@braidhq/server 0.0.1 → 0.2.0

package/dist/infrastructure/_shared/paths.d.ts

@@ -0,0 +1,43 @@
+import type { AbsolutePath, ClarificationStatus, ProposalStatus, WorkspaceId } from '@braidhq/schema';
+export declare const PROPOSAL_STATUSES: readonly ProposalStatus[];
+export declare const CLARIFY_STATUSES: readonly ClarificationStatus[];
+/**
+ * Path-prefix containment check. Both inputs must be absolute.
+ * Handles the `/foo/bar-evil` vs `/foo/bar/` aliasing gotcha,
+ * normalising the parent with a trailing slash before `startsWith`.
+ */
+export declare function isUnder(candidate: string, parent: string): boolean;
+/** `true` when `path` resolves to anything (file, dir, symlink). */
+export declare function pathExists(path: string): Promise<boolean>;
+export declare function workspaceArtifactsDir(workspaceRoot: AbsolutePath): string;
+export declare function graphJsonPath(workspaceRoot: AbsolutePath): string;
+export declare function batchPlanPath(workspaceRoot: AbsolutePath): string;
+export declare function sourceUnitObservationDir(workspaceRoot: AbsolutePath): string;
+export declare function sourceUnitObservationFilePath(workspaceRoot: AbsolutePath, sourceId: string, relativePath: string): string;
+export declare function sourceUnitObservationSourceDir(workspaceRoot: AbsolutePath, sourceId: string): string;
+export declare function proposalsDir(workspaceRoot: AbsolutePath, status: ProposalStatus): string;
+export declare function clarificationDir(workspaceRoot: AbsolutePath, status: ClarificationStatus): string;
+export declare function viewsDir(workspaceRoot: AbsolutePath, kind: string): string;
+export declare function runsDir(workspaceRoot: AbsolutePath): string;
+export declare function reactorCyclesDir(workspaceRoot: AbsolutePath): string;
+export declare function reactorCycleFilePath(workspaceRoot: AbsolutePath, cycleId: string): string;
+export declare function runIndexPath(workspaceRoot: AbsolutePath): string;
+export declare function runEventsPath(workspaceRoot: AbsolutePath, runId: string): string;
+export declare function runSessionsMetadataPath(workspaceRoot: AbsolutePath): string;
+/**
+ * claude stores conversation memory keyed by cwd,
+ * so resume must spawn from the same dir as the first turn.
+ * Keeping it in the workspace, not /tmp, stays derivable from runId,
+ * and survives a server restart.
+ */
+export declare function sessionsDir(workspaceRoot: AbsolutePath): string;
+export declare function sessionDirPath(workspaceRoot: AbsolutePath, runId: string): string;
+export declare function workspaceSkillsDir(workspaceRoot: AbsolutePath): string;
+export declare function workspaceSkillExtensionsDir(workspaceRoot: AbsolutePath): string;
+export declare function workspaceProductManifestPath(workspaceRoot: AbsolutePath): string;
+export interface WorkspaceLayout {
+    readonly root: AbsolutePath;
+    readonly workspaceId: WorkspaceId;
+    readonly manifestPath: string;
+}
+//# sourceMappingURL=paths.d.ts.map

package/dist/infrastructure/_shared/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/_shared/paths.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAIrG,eAAO,MAAM,iBAAiB,EAAE,SAAS,cAAc,EAAuC,CAAA;AAC9F,eAAO,MAAM,gBAAgB,EAAE,SAAS,mBAAmB,EAAkD,CAAA;AAE7G;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAGlE;AAED,oEAAoE;AACpE,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQ/D;AAED,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,YAAY,GAAG,MAAM,CAEzE;AAED,wBAAgB,aAAa,CAAC,aAAa,EAAE,YAAY,GAAG,MAAM,CAEjE;AAED,wBAAgB,aAAa,CAAC,aAAa,EAAE,YAAY,GAAG,MAAM,CAEjE;AAED,wBAAgB,wBAAwB,CAAC,aAAa,EAAE,YAAY,GAAG,MAAM,CAE5E;AAED,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,YAAY,EAC3B,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,MAAM,CAQR;AAED,wBAAgB,8BAA8B,CAC5C,aAAa,EAAE,YAAY,EAC3B,QAAQ,EAAE,MAAM,GACf,MAAM,CAER;AAED,wBAAgB,YAAY,CAAC,aAAa,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,GAAG,MAAM,CAExF;AAED,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,YAAY,EAAE,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAEjG;AAED,wBAAgB,QAAQ,CAAC,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,wBAAgB,OAAO,CAAC,aAAa,EAAE,YAAY,GAAG,MAAM,CAE3D;AAED,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,YAAY,GAAG,MAAM,CAEpE;AAED,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEzF;AAED,wBAAgB,YAAY,CAAC,aAAa,EAAE,YAAY,GAAG,MAAM,CAEhE;AAED,wBAAgB,aAAa,CAAC,aAAa,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhF;AAED,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,YAAY,GAAG,MAAM,CAE3E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,aAAa,EAAE,YAAY,GAAG,MAAM,CAE/D;AAED,wBAAgB,cAAc,CAAC,aAAa,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,YAAY,GAAG,MAAM,CAEtE;AAED,wBAAgB,2BAA2B,CAAC,aAAa,EAAE,YAAY,GAAG,MAAM,CAE/E;AAED,wBAAgB,4BAA4B,CAAC,aAAa,EAAE,YAAY,GAAG,MAAM,CAEhF;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAC9B"}

package/dist/infrastructure/_shared/paths.js

@@ -0,0 +1,96 @@
+import { stat } from 'node:fs/promises';
+import { join } from 'node:path';
+export const PROPOSAL_STATUSES = ['pending', 'applied', 'rejected'];
+export const CLARIFY_STATUSES = ['pending', 'answered', 'applied', 'skipped'];
+/**
+ * Path-prefix containment check. Both inputs must be absolute.
+ * Handles the `/foo/bar-evil` vs `/foo/bar/` aliasing gotcha,
+ * normalising the parent with a trailing slash before `startsWith`.
+ */
+export function isUnder(candidate, parent) {
+    const normalisedParent = parent.endsWith('/') ? parent : `${parent}/`;
+    return candidate === parent || candidate.startsWith(normalisedParent);
+}
+/** `true` when `path` resolves to anything (file, dir, symlink). */
+export async function pathExists(path) {
+    try {
+        await stat(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function workspaceArtifactsDir(workspaceRoot) {
+    return join(workspaceRoot, 'artifacts');
+}
+export function graphJsonPath(workspaceRoot) {
+    return join(workspaceArtifactsDir(workspaceRoot), 'model.json');
+}
+export function batchPlanPath(workspaceRoot) {
+    return join(workspaceArtifactsDir(workspaceRoot), 'batch-plan.json');
+}
+export function sourceUnitObservationDir(workspaceRoot) {
+    return join(workspaceArtifactsDir(workspaceRoot), 'source-unit-state');
+}
+export function sourceUnitObservationFilePath(workspaceRoot, sourceId, relativePath) {
+    // Drop the trailing slash from folder units,
+    // so the file name doesn't end in `/.json`.
+    // In the unit name,
+    // replace path separators with `__`, so a nested unit maps to one file.
+    const trimmed = relativePath.endsWith('/') ? relativePath.slice(0, -1) : relativePath;
+    const flattened = trimmed.replace(/\//g, '__');
+    return join(sourceUnitObservationDir(workspaceRoot), sourceId, `${flattened}.json`);
+}
+export function sourceUnitObservationSourceDir(workspaceRoot, sourceId) {
+    return join(sourceUnitObservationDir(workspaceRoot), sourceId);
+}
+export function proposalsDir(workspaceRoot, status) {
+    return join(workspaceArtifactsDir(workspaceRoot), 'proposals', status);
+}
+export function clarificationDir(workspaceRoot, status) {
+    return join(workspaceArtifactsDir(workspaceRoot), 'clarifications', status);
+}
+export function viewsDir(workspaceRoot, kind) {
+    return join(workspaceArtifactsDir(workspaceRoot), 'views', kind);
+}
+export function runsDir(workspaceRoot) {
+    return join(workspaceArtifactsDir(workspaceRoot), 'runs');
+}
+export function reactorCyclesDir(workspaceRoot) {
+    return join(workspaceArtifactsDir(workspaceRoot), 'reactor-cycles');
+}
+export function reactorCycleFilePath(workspaceRoot, cycleId) {
+    return join(reactorCyclesDir(workspaceRoot), `${cycleId}.json`);
+}
+export function runIndexPath(workspaceRoot) {
+    return join(runsDir(workspaceRoot), 'index.jsonl');
+}
+export function runEventsPath(workspaceRoot, runId) {
+    return join(runsDir(workspaceRoot), `${runId}.jsonl`);
+}
+export function runSessionsMetadataPath(workspaceRoot) {
+    return join(runsDir(workspaceRoot), 'sessions.jsonl');
+}
+/**
+ * claude stores conversation memory keyed by cwd,
+ * so resume must spawn from the same dir as the first turn.
+ * Keeping it in the workspace, not /tmp, stays derivable from runId,
+ * and survives a server restart.
+ */
+export function sessionsDir(workspaceRoot) {
+    return join(workspaceRoot, '.braid-sessions');
+}
+export function sessionDirPath(workspaceRoot, runId) {
+    return join(sessionsDir(workspaceRoot), runId);
+}
+export function workspaceSkillsDir(workspaceRoot) {
+    return join(workspaceRoot, 'skills');
+}
+export function workspaceSkillExtensionsDir(workspaceRoot) {
+    return join(workspaceRoot, 'skill-extensions');
+}
+export function workspaceProductManifestPath(workspaceRoot) {
+    return join(workspaceRoot, 'PRODUCT.md');
+}
+//# sourceMappingURL=paths.js.map

package/dist/infrastructure/_shared/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../../src/infrastructure/_shared/paths.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,MAAM,CAAC,MAAM,iBAAiB,GAA8B,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;AAC9F,MAAM,CAAC,MAAM,gBAAgB,GAAmC,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;AAE7G;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,SAAiB,EAAE,MAAc;IACvD,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAA;IACrE,OAAO,SAAS,KAAK,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAA;AACvE,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY;IAC3C,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,CAAA;QAChB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,CAAC;QACL,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,aAA2B;IAC/D,OAAO,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;AACzC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,aAA2B;IACvD,OAAO,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE,YAAY,CAAC,CAAA;AACjE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,aAA2B;IACvD,OAAO,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE,iBAAiB,CAAC,CAAA;AACtE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,aAA2B;IAClE,OAAO,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE,mBAAmB,CAAC,CAAA;AACxE,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,aAA2B,EAC3B,QAAgB,EAChB,YAAoB;IAEpB,6CAA6C;IAC7C,4CAA4C;IAC5C,oBAAoB;IACpB,wEAAwE;IACxE,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAA;IACrF,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IAC9C,OAAO,IAAI,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,GAAG,SAAS,OAAO,CAAC,CAAA;AACrF,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,aAA2B,EAC3B,QAAgB;IAEhB,OAAO,IAAI,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,CAAA;AAChE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,aAA2B,EAAE,MAAsB;IAC9E,OAAO,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,CAAA;AACxE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,aAA2B,EAAE,MAA2B;IACvF,OAAO,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAA;AAC7E,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,aAA2B,EAAE,IAAY;IAChE,OAAO,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;AAClE,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,aAA2B;IACjD,OAAO,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,CAAA;AAC3D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,aAA2B;IAC1D,OAAO,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE,gBAAgB,CAAC,CAAA;AACrE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,aAA2B,EAAE,OAAe;IAC/E,OAAO,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,GAAG,OAAO,OAAO,CAAC,CAAA;AACjE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,aAA2B;IACtD,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,CAAA;AACpD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,aAA2B,EAAE,KAAa;IACtE,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAA;AACvD,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,aAA2B;IACjE,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,gBAAgB,CAAC,CAAA;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,aAA2B;IACrD,OAAO,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAA;AAC/C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,aAA2B,EAAE,KAAa;IACvE,OAAO,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,CAAA;AAChD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,aAA2B;IAC5D,OAAO,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;AACtC,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,aAA2B;IACrE,OAAO,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAA;AAChD,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,aAA2B;IACtE,OAAO,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;AAC1C,CAAC"}

package/dist/infrastructure/auth/AccessPolicy.d.ts

@@ -0,0 +1,87 @@
+import { z } from 'zod';
+declare const Invite: z.ZodObject<{
+    email: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    invitedAt: z.ZodString;
+    serverRole: z.ZodDefault<z.ZodEnum<{
+        user: "user";
+        admin: "admin";
+    }>>;
+}, z.core.$strip>;
+export type Invite = z.infer<typeof Invite>;
+export interface AccessDecision {
+    readonly allow: boolean;
+    readonly reason?: string;
+    readonly viaInvite?: Invite;
+}
+export interface AccessPolicyConfig {
+    readonly allowedDomains?: readonly string[];
+    readonly allowedEmails?: readonly string[];
+    readonly adminEmails?: readonly string[];
+}
+/**
+ * Gate 1 decides whether a Google account may log in to this Braid server.
+ * It composes two layers.
+ *
+ * The static allowlist reads the `BRAID_ALLOWED_DOMAINS` and `BRAID_ALLOWED_EMAILS` env vars.
+ * Domain matches (`@kdanmobile.com`) and email matches (`alice@example.com`) auto-pass.
+ * Both may be left unset on a public instance,
+ * combined with an empty invite list this rejects everyone (fail closed).
+ *
+ * The invite list lives at `${BRAID_HOME}/access.json`, maintained by an admin via `/admin/invites`.
+ * One invite per email, consumed on first successful login.
+ *
+ * The policy is open for either path, a domain pass OR an invite present.
+ * That matches the "hybrid" Gate 1 the design picked.
+ */
+export declare class AccessPolicy {
+    private readonly invitesPath;
+    private readonly allowedDomains;
+    private readonly allowedEmails;
+    private readonly adminEmails;
+    constructor(invitesPath: string, config?: AccessPolicyConfig);
+    /**
+     * Evaluate against the current allowlist and invite file.
+     * Reads the invite file every call, since invite management is low-frequency,
+     * and a stale cache would create a frustrating race,
+     * where an admin invites Bob, Bob logs in, and the server still says "no".
+     */
+    decide(email: string): Promise<AccessDecision>;
+    /**
+     * Whether the email should be marked `serverRole='admin'` on the resulting user record.
+     * Independent of `decide`, since invites carry their own role override,
+     * and an admin email might take the allowlist path with no invite.
+     */
+    isAdmin(email: string): boolean;
+    listInvites(): Promise<Invite[]>;
+    addInvite(input: {
+        email: string;
+        serverRole?: 'admin' | 'user';
+    }): Promise<Invite>;
+    removeInvite(email: string): Promise<void>;
+    /**
+     * Consume an invite once the user record exists.
+     * Remove it from invites,
+     * add to approvedEmails so the user can sign in again without the admin re-inviting them.
+     * Idempotent.
+     */
+    consumeInvite(email: string): Promise<void>;
+    /**
+     * Add an email to the persistent allowlist directly, without going through the invite step.
+     * Used by the bootstrap migration that back-fills approvedEmails,
+     * for users who registered before this field existed.
+     */
+    approveEmail(email: string): Promise<void>;
+    /**
+     * Drop an email from the persistent allowlist.
+     * Called when an admin deletes a user,
+     * so the underlying email can't sneak back in without a fresh invite.
+     * Idempotent.
+     */
+    revokeApproval(email: string): Promise<void>;
+    listApprovedEmails(): Promise<string[]>;
+    private readInvites;
+    private readContent;
+    private writeContent;
+}
+export {};
+//# sourceMappingURL=AccessPolicy.d.ts.map

package/dist/infrastructure/auth/AccessPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessPolicy.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/auth/AccessPolicy.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,QAAA,MAAM,MAAM;;;;;;;iBAMV,CAAA;AACF,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAA;AAc3C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IAIvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IAGxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,kBAAkB;IAEjC,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAE3C,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAE1C,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACzC;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,YAAY;IAMrB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAL9B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;IACnD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;gBAG9B,WAAW,EAAE,MAAM,EACpC,MAAM,GAAE,kBAAuB;IAOjC;;;;;OAKG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAsBpD;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIzB,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAIhC,SAAS,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAenF,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAShD;;;;;OAKG;IACG,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYjD;;;;OAIG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWhD;;;;;OAKG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAS5C,kBAAkB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAI/B,WAAW;YAIX,WAAW;YAeX,YAAY;CAI3B"}

package/dist/infrastructure/auth/AccessPolicy.js

@@ -0,0 +1,177 @@
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { ValidationError } from '@braidhq/core';
+import { z } from 'zod';
+const Invite = z.object({
+    email: z.string().email().transform(s => s.toLowerCase()),
+    invitedAt: z.string().datetime({ offset: true }),
+    // Initial server role applied when the invite is redeemed.
+    // Defaults to `user`, so an admin who picks `admin` is making a deliberate choice.
+    serverRole: z.enum(['admin', 'user']).default('user'),
+});
+const Content = z.object({
+    invites: z.array(Invite).default([]),
+    // Emails that have already redeemed an invite (or been approved directly),
+    // and are persistently allowed to sign in.
+    // Without this, an invite would be a one-shot ticket,
+    // gone after the first login, locking the user out on the second.
+    // Treat this as the "dynamic allowlist" that grows as invites get consumed,
+    // revoking a user removes their entry here.
+    approvedEmails: z.array(z.string().email().transform(s => s.toLowerCase())).default([]),
+});
+/**
+ * Gate 1 decides whether a Google account may log in to this Braid server.
+ * It composes two layers.
+ *
+ * The static allowlist reads the `BRAID_ALLOWED_DOMAINS` and `BRAID_ALLOWED_EMAILS` env vars.
+ * Domain matches (`@kdanmobile.com`) and email matches (`alice@example.com`) auto-pass.
+ * Both may be left unset on a public instance,
+ * combined with an empty invite list this rejects everyone (fail closed).
+ *
+ * The invite list lives at `${BRAID_HOME}/access.json`, maintained by an admin via `/admin/invites`.
+ * One invite per email, consumed on first successful login.
+ *
+ * The policy is open for either path, a domain pass OR an invite present.
+ * That matches the "hybrid" Gate 1 the design picked.
+ */
+export class AccessPolicy {
+    invitesPath;
+    allowedDomains;
+    allowedEmails;
+    adminEmails;
+    constructor(invitesPath, config = {}) {
+        this.invitesPath = invitesPath;
+        this.allowedDomains = new Set((config.allowedDomains ?? []).map(s => s.toLowerCase()));
+        this.allowedEmails = new Set((config.allowedEmails ?? []).map(s => s.toLowerCase()));
+        this.adminEmails = new Set((config.adminEmails ?? []).map(s => s.toLowerCase()));
+    }
+    /**
+     * Evaluate against the current allowlist and invite file.
+     * Reads the invite file every call, since invite management is low-frequency,
+     * and a stale cache would create a frustrating race,
+     * where an admin invites Bob, Bob logs in, and the server still says "no".
+     */
+    async decide(email) {
+        const lower = email.toLowerCase();
+        if (this.allowedEmails.has(lower))
+            return { allow: true };
+        const domain = lower.split('@')[1] ?? '';
+        if (domain && this.allowedDomains.has(domain))
+            return { allow: true };
+        const content = await this.readContent();
+        // Approved (post-redemption) allowlist persists across logins.
+        if (content.approvedEmails.includes(lower))
+            return { allow: true };
+        const invite = content.invites.find(i => i.email === lower);
+        if (invite)
+            return { allow: true, viaInvite: invite };
+        return {
+            allow: false,
+            reason: 'This Google account is not authorized to sign in. Ask an admin to invite you.',
+        };
+    }
+    /**
+     * Whether the email should be marked `serverRole='admin'` on the resulting user record.
+     * Independent of `decide`, since invites carry their own role override,
+     * and an admin email might take the allowlist path with no invite.
+     */
+    isAdmin(email) {
+        return this.adminEmails.has(email.toLowerCase());
+    }
+    async listInvites() {
+        return this.readInvites();
+    }
+    async addInvite(input) {
+        const lower = input.email.toLowerCase();
+        const content = await this.readContent();
+        if (content.invites.some(i => i.email === lower))
+            throw new ValidationError(`Invite for "${lower}" already exists`);
+        const invite = {
+            email: lower,
+            invitedAt: new Date().toISOString(),
+            serverRole: input.serverRole ?? 'user',
+        };
+        content.invites.push(invite);
+        await this.writeContent(content);
+        return invite;
+    }
+    async removeInvite(email) {
+        const lower = email.toLowerCase();
+        const content = await this.readContent();
+        const filtered = content.invites.filter(i => i.email !== lower);
+        if (filtered.length === content.invites.length)
+            return;
+        await this.writeContent({ ...content, invites: filtered });
+    }
+    /**
+     * Consume an invite once the user record exists.
+     * Remove it from invites,
+     * add to approvedEmails so the user can sign in again without the admin re-inviting them.
+     * Idempotent.
+     */
+    async consumeInvite(email) {
+        const lower = email.toLowerCase();
+        const content = await this.readContent();
+        const invites = content.invites.filter(i => i.email !== lower);
+        const approvedEmails = content.approvedEmails.includes(lower)
+            ? content.approvedEmails
+            : [...content.approvedEmails, lower];
+        if (invites.length === content.invites.length && approvedEmails === content.approvedEmails)
+            return;
+        await this.writeContent({ invites, approvedEmails });
+    }
+    /**
+     * Add an email to the persistent allowlist directly, without going through the invite step.
+     * Used by the bootstrap migration that back-fills approvedEmails,
+     * for users who registered before this field existed.
+     */
+    async approveEmail(email) {
+        const lower = email.toLowerCase();
+        const content = await this.readContent();
+        if (content.approvedEmails.includes(lower))
+            return;
+        await this.writeContent({
+            ...content,
+            approvedEmails: [...content.approvedEmails, lower],
+        });
+    }
+    /**
+     * Drop an email from the persistent allowlist.
+     * Called when an admin deletes a user,
+     * so the underlying email can't sneak back in without a fresh invite.
+     * Idempotent.
+     */
+    async revokeApproval(email) {
+        const lower = email.toLowerCase();
+        const content = await this.readContent();
+        const filtered = content.approvedEmails.filter(e => e !== lower);
+        if (filtered.length === content.approvedEmails.length)
+            return;
+        await this.writeContent({ ...content, approvedEmails: filtered });
+    }
+    async listApprovedEmails() {
+        return (await this.readContent()).approvedEmails;
+    }
+    async readInvites() {
+        return (await this.readContent()).invites;
+    }
+    async readContent() {
+        try {
+            const raw = await readFile(this.invitesPath, 'utf-8');
+            const parsed = Content.safeParse(JSON.parse(raw));
+            if (!parsed.success)
+                throw new ValidationError(`Invalid access file at "${this.invitesPath}": ${parsed.error.message}`);
+            return parsed.data;
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return { invites: [], approvedEmails: [] };
+            throw error;
+        }
+    }
+    async writeContent(content) {
+        await mkdir(dirname(this.invitesPath), { recursive: true });
+        await writeFile(this.invitesPath, `${JSON.stringify(content, null, 2)}\n`, 'utf-8');
+    }
+}
+//# sourceMappingURL=AccessPolicy.js.map

package/dist/infrastructure/auth/AccessPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessPolicy.js","sourceRoot":"","sources":["../../../src/infrastructure/auth/AccessPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAChD,2DAA2D;IAC3D,mFAAmF;IACnF,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACtD,CAAC,CAAA;AAGF,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpC,2EAA2E;IAC3E,2CAA2C;IAC3C,sDAAsD;IACtD,kEAAkE;IAClE,4EAA4E;IAC5E,4CAA4C;IAC5C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACxF,CAAC,CAAA;AAuBF;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,YAAY;IAMJ;IALF,cAAc,CAAqB;IACnC,aAAa,CAAqB;IAClC,WAAW,CAAqB;IAEjD,YACmB,WAAmB,EACpC,SAA6B,EAAE;QADd,gBAAW,GAAX,WAAW,CAAQ;QAGpC,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;QACtF,IAAI,CAAC,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;QACpF,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;IAClF,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;QACjC,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC;YAC/B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QACxB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACxC,IAAI,MAAM,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;YAC3C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QAExB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACxC,+DAA+D;QAC/D,IAAI,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;YACxC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QACxB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAA;QAC3D,IAAI,MAAM;YACR,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;QAE3C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,+EAA+E;SACxF,CAAA;IACH,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,KAAa;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,KAAK,CAAC,WAAW;QACf,OAAO,IAAI,CAAC,WAAW,EAAE,CAAA;IAC3B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAuD;QACrE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAA;QACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACxC,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC;YAC9C,MAAM,IAAI,eAAe,CAAC,eAAe,KAAK,kBAAkB,CAAC,CAAA;QACnE,MAAM,MAAM,GAAW;YACrB,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,MAAM;SACvC,CAAA;QACD,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5B,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;QAChC,OAAO,MAAM,CAAA;IACf,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAA;QAC/D,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM;YAC5C,OAAM;QACR,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACxC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAA;QAC9D,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC3D,CAAC,CAAC,OAAO,CAAC,cAAc;YACxB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;QACtC,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,cAAc,KAAK,OAAO,CAAC,cAAc;YACxF,OAAM;QACR,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAA;IACtD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACxC,IAAI,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;YACxC,OAAM;QACR,MAAM,IAAI,CAAC,YAAY,CAAC;YACtB,GAAG,OAAO;YACV,cAAc,EAAE,CAAC,GAAG,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC;SACnD,CAAC,CAAA;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,KAAa;QAChC,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,CAAA;QAChE,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,MAAM;YACnD,OAAM;QACR,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAA;IACnE,CAAC;IAED,KAAK,CAAC,kBAAkB;QACtB,OAAO,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,cAAc,CAAA;IAClD,CAAC;IAEO,KAAK,CAAC,WAAW;QACvB,OAAO,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAA;IAC3C,CAAC;IAEO,KAAK,CAAC,WAAW;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;YACrD,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;YACjD,IAAI,CAAC,MAAM,CAAC,OAAO;gBACjB,MAAM,IAAI,eAAe,CAAC,2BAA2B,IAAI,CAAC,WAAW,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;YACpG,OAAO,MAAM,CAAC,IAAI,CAAA;QACpB,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBACpD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CAAA;YAC5C,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,OAAgB;QACzC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3D,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACrF,CAAC;CACF"}

package/dist/infrastructure/auth/SessionStore.d.ts

@@ -0,0 +1,50 @@
+import type { UserId } from '@braidhq/schema';
+export interface IssuedSession {
+    readonly token: string;
+    readonly userId: UserId;
+    readonly expiresAt?: string;
+}
+export interface ResolvedSession {
+    readonly userId: UserId;
+    readonly expiresAt?: string;
+}
+/**
+ * The port. A hosted deployment swaps the file-backed impl for a shared store,
+ * such as Redis or Postgres, behind this interface.
+ */
+export interface SessionStore {
+    issue: (userId: UserId, options?: {
+        ttlSeconds?: number;
+    }) => Promise<IssuedSession>;
+    resolve: (token: string) => Promise<ResolvedSession | null>;
+    revoke: (token: string) => Promise<void>;
+    revokeAllForUser: (userId: UserId) => Promise<void>;
+}
+/**
+ * Hashed session tokens persisted to `${BRAID_HOME}/sessions.json`.
+ * Token format is 32 random bytes encoded as `base64url` (43 chars).
+ * The plain text is returned once at issuance time, the server stores SHA-256 of it.
+ * A leaked sessions.json therefore cannot be replayed as a Bearer header.
+ *
+ * No rotation, no rolling expiry, no per-device tracking,
+ * this is the minimum useful surface for v0.2.
+ * Future remote-server work can revisit if needed.
+ */
+export declare class FsSessionStore implements SessionStore {
+    private readonly filePath;
+    constructor(filePath: string);
+    issue(userId: UserId, options?: {
+        ttlSeconds?: number;
+    }): Promise<IssuedSession>;
+    /**
+     * Resolve a Bearer token to its session.
+     * Updates `lastUsedAt` as a side effect,
+     * not required for correctness but useful for the future "active sessions" admin view.
+     */
+    resolve(token: string): Promise<ResolvedSession | null>;
+    revoke(token: string): Promise<void>;
+    revokeAllForUser(userId: UserId): Promise<void>;
+    private read;
+    private write;
+}
+//# sourceMappingURL=SessionStore.d.ts.map

package/dist/infrastructure/auth/SessionStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionStore.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/auth/SessionStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AA2B7C,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,aAAa,CAAC,CAAA;IACpF,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAA;IAC3D,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACxC,gBAAgB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACpD;AAED;;;;;;;;;GASG;AACH,qBAAa,cAAe,YAAW,YAAY;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,MAAM;IAEvC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,aAAa,CAAC;IAa1F;;;;OAIG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAevD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASpC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAQvC,IAAI;YAeJ,KAAK;CAIpB"}

package/dist/infrastructure/auth/SessionStore.js

@@ -0,0 +1,104 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { ValidationError } from '@braidhq/core';
+import { z } from 'zod';
+const SessionRow = z.object({
+    // SHA-256 hex of the actual token.
+    // The plaintext is shown to the client once at issuance time,
+    // the server only ever sees the hash thereafter.
+    // Constant-time compare is unnecessary for a pre-image lookup on hex strings,
+    // which is what `findByToken` does.
+    tokenHash: z.string().length(64),
+    userId: z.string().min(1),
+    createdAt: z.string().datetime({ offset: true }),
+    expiresAt: z.string().datetime({ offset: true }).optional(),
+    lastUsedAt: z.string().datetime({ offset: true }).optional(),
+});
+const StoreContent = z.object({
+    sessions: z.array(SessionRow).default([]),
+});
+/**
+ * Hashed session tokens persisted to `${BRAID_HOME}/sessions.json`.
+ * Token format is 32 random bytes encoded as `base64url` (43 chars).
+ * The plain text is returned once at issuance time, the server stores SHA-256 of it.
+ * A leaked sessions.json therefore cannot be replayed as a Bearer header.
+ *
+ * No rotation, no rolling expiry, no per-device tracking,
+ * this is the minimum useful surface for v0.2.
+ * Future remote-server work can revisit if needed.
+ */
+export class FsSessionStore {
+    filePath;
+    constructor(filePath) {
+        this.filePath = filePath;
+    }
+    async issue(userId, options = {}) {
+        const content = await this.read();
+        const token = randomBytes(32).toString('base64url');
+        const tokenHash = sha256Hex(token);
+        const createdAt = new Date().toISOString();
+        const expiresAt = options.ttlSeconds
+            ? new Date(Date.now() + options.ttlSeconds * 1000).toISOString()
+            : undefined;
+        content.sessions.push({ tokenHash, userId, createdAt, ...(expiresAt ? { expiresAt } : {}) });
+        await this.write(content);
+        return { token, userId, ...(expiresAt ? { expiresAt } : {}) };
+    }
+    /**
+     * Resolve a Bearer token to its session.
+     * Updates `lastUsedAt` as a side effect,
+     * not required for correctness but useful for the future "active sessions" admin view.
+     */
+    async resolve(token) {
+        if (!token || token.length === 0)
+            return null;
+        const tokenHash = sha256Hex(token);
+        const content = await this.read();
+        const row = content.sessions.find(s => s.tokenHash === tokenHash);
+        if (!row)
+            return null;
+        if (row.expiresAt && Date.parse(row.expiresAt) < Date.now())
+            return null;
+        row.lastUsedAt = new Date().toISOString();
+        await this.write(content);
+        return { userId: row.userId, ...(row.expiresAt ? { expiresAt: row.expiresAt } : {}) };
+    }
+    async revoke(token) {
+        const tokenHash = sha256Hex(token);
+        const content = await this.read();
+        const filtered = content.sessions.filter(s => s.tokenHash !== tokenHash);
+        if (filtered.length === content.sessions.length)
+            return;
+        await this.write({ sessions: filtered });
+    }
+    async revokeAllForUser(userId) {
+        const content = await this.read();
+        const filtered = content.sessions.filter(s => s.userId !== userId);
+        if (filtered.length === content.sessions.length)
+            return;
+        await this.write({ sessions: filtered });
+    }
+    async read() {
+        try {
+            const raw = await readFile(this.filePath, 'utf-8');
+            const parsed = StoreContent.safeParse(JSON.parse(raw));
+            if (!parsed.success)
+                throw new ValidationError(`Invalid session store at "${this.filePath}": ${parsed.error.message}`);
+            return parsed.data;
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return { sessions: [] };
+            throw error;
+        }
+    }
+    async write(content) {
+        await mkdir(dirname(this.filePath), { recursive: true });
+        await writeFile(this.filePath, `${JSON.stringify(content, null, 2)}\n`, 'utf-8');
+    }
+}
+function sha256Hex(input) {
+    return createHash('sha256').update(input).digest('hex');
+}
+//# sourceMappingURL=SessionStore.js.map

package/dist/infrastructure/auth/SessionStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionStore.js","sourceRoot":"","sources":["../../../src/infrastructure/auth/SessionStore.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,mCAAmC;IACnC,8DAA8D;IAC9D,iDAAiD;IACjD,8EAA8E;IAC9E,oCAAoC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC7D,CAAC,CAAA;AAIF,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC1C,CAAC,CAAA;AAyBF;;;;;;;;;GASG;AACH,MAAM,OAAO,cAAc;IACI;IAA7B,YAA6B,QAAgB;QAAhB,aAAQ,GAAR,QAAQ,CAAQ;IAAG,CAAC;IAEjD,KAAK,CAAC,KAAK,CAAC,MAAc,EAAE,UAAmC,EAAE;QAC/D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACnD,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU;YAClC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;YAChE,CAAC,CAAC,SAAS,CAAA;QACb,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QAC5F,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACzB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;IAC/D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,KAAa;QACzB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAC9B,OAAO,IAAI,CAAA;QACb,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAA;QACjE,IAAI,CAAC,GAAG;YACN,OAAO,IAAI,CAAA;QACb,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE;YACzD,OAAO,IAAI,CAAA;QACb,GAAG,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACzC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACzB,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAgB,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;IACjG,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAA;QACxE,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,MAAM;YAC7C,OAAM;QACR,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC1C,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAc;QACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;QAClE,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,MAAM;YAC7C,OAAM;QACR,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC1C,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YAClD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;YACtD,IAAI,CAAC,MAAM,CAAC,OAAO;gBACjB,MAAM,IAAI,eAAe,CAAC,6BAA6B,IAAI,CAAC,QAAQ,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;YACnG,OAAO,MAAM,CAAC,IAAI,CAAA;QACpB,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBACpD,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;YACzB,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,OAAqB;QACvC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACxD,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAClF,CAAC;CACF;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACzD,CAAC"}