@alashi/cli 0.11.0 → 0.13.0

package/dist/{store-VoJe_U1Q.mjs → store-DoAGOynU.mjs}

@@ -1,16 +1,352 @@
-import { APP_NAME_PATTERN, AppSdkError, ConfigError, JsonFileStore, SDK_VERSION, evaluateAppConfig, interpolateConfig, manifestConfigDefaults, mergeConfig, parseAgentFile, parseManifest } from "@alashi/apps-sdk";
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { deleteCookie, getCookie, setCookie } from "hono/cookie";
+import { APP_NAME_PATTERN, AppSdkError, ConfigError, JsonFileStore, SDK_VERSION, evaluateAppConfig, interpolateConfig, manifestConfigDefaults, mergeConfig, parseAgentFile, parseManifestWithWarnings } from "@alashi/apps-sdk";
 import semver from "semver";
 import { execFile } from "node:child_process";
-import { randomUUID } from "node:crypto";
 import { cp, lstat, mkdir, readFile, readdir, readlink, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
 import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { promisify } from "node:util";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { z } from "zod";
+import { getConnInfo } from "@hono/node-server/conninfo";
 import { Hono } from "hono";
 import { streamSSE } from "hono/streaming";
 import { Cron } from "croner";
 import { homedir } from "node:os";
+//#region src/auth.ts
+/** Session cookie lifetime. Fixed, not sliding: re-login once a month. */
+const SESSION_TTL_MS = 2592e6;
+const SESSION_COOKIE = "alashi_session";
+/** Recognizable in `Authorization: Bearer ...` and in shell history. */
+const TOKEN_PREFIX = "alashi_tok_";
+function sha256(value) {
+	return createHash("sha256").update(value).digest("hex");
+}
+/** Constant-time compare of two hex digests of equal length. */
+function hashEquals(a, b) {
+	const bufA = Buffer.from(a, "hex");
+	const bufB = Buffer.from(b, "hex");
+	return bufA.length === bufB.length && timingSafeEqual(bufA, bufB);
+}
+const LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"::1"
+]);
+function isLoopbackAddress(addr) {
+	const bare = addr.startsWith("::ffff:") ? addr.slice(7) : addr;
+	return bare === "::1" || bare.startsWith("127.");
+}
+const FORWARDING_HEADERS = [
+	"x-forwarded-for",
+	"x-forwarded-host",
+	"x-forwarded-proto",
+	"x-real-ip",
+	"forwarded"
+];
+/** True when the request carries any reverse-proxy forwarding header. */
+function hasForwardingHeaders(headers) {
+	return FORWARDING_HEADERS.some((name) => headers.get(name) !== null);
+}
+/**
+* The console heuristic: is this request verifiably from the local machine?
+*
+* Requires all three of: a loopback peer address, a local request hostname,
+* and no forwarding headers — because tunnels (ngrok, cloudflared, `tailscale
+* serve`) connect from loopback too, and what gives them away is the forwarded
+* hostname or the forwarding headers they add. A proxy configured to strip
+* both is indistinguishable from a local request; `mode: "required"` exists
+* for anyone deliberately exposing the host.
+*
+* `hostname` is the request URL's hostname (which the server derives from the
+* Host header) rather than the raw header, because in-process requests carry
+* no Host header at all. `remoteAddress === undefined` means an in-process
+* request (tests, the host calling itself) — there is no socket, so it is by
+* definition local.
+*/
+function isConsoleRequest(hostname, headers, remoteAddress) {
+	if (remoteAddress !== void 0 && !isLoopbackAddress(remoteAddress)) return false;
+	if (hasForwardingHeaders(headers)) return false;
+	return LOOPBACK_HOSTS.has(hostname.toLowerCase().replace(/^\[|\]$/g, ""));
+}
+/**
+* The access level a path demands. Deny-by-default shape: everything is at
+* least `user` unless it is explicitly public, and the routes that change
+* host state or spend-relevant settings (config, budgets, manual job runs)
+* are `owner`.
+*/
+function requiredLevel(path, publicApps) {
+	if (path === "/login" || path === "/logout" || path === "/api/me" || path === "/favicon.ico") return "public";
+	if (path === "/assets" || path.startsWith("/assets/")) return "public";
+	if (path.startsWith("/app/")) {
+		const name = path.slice(5).split("/", 1)[0] ?? "";
+		return publicApps.includes(name) ? "public" : "user";
+	}
+	if (path.startsWith("/settings/")) return "owner";
+	if (/^\/api\/apps\/[^/]+\/(config|budget)$/.test(path)) return "owner";
+	if (/^\/api\/apps\/[^/]+\/jobs\/[^/]+\/run$/.test(path)) return "owner";
+	return "user";
+}
+function meetsLevel(identity, required) {
+	return required !== "owner" || identity.level === "owner";
+}
+/**
+* Host authentication: bearer tokens and browser sessions persisted in
+* `auth.json` (hashes only), plus an in-memory one-time boot login token.
+* Writes are serialized so concurrent logins cannot lose each other's update.
+*/
+var AuthService = class {
+	store;
+	queue = Promise.resolve();
+	bootHash;
+	constructor(store) {
+		this.store = store;
+	}
+	/**
+	* Mints the one-time login secret printed at serve startup. In-memory only
+	* and consumed by the first successful login; restart the host (or mint a
+	* real token) to get another.
+	*/
+	issueBootToken() {
+		const secret = `${TOKEN_PREFIX}${randomBytes(24).toString("hex")}`;
+		this.bootHash = sha256(secret);
+		return secret;
+	}
+	/** Creates a persistent owner bearer token; the secret is only returned here. */
+	async mintToken(label) {
+		const secret = `${TOKEN_PREFIX}${randomBytes(24).toString("hex")}`;
+		const record = {
+			id: randomBytes(6).toString("hex"),
+			...label !== void 0 && label !== "" && { label },
+			hash: sha256(secret),
+			createdAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		await this.mutate((state) => {
+			state.tokens.push(record);
+		});
+		return {
+			id: record.id,
+			secret
+		};
+	}
+	async listTokens() {
+		const { tokens } = await this.store.readAuthState();
+		return tokens.map(({ hash: _hash, ...info }) => info);
+	}
+	/** Revokes a token and every session it created is left alone: sessions expire on their own. */
+	async revokeToken(id) {
+		let found = false;
+		await this.mutate((state) => {
+			const before = state.tokens.length;
+			state.tokens = state.tokens.filter((token) => token.id !== id);
+			found = state.tokens.length !== before;
+		});
+		return found;
+	}
+	/**
+	* Exchanges a login secret (boot token or minted token) for an identity.
+	* A boot token is consumed by success; minted tokens are reusable.
+	*/
+	async redeemLoginSecret(secret) {
+		const hash = sha256(secret);
+		if (this.bootHash !== void 0 && hashEquals(hash, this.bootHash)) {
+			this.bootHash = void 0;
+			return {
+				level: "owner",
+				via: "boot",
+				name: "owner"
+			};
+		}
+		return this.tokenIdentity(hash);
+	}
+	/** Resolves `Authorization: Bearer <secret>`; undefined when absent or invalid. */
+	async bearerIdentity(authorization) {
+		if (authorization === void 0 || !authorization.toLowerCase().startsWith("bearer ")) return;
+		return this.tokenIdentity(sha256(authorization.slice(7).trim()));
+	}
+	async tokenIdentity(hash) {
+		const { tokens } = await this.store.readAuthState();
+		const token = tokens.find((entry) => hashEquals(entry.hash, hash));
+		if (!token) return void 0;
+		this.mutate((state) => {
+			const entry = state.tokens.find((candidate) => candidate.id === token.id);
+			if (entry) entry.lastUsedAt = (/* @__PURE__ */ new Date()).toISOString();
+		}).catch(() => void 0);
+		return {
+			level: "owner",
+			via: "token",
+			name: token.label ?? `token ${token.id}`
+		};
+	}
+	/** Creates a session for an already-verified identity; returns the cookie value. */
+	async createSession(identity, at = /* @__PURE__ */ new Date()) {
+		const value = randomBytes(24).toString("hex");
+		const record = {
+			hash: sha256(value),
+			name: identity.name,
+			level: identity.level,
+			createdAt: at.toISOString(),
+			expiresAt: new Date(at.getTime() + SESSION_TTL_MS).toISOString()
+		};
+		await this.mutate((state) => {
+			state.sessions.push(record);
+		});
+		return value;
+	}
+	/** Resolves a session cookie value; undefined when unknown or expired. */
+	async sessionIdentity(value, at = /* @__PURE__ */ new Date()) {
+		if (value === void 0 || value === "") return void 0;
+		const hash = sha256(value);
+		const { sessions } = await this.store.readAuthState();
+		const session = sessions.find((entry) => hashEquals(entry.hash, hash));
+		if (!session || session.expiresAt <= at.toISOString()) return void 0;
+		return {
+			level: session.level,
+			via: "session",
+			name: session.name
+		};
+	}
+	/** Deletes the session behind a cookie value (logout). */
+	async destroySession(value) {
+		const hash = sha256(value);
+		await this.mutate((state) => {
+			state.sessions = state.sessions.filter((entry) => !hashEquals(entry.hash, hash));
+		});
+	}
+	/** Read-modify-write of auth.json, serialized, with expired sessions pruned. */
+	mutate(change) {
+		const next = this.queue.then(async () => {
+			const state = await this.store.readAuthState();
+			const now = (/* @__PURE__ */ new Date()).toISOString();
+			state.sessions = state.sessions.filter((session) => session.expiresAt > now);
+			change(state);
+			await this.store.writeAuthState(state);
+		});
+		this.queue = next.catch(() => void 0);
+		return next;
+	}
+};
+function wantsHtml(c) {
+	return c.req.method === "GET" && (c.req.header("accept") ?? "").includes("text/html");
+}
+/** Tailscale identity, when the config says the headers can be believed. */
+function tailscaleIdentity(c, trusted) {
+	if (!trusted) return void 0;
+	const login = c.req.header("tailscale-user-login");
+	if (login === void 0 || login === "") return void 0;
+	return {
+		level: "user",
+		via: "tailscale",
+		name: c.req.header("tailscale-user-name") ?? login
+	};
+}
+/**
+* The host's front door. Resolves an identity for every request (bearer token,
+* session cookie, tailscale headers, console heuristic — in that order) and
+* enforces the path's required level. Auth config is read per request so
+* settings changes apply without a restart.
+*/
+function createAuthMiddleware(store, auth, options = {}) {
+	let warnedProxyWhileOff = false;
+	return async (c, next) => {
+		const config = (await store.readGlobalConfig()).auth ?? {};
+		const mode = config.mode ?? "auto";
+		const required = requiredLevel(c.req.path, config.public ?? []);
+		if (mode === "off") {
+			if (!warnedProxyWhileOff && hasForwardingHeaders(c.req.raw.headers)) {
+				warnedProxyWhileOff = true;
+				console.warn("alashi: a request arrived through a proxy while auth.mode is \"off\" — this host appears to be exposed; set auth.mode to \"required\" in config.json");
+			}
+			c.set("identity", {
+				level: "owner",
+				via: "off",
+				name: "owner"
+			});
+			return next();
+		}
+		const identity = await auth.bearerIdentity(c.req.header("authorization")) ?? await auth.sessionIdentity(getCookie(c, "alashi_session")) ?? tailscaleIdentity(c, config.trustTailscaleHeaders === true) ?? (mode === "auto" && isConsoleRequest(new URL(c.req.url).hostname, c.req.raw.headers, options.getRemoteAddress?.(c)) ? {
+			level: "owner",
+			via: "console",
+			name: "owner"
+		} : void 0);
+		if (identity) c.set("identity", identity);
+		if (required === "public") return next();
+		if (identity && meetsLevel(identity, required)) return next();
+		if (wantsHtml(c)) return c.redirect("/login");
+		return c.json({ error: identity ? "This action requires the owner" : "Authentication required" }, identity ? 403 : 401);
+	};
+}
+function loginPage(error) {
+	return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>alashi — sign in</title>
+<link rel="stylesheet" href="/assets/v1/system.css">
+</head>
+<body>
+<header class="topbar"><strong>alashi</strong></header>
+<main class="narrow">
+<h1>Sign in</h1>
+<div class="panel">
+${error ? "<p class=\"badge err\">Invalid or expired token</p>" : ""}
+<p class="muted">Paste a login token — the one printed by <code>alashi serve</code>, or one minted with <code>alashi token create</code>.</p>
+<form method="post" action="/login">
+<p><input type="password" name="token" autocomplete="off" autofocus style="width:100%"></p>
+<p><button type="submit">Sign in</button></p>
+</form>
+</div>
+</main>
+</body>
+</html>
+`;
+}
+function grantSession(c, value) {
+	setCookie(c, SESSION_COOKIE, value, {
+		path: "/",
+		httpOnly: true,
+		sameSite: "Lax",
+		maxAge: Math.floor(SESSION_TTL_MS / 1e3)
+	});
+}
+/**
+* The auth surface itself (all public in the policy map):
+*   GET  /login    login form; `?token=` redeems the printed one-time URL
+*   POST /login    { token } (form-encoded) -> session cookie + redirect /
+*   GET  /logout   destroys the session, back to /login
+*   GET  /api/me   the resolved identity, or { identity: null }
+*/
+function registerAuthRoutes(app, auth) {
+	app.get("/login", async (c) => {
+		const token = c.req.query("token");
+		if (token === void 0) {
+			const existing = c.get("identity");
+			if (existing && existing.via !== "console") return c.redirect("/");
+			return c.html(loginPage());
+		}
+		const identity = await auth.redeemLoginSecret(token);
+		if (!identity) return c.html(loginPage("invalid"), 401);
+		grantSession(c, await auth.createSession(identity));
+		return c.redirect("/");
+	});
+	app.post("/login", async (c) => {
+		const body = await c.req.parseBody();
+		const token = typeof body.token === "string" ? body.token.trim() : "";
+		const identity = token === "" ? void 0 : await auth.redeemLoginSecret(token);
+		if (!identity) return c.html(loginPage("invalid"), 401);
+		grantSession(c, await auth.createSession(identity));
+		return c.redirect("/");
+	});
+	app.get("/logout", async (c) => {
+		const value = getCookie(c, SESSION_COOKIE);
+		if (value !== void 0) await auth.destroySession(value);
+		deleteCookie(c, SESSION_COOKIE, { path: "/" });
+		return c.redirect("/login");
+	});
+	app.get("/api/me", (c) => c.json({ identity: c.get("identity") ?? null }));
+}
+//#endregion
 //#region src/usage.ts
 /** Days of history kept in usage.json; older days are dropped on write. */
 const USAGE_RETENTION_DAYS = 90;
@@ -21,6 +357,10 @@ const DAY_MS = 864e5;
 function utcDay(at = /* @__PURE__ */ new Date()) {
 	return at.toISOString().slice(0, 10);
 }
+/** The UTC calendar month (`YYYY-MM`) a timestamp falls in. */
+function utcMonth(at = /* @__PURE__ */ new Date()) {
+	return at.toISOString().slice(0, 7);
+}
 function round(value) {
 	return Number(value.toFixed(COST_PRECISION));
 }
@@ -28,15 +368,100 @@ function round(value) {
 function formatUsd(value) {
 	return `$${value.toFixed(value >= 1 ? 2 : 4)}`;
 }
+/** Merges per-app summaries into the host-wide view. */
+function combineSummaries(summaries) {
+	const combined = {
+		todayCostUsd: 0,
+		todayTurns: 0,
+		totalCostUsd: 0,
+		todayModels: {},
+		models: {},
+		months: [],
+		recorded: false
+	};
+	const byMonth = /* @__PURE__ */ new Map();
+	for (const summary of summaries) {
+		combined.todayCostUsd = round(combined.todayCostUsd + summary.todayCostUsd);
+		combined.todayTurns += summary.todayTurns;
+		combined.totalCostUsd = round(combined.totalCostUsd + summary.totalCostUsd);
+		combined.recorded ||= summary.recorded;
+		mergeTotals(combined.todayModels, summary.todayModels);
+		mergeTotals(combined.models, summary.models);
+		for (const month of summary.months) {
+			const target = byMonth.get(month.month) ?? {
+				month: month.month,
+				costUsd: 0,
+				turns: 0
+			};
+			target.costUsd = round(target.costUsd + month.costUsd);
+			target.turns += month.turns;
+			if (month.models !== void 0) {
+				target.models ??= {};
+				mergeTotals(target.models, month.models);
+			}
+			byMonth.set(month.month, target);
+		}
+	}
+	combined.months = [...byMonth.values()].sort((a, b) => a.month.localeCompare(b.month));
+	return combined;
+}
+function emptyTotals() {
+	return {
+		inputTokens: 0,
+		outputTokens: 0,
+		cacheReadInputTokens: 0,
+		cacheCreationInputTokens: 0,
+		costUsd: 0
+	};
+}
+function count(value) {
+	return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : 0;
+}
+function addModelUsage(models, usage) {
+	for (const [model, turn] of Object.entries(usage)) {
+		models[model] ??= emptyTotals();
+		const totals = models[model];
+		totals.inputTokens += count(turn.inputTokens);
+		totals.outputTokens += count(turn.outputTokens);
+		totals.cacheReadInputTokens += count(turn.cacheReadInputTokens);
+		totals.cacheCreationInputTokens += count(turn.cacheCreationInputTokens);
+		totals.costUsd = round(totals.costUsd + count(turn.costUsd));
+	}
+}
+function mergeTotals(into, from) {
+	for (const [model, totals] of Object.entries(from ?? {})) {
+		into[model] ??= emptyTotals();
+		const target = into[model];
+		target.inputTokens += count(totals.inputTokens);
+		target.outputTokens += count(totals.outputTokens);
+		target.cacheReadInputTokens += count(totals.cacheReadInputTokens);
+		target.cacheCreationInputTokens += count(totals.cacheCreationInputTokens);
+		target.costUsd = round(target.costUsd + count(totals.costUsd));
+	}
+}
+function sanitizeModels(models) {
+	if (models === void 0) return void 0;
+	const clean = {};
+	for (const [model, totals] of Object.entries(models)) clean[model] = {
+		inputTokens: count(totals?.inputTokens),
+		outputTokens: count(totals?.outputTokens),
+		cacheReadInputTokens: count(totals?.cacheReadInputTokens),
+		cacheCreationInputTokens: count(totals?.cacheCreationInputTokens),
+		costUsd: round(count(totals?.costUsd))
+	};
+	return Object.keys(clean).length > 0 ? clean : void 0;
+}
 /**
-* Per-app, per-UTC-day AI spend, persisted as OS bookkeeping in the app
-* container (`apps/<name>/usage.json`, next to jobs.json and chat.json).
+* Per-app AI spend and token usage, persisted as OS bookkeeping in the app
+* container (`apps/<name>/usage.json`, next to jobs.json and chat.json):
+* a per-UTC-day series trimmed to the retention window, plus per-month
+* rollups that are kept forever.
 *
-* Cost arrives from the `result` event's `costUsd`, which the SDK contract
-* marks optional: engines that do not report cost simply contribute nothing.
-* Writes are serialized per app so concurrent turns cannot lose an update,
-* and each app has its own queue so a slow write for one app never delays
-* another.
+* Cost and per-model tokens arrive from the `result` event, whose fields the
+* SDK contract marks optional: engines that report neither simply contribute
+* nothing. Writes are serialized per app so concurrent turns cannot lose an
+* update, and each app has its own queue so a slow write for one app never
+* delays another.
 */
 var UsageRecorder = class {
 	store;
@@ -48,53 +473,136 @@ var UsageRecorder = class {
 		this.retentionDays = retentionDays;
 	}
 	/**
-	* Adds one turn's cost to the app's total for the UTC day of `at`.
-	* A missing, non-finite, or negative `costUsd` is ignored (no turn counted,
-	* no file written) so a provider that omits cost cannot corrupt the totals.
+	* Adds one turn's cost and token usage to the app's totals for the UTC day
+	* and month of `at`. A missing, non-finite, or negative `costUsd` is
+	* ignored; a turn that reports neither valid cost nor any model usage is
+	* not counted and nothing is written, so a provider that omits metering
+	* cannot corrupt the totals.
 	*/
-	record(appName, costUsd, at = /* @__PURE__ */ new Date()) {
-		if (typeof costUsd !== "number" || !Number.isFinite(costUsd) || costUsd < 0) return Promise.resolve();
+	record(appName, turn, at = /* @__PURE__ */ new Date()) {
+		const costValid = typeof turn.costUsd === "number" && Number.isFinite(turn.costUsd) && turn.costUsd >= 0;
+		const modelUsage = turn.modelUsage !== void 0 && Object.keys(turn.modelUsage).length > 0 ? turn.modelUsage : void 0;
+		if (!costValid && modelUsage === void 0) return Promise.resolve();
+		const costUsd = costValid ? turn.costUsd : 0;
 		return this.enqueue(appName, async () => {
-			const state = await this.store.readUsageState(appName);
+			const state = this.normalize(await this.store.readUsageState(appName));
 			const date = utcDay(at);
 			const day = state.days.find((entry) => entry.date === date);
-			if (day) {
-				day.costUsd = round(day.costUsd + costUsd);
-				day.turns += 1;
-			} else state.days.push({
-				date,
-				costUsd: round(costUsd),
-				turns: 1
-			});
+			if (day) this.apply(day, costUsd, modelUsage);
+			else {
+				const fresh = {
+					date,
+					costUsd: 0,
+					turns: 0
+				};
+				this.apply(fresh, costUsd, modelUsage);
+				state.days.push(fresh);
+			}
+			const monthKey = utcMonth(at);
+			const months = state.months ?? [];
+			const month = months.find((entry) => entry.month === monthKey);
+			if (month) this.apply(month, costUsd, modelUsage);
+			else {
+				const fresh = {
+					month: monthKey,
+					costUsd: 0,
+					turns: 0
+				};
+				this.apply(fresh, costUsd, modelUsage);
+				months.push(fresh);
+			}
+			state.months = months;
 			await this.store.writeUsageState(appName, this.prune(state, at));
 		});
 	}
-	/** The app's recorded days, oldest first, with expired days filtered out. */
+	/** The app's recorded usage, oldest first, with expired days filtered out. */
 	async read(appName, at = /* @__PURE__ */ new Date()) {
-		return this.prune(await this.store.readUsageState(appName), at);
+		return this.prune(this.normalize(await this.store.readUsageState(appName)), at);
 	}
-	/** Today's spend plus the daily series, for the dashboard and the usage endpoint. */
+	/** Today's spend plus the daily/monthly series, for the dashboard and the usage endpoints. */
 	async summary(appName, at = /* @__PURE__ */ new Date()) {
-		const { days } = await this.read(appName, at);
+		const { days, months } = await this.read(appName, at);
 		const date = utcDay(at);
 		const today = days.find((entry) => entry.date === date);
+		const models = {};
+		for (const day of days) mergeTotals(models, day.models);
 		return {
 			date,
 			todayCostUsd: today?.costUsd ?? 0,
 			todayTurns: today?.turns ?? 0,
+			todayModels: today?.models ?? {},
 			totalCostUsd: round(days.reduce((sum, entry) => sum + entry.costUsd, 0)),
+			models,
 			retentionDays: this.retentionDays,
-			days
+			recorded: days.length > 0 || months.length > 0,
+			days,
+			months
 		};
 	}
-	/** Drops days outside the retention window and normalizes ordering/values. */
+	apply(bucket, costUsd, modelUsage) {
+		bucket.costUsd = round(bucket.costUsd + costUsd);
+		bucket.turns += 1;
+		if (modelUsage !== void 0) {
+			bucket.models ??= {};
+			addModelUsage(bucket.models, modelUsage);
+		}
+	}
+	/**
+	* One-time migration for files written before monthly rollups existed:
+	* absent `months` is seeded from the surviving days, so history inside the
+	* retention window is not lost to the rollups. After the first write the
+	* field is always present (possibly empty) and this is a no-op.
+	*/
+	normalize(state) {
+		if (state.months !== void 0) return {
+			days: state.days,
+			months: state.months
+		};
+		const byMonth = /* @__PURE__ */ new Map();
+		for (const day of state.days) {
+			if (typeof day?.date !== "string" || day.date.length < 7) continue;
+			const key = day.date.slice(0, 7);
+			const month = byMonth.get(key) ?? {
+				month: key,
+				costUsd: 0,
+				turns: 0
+			};
+			month.costUsd = round(month.costUsd + (Number.isFinite(day.costUsd) ? day.costUsd : 0));
+			month.turns += Number.isFinite(day.turns) ? day.turns : 0;
+			if (day.models !== void 0) {
+				month.models ??= {};
+				mergeTotals(month.models, day.models);
+			}
+			byMonth.set(key, month);
+		}
+		return {
+			days: state.days,
+			months: [...byMonth.values()]
+		};
+	}
+	/** Drops days outside the retention window and normalizes ordering/values. Months are kept forever. */
 	prune(state, at) {
 		const cutoff = utcDay(/* @__PURE__ */ new Date(at.getTime() - (this.retentionDays - 1) * DAY_MS));
-		return { days: state.days.filter((entry) => typeof entry?.date === "string" && entry.date >= cutoff && Number.isFinite(entry.costUsd) && entry.costUsd >= 0).map((entry) => ({
-			date: entry.date,
-			costUsd: round(entry.costUsd),
-			turns: Number.isFinite(entry.turns) ? entry.turns : 0
-		})).sort((a, b) => a.date.localeCompare(b.date)) };
+		return {
+			days: state.days.filter((entry) => typeof entry?.date === "string" && entry.date >= cutoff && Number.isFinite(entry.costUsd) && entry.costUsd >= 0).map((entry) => {
+				const models = sanitizeModels(entry.models);
+				return {
+					date: entry.date,
+					costUsd: round(entry.costUsd),
+					turns: Number.isFinite(entry.turns) ? entry.turns : 0,
+					...models !== void 0 && { models }
+				};
+			}).sort((a, b) => a.date.localeCompare(b.date)),
+			months: state.months.filter((entry) => typeof entry?.month === "string" && Number.isFinite(entry.costUsd) && entry.costUsd >= 0).map((entry) => {
+				const models = sanitizeModels(entry.models);
+				return {
+					month: entry.month,
+					costUsd: round(entry.costUsd),
+					turns: Number.isFinite(entry.turns) ? entry.turns : 0,
+					...models !== void 0 && { models }
+				};
+			}).sort((a, b) => a.month.localeCompare(b.month))
+		};
 	}
 	enqueue(appName, work) {
 		const next = (this.queues.get(appName) ?? Promise.resolve()).then(work);
@@ -170,6 +678,7 @@ function budgetStatusFor(summary, dailyUsd) {
 	return {
 		date: summary.date,
 		spentUsd: summary.todayCostUsd,
+		recorded: summary.recorded,
 		...dailyUsd !== void 0 && {
 			dailyUsd,
 			remainingUsd: Math.max(0, Number((dailyUsd - summary.todayCostUsd).toFixed(6)))
@@ -226,6 +735,9 @@ function checkSdkCompatibility(manifest) {
 }
 //#endregion
 //#region src/loader.ts
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 function entryFromExports(exportsField) {
 	if (typeof exportsField === "string") return exportsField;
 	if (typeof exportsField !== "object" || exportsField === null) return void 0;
@@ -243,7 +755,7 @@ function entryFromExports(exportsField) {
 * The manifest is always re-validated here — the host never trusts
 * that an app used defineApp().
 */
-async function loadApp(repoDir) {
+async function loadApp(repoDir, options = {}) {
 	let pkg;
 	try {
 		pkg = JSON.parse(await readFile(join(repoDir, "package.json"), "utf8"));
@@ -262,15 +774,21 @@ async function loadApp(repoDir) {
 	}
 	const definition = mod.default;
 	if (typeof definition !== "object" || definition === null || !("manifest" in definition)) throw new AppSdkError("App entry must default-export an app definition (use defineApp() from @alashi/apps-sdk)");
-	const raw = definition.manifest;
+	const input = isRecord(definition.rawManifest) ? definition.rawManifest : definition.manifest;
+	const raw = input;
 	if (typeof raw.sdkVersion === "string") checkSdkCompatibility({
 		name: typeof raw.name === "string" ? raw.name : entry,
 		sdkVersion: raw.sdkVersion
 	});
+	const { manifest, unknownKeys } = parseManifestWithWarnings(input);
+	const warnings = unknownKeys.map((key) => `ignoring unknown manifest key "${key}" — this host uses SDK ${SDK_VERSION}`);
+	const warn = options.warn ?? ((message) => console.warn(`[${manifest.name}] ${message}`));
+	for (const warning of warnings) warn(warning);
 	return {
 		definition,
-		manifest: parseManifest(definition.manifest),
-		entryPath
+		manifest,
+		entryPath,
+		warnings
 	};
 }
 //#endregion
@@ -481,7 +999,7 @@ async function installApp(store, source, options = {}) {
 		inspectDir = stageDir;
 	}
 	try {
-		const { manifest } = await loadApp(inspectDir);
+		const { manifest, warnings } = await loadApp(inspectDir, { warn: () => {} });
 		if (expectName && manifest.name !== expectName) throw new AppSdkError(`App manifest name "${manifest.name}" does not match requested "${expectName}"`);
 		if (await store.readAppRecord(manifest.name)) throw new AppSdkError(`App "${manifest.name}" is already installed (use: alashi update ${manifest.name})`);
 		const repoDir = store.appRepoDir(manifest.name);
@@ -501,7 +1019,10 @@ async function installApp(store, source, options = {}) {
 			updatedAt: now
 		};
 		await store.writeAppRecord(record);
-		return record;
+		return {
+			record,
+			warnings
+		};
 	} finally {
 		if (stageDir) await rm(stageDir, {
 			recursive: true,
@@ -515,7 +1036,7 @@ async function updateApp(store, name) {
 	const repoDir = store.appRepoDir(name);
 	await updateSource(record.source, repoDir);
 	await installDependencies(repoDir);
-	const { manifest } = await loadApp(repoDir);
+	const { manifest, warnings } = await loadApp(repoDir, { warn: () => {} });
 	if (manifest.name !== name) throw new AppSdkError(`App renamed itself to "${manifest.name}"; refusing update`);
 	const updated = {
 		...record,
@@ -524,7 +1045,10 @@ async function updateApp(store, name) {
 		updatedAt: (/* @__PURE__ */ new Date()).toISOString()
 	};
 	await store.writeAppRecord(updated);
-	return updated;
+	return {
+		record: updated,
+		warnings
+	};
 }
 async function removeApp(store, name, options = {}) {
 	if (!await store.readAppRecord(name)) throw new AppSdkError(`App "${name}" is not installed`);
@@ -832,7 +1356,7 @@ function createLogger(prefix) {
 * chat turns, cron job handlers, and app routes alike — so spend is recorded
 * no matter who opened the session.
 */
-function meterSession(session, recordCost) {
+function meterSession(session, recordUsage) {
 	return {
 		get id() {
 			return session.id;
@@ -841,7 +1365,10 @@ function meterSession(session, recordCost) {
 			const events = session.send(input);
 			return (async function* metered() {
 				for await (const event of events) {
-					if (event.type === "result") await recordCost(event.costUsd);
+					if (event.type === "result") await recordUsage({
+						costUsd: event.costUsd,
+						modelUsage: event.modelUsage
+					});
 					yield event;
 				}
 			})();
@@ -881,7 +1408,7 @@ function scopeProvider(provider, defaults) {
 				...Object.keys(agents).length > 0 && { agents },
 				...skillDirs.length > 0 && { skillDirs }
 			});
-			return defaults.recordCost ? meterSession(session, defaults.recordCost) : session;
+			return defaults.recordUsage ? meterSession(session, defaults.recordUsage) : session;
 		}
 	};
 }
@@ -943,11 +1470,11 @@ async function buildAppContext(store, manifest, provider, usage) {
 	const mcpServers = interpolate(Object.fromEntries(Object.entries(manifest.mcpServers).filter(([server]) => !excluded.includes(server)).map(([server, { optional: _optional, ...decl }]) => [server, decl])));
 	const allowedTools = manifest.permissions.allowedTools.filter((tool) => !excluded.some((server) => tool.startsWith(`mcp__${server}__`)));
 	const logger = createLogger(name);
-	const recordCost = usage ? async (costUsd) => {
+	const recordUsage = usage ? async (turn) => {
 		try {
-			await usage.record(name, costUsd);
+			await usage.record(name, turn);
 		} catch (err) {
-			logger.warn("Failed to record AI spend", { error: String(err) });
+			logger.warn("Failed to record AI usage", { error: String(err) });
 		}
 	} : void 0;
 	return {
@@ -963,7 +1490,7 @@ async function buildAppContext(store, manifest, provider, usage) {
 			skillDirs: manifest.skills.map((dir) => resolve(repoDir, dir)),
 			...instructions !== void 0 && { instructions },
 			cwd: dataDir,
-			...recordCost !== void 0 && { recordCost },
+			...recordUsage !== void 0 && { recordUsage },
 			...usage !== void 0 && { checkBudget: () => assertWithinBudget(store, usage, name) },
 			...!status.ready && { unreadyError: `App "${name}" is not configured: missing ${status.missing.join(", ")}. Set the missing keys in the dashboard settings or ${store.appConfigPath(name)}.` }
 		})
@@ -1034,6 +1561,10 @@ var Scheduler = class {
 		this.crons = [];
 		this.started = false;
 	}
+	/** How many jobs are currently scheduled (0 until start()). */
+	get jobCount() {
+		return this.crons.length;
+	}
 	/**
 	* Runs one job immediately. Returns the recorded run, 'skipped' when that
 	* job is already mid-run, or undefined when the app/job doesn't exist.
@@ -1140,6 +1671,7 @@ function settingsPage(name) {
 <main class="narrow">
   <div id="banner" class="banner" hidden></div>
   <div id="budget-card"></div>
+  <div id="usage-card"></div>
   <div id="cards"></div>
   <button id="save" class="primary">Save changes</button><span id="status"></span>
   <div id="manifest-cards"></div>
@@ -1316,7 +1848,17 @@ function renderBudget(b, message) {
     },
   });
 
-  const spent = 'Spent today (' + b.date + ', UTC): ' + usd(b.spentUsd);
+  const capNote = capped
+    ? usd(b.remainingUsd) + ' left of ' + usd(b.dailyUsd)
+    : 'no cap set, spend is unlimited';
+  // No ledger at all is an absence, not $0.0000: the host meters only sessions
+  // opened through ctx.ai, so an app that tracks its own costs elsewhere can
+  // report real spend while the host has recorded nothing for it.
+  const spent = b.recorded === false
+    ? 'No AI spend recorded for this app yet (' + b.date + ', UTC) — ' + capNote
+      + '. The host meters only sessions the app opens through ctx.ai, so the '
+      + "app's own cost display may differ."
+    : 'Spent today (' + b.date + ', UTC): ' + usd(b.spentUsd) + ' — ' + capNote;
   const body = [
     el('div', { class: 'desc', text:
       'Enforced by the host: once the spend for the UTC day reaches the cap, new AI sessions for '
@@ -1326,9 +1868,7 @@ function renderBudget(b, message) {
       el('label', { text: 'Daily spend cap (USD)' }),
       input,
     ]),
-    el('div', { class: 'desc', text: capped
-      ? spent + ' — ' + usd(b.remainingUsd) + ' left of ' + usd(b.dailyUsd)
-      : spent + ' — no cap set, spend is unlimited' }),
+    el('div', { class: 'desc', text: spent }),
     el('div', { style: 'margin-top:12px' }, [save, status]),
   ];
   if (b.overBudget) {
@@ -1344,6 +1884,70 @@ function renderBudget(b, message) {
   ]));
 }
 
+function tokens(n) {
+  return (n ?? 0).toLocaleString('en-US');
+}
+
+function usageTable(headers, rows) {
+  return el('table', {}, [
+    el('thead', {}, [el('tr', {}, headers.map((h, i) =>
+      el('th', i === 0 ? { text: h } : { text: h, style: 'text-align:right' })))]),
+    el('tbody', {}, rows.map((cells) => el('tr', {}, cells.map((c, i) =>
+      el('td', i === 0 ? { text: c } : { text: c, style: 'text-align:right' }))))),
+  ]);
+}
+
+function monthTokens(models) {
+  let input = 0, output = 0;
+  for (const t of Object.values(models ?? {})) {
+    input += t.inputTokens ?? 0;
+    output += t.outputTokens ?? 0;
+  }
+  return { input, output };
+}
+
+/** Read-only token/cost breakdown from GET /api/apps/:name/usage. */
+function renderUsage(u) {
+  const root = document.getElementById('usage-card');
+  root.replaceChildren();
+  const body = [];
+  if (!u.recorded) {
+    body.push(el('div', { class: 'desc', text:
+      'No AI usage recorded for this app yet. The host meters only sessions the app opens '
+      + 'through ctx.ai, so usage the app tracks on its own does not appear here.' }));
+  } else {
+    body.push(el('div', { class: 'desc', text:
+      'Today (' + u.date + ', UTC): ' + usd(u.todayCostUsd) + ' across ' + u.todayTurns
+      + ' turn' + (u.todayTurns === 1 ? '' : 's') + '.' }));
+    const models = Object.keys(u.models).sort();
+    if (models.length > 0) {
+      body.push(el('h3', { text: 'By model (last ' + u.retentionDays + ' days)' }));
+      body.push(usageTable(
+        ['Model', 'Input', 'Output', 'Cache read', 'Cache write', 'Cost'],
+        models.map((m) => {
+          const t = u.models[m];
+          return [m, tokens(t.inputTokens), tokens(t.outputTokens),
+                  tokens(t.cacheReadInputTokens), tokens(t.cacheCreationInputTokens), usd(t.costUsd)];
+        }),
+      ));
+    }
+    if (u.months.length > 0) {
+      body.push(el('h3', { text: 'By month' }));
+      body.push(usageTable(
+        ['Month', 'Turns', 'Input', 'Output', 'Cost'],
+        [...u.months].reverse().map((m) => {
+          const t = monthTokens(m.models);
+          return [m.month, String(m.turns), tokens(t.input), tokens(t.output), usd(m.costUsd)];
+        }),
+      ));
+    }
+  }
+  root.append(el('div', { class: 'card' }, [
+    el('h2', { text: 'AI usage' }),
+    el('div', { class: 'body' }, body),
+  ]));
+}
+
 function roCard(title, children) {
   return el('div', { class: 'card' }, [
     el('h2', { text: title }),
@@ -1417,13 +2021,15 @@ function renderManifest(m) {
 }
 
 async function load() {
-  const [res, manRes, budgetRes] = await Promise.all([
+  const [res, manRes, budgetRes, usageRes] = await Promise.all([
     fetch('/api/apps/' + APP + '/config'),
     fetch('/api/apps/' + APP + '/manifest'),
     fetch('/api/apps/' + APP + '/budget'),
+    fetch('/api/apps/' + APP + '/usage'),
   ]);
-  // Host bookkeeping: the cap renders even when the app itself fails to load.
+  // Host bookkeeping: the cap and usage render even when the app itself fails to load.
   if (budgetRes.ok) renderBudget(await budgetRes.json());
+  if (usageRes.ok) renderUsage(await usageRes.json());
   if (!res.ok) {
     document.getElementById('banner').hidden = false;
     document.getElementById('banner').className = 'banner warn';
@@ -1475,6 +2081,18 @@ const CONTENT_TYPES = {
 function escapeHtml(value) {
 	return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;");
 }
+/**
+* What the dashboard's Today column actually measures. The host ledger
+* (`apps/<name>/usage.json`) only ever grows when a session opened through
+* `ctx.ai` reports `costUsd`, so an app that spends through its own bookkeeping
+* can legitimately show a different number in its own UI. Saying so in the
+* header keeps a smaller host figure from reading as a bug.
+*/
+const TODAY_COLUMN_TITLE = "AI spend today (UTC) as metered by the host: only sessions opened through an app's ctx.ai are counted, so an app's own in-app cost display may differ.";
+/** Tooltip for the em dash that stands in for "no host ledger at all". */
+const NO_SPEND_RECORDED_TITLE = "No AI spend recorded for this app yet — the host meters only sessions an app opens through ctx.ai";
+/** The same absence, said for the whole table rather than one app. */
+const NO_SPEND_RECORDED_ANY_TITLE = "No AI spend recorded for any installed app yet — the host meters only sessions an app opens through ctx.ai";
 /** Host-rendered failure page — apps never need to ship their own error UI. */
 function appErrorPage(name, err) {
 	return `<!doctype html>
@@ -1499,14 +2117,27 @@ function appErrorPage(name, err) {
 `;
 }
 /**
-* The host HTTP surface:
+* The host HTTP surface (all routes sit behind the auth policy middleware —
+* see auth.ts: public/user/owner levels, config-driven via config.auth):
+*   GET  /login                 sign-in form; ?token= redeems a printed login URL
+*   POST /login                 { token } form -> session cookie
+*   GET  /logout                destroy the session
+*   GET  /api/me                the request's resolved identity, or null
 *   GET  /                      dashboard of installed apps
 *   GET  /settings/:name        per-app settings page (config form)
-*   GET  /api/apps              installed apps as JSON, each with todayCostUsd
-*                               and its daily spend cap / over-budget state
+*   GET  /api/apps              installed apps as JSON, each with todayCostUsd,
+*                               `recorded` (false when the host has never metered
+*                               the app, so todayCostUsd is an absence rather than
+*                               a measured zero), and its daily spend cap /
+*                               over-budget state
+*   GET  /api/usage             host-wide usage: per-app summaries (cost, turns,
+*                               per-model tokens, daily series, monthly rollups)
+*                               plus combined totals across apps
 *   GET  /api/apps/:name/usage  recorded AI spend: today's total, a daily series,
-*                               and the budget status
-*   GET  /api/apps/:name/budget today's spend against the app's daily cap
+*                               per-model token totals, monthly rollups,
+*                               `recorded`, and the budget status
+*   GET  /api/apps/:name/budget today's spend against the app's daily cap,
+*                               plus `recorded`
 *   PUT  /api/apps/:name/budget { dailyUsd: number | null } -> set or clear the cap
 *                               (a host setting; apps cannot set their own)
 *   POST /api/apps/:name/chat   { message, conversationId? } -> SSE stream of AgentEvents
@@ -1532,7 +2163,8 @@ function appErrorPage(name, err) {
 *                               otherwise the app's fetch handler (/app/:name stripped),
 *                               otherwise 404
 */
-function createServer(store, provider) {
+function createServer(store, provider, options = {}) {
+	const auth = options.auth ?? new AuthService(store);
 	const apps = /* @__PURE__ */ new Map();
 	const sessions = /* @__PURE__ */ new Map();
 	const usage = new UsageRecorder(store);
@@ -1621,6 +2253,15 @@ function createServer(store, provider) {
 	}
 	const app = new Hono();
 	app.onError((err, c) => c.json({ error: String(err) }, 500));
+	const getRemoteAddress = options.getRemoteAddress ?? ((c) => {
+		try {
+			return getConnInfo(c).remote.address;
+		} catch {
+			return;
+		}
+	});
+	app.use("*", createAuthMiddleware(store, auth, { getRemoteAddress }));
+	registerAuthRoutes(app, auth);
 	const assetsDir = fileURLToPath(new URL("../assets", import.meta.url));
 	app.get("/assets/*", async (c) => {
 		let rest;
@@ -1662,29 +2303,31 @@ function createServer(store, provider) {
 			const status = await readiness(r.name);
 			const badge = !status ? "<span class=\"badge err\">failed to load</span>" : "loadError" in status ? `<span class="badge err" title="${escapeHtml(status.loadError)}">failed to load</span>` : status.ready ? "<span class=\"badge ok\">ready</span>" : `<a href="/settings/${name}"><span class="badge err">needs setup</span></a>`;
 			const budget = await budgetStatus(store, usage, r.name);
-			const todayCostUsd = budget.spentUsd;
 			const overBadge = budget.overBudget ? ` <a href="/settings/${name}" title="Daily AI spend cap reached — new sessions are refused until 00:00 UTC"><span class="badge err">over budget</span></a>` : "";
 			const cap = budget.dailyUsd === void 0 ? "" : ` <span class="muted" title="Daily spend cap">/ ${formatUsd(budget.dailyUsd)}</span>`;
+			const today = budget.recorded ? formatUsd(budget.spentUsd) : `<span title="${escapeHtml(NO_SPEND_RECORDED_TITLE)}">—</span>`;
 			return {
 				row: `<tr>
   <td><a href="/app/${name}/">${name}</a></td>
   <td class="muted">v${escapeHtml(r.version)}</td>
   <td class="muted">${escapeHtml(r.source.type)}</td>
   <td>${badge}${overBadge}</td>
-  <td class="muted" style="text-align:right">${formatUsd(todayCostUsd)}${cap}</td>
+  <td class="muted" style="text-align:right">${today}${cap}</td>
   <td style="text-align:right"><a href="/settings/${name}">settings</a></td>
 </tr>`,
-				todayCostUsd
+				todayCostUsd: budget.spentUsd,
+				recorded: budget.recorded
 			};
 		}));
 		const rows = cells.map((cell) => cell.row).join("\n");
-		const totalToday = cells.reduce((sum, cell) => sum + cell.todayCostUsd, 0);
+		const recorded = cells.filter((cell) => cell.recorded);
+		const totalToday = recorded.length === 0 ? `<span title="${escapeHtml(NO_SPEND_RECORDED_ANY_TITLE)}">—</span>` : formatUsd(recorded.reduce((sum, cell) => sum + cell.todayCostUsd, 0));
 		const body = records.length === 0 ? "<div class=\"empty\">No apps installed. Run <code>alashi install &lt;name&gt;</code>.</div>" : `<table>
-<thead><tr><th>App</th><th>Version</th><th>Source</th><th>Status</th><th style="text-align:right" title="AI spend today (UTC)">Today</th><th></th></tr></thead>
+<thead><tr><th>App</th><th>Version</th><th>Source</th><th>Status</th><th style="text-align:right" title="${escapeHtml(TODAY_COLUMN_TITLE)}">Today</th><th></th></tr></thead>
 <tbody>
 ${rows}
 </tbody>
-<tfoot><tr><td colspan="4" class="muted">AI spend today (UTC)</td><td class="muted" style="text-align:right">${formatUsd(totalToday)}</td><td></td></tr></tfoot>
+<tfoot><tr><td colspan="4" class="muted" title="${escapeHtml(TODAY_COLUMN_TITLE)}">AI spend today (UTC)</td><td class="muted" style="text-align:right">${totalToday}</td><td></td></tr></tfoot>
 </table>`;
 		return c.html(`<!doctype html>
 <html lang="en">
@@ -1714,6 +2357,7 @@ ${body}
 			return {
 				...record,
 				todayCostUsd: budget.spentUsd,
+				recorded: budget.recorded,
 				overBudget: budget.overBudget,
 				...budget.dailyUsd !== void 0 && { dailyBudgetUsd: budget.dailyUsd }
 			};
@@ -1724,6 +2368,19 @@ ${body}
 	async function installedApp(name) {
 		return APP_NAME_PATTERN.test(name) && await store.readAppRecord(name) !== void 0;
 	}
+	app.get("/api/usage", async (c) => {
+		const records = await store.listInstalled();
+		const summaries = await Promise.all(records.map(async (record) => ({
+			name: record.name,
+			...await usage.summary(record.name)
+		})));
+		return c.json({
+			date: utcDay(),
+			retentionDays: 90,
+			apps: summaries,
+			totals: combineSummaries(summaries)
+		});
+	});
 	app.get("/api/apps/:name/usage", async (c) => {
 		const name = c.req.param("name");
 		if (!await installedApp(name)) return c.json({ error: `App "${name}" is not installed` }, 404);
@@ -2008,6 +2665,7 @@ ${body}
 	return {
 		app,
 		scheduler,
+		auth,
 		async close() {
 			scheduler.stop();
 			const open = [...sessions.values()];
@@ -2123,11 +2781,28 @@ var Store = class {
 		await writeJson(this.appJobStatePath(name), state);
 	}
 	async readUsageState(name) {
-		return { days: (await readJson(this.appUsagePath(name)))?.days ?? [] };
+		const state = await readJson(this.appUsagePath(name));
+		return {
+			days: state?.days ?? [],
+			...state?.months !== void 0 && { months: state.months }
+		};
 	}
 	async writeUsageState(name, state) {
 		await writeJson(this.appUsagePath(name), state);
 	}
+	get authStatePath() {
+		return join(this.root, "auth.json");
+	}
+	async readAuthState() {
+		const state = await readJson(this.authStatePath);
+		return {
+			tokens: state?.tokens ?? [],
+			sessions: state?.sessions ?? []
+		};
+	}
+	async writeAuthState(state) {
+		await writeJson(this.authStatePath, state);
+	}
 	async listInstalled() {
 		let entries;
 		try {
@@ -2146,6 +2821,6 @@ var Store = class {
 	}
 };
 //#endregion
-export { UsageRecorder as A, BudgetExceededError as C, budgetStatusFor as D, budgetStatus as E, utcDay as M, setAppBudget as O, BUDGET_EXCEEDED_CODE as S, assertWithinBudget as T, fetchSource as _, EXPORT_FORMAT_VERSION as a, loadApp as b, installApp as c, updateApp as d, addRegistry as f, resolveApp as g, removeRegistry as h, resolveAppConfig as i, formatUsd as j, USAGE_RETENTION_DAYS as k, installDependencies as l, refreshRegistry as m, createServer as n, exportApp as o, readCachedIndex as p, buildAppContext as r, importApp as s, Store as t, removeApp as u, parseSourceArg as v, appBudget as w, checkSdkCompatibility as x, updateSource as y };
+export { UsageRecorder as A, BudgetExceededError as C, budgetStatusFor as D, budgetStatus as E, createAuthMiddleware as F, isConsoleRequest as I, registerAuthRoutes as L, utcDay as M, AuthService as N, setAppBudget as O, SESSION_COOKIE as P, requiredLevel as R, BUDGET_EXCEEDED_CODE as S, assertWithinBudget as T, fetchSource as _, EXPORT_FORMAT_VERSION as a, loadApp as b, installApp as c, updateApp as d, addRegistry as f, resolveApp as g, removeRegistry as h, resolveAppConfig as i, formatUsd as j, USAGE_RETENTION_DAYS as k, installDependencies as l, refreshRegistry as m, createServer as n, exportApp as o, readCachedIndex as p, buildAppContext as r, importApp as s, Store as t, removeApp as u, parseSourceArg as v, appBudget as w, checkSdkCompatibility as x, updateSource as y };
 
-//# sourceMappingURL=store-VoJe_U1Q.mjs.map
+//# sourceMappingURL=store-DoAGOynU.mjs.map