@ai-coders/installer 0.3.0

package/dist/products/second-brain/keys.js

@@ -0,0 +1,16 @@
+/**
+ * Deploy keypair generation. ssh2 emits OpenSSH-format ed25519 keys on every
+ * platform, which is what the workflow writes verbatim to ~/.ssh/deploy_key.
+ */
+import ssh2 from "ssh2";
+export function generateDeployKey() {
+    return new Promise((resolve, reject) => {
+        ssh2.utils.generateKeyPair("ed25519", { comment: "second-brain-deploy" }, (error, keys) => {
+            if (error)
+                reject(error);
+            else
+                resolve({ publicKey: keys.public, privateKey: keys.private });
+        });
+    });
+}
+//# sourceMappingURL=keys.js.map

package/dist/products/second-brain/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../packages/second-brain/src/keys.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,IAAI,MAAM,MAAM,CAAC;AAOxB,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,CAAC,KAAK,CAAC,eAAe,CACxB,SAAS,EACT,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAClC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACd,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;gBACpB,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACrE,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/products/second-brain/main.d.ts

@@ -0,0 +1,3 @@
+export declare function runSecondBrainInstaller(options: {
+    readonly projectRoot: string;
+}): Promise<void>;

package/dist/products/second-brain/main.js

@@ -0,0 +1,78 @@
+/** Local web-UI installer composition root for the Second Brain product. */
+import { execFile } from "node:child_process";
+import { spawn } from "node:child_process";
+import path from "node:path";
+import { promisify } from "node:util";
+import { parseRepositoryFromRemote } from "./github.js";
+import { defaultLanguage, installerMessages } from "./i18n.js";
+import { startInstallerServer } from "./server.js";
+import { createInstallerService, loadInitialState } from "./service.js";
+import { stateFileName } from "./state.js";
+const execFileAsync = promisify(execFile);
+const messages = installerMessages[defaultLanguage];
+async function detectRepository(repoRoot) {
+    try {
+        const { stdout } = await execFileAsync("git", ["remote", "get-url", "origin"], { cwd: repoRoot });
+        return parseRepositoryFromRemote(stdout.trim());
+    }
+    catch {
+        return null;
+    }
+}
+function openBrowser(url) {
+    const command = process.platform === "darwin"
+        ? { file: "open", args: [url] }
+        : process.platform === "win32"
+            ? { file: "cmd", args: ["/c", "start", "", url] }
+            : { file: "xdg-open", args: [url] };
+    try {
+        const child = spawn(command.file, command.args, {
+            detached: true,
+            stdio: "ignore",
+        });
+        child.on("error", () => { });
+        child.unref();
+    }
+    catch {
+        // The printed URL is the contract; opening the browser is best effort.
+    }
+}
+export async function runSecondBrainInstaller(options) {
+    const repoRoot = path.resolve(options.projectRoot);
+    const statePath = path.join(repoRoot, stateFileName);
+    let server;
+    try {
+        const [initialState, detectedRepository] = await Promise.all([
+            loadInitialState(statePath),
+            detectRepository(repoRoot),
+        ]);
+        const service = createInstallerService({
+            statePath,
+            repoRoot,
+            initialState,
+            detectedRepository,
+        });
+        server = await startInstallerServer(service);
+    }
+    catch {
+        throw new Error(messages.terminalStartFailed);
+    }
+    process.stdout.write(`${messages.terminalRunningAt}\n│  ${server.url}\n│\n`);
+    process.stdout.write(`${messages.terminalPressCtrlC}\n`);
+    openBrowser(server.url);
+    let shutdownPromise = null;
+    const shutdown = () => {
+        if (shutdownPromise !== null)
+            return;
+        shutdownPromise = server
+            .close()
+            .then(() => process.exit(0))
+            .catch(() => {
+            process.stderr.write(`${messages.terminalStopFailed}\n`);
+            process.exit(1);
+        });
+    };
+    process.on("SIGINT", shutdown);
+    process.on("SIGTERM", shutdown);
+}
+//# sourceMappingURL=main.js.map

package/dist/products/second-brain/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../../packages/second-brain/src/main.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,yBAAyB,EAAsB,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;AAEpD,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IAC9C,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CACpC,KAAK,EACL,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAC/B,EAAE,GAAG,EAAE,QAAQ,EAAE,CAClB,CAAC;QACF,OAAO,yBAAyB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,OAAO,GACX,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAC3B,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE;QAC/B,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC5B,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE;YACjD,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;YAC9C,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC5B,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;IACzE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAE7C;IACC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACrD,IAAI,MAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,CAAC,YAAY,EAAE,kBAAkB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC3D,gBAAgB,CAAC,SAAS,CAAC;YAC3B,gBAAgB,CAAC,QAAQ,CAAC;SAC3B,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,sBAAsB,CAAC;YACrC,SAAS;YACT,QAAQ;YACR,YAAY;YACZ,kBAAkB;SACnB,CAAC,CAAC;QACH,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,iBAAiB,QAAQ,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC;IAC7E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,kBAAkB,IAAI,CAAC,CAAC;IACzD,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,eAAe,GAAyB,IAAI,CAAC;IACjD,MAAM,QAAQ,GAAG,GAAS,EAAE;QAC1B,IAAI,eAAe,KAAK,IAAI;YAAE,OAAO;QACrC,eAAe,GAAG,MAAM;aACrB,KAAK,EAAE;aACP,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aAC3B,KAAK,CAAC,GAAG,EAAE;YACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,kBAAkB,IAAI,CAAC,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC"}

package/dist/products/second-brain/ports.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Host-port provisioning for the compose loopback binds. The compose file
+ * publishes the engine on 127.0.0.1:3000 and the OAuth server on
+ * 127.0.0.1:3001 by default, and another product installed on the same VPS
+ * may already hold those ports — `docker compose up` then fails with "port
+ * is already allocated". The installer probes the server's listeners and
+ * provisions free ports through SECOND_BRAIN_HTTP_PORT and
+ * SECOND_BRAIN_OAUTH_PORT in /opt/second-brain/.env.
+ */
+export declare const defaultHttpPort = 3000;
+export declare const defaultOauthPort = 3001;
+/**
+ * Lists every TCP listener, then the host ports second-brain's own
+ * containers publish. Own binds are not conflicts: compose replaces those
+ * containers and rebinds the same ports. Each half degrades to empty output
+ * instead of failing the install on a server missing one command.
+ */
+export declare const portProbeCommand: string;
+/** Ports something other than second-brain's own containers listens on. */
+export declare function parsePortProbe(stdout: string): Set<number>;
+export interface HostPorts {
+    readonly httpPort: number;
+    readonly oauthPort: number;
+}
+export declare function isDefaultHostPorts(ports: HostPorts): boolean;
+/**
+ * Keeps ports a previous install pinned in .env (its own containers hold
+ * those binds) and otherwise picks the first free port at or above each
+ * default. The engine skips the OAuth default so the pair stays legible.
+ */
+export declare function chooseHostPorts(input: {
+    readonly existingEnv: Record<string, string>;
+    readonly occupied: ReadonlySet<number>;
+}): HostPorts;

package/dist/products/second-brain/ports.js

@@ -0,0 +1,77 @@
+/**
+ * Host-port provisioning for the compose loopback binds. The compose file
+ * publishes the engine on 127.0.0.1:3000 and the OAuth server on
+ * 127.0.0.1:3001 by default, and another product installed on the same VPS
+ * may already hold those ports — `docker compose up` then fails with "port
+ * is already allocated". The installer probes the server's listeners and
+ * provisions free ports through SECOND_BRAIN_HTTP_PORT and
+ * SECOND_BRAIN_OAUTH_PORT in /opt/second-brain/.env.
+ */
+export const defaultHttpPort = 3000;
+export const defaultOauthPort = 3001;
+const probeSeparator = "__second-brain-own-ports__";
+const scanLimit = 200;
+/**
+ * Lists every TCP listener, then the host ports second-brain's own
+ * containers publish. Own binds are not conflicts: compose replaces those
+ * containers and rebinds the same ports. Each half degrades to empty output
+ * instead of failing the install on a server missing one command.
+ */
+export const portProbeCommand = `ss -ltnH 2>/dev/null; echo ${probeSeparator}; ` +
+    "docker ps --filter label=com.docker.compose.project=second-brain " +
+    "--format '{{.Ports}}' 2>/dev/null; true";
+function parsePort(value) {
+    if (value === undefined || !/^\d+$/.test(value))
+        return undefined;
+    const port = Number(value);
+    return port >= 1 && port <= 65535 ? port : undefined;
+}
+/** Ports something other than second-brain's own containers listens on. */
+export function parsePortProbe(stdout) {
+    const [listenersText = "", ownText = ""] = stdout.split(probeSeparator);
+    const occupied = new Set();
+    for (const line of listenersText.split("\n")) {
+        // ss -ltnH: "LISTEN 0 4096 127.0.0.1:3000 0.0.0.0:*"; the local address
+        // may also be [::]:3000 or *:3000, so take the digits after the last ":".
+        const local = line.trim().split(/\s+/)[3];
+        const port = parsePort(local?.slice(local.lastIndexOf(":") + 1));
+        if (port !== undefined)
+            occupied.add(port);
+    }
+    // docker ps Ports: "127.0.0.1:3001->3001/tcp, 3000/tcp" — the host port
+    // sits between ":" and "->".
+    for (const match of ownText.matchAll(/:(\d+)->/g)) {
+        const own = parsePort(match[1]);
+        if (own !== undefined)
+            occupied.delete(own);
+    }
+    return occupied;
+}
+export function isDefaultHostPorts(ports) {
+    return (ports.httpPort === defaultHttpPort && ports.oauthPort === defaultOauthPort);
+}
+/**
+ * Keeps ports a previous install pinned in .env (its own containers hold
+ * those binds) and otherwise picks the first free port at or above each
+ * default. The engine skips the OAuth default so the pair stays legible.
+ */
+export function chooseHostPorts(input) {
+    const pinnedHttp = parsePort(input.existingEnv["SECOND_BRAIN_HTTP_PORT"]);
+    const pinnedOauth = parsePort(input.existingEnv["SECOND_BRAIN_OAUTH_PORT"]);
+    const taken = new Set(input.occupied);
+    if (pinnedOauth !== undefined)
+        taken.add(pinnedOauth);
+    const httpPort = pinnedHttp ??
+        nextFreePort(defaultHttpPort, new Set([...taken, defaultOauthPort]));
+    taken.add(httpPort);
+    const oauthPort = pinnedOauth ?? nextFreePort(defaultOauthPort, taken);
+    return { httpPort, oauthPort };
+}
+function nextFreePort(from, taken) {
+    for (let port = from; port < from + scanLimit; port += 1) {
+        if (!taken.has(port))
+            return port;
+    }
+    throw new Error(`No free port found between ${from} and ${from + scanLimit - 1}.`);
+}
+//# sourceMappingURL=ports.js.map

package/dist/products/second-brain/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../packages/second-brain/src/ports.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AACpC,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAErC,MAAM,cAAc,GAAG,4BAA4B,CAAC;AACpD,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAC3B,8BAA8B,cAAc,IAAI;IAChD,mEAAmE;IACnE,yCAAyC,CAAC;AAE5C,SAAS,SAAS,CAAC,KAAyB;IAC1C,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,OAAO,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,CAAC,aAAa,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,wEAAwE;QACxE,0EAA0E;QAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjE,IAAI,IAAI,KAAK,SAAS;YAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IACD,wEAAwE;IACxE,6BAA6B;IAC7B,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,GAAG,KAAK,SAAS;YAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAOD,MAAM,UAAU,kBAAkB,CAAC,KAAgB;IACjD,OAAO,CACL,KAAK,CAAC,QAAQ,KAAK,eAAe,IAAI,KAAK,CAAC,SAAS,KAAK,gBAAgB,CAC3E,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAG/B;IACC,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAC1E,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,WAAW,KAAK,SAAS;QAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtD,MAAM,QAAQ,GACZ,UAAU;QACV,YAAY,CAAC,eAAe,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACvE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpB,MAAM,SAAS,GAAG,WAAW,IAAI,YAAY,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACvE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,KAA0B;IAC5D,KAAK,IAAI,IAAI,GAAG,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACpC,CAAC;IACD,MAAM,IAAI,KAAK,CACb,8BAA8B,IAAI,QAAQ,IAAI,GAAG,SAAS,GAAG,CAAC,GAAG,CAClE,CAAC;AACJ,CAAC"}

package/dist/products/second-brain/recovery.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Reconnects a new computer to an existing VPS installation. Recovery proves
+ * server ownership over SSH, reads only the public hostname, installs a fresh
+ * deploy key for this computer, and persists a new private local state file.
+ */
+import type { DeployKeyPair } from "./keys.js";
+import type { InstallerLanguage } from "./i18n.js";
+import type { InstallerState } from "./state.js";
+import type { SshLike } from "./apply.js";
+type RecoverySshAuth = {
+    readonly kind: "password";
+    readonly password: string;
+} | {
+    readonly kind: "key";
+    readonly privateKey: string;
+};
+export interface RecoveryInput {
+    readonly language: InstallerLanguage;
+    readonly repository?: {
+        readonly owner: string;
+        readonly repo: string;
+    } | undefined;
+    readonly vps: {
+        readonly host: string;
+        readonly port: number;
+        readonly username: string;
+    };
+    readonly vpsAuth: RecoverySshAuth;
+}
+export interface RecoveryDependencies {
+    readonly generateKey: () => Promise<DeployKeyPair>;
+    readonly connectSsh: (credentials: {
+        readonly host: string;
+        readonly port: number;
+        readonly username: string;
+        readonly auth: RecoverySshAuth;
+    }) => Promise<SshLike>;
+    readonly saveState: (state: InstallerState) => Promise<void>;
+    readonly now: () => Date;
+}
+export type RecoveryOutcome = {
+    readonly ok: true;
+    readonly domain: string;
+} | {
+    readonly ok: false;
+    readonly error: string;
+};
+export declare const readRecoveryMetadataCommand: string;
+export declare function recoverExistingInstallation(input: RecoveryInput, deps: RecoveryDependencies): Promise<RecoveryOutcome>;
+export {};

package/dist/products/second-brain/recovery.js

@@ -0,0 +1,96 @@
+import { normalizeDomain } from "./envfile.js";
+import { buildAuthorizedKeysCommand } from "./ssh.js";
+export const readRecoveryMetadataCommand = [
+    "test -f /opt/second-brain/.env || exit 44",
+    "test -f /opt/second-brain/compose.yaml || exit 44",
+    "domain=$(awk -F= '$1 == \"SECOND_BRAIN_PUBLIC_HOST\" { sub(/^[^=]*=/, \"\"); print; exit }' /opt/second-brain/.env)",
+    "test -n \"$domain\" || exit 45",
+    "printf '%s\\n' \"$domain\"",
+].join(" && ");
+export async function recoverExistingInstallation(input, deps) {
+    let keys;
+    try {
+        keys = await deps.generateKey();
+    }
+    catch {
+        return {
+            ok: false,
+            error: "A new local deploy key could not be created.",
+        };
+    }
+    let ssh;
+    try {
+        ssh = await deps.connectSsh({ ...input.vps, auth: input.vpsAuth });
+    }
+    catch (error) {
+        return {
+            ok: false,
+            error: error instanceof Error ? error.message : String(error),
+        };
+    }
+    try {
+        const metadata = await ssh.exec(readRecoveryMetadataCommand);
+        if (metadata.code !== 0 || metadata.stdout.trim() === "") {
+            return {
+                ok: false,
+                error: "No existing Second Brain installation was found on this server.",
+            };
+        }
+        let domain;
+        try {
+            domain = normalizeDomain(metadata.stdout.trim());
+        }
+        catch {
+            return {
+                ok: false,
+                error: "The existing installation has an invalid public hostname.",
+            };
+        }
+        const authorized = await ssh.exec(buildAuthorizedKeysCommand(keys.publicKey));
+        if (authorized.code !== 0) {
+            return {
+                ok: false,
+                error: "The new local deploy key could not be installed on the server.",
+            };
+        }
+        try {
+            const keySession = await deps.connectSsh({
+                ...input.vps,
+                auth: { kind: "key", privateKey: keys.privateKey },
+            });
+            keySession.close();
+        }
+        catch {
+            return {
+                ok: false,
+                error: "The new local deploy key could not connect to the server.",
+            };
+        }
+        const timestamp = deps.now().toISOString();
+        try {
+            await deps.saveState({
+                version: 1,
+                language: input.language,
+                ...(input.repository === undefined
+                    ? {}
+                    : { repository: input.repository }),
+                vps: input.vps,
+                deployKey: keys,
+                domain,
+                installedAt: timestamp,
+                updatedAt: timestamp,
+            });
+        }
+        catch {
+            return {
+                ok: false,
+                error: "The recovered settings could not be saved on this computer.",
+            };
+        }
+        return { ok: true, domain };
+    }
+    finally {
+        ssh.close();
+    }
+}
+//# sourceMappingURL=recovery.js.map

package/dist/products/second-brain/recovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery.js","sourceRoot":"","sources":["../../../packages/second-brain/src/recovery.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAmCtD,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,2CAA2C;IAC3C,mDAAmD;IACnD,qHAAqH;IACrH,gCAAgC;IAChC,4BAA4B;CAC7B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAEf,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAoB,EACpB,IAA0B;IAE1B,IAAI,IAAmB,CAAC;IACxB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,8CAA8C;SACtD,CAAC;IACJ,CAAC;IAED,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC7D,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACzD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,iEAAiE;aACzE,CAAC;QACJ,CAAC;QAED,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,2DAA2D;aACnE,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,IAAI,CAC/B,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,CAC3C,CAAC;QACF,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,gEAAgE;aACxE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC;gBACvC,GAAG,KAAK,CAAC,GAAG;gBACZ,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;aACnD,CAAC,CAAC;YACH,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,2DAA2D;aACnE,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,CAAC;gBACV,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS;oBAChC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;gBACrC,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,SAAS,EAAE,IAAI;gBACf,MAAM;gBACN,WAAW,EAAE,SAAS;gBACtB,SAAS,EAAE,SAAS;aACrB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,6DAA6D;aACrE,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,KAAK,EAAE,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/products/second-brain/sealed-box.d.ts

@@ -0,0 +1 @@
+export declare function sealForGitHubSecret(publicKeyBase64: string, value: string): Promise<string>;

package/dist/products/second-brain/sealed-box.js

@@ -0,0 +1,11 @@
+/**
+ * GitHub Actions secrets require libsodium sealed-box encryption with the
+ * repository public key; node:crypto has no crypto_box_seal equivalent.
+ */
+import sodium from "libsodium-wrappers";
+export async function sealForGitHubSecret(publicKeyBase64, value) {
+    await sodium.ready;
+    const sealed = sodium.crypto_box_seal(sodium.from_string(value), sodium.from_base64(publicKeyBase64, sodium.base64_variants.ORIGINAL));
+    return sodium.to_base64(sealed, sodium.base64_variants.ORIGINAL);
+}
+//# sourceMappingURL=sealed-box.js.map

package/dist/products/second-brain/sealed-box.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealed-box.js","sourceRoot":"","sources":["../../../packages/second-brain/src/sealed-box.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,eAAuB,EACvB,KAAa;IAEb,MAAM,MAAM,CAAC,KAAK,CAAC;IACnB,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CACnC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,EACzB,MAAM,CAAC,WAAW,CAAC,eAAe,EAAE,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CACrE,CAAC;IACF,OAAO,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;AACnE,CAAC"}

package/dist/products/second-brain/server.d.ts

@@ -0,0 +1,143 @@
+import type { InstallerLanguage } from "./i18n.js";
+import type { InstallStepReport } from "./apply.js";
+import type { DnsCheckResult, VerificationResult } from "./verify.js";
+import type { HostingerVirtualMachine } from "./hostinger.js";
+import type { WorkflowRun } from "./github.js";
+export interface InstallerContext {
+    readonly mode: "wizard" | "dashboard";
+    readonly language: InstallerLanguage;
+    readonly repository: {
+        readonly owner: string;
+        readonly repo: string;
+    } | null;
+    readonly domain: string | null;
+    readonly vpsHost: string | null;
+    readonly ownerEmail: string | null;
+    readonly githubConnected: boolean;
+}
+export interface InstallProgress {
+    readonly running: boolean;
+    readonly finished: boolean;
+    readonly ok: boolean | null;
+    readonly steps: readonly InstallStepReport[];
+    /**
+     * The provisioned static bearer token, present only after an install that
+     * requested one finished. Held in memory and shown once — never persisted.
+     */
+    readonly bearerToken?: string;
+}
+interface HostingerOperationFailure {
+    readonly ok: false;
+    readonly errorCode: string;
+    readonly correlationId?: string;
+    readonly retryAfterMs?: number;
+}
+type HostingerVirtualMachinesResult = {
+    readonly ok: true;
+    readonly virtualMachines: readonly HostingerVirtualMachine[];
+} | HostingerOperationFailure;
+type HostingerPasswordPreparationResult = {
+    readonly ok: true;
+    readonly confirmationToken: string;
+    readonly target: {
+        readonly virtualMachineId: number;
+        readonly hostname: string;
+        readonly ipv4Id: number;
+        readonly ipv4: string;
+    };
+} | HostingerOperationFailure;
+type HostingerPasswordResetResult = {
+    readonly ok: true;
+    readonly actionId: number;
+} | HostingerOperationFailure;
+export interface InstallerService {
+    context(): InstallerContext;
+    connectHostinger(input: {
+        token: string;
+    }): Promise<HostingerVirtualMachinesResult>;
+    disconnectHostinger(): Promise<{
+        readonly ok: true;
+    } | HostingerOperationFailure>;
+    refreshHostinger(): Promise<HostingerVirtualMachinesResult>;
+    prepareHostingerRootPasswordReset(input: {
+        virtualMachineId: number;
+    }): Promise<HostingerPasswordPreparationResult>;
+    resetHostingerRootPassword(input: {
+        confirmationToken: string;
+        confirmationText: string;
+        password: string;
+    }): Promise<HostingerPasswordResetResult>;
+    validateGitHub(input: {
+        token: string;
+        owner: string;
+        repo: string;
+    }): Promise<unknown>;
+    connectGitHub(input: {
+        token: string;
+        owner?: string;
+        repo?: string;
+    }): Promise<unknown>;
+    testSsh(input: {
+        host: string;
+        port: number;
+        username: string;
+        password: string;
+    }): Promise<{
+        ok: boolean;
+        message?: string;
+        proof?: string;
+    }>;
+    recoverExisting(input: Record<string, unknown>): Promise<{
+        ok: boolean;
+        domain?: string;
+        error?: string;
+    }>;
+    checkDns(input: {
+        domain: string;
+        host: string;
+    }): Promise<DnsCheckResult>;
+    startInstall(input: Record<string, unknown>): {
+        started: boolean;
+        error?: string;
+    };
+    deployLocal(): {
+        started: boolean;
+    };
+    progress(): InstallProgress;
+    deploy(input: {
+        imageTag?: string;
+    }): Promise<{
+        ok: boolean;
+    }>;
+    listRuns(): Promise<WorkflowRun[]>;
+    bootstrapOwner(input: {
+        email: string;
+        password: string;
+    }): Promise<{
+        kind: string;
+        message?: string;
+    }>;
+    provisionBearer(input: {
+        email: string;
+    }): Promise<{
+        ok: boolean;
+        bearerToken?: string;
+        error?: string;
+    }>;
+    verify(): Promise<VerificationResult>;
+    reset(): Promise<{
+        ok: boolean;
+        errorCode?: string;
+    }>;
+    shutdown?(): void | Promise<void>;
+}
+export interface InstallerServer {
+    readonly url: string;
+    close(): Promise<void>;
+}
+export interface InstallerServerOptions {
+    /** Directory holding the built UI (index.html + assets/). Test override. */
+    readonly uiDir?: string;
+}
+export declare function startInstallerServer(service: InstallerService, options?: InstallerServerOptions): Promise<InstallerServer>;
+export {};