filter((line) => line !== "")
+        .at(-1);
+    return {
+        kind: "failed",
+        message: lastLine ?? "The owner account could not be created.",
+    };
+}
+//# sourceMappingURL=bootstrap.js.map

package/dist/products/second-brain/bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../../packages/second-brain/src/bootstrap.ts"],"names":[],"mappings":"AAaA,MAAM,CAAC,MAAM,qBAAqB,GAChC,qDAAqD;IACrD,kDAAkD,CAAC;AAErD;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAC5B,+DAA+D;IAC/D,yCAAyC,CAAC;AAE5C;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAa,EACb,QAAgB;IAEhB,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;QACtC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,KAAK,KAAK,QAAQ,IAAI,CAAC;AACnC,CAAC;AAOD,MAAM,UAAU,wBAAwB,CACtC,MAAwB;IAExB,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,yCAAyC,CAAC,EAAE,CAAC;QACtE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACpC,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM;SAC3B,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;SAC7B,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACV,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,QAAQ,IAAI,yCAAyC;KAC/D,CAAC;AACJ,CAAC"}

package/dist/products/second-brain/envfile.d.ts

@@ -0,0 +1,35 @@
+import type { HostPorts } from "./ports.js";
+/** The placeholder written by deploy/vps-setup.sh before any real install. */
+export declare const databasePasswordPlaceholder = "replace-with-a-strong-database-password";
+export declare const vpsEnvPath = "/opt/second-brain/.env";
+/**
+ * Members paste domains in every shape — with https://, trailing slashes,
+ * paths, uppercase. The OAuth server refuses to start unless
+ * SECOND_BRAIN_PUBLIC_URL is a clean HTTPS origin, so normalize here.
+ */
+export declare function normalizeDomain(value: string): string;
+export declare function generateDatabasePassword(): string;
+export declare function parseEnvContent(text: string): Record<string, string>;
+export interface MergeVpsEnvInput {
+    readonly existingContent?: string | undefined;
+    readonly domain: string;
+    readonly openRouterApiKey: string;
+    readonly freshDatabasePassword: string;
+    readonly hostPorts: HostPorts;
+}
+export interface MergeVpsEnvResult {
+    readonly content: string;
+    readonly keptExistingDatabasePassword: boolean;
+}
+export interface BearerCredentials {
+    readonly token: string;
+    readonly principalId: string;
+}
+/**
+ * Adds or replaces the static bearer credential lines in the VPS .env. This
+ * runs after owner bootstrap — the principal id does not exist earlier — so
+ * it edits the file in place instead of re-rendering: deploy.sh may have
+ * upserted image pins since write-env, and those must survive.
+ */
+export declare function withBearerCredentials(content: string, credentials: BearerCredentials): string;
+export declare function mergeVpsEnv(input: MergeVpsEnvInput): MergeVpsEnvResult;