@happier-dev/stack 0.1.0-preview.96.1 → 0.1.0

package/node_modules/@happier-dev/release-runtime/dist/minisign.d.ts

@@ -0,0 +1,7 @@
+export declare const DEFAULT_MINISIGN_PUBLIC_KEY = "untrusted comment: minisign public key 91AE28177BF6E43C\nRWQ85PZ7FyiukYbL3qv/bKnwgbT68wLVzotapeMFIb8n+c7pBQ7U8W2t\n";
+export declare function verifyMinisign(params: Readonly<{
+    message: Buffer;
+    pubkeyFile: string;
+    sigFile: string;
+}>): boolean;
+//# sourceMappingURL=minisign.d.ts.map

package/node_modules/@happier-dev/release-runtime/dist/minisign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"minisign.d.ts","sourceRoot":"","sources":["../src/minisign.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,2BAA2B,wHAEvC,CAAC;AAmEF,wBAAgB,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,OAAO,CAiClH"}

package/node_modules/@happier-dev/release-runtime/dist/minisign.js

@@ -0,0 +1,92 @@
+import { createHash, createPublicKey, verify } from 'node:crypto';
+const ED25519_SPKI_PREFIX = Buffer.from('302a300506032b6570032100', 'hex');
+export const DEFAULT_MINISIGN_PUBLIC_KEY = `untrusted comment: minisign public key 91AE28177BF6E43C
+RWQ85PZ7FyiukYbL3qv/bKnwgbT68wLVzotapeMFIb8n+c7pBQ7U8W2t
+`;
+function decodeBase64Line(line, expectedBytes) {
+    const bytes = Buffer.from(String(line ?? '').trim(), 'base64');
+    if (expectedBytes != null && bytes.length !== expectedBytes) {
+        throw new Error(`[minisign] expected ${expectedBytes} bytes, got ${bytes.length}`);
+    }
+    return bytes;
+}
+function parseMinisignPublicKeyFile(pubkeyFile) {
+    const lines = String(pubkeyFile ?? '')
+        .split('\n')
+        .map((l) => l.trim())
+        .filter(Boolean);
+    if (lines.length < 2)
+        throw new Error('[minisign] invalid public key file');
+    const payload = lines[lines.length - 1] ?? '';
+    const bytes = decodeBase64Line(payload, 42);
+    const signatureAlgorithm = bytes.subarray(0, 2);
+    const keyId = bytes.subarray(2, 10);
+    const rawPublicKey = bytes.subarray(10, 42);
+    return { signatureAlgorithm, keyId, rawPublicKey };
+}
+function parseMinisignSignatureFile(sigFile) {
+    const lines = String(sigFile ?? '').split('\n');
+    if (lines.length < 4)
+        throw new Error('[minisign] invalid signature file');
+    const untrustedPayload = String(lines[1] ?? '').trim();
+    const trustedComment = String(lines[2] ?? '');
+    const globalPayload = String(lines[3] ?? '').trim();
+    const untrustedBytes = decodeBase64Line(untrustedPayload, 74);
+    const signatureAlgorithm = untrustedBytes.subarray(0, 2);
+    const keyId = untrustedBytes.subarray(2, 10);
+    const signature = untrustedBytes.subarray(10, 74);
+    const globalSignature = decodeBase64Line(globalPayload, 64);
+    if (!trustedComment.startsWith('trusted comment: ')) {
+        throw new Error('[minisign] unexpected trusted comment format');
+    }
+    const trustedSuffix = Buffer.from(trustedComment.slice('trusted comment: '.length), 'utf-8');
+    return { signatureAlgorithm, keyId, signature, trustedSuffix, globalSignature };
+}
+function createEd25519PublicKey(rawPublicKey) {
+    if (!Buffer.isBuffer(rawPublicKey) || rawPublicKey.length !== 32) {
+        throw new Error('[minisign] invalid Ed25519 public key length');
+    }
+    const spki = Buffer.concat([ED25519_SPKI_PREFIX, rawPublicKey]);
+    return createPublicKey({ key: spki, format: 'der', type: 'spki' });
+}
+function bytesEqual(a, b) {
+    if (!a || !b)
+        return false;
+    if (a.length !== b.length)
+        return false;
+    return Buffer.compare(a, b) === 0;
+}
+export function verifyMinisign(params) {
+    try {
+        const bin = Buffer.isBuffer(params.message) ? params.message : Buffer.from(params.message ?? '');
+        const pubkey = parseMinisignPublicKeyFile(params.pubkeyFile);
+        const sig = parseMinisignSignatureFile(params.sigFile);
+        if (!bytesEqual(pubkey.signatureAlgorithm, Buffer.from('Ed'))) {
+            throw new Error('[minisign] incompatible public key signature algorithm');
+        }
+        if (!bytesEqual(pubkey.keyId, sig.keyId)) {
+            throw new Error('[minisign] incompatible key identifiers');
+        }
+        let prehashed = false;
+        if (bytesEqual(sig.signatureAlgorithm, Buffer.from('Ed'))) {
+            prehashed = false;
+        }
+        else if (bytesEqual(sig.signatureAlgorithm, Buffer.from('ED'))) {
+            prehashed = true;
+        }
+        else {
+            throw new Error('[minisign] unsupported signature algorithm');
+        }
+        const publicKey = createEd25519PublicKey(pubkey.rawPublicKey);
+        const payload = prehashed ? createHash('blake2b512').update(bin).digest() : bin;
+        const okSig = verify(null, payload, publicKey, sig.signature);
+        if (!okSig)
+            return false;
+        const okGlobal = verify(null, Buffer.concat([sig.signature, sig.trustedSuffix]), publicKey, sig.globalSignature);
+        return okGlobal;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=minisign.js.map

package/node_modules/@happier-dev/release-runtime/dist/minisign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"minisign.js","sourceRoot":"","sources":["../src/minisign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAElE,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;AAE3E,MAAM,CAAC,MAAM,2BAA2B,GAAG;;CAE1C,CAAC;AAEF,SAAS,gBAAgB,CAAC,IAAY,EAAE,aAAsB;IAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC/D,IAAI,aAAa,IAAI,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,uBAAuB,aAAa,eAAe,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,0BAA0B,CAAC,UAAkB;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;SACnC,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,kBAAkB,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACpC,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAe;IAOjD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAE3E,MAAM,gBAAgB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAEpD,MAAM,cAAc,GAAG,gBAAgB,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;IAC9D,MAAM,kBAAkB,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAElD,MAAM,eAAe,GAAG,gBAAgB,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAE5D,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;IAE7F,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;AAClF,CAAC;AAED,SAAS,sBAAsB,CAAC,YAAoB;IAClD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC,CAAC;IAChE,OAAO,eAAe,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,UAAU,CAAC,CAAS,EAAE,CAAS;IACtC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAA0E;IACvG,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACjG,MAAM,MAAM,GAAG,0BAA0B,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,0BAA0B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEvD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,UAAU,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1D,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;aAAM,IAAI,UAAU,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACjE,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,SAAS,GAAG,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAEhF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9D,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAEzB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;QACjH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/node_modules/@happier-dev/release-runtime/dist/verifiedDownload.d.ts

@@ -0,0 +1,26 @@
+type ReleaseAsset = Readonly<{
+    name: string;
+    url: string;
+}>;
+export type ReleaseAssetBundle = Readonly<{
+    version: string;
+    archive: ReleaseAsset;
+    checksums: ReleaseAsset;
+    checksumsSig: ReleaseAsset;
+}>;
+export declare function downloadVerifiedReleaseAssetBundle(params: Readonly<{
+    bundle: ReleaseAssetBundle;
+    destDir: string;
+    pubkeyFile: string;
+    userAgent?: string;
+}>): Promise<Readonly<{
+    version: string;
+    archiveName: string;
+    archivePath: string;
+    source: {
+        archiveUrl: string;
+        checksumsUrl: string;
+    };
+}>>;
+export {};
+//# sourceMappingURL=verifiedDownload.d.ts.map

package/node_modules/@happier-dev/release-runtime/dist/verifiedDownload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifiedDownload.d.ts","sourceRoot":"","sources":["../src/verifiedDownload.ts"],"names":[],"mappings":"AAOA,KAAK,YAAY,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE5D,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,YAAY,CAAC;IACtB,SAAS,EAAE,YAAY,CAAC;IACxB,YAAY,EAAE,YAAY,CAAC;CAC5B,CAAC,CAAC;AAmBH,wBAAsB,kCAAkC,CAAC,MAAM,EAAE,QAAQ,CAAC;IACxE,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD,CAAC,CAAC,CAgCF"}

package/node_modules/@happier-dev/release-runtime/dist/verifiedDownload.js

@@ -0,0 +1,53 @@
+import { createHash } from 'node:crypto';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { lookupSha256 } from './checksums.js';
+import { verifyMinisign } from './minisign.js';
+async function fetchText(url, { userAgent = 'happier-release-runtime' } = {}) {
+    const res = await fetch(url, { headers: { 'user-agent': userAgent } });
+    if (!res.ok)
+        throw new Error(`[download] failed: ${url} (${res.status})`);
+    return res.text();
+}
+async function fetchBytes(url, { userAgent = 'happier-release-runtime' } = {}) {
+    const res = await fetch(url, { headers: { 'user-agent': userAgent } });
+    if (!res.ok)
+        throw new Error(`[download] failed: ${url} (${res.status})`);
+    const ab = await res.arrayBuffer();
+    return Buffer.from(ab);
+}
+function sha256Hex(bytes) {
+    return createHash('sha256').update(bytes).digest('hex');
+}
+export async function downloadVerifiedReleaseAssetBundle(params) {
+    const bundle = params.bundle;
+    const destDir = String(params.destDir ?? '').trim();
+    const pubkeyFile = String(params.pubkeyFile ?? '');
+    const userAgent = String(params.userAgent ?? '').trim() || 'happier-release-runtime';
+    if (!destDir)
+        throw new Error('[download] destDir is required');
+    if (!pubkeyFile.trim())
+        throw new Error('[download] pubkeyFile is required');
+    await mkdir(destDir, { recursive: true });
+    const checksumsText = await fetchText(bundle.checksums.url, { userAgent });
+    const sigFile = await fetchText(bundle.checksumsSig.url, { userAgent });
+    const ok = verifyMinisign({ message: Buffer.from(checksumsText, 'utf-8'), pubkeyFile, sigFile });
+    if (!ok) {
+        throw new Error('[download] signature verification failed for checksums file');
+    }
+    const expected = lookupSha256({ checksumsText, filename: bundle.archive.name });
+    const bytes = await fetchBytes(bundle.archive.url, { userAgent });
+    const actual = sha256Hex(bytes);
+    if (actual !== expected) {
+        throw new Error(`[download] checksum verification failed for ${bundle.archive.name}`);
+    }
+    const archivePath = join(destDir, bundle.archive.name);
+    await writeFile(archivePath, bytes);
+    return {
+        version: String(bundle.version ?? ''),
+        archiveName: bundle.archive.name,
+        archivePath,
+        source: { archiveUrl: bundle.archive.url, checksumsUrl: bundle.checksums.url },
+    };
+}
+//# sourceMappingURL=verifiedDownload.js.map

package/node_modules/@happier-dev/release-runtime/dist/verifiedDownload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifiedDownload.js","sourceRoot":"","sources":["../src/verifiedDownload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAW/C,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,EAAE,SAAS,GAAG,yBAAyB,EAAE,GAAG,EAAE;IAClF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IACvE,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1E,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,EAAE,SAAS,GAAG,yBAAyB,EAAE,GAAG,EAAE;IACnF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IACvE,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1E,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC;IACnC,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,MAKvD;IAMA,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,yBAAyB,CAAC;IACrF,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAChE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAE7E,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1C,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACxE,MAAM,EAAE,GAAG,cAAc,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IACjG,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,+CAA+C,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACpC,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QACrC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;QAChC,WAAW;QACX,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE;KAC/E,CAAC;AACJ,CAAC"}

package/node_modules/@happier-dev/release-runtime/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@happier-dev/release-runtime",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./minisign": {
+      "types": "./dist/minisign.d.ts",
+      "default": "./dist/minisign.js"
+    },
+    "./checksums": {
+      "types": "./dist/checksums.d.ts",
+      "default": "./dist/checksums.js"
+    },
+    "./assets": {
+      "types": "./dist/assets.d.ts",
+      "default": "./dist/assets.js"
+    },
+    "./extractPlan": {
+      "types": "./dist/extractPlan.d.ts",
+      "default": "./dist/extractPlan.js"
+    },
+    "./verifiedDownload": {
+      "types": "./dist/verifiedDownload.d.ts",
+      "default": "./dist/verifiedDownload.js"
+    },
+    "./github": {
+      "types": "./dist/github.d.ts",
+      "default": "./dist/github.js"
+    }
+  }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@happier-dev/stack",
   "type": "module",
-  "version": "0.1.0-preview.96.1",
+  "version": "0.1.0",
   "repository": "happier-dev/happier",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
@@ -18,7 +18,10 @@
     "scripts/"
   ],
   "bundledDependencies": [
-    "@happier-dev/cli-common"
+    "@happier-dev/agents",
+    "@happier-dev/cli-common",
+    "@happier-dev/protocol",
+    "@happier-dev/release-runtime"
   ],
   "scripts": {
     "setup": "node ./scripts/setup.mjs",
@@ -70,7 +73,10 @@
     "test:ci": "yarn -s test:unit"
   },
   "dependencies": {
+    "@happier-dev/agents": "0.0.0",
     "@happier-dev/cli-common": "0.0.0",
+    "@happier-dev/protocol": "0.0.0",
+    "@happier-dev/release-runtime": "0.0.0",
     "qrcode": "^1.5.4",
     "qrcode-terminal": "^0.12.0"
   }

package/scripts/auth.mjs

@@ -56,7 +56,20 @@ function resolveGuidedStartAction({ healthOk = false, runtimeOwnerAlive = false,
   return 'prompt';
 }
 
-function getInternalServerUrlCompat() {
+async function getInternalServerUrlCompat() {
+  const stackName = getStackName();
+  try {
+    const statePath = getStackRuntimeStatePath(stackName);
+    const st = await readStackRuntimeStateFile(statePath);
+    const ownerPid = Number(st?.ownerPid);
+    const runtimeOwnerAlive = Number.isFinite(ownerPid) && ownerPid > 1 ? isRuntimePidAlive(ownerPid) : false;
+    const port = Number(st?.ports?.server);
+    if (runtimeOwnerAlive && Number.isFinite(port) && port > 0) {
+      return { port, url: `http://127.0.0.1:${port}` };
+    }
+  } catch {
+    // ignore; fall back to env/default port
+  }
   const { port, internalServerUrl } = getInternalServerUrl({ env: process.env, defaultPort: 3005 });
   return { port, url: internalServerUrl };
 }
@@ -451,8 +464,9 @@ function resolveLightDirsForStack({ env, baseDir }) {
 function resolveDbProviderForLightFromEnv(env) {
   const raw = (env.HAPPIER_DB_PROVIDER ?? env.HAPPY_DB_PROVIDER ?? '').toString().trim().toLowerCase();
   if (raw === 'sqlite') return 'sqlite';
-  // Default for light flavor (embedded Postgres via pglite).
-  return 'pglite';
+  if (raw === 'pglite') return 'pglite';
+  // Default for light flavor.
+  return 'sqlite';
 }
 
 function resolveDbProviderForFullFromEnv(env) {
@@ -887,13 +901,13 @@ async function cmdCopyFrom({ argv, json }) {
 
   const positionals = argv.filter((a) => !a.startsWith('--'));
   const fromStackName = (positionals[1] ?? '').trim();
-  if (!fromStackName) {
-    throw new Error(
-      '[auth] usage: hstack stack auth <name> copy-from <sourceStack> [--force] [--with-infra] [--json]  OR  hstack auth copy-from <sourceStack> --all [--except=main,dev-auth] [--force] [--with-infra] [--json]\n' +
-        'notes:\n' +
-        '  - sourceStack can be a stack name (e.g. main, dev-auth)'
-    );
-  }
+	  if (!fromStackName) {
+	    throw new Error(
+	      '[auth] usage: hstack stack auth <name> copy-from <sourceStack> [--force] [--with-infra] [--offline-ok] [--json]  OR  hstack auth copy-from <sourceStack> --all [--except=main,dev-auth] [--force] [--with-infra] [--offline-ok] [--json]\n' +
+	        'notes:\n' +
+	        '  - sourceStack can be a stack name (e.g. main, dev-auth)'
+	    );
+	  }
 
   const { flags, kv } = parseArgs(argv);
   const all = flags.has('--all');
@@ -902,16 +916,26 @@ async function cmdCopyFrom({ argv, json }) {
     flags.has('--overwrite') ||
     (kv.get('--force') ?? '').trim() === '1' ||
     (kv.get('--overwrite') ?? '').trim() === '1';
-  const withInfra =
-    flags.has('--with-infra') ||
-    flags.has('--ensure-infra') ||
-    flags.has('--infra') ||
-    (kv.get('--with-infra') ?? '').trim() === '1' ||
-    (kv.get('--ensure-infra') ?? '').trim() === '1';
-  const linkMode =
-    flags.has('--link') ||
-    flags.has('--symlink') ||
-    flags.has('--link-auth') ||
+	  const withInfra =
+	    flags.has('--with-infra') ||
+	    flags.has('--ensure-infra') ||
+	    flags.has('--infra') ||
+	    (kv.get('--with-infra') ?? '').trim() === '1' ||
+	    (kv.get('--ensure-infra') ?? '').trim() === '1';
+	  const offlineOk =
+	    flags.has('--offline-ok') ||
+	    flags.has('--offline') ||
+	    (kv.get('--offline-ok') ?? '').trim() === '1' ||
+	    (kv.get('--offline') ?? '').trim() === '1';
+	  const noSecret =
+	    flags.has('--no-secret') ||
+	    flags.has('--skip-secret') ||
+	    (kv.get('--no-secret') ?? '').trim() === '1' ||
+	    (kv.get('--skip-secret') ?? '').trim() === '1';
+	  const linkMode =
+	    flags.has('--link') ||
+	    flags.has('--symlink') ||
+	    flags.has('--link-auth') ||
     (kv.get('--link') ?? '').trim() === '1' ||
     (kv.get('--symlink') ?? '').trim() === '1' ||
     (kv.get('--auth-mode') ?? '').trim() === 'link' ||
@@ -1086,7 +1110,7 @@ async function cmdCopyFrom({ argv, json }) {
     stackName,
     cliIdentity: 'default',
   });
-  const { url: targetInternalServerUrl } = getInternalServerUrlCompat();
+  const { url: targetInternalServerUrl } = await getInternalServerUrlCompat();
   const targetCredentialPaths = resolveStackCredentialPaths({
     cliHomeDir: targetCli,
     serverUrl: targetInternalServerUrl,
@@ -1143,15 +1167,21 @@ async function cmdCopyFrom({ argv, json }) {
     return await listAccountsFromPostgres({ cwd: sourceCwd, clientImport: sourceClientImport, databaseUrl: fromDatabaseUrl });
   };
 
-  let sourceAccounts = null;
-  const sourceTokenSubject = resolveJwtSubjectFromCredentialPath(sourceCredentialPath);
-  let sourceTokenValidation = null;
-  const sourceRuntimeOwnerAlive = await isStackRuntimeOwnerAlive(fromStackName);
-  if (sourceCredentialPath && sourceRuntimeOwnerAlive) {
-    sourceTokenValidation = await validateAuthTokenAgainstServer({
-      credentialPath: sourceCredentialPath,
-      internalServerUrl: sourceInternalServerUrl,
-    });
+	  let sourceAccounts = null;
+	  const sourceTokenSubject = resolveJwtSubjectFromCredentialPath(sourceCredentialPath);
+	  let sourceTokenValidation = null;
+	  const sourceRuntimeOwnerAlive = await isStackRuntimeOwnerAlive(fromStackName);
+	  if (sourceCredentialPath && !sourceRuntimeOwnerAlive && !offlineOk) {
+	    throw new Error(
+	      `[auth] source stack "${fromStackName}" does not appear to be running (no live stack.runtime.json). ` +
+	        `Start the source stack and retry, or re-run with --offline-ok to copy credentials without live server validation.`
+	    );
+	  }
+	  if (sourceCredentialPath && sourceRuntimeOwnerAlive) {
+	    sourceTokenValidation = await validateAuthTokenAgainstServer({
+	      credentialPath: sourceCredentialPath,
+	      internalServerUrl: sourceInternalServerUrl,
+	    });
     if (sourceTokenValidation.checked && sourceTokenValidation.valid === false) {
       const status = sourceTokenValidation.status != null ? sourceTokenValidation.status : 'error';
       const code = sourceTokenValidation.code ? `/${sourceTokenValidation.code}` : '';
@@ -1182,12 +1212,12 @@ async function cmdCopyFrom({ argv, json }) {
     }
   }
 
-  if (secret) {
-    if (serverComponent === 'happier-server-light') {
-      const target = join(targetServerLightDataDir, 'handy-master-secret.txt');
-      const sourcePath = source && !String(source).includes('(HANDY_MASTER_SECRET)') ? String(source) : '';
-      if (linkMode && sourcePath && existsSync(sourcePath)) {
-        copied.secret = await linkFileIfMissing({ from: sourcePath, to: target, force });
+	  if (secret && !noSecret) {
+	    if (serverComponent === 'happier-server-light') {
+	      const target = join(targetServerLightDataDir, 'handy-master-secret.txt');
+	      const sourcePath = source && !String(source).includes('(HANDY_MASTER_SECRET)') ? String(source) : '';
+	      if (linkMode && sourcePath && existsSync(sourcePath)) {
+	        copied.secret = await linkFileIfMissing({ from: sourcePath, to: target, force });
       } else {
         copied.secret = await writeSecretFileIfMissing({ path: target, secret, force });
       }
@@ -1278,7 +1308,7 @@ async function cmdCopyFrom({ argv, json }) {
         // so we can seed DB accounts reliably.
         const managed = (targetEnv.HAPPIER_STACK_MANAGED_INFRA ?? '1').toString().trim() !== '0';
 	        if (targetServerComponent === 'happier-server' && targetDbProvider === 'postgres' && withInfra && managed) {
-          const { port } = getInternalServerUrlCompat();
+          const { port } = await getInternalServerUrlCompat();
           const publicServerUrl = await preferStackLocalhostUrl(`http://localhost:${port}`, { stackName });
           const envPath = resolveStackEnvPath(stackName).envPath;
           const infra = await ensureHappyServerManagedInfra({
@@ -1364,7 +1394,7 @@ async function cmdStatus({ json }) {
   const { kv } = parseArgs(argv);
   const identity = parseCliIdentityOrThrow((kv.get('--identity') ?? '').trim());
 
-  const { port, url: internalServerUrl } = getInternalServerUrlCompat();
+  const { port, url: internalServerUrl } = await getInternalServerUrlCompat();
   const { defaultPublicUrl, envPublicUrl } = getPublicServerUrlEnvOverride({ env: process.env, serverPort: port, stackName });
   const { publicServerUrl } = await resolvePublicServerUrl({
     internalServerUrl,
@@ -1499,7 +1529,7 @@ async function cmdLogin({ argv, json }) {
   const { flags, kv } = parseArgs(argv);
 
   const tty = isTty();
-  const { port, url: internalServerUrl } = getInternalServerUrlCompat();
+  const { port, url: internalServerUrl } = await getInternalServerUrlCompat();
   const { defaultPublicUrl, envPublicUrl } = getPublicServerUrlEnvOverride({ env: process.env, serverPort: port, stackName });
   const { publicServerUrl } = await resolvePublicServerUrl({
     internalServerUrl,
@@ -1748,7 +1778,7 @@ async function main() {
   const usageByCmd = new Map([
     ['status', 'hstack auth status [--json]'],
     ['login', 'hstack auth login [--identity=<name>] [--no-open] [--force] [--method=web|mobile] [--print] [--webapp=auto|stack|public|expo|hosted] [--webapp-url=<url>] [--start-if-needed] [--json]'],
-    ['seed', 'hstack auth seed [name=dev-auth] [--login|--no-login] [--server=...] [--skip-default-seed] [--non-interactive] [--json]'],
+    ['seed', 'hstack auth seed [name=dev-auth] [--login|--no-login] [--force] [--server=...] [--skip-default-seed] [--non-interactive] [--json]'],
     ['copy-from', 'hstack auth copy-from <sourceStack|legacy> --all [--except=main,dev-auth] [--force] [--with-infra] [--link] [--json]'],
     ['dev-key', 'hstack auth dev-key [--print] [--format=base64url|backup] [--set=<secret>] [--clear] [--json]'],
   ]);
@@ -1777,7 +1807,7 @@ async function main() {
         bullets([
           `${dim('status:')} ${cmdFmt('hstack auth status')} ${dim('[--json]')}`,
           `${dim('login:')}  ${cmdFmt('hstack auth login')} ${dim('[--identity=<name>] [--no-open] [--force] [--method=web|mobile] [--print] [--webapp=auto|stack|public|expo|hosted] [--webapp-url=<url>] [--start-if-needed] [--json]')}`,
-          `${dim('seed stack:')} ${cmdFmt('hstack auth seed')} ${dim('[name=dev-auth] [--login|--no-login] [--server=...] [--skip-default-seed] [--non-interactive] [--json]')}`,
+          `${dim('seed stack:')} ${cmdFmt('hstack auth seed')} ${dim('[name=dev-auth] [--login|--no-login] [--force] [--server=...] [--skip-default-seed] [--non-interactive] [--json]')}`,
           `${dim('seed:')}   ${cmdFmt('hstack auth copy-from <sourceStack|legacy> --all')} ${dim('[--except=main,dev-auth] [--force] [--with-infra] [--link] [--json]')}`,
           `${dim('dev key:')} ${cmdFmt('hstack auth dev-key')} ${dim('[--print] [--format=base64url|backup] [--set=<secret>] [--clear] [--json]')}`,
         ]),

package/scripts/auth_copy_from_pglite_lock_in_use.integration.test.mjs

@@ -37,6 +37,7 @@ test('hstack stack auth copy-from skips pglite DB seed when lock is held by a li
       [
         `HAPPIER_STACK_STACK=${name}`,
         `HAPPIER_STACK_SERVER_COMPONENT=happier-server-light`,
+        `HAPPIER_DB_PROVIDER=pglite`,
         `HAPPIER_STACK_REPO_DIR=${repoRoot}`,
         `HAPPIER_SERVER_LIGHT_DATA_DIR=${dataDir}`,
         `HAPPIER_SERVER_LIGHT_FILES_DIR=${join(dataDir, 'files')}`,