@happyvertical/smrt-app-runtime 0.57.7 → 0.57.8

package/README.md

@@ -232,7 +232,7 @@ Diagnostics authorize (owner role or `runtime_diagnostics.read` on an active,
 session-matching membership) before reading the runtime and return only stable
 `{ schemaVersion: 1, error: { code } }` failures. Owner setup is local-only and
 re-checks on every request that both the peer address and the URL host are
-loopback; its `default` action reads `token`, `name`, `email`, and optional
+loopback; its `default` action reads `token`, `name`, `email`, and optional `password` and
 `tenantName`, sets the session cookie, and redirects 303, or returns
 `fail(status, { code, message })` with `setup_disabled` (404),
 `setup_unavailable` (403), `setup_invalid_input` (400), `setup_invalid`
@@ -243,6 +243,27 @@ runtime removes the `smrt app setup` / `recover` hand-off files
 invitation; failed claims leave them untouched. `onOwnerClaimed` remains for
 extra app cleanup and `removeOnboardingHandoff: false` opts out.
 
+Password-based applications should pass `{ requirePassword: true }` to
+`createOwnerSetupPage` and include a password field in their setup form. The
+password is stored in the owner-claim transaction; a rejected password leaves
+the token available for retry. Existing bootstrap consumers may omit it.
+Use one server-only `PasswordPolicyOptions` value for bootstrap and sign-in,
+including any pepper, length constraints, or custom rejection hook:
+
+```typescript
+const passwordPolicy = { pepper: serverSecrets.passwordPepper, minLength: 16 };
+const runtime = createSmrtSvelteKitRuntime({ passwordPolicy });
+const passwords = await PasswordCredentialService.create({
+  ...runtime.classOptions('User'),
+  password: passwordPolicy,
+});
+```
+
+`initializeLocalApplicationRuntime` accepts the same `passwordPolicy` option.
+It is never taken from form data or included in diagnostics. Bootstrap uses the
+policy on its transaction-bound service, and registers password-management
+permissions before seeding the owner's grants.
+
 `resolveApplicationId()` and `runtimeConfigurationFingerprint()` (root entry)
 are the canonical app ID and secret-free configuration fingerprint shared by
 the web health route and process managers.

package/dist/chunks/{src-DeNO6bG_.js → src-C98Cqurb.js}

@@ -9,7 +9,7 @@ import { resolveApplicationRuntime } from "@happyvertical/smrt-config";
 import { SCHEDULED_JOB_QUEUE, ScheduleRunner, TaskRunner } from "@happyvertical/smrt-jobs";
 import { Person, ProfileTypeCollection } from "@happyvertical/smrt-profiles";
 import { withSystemContext } from "@happyvertical/smrt-tenancy";
-import { DEFAULT_ROLE_SLUGS, MembershipCollection, MembershipStatus, PermissionResolver, RoleCollection, SessionCollection, SessionService, TenantCollection, TenantService, TenantStatus, UserCollection, UserStatus } from "@happyvertical/smrt-users";
+import { DEFAULT_ROLE_SLUGS, MembershipCollection, MembershipStatus, PasswordCredentialService, PermissionResolver, RoleCollection, SessionCollection, SessionService, TenantCollection, TenantService, TenantStatus, UserCollection, UserStatus, ensurePasswordPermissionsRegistered } from "@happyvertical/smrt-users";
 import { getDatabase } from "@happyvertical/sql";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { chmodSync, closeSync, constants as constants$1, existsSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
@@ -1725,6 +1725,7 @@ async function initializeLocalApplicationRuntime(options) {
 			backgroundJobs: options.backgroundJobs === true,
 			paidCapabilities: options.paidCapabilities === true,
 			ownerTenant,
+			passwordPolicy: options.passwordPolicy,
 			now: options.now ?? (() => /* @__PURE__ */ new Date()),
 			canonicalSourceRoot
 		});
@@ -1766,6 +1767,7 @@ var InitializedLocalApplicationRuntime = class {
 	bootstrapTtlSeconds;
 	sessionTtlSeconds;
 	ownerTenant;
+	passwordPolicy;
 	now;
 	canonicalSourceRoot;
 	constructor(state) {
@@ -1776,6 +1778,7 @@ var InitializedLocalApplicationRuntime = class {
 		this.bootstrapTtlSeconds = state.bootstrapTtlSeconds;
 		this.sessionTtlSeconds = state.sessionTtlSeconds;
 		this.ownerTenant = state.ownerTenant;
+		this.passwordPolicy = state.passwordPolicy;
 		this.backgroundJobsEnabled = state.backgroundJobs;
 		this.paidCapabilitiesEnabled = state.paidCapabilities;
 		this.now = state.now;
@@ -1818,6 +1821,7 @@ var InitializedLocalApplicationRuntime = class {
 		const now = this.now();
 		const nowIso = now.toISOString();
 		if (!await isBootstrapTokenClaimable(this.db, tokenHash, nowIso)) await throwBootstrapClaimFailure(this.db, now);
+		if (input.password) ensurePasswordPermissionsRegistered();
 		await (await RoleCollection.create({ db: this.db })).seedSystemRoles({ seedPermissions: true });
 		return this.db.transaction(async (tx) => {
 			if ((await tx.query(`UPDATE ${BOOTSTRAP_TABLE}
@@ -1828,7 +1832,7 @@ var InitializedLocalApplicationRuntime = class {
            AND expires_at > ?
          RETURNING expires_at`, nowIso, tokenHash, nowIso)).rows.length === 0) await throwBootstrapClaimFailure(tx, now);
 			if (await findExistingOwner(tx)) throw new LocalRuntimeError("bootstrap_claimed", "The local owner has already been claimed.");
-			return createLocalOwnerRecords(tx, input, this.sessionTtlSeconds, this.ownerTenant);
+			return createLocalOwnerRecords(tx, input, this.sessionTtlSeconds, this.ownerTenant, this.passwordPolicy);
 		});
 	}
 	/** Restore the normal server-side session created by owner bootstrap. */
@@ -1918,7 +1922,7 @@ var InitializedLocalApplicationRuntime = class {
 		return createHmac("sha256", (await validateApplicationSecret(this.paths.applicationSecret, this.canonicalSourceRoot)).trim()).update(token).digest("hex");
 	}
 };
-async function createLocalOwnerRecords(db, input, sessionTtlSeconds, ownerTenant) {
+async function createLocalOwnerRecords(db, input, sessionTtlSeconds, ownerTenant, passwordPolicy) {
 	const existingTenant = await (await TenantCollection.create({ db })).findBySlug(ownerTenant.slug);
 	const memberships = await MembershipCollection.create({ db });
 	if (existingTenant) await assertAdoptableOwnerTenant(existingTenant, ownerTenant, memberships);
@@ -1972,7 +1976,25 @@ async function createLocalOwnerRecords(db, input, sessionTtlSeconds, ownerTenant
 		ttl: sessionTtlSeconds,
 		userAgent: input.userAgent,
 		ipAddress: input.ipAddress,
-		data: { localOwner: true }
+		data: { localOwner: true },
+		authMethod: input.password ? "password" : "local-bootstrap"
+	});
+	if (input.password) await (await PasswordCredentialService.create({
+		db,
+		sessionTtl: sessionTtlSeconds,
+		password: passwordPolicy
+	})).setPassword({
+		actor: {
+			user,
+			membership,
+			permissions: [],
+			tenantId: requireId(tenant.id, "Tenant"),
+			sessionId: requireId(session.id, "Session"),
+			authMethod: "password",
+			parent: null
+		},
+		userId,
+		password: input.password
 	});
 	return Object.freeze({
 		profileId: requireId(person.id, "Person"),
@@ -2750,4 +2772,4 @@ function isDirectoryNotEmpty(error) {
 //#endregion
 export { reclaimStaleRecord as A, deepFrozenPlainCopy as B, findInstalledPackage as C, processExists as D, lockOwnerPid as E, LOCAL_MCP_TOKEN_PRINCIPAL as F, initializeDeployedApplicationRuntime as G, resolveBoundMembershipPermissions as H, LOCAL_MCP_TOKEN_TABLE as I, isSessionTenantAuthorized as K, MAX_LOCAL_MCP_TOKEN_TTL_SECONDS as L, runtimeConfigurationFingerprint as M, DEFAULT_LOCAL_MCP_TOKEN_TTL_SECONDS as N, withOperationLock as O, LOCAL_MCP_TOKEN_PREFIX as P, isLocalMcpTokenPrincipal as R, createProviderReadinessProbe as S, isStaleOperationLock as T, DeployedRuntimeCleanupError as U, ownValue as V, DeployedRuntimeError as W, MAX_RUNTIME_DIAGNOSTIC_TOOLS as _, openLocalMcpTokenStore as a, projectRuntimeDiagnostics as b, validateApplicationId as c, readActiveWriterLease as d, ONBOARDING_HANDOFF_FILES as f, MAX_RUNTIME_DIAGNOSTIC_ERRORS as g, resolveApplicationStateRoot as h, initializeLocalApplicationRuntime as i, resolveApplicationId as j, RECLAIM_MUTEX_FILE as k, validateLocalDatabaseStorage as l, removeOnboardingHandoff as m, MIGRATION_FAILED_MESSAGE as n, prepareLocalDatabaseStorage as o, prepareApplicationStateRoot as p, encodeApplicationId as r, resolveLocalRuntimePaths as s, LocalRuntimeError as t, acquireWriterLease as u, RUNTIME_DIAGNOSTICS_SCHEMA_VERSION as v, resolveReadinessModule as w, PROVIDER_READINESS_SETTINGS as x, RUNTIME_WORKER_FRESHNESS_SECONDS as y, PlainDataError as z };
 
-//# sourceMappingURL=src-DeNO6bG_.js.map
+//# sourceMappingURL=src-C98Cqurb.js.map