@deslop/auth 0.1.1222 → 0.1.1227

package/README.md

@@ -1,28 +1,13 @@
 # Deslop Auth
 
-The shared sign-in server: an OAuth 2.1 authorization server for every Deslop app and MCP server, with GitHub and code sign-ins.
+The sign-in for every Deslop app: GitHub, or a code approved from a browser, phone or agent.
 
-## Sign-ins
+```bash
+npm install --global @deslop/auth
+auth service install --url https://auth.mp281x.xyz --auth https://auth.mp281x.xyz --admins <github-id> --github-client-id <id>
+```
 
-Every sign-in is one waiting code, approved from a signed-in browser, a phone or an agent's `answer_request`, and delivered once at `/auth/continue` to the browser or command holding its cookie.
+- **Secret**: `GITHUB_CLIENT_SECRET` in `~/.deslop/auth.env`.
+- **MCP** at `/mcp`: `answer_request` approves a sign-in by its code.
 
-| Signs in                        | Gets                             | Approved by                        |
-| ------------------------------- | -------------------------------- | ---------------------------------- |
-| App or harness                  | OAuth code at its callback       | Browser, phone or `answer_request` |
-| **Sign in with a code** browser | 30-day session, back to its page | A signed-in browser only           |
-| GitHub                          | One-year session                 | GitHub                             |
-
-- **Waiting page** shows a QR code and the code; leave it open in the client's browser, which completes the localhost callback, never on the phone.
-- **Lifetime**: 10 minutes, in memory; a restart ends the waiting ones. Workers' harness steps: environment skill, Maintenance.
-- **Clients**: the id is the encoded registration, so registering stores nothing. The signed-in list shows `Client · Device`: a known worker, the User-Agent's platform, or the address.
-- **Without `--auth`**, as in a preview, **Sign in with GitHub** returns at once as `dev` (`github:0`), an admin unless `--admins` says otherwise; the session stays on the preview's host. Every other app without `--auth` needs no sign-in.
-- **Sign out** from any app's account menu arrives at `/?sign-out`, which ends the shared session and returns to that app.
-- **Settings**: `--admins` and `--github-client-id` flags; `GITHUB_CLIENT_SECRET` in `~/.deslop/auth.env`.
-- **Storage**: signed-in apps and browsers in its data directory; authorization codes in memory.
-- **Rate limit**: registration, authorization, token, revocation, GitHub and code sign-in requests have a per-minute budget per address (IPv6 /64), 429 past it.
-
-## MCP
-
-- **Discovery**: each Deslop MCP server's `/.well-known/oauth-protected-resource/mcp` names Auth; no credentials → 401 challenge; rejected bearer → `error="invalid_token"`; Auth down → 503 with `Retry-After`.
-- **Stored credentials prove nothing**: check the client's MCP status and tool discovery. `OAuth authorization required` at startup, or after an auth-store reset: sign the client in to the gateway again.
-- **`answer_request`**: `https://auth.mp281x.xyz/mcp`'s one tool, reached through the [gateway](../gateway/README.md) as `auth__answer_request`.
+Common flags and service commands: [Deslop app runtime](https://github.com/MP281X/deslop/blob/main/packages/runtime/README.md).

package/dist/server.js

@@ -89006,7 +89006,7 @@ function layerKeyValueStore(directory) {
 const layerDataStore = unwrap$7(map$5(dataDirectory, layerKeyValueStore));
 const layerProtocol = mergeAll$1(layerSchemaBinary(), succeed$6(MaxBodySize)(mebibytes(10)));
 const layerTelemetry = unwrap$7(gen(function* () {
-	const name = yield* appName;
+	const name = (yield* packageMetadata).name;
 	return match$8(yield* option(String$5("OTEL_URL")), {
 		onNone: () => empty$11,
 		onSome: (url) => layerOtlp(`${name}-server`, url, "server")
@@ -89152,17 +89152,20 @@ function systemctl(...args) {
 const unitDirectory = gen(function* () {
 	return (yield* Path$1).join(yield* String$5("HOME"), ".config", "systemd", "user");
 });
-const install = fnUntraced(function* (name, command) {
+const install = fnUntraced(function* (name, command, options) {
 	const fs = yield* FileSystem;
 	const path = yield* Path$1;
 	const home = yield* String$5("HOME");
 	const directory = yield* unitDirectory;
 	const unit = `deslop-${name}.service`;
 	yield* fs.makeDirectory(directory, { recursive: true });
-	yield* fs.writeFileString(path.join(directory, unit), `[Unit]\nDescription=Deslop ${name}\nAfter=network-online.target\n\n[Service]\nType=simple\nEnvironment=NODE_ENV=production\nEnvironment=${systemdArgument(`PATH=${home}/.vite-plus/bin:/usr/local/bin:/usr/bin:/bin`)}\nEnvironmentFile=-${systemdArgument(`${home}/.deslop/${name}.env`)}\nExecStart=${join$2(map$8(command, systemdArgument), " ")}\nRestart=on-failure\nRestartSec=3\nUMask=0077\n\n[Install]\nWantedBy=default.target\n`, { mode: 384 });
+	yield* fs.writeFileString(path.join(directory, unit), `[Unit]\nDescription=Deslop ${name}\nAfter=network-online.target\n\n[Service]\nType=simple\nEnvironment=NODE_ENV=production\nEnvironment=${systemdArgument(`PATH=${home}/.vite-plus/bin:/usr/local/bin:/usr/bin:/bin`)}\nEnvironmentFile=-${replaceAll("%", "%%")(`${home}/.deslop/${name}.env`)}\nExecStart=${join$2(map$8(command, systemdArgument), " ")}\nRestart=on-failure\nRestartSec=3\nUMask=0077\n\n[Install]\nWantedBy=default.target\n`, { mode: 384 });
 	yield* systemctl("daemon-reload");
 	yield* systemctl("enable", unit);
-	yield* systemctl("restart", unit);
+	yield* systemctl(match$1(options?.restart === false, {
+		onFalse: () => "restart",
+		onTrue: () => "start"
+	}), unit);
 	return `${unit} installed\n`;
 });
 const installUpdates = fnUntraced(function* (name, command) {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@deslop/auth",
-	"version": "0.1.1222",
+	"version": "0.1.1227",
 	"repository": {
 		"type": "git",
 		"url": "https://github.com/MP281X/deslop",
@@ -32,5 +32,5 @@
 	"engines": {
 		"node": ">=26"
 	},
-	"fingerprint": "9152935bf0e221622997f3b41fb0184605dfa4da0df41cee57d0d764a9eb56e9"
+	"fingerprint": "33c8e9ec656d6d0ecb755911d55e06fe8fda82c363e5486ab13351a45cae82ce"
 }