@happyvertical/smrt-app-runtime 0.60.9 → 0.60.10

package/AGENTS.md

@@ -46,7 +46,11 @@ Application infrastructure composition for the validated runtime profiles in
   selects the tenant slug (default `default`); because `Tenant` upserts on
   slug, the claim must look the slug up first and fail closed
   (`owner_tenant_conflict`) rather than save over it. `adoptExisting` adopts
-  only an active root tenant with zero memberships (#3032).
+  only an active root tenant with zero memberships (#3032). Fresh tenant
+  creation uses `TenantService` with the local ownership policy and a trusted
+  reserved identity. Default tenant and owner graph IDs derive from the
+  protected per-install application secret. Preserve that file when restoring
+  the same installation.
 - Bootstrap is loopback-only. Only an HMAC of the short-lived token is stored.
   A token that cannot claim fails a read-only preflight before role/catalog
   seeding (#3323); the claim transaction's conditional UPDATE stays the

package/README.md

@@ -134,11 +134,31 @@ remains global. Startup and setup are idempotent; replayed, expired, or
 concurrent claims fail closed.
 `ownerTenant: { slug, name, adoptExisting }` (also accepted by the SvelteKit
 runtime) selects the bootstrap tenant; the default is a new tenant with slug
-`default`. Because `Tenant` upserts on its slug, the claim checks first and
-never replaces an existing tenant: it fails with `owner_tenant_conflict`, or,
-with `adoptExisting: true`, adds the owner membership to an application-seeded
-tenant only when that tenant is active, has no parent, and has no memberships of
-any status. An adopted tenant keeps its id and name. A failed claim rolls back
+`default`. The default tenant, owner User, owner Person, and owner Membership
+have separate UUIDv8 identifiers derived with domain-separated HMAC-SHA256
+from the installation's private `secrets/application.secret`. Independent
+installs of the same app get distinct identities and share the global built-in
+role IDs. Restarts reuse the same installation identities. Treat
+`secrets/application.secret` as installation identity material. Preserve it
+with the database in protected backups and during a restore or move of the
+same installation. Deleting, replacing, or rotating the file changes the
+derived identities and invalidates existing bootstrap and local MCP tokens.
+Keep only one active installation for a given secret. A copied data root
+retains the same owner, tenant, and writer IDs, and the runtime currently has
+no way to detect that copy. Start independent installations with a fresh data
+root.
+
+The invitation and active owner membership authorize the owner. The same
+seed derives a separate writer UUID. The local runtime binds it to the
+database so local edits to tracked rows identify this installation, including
+after a restart.
+
+A tenant with the selected slug causes `owner_tenant_conflict`, unless
+`adoptExisting: true` explicitly allows adopting an active root tenant with
+zero memberships of any status. An adopted tenant keeps its id and name.
+The claim rejects an unrelated row using the reserved tenant UUID and an
+account using the owner UUID or the claimed email. The owner Person and
+Membership also use strict inserts. A failed claim rolls back
 and leaves the invitation claimable.
 Authenticated session TTLs are configured in whole seconds with a minimum of
 one second, and invalid values are rejected before filesystem mutation.

package/dist/chunks/{src-DP7SxcSY.js → src-DOepXMDO.js}

@@ -6,6 +6,7 @@ import { dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:p
 import { promisify } from "node:util";
 import { Worker } from "node:worker_threads";
 import { resolveApplicationRuntime } from "@happyvertical/smrt-config";
+import { setDatabaseSyncDeviceId } from "@happyvertical/smrt-core";
 import { SCHEDULED_JOB_QUEUE, ScheduleRunner, TaskRunner } from "@happyvertical/smrt-jobs";
 import { Person, ProfileTypeCollection } from "@happyvertical/smrt-profiles";
 import { withSystemContext } from "@happyvertical/smrt-tenancy";
@@ -16,6 +17,25 @@ import { chmodSync, closeSync, constants as constants$1, existsSync, lstatSync,
 import { DatabaseSync } from "node:sqlite";
 import { registerHooks } from "node:module";
 import { fileURLToPath, pathToFileURL } from "node:url";
+//#region src/local-installation-identity.ts
+function installationUuid(key, purpose) {
+	const bytes = createHmac("sha256", key).update(`smrt/local-installation/v1/${purpose}`).digest();
+	bytes[6] = bytes[6] & 15 | 128;
+	bytes[8] = bytes[8] & 63 | 128;
+	const hex = bytes.toString("hex", 0, 16);
+	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+function deriveLocalInstallationIdentity(applicationSecret) {
+	const key = Buffer.from(applicationSecret.trim(), "base64url");
+	return {
+		deviceId: installationUuid(key, "device"),
+		tenantId: installationUuid(key, "default-tenant"),
+		ownerId: installationUuid(key, "owner"),
+		profileId: installationUuid(key, "owner-profile"),
+		membershipId: installationUuid(key, "owner-membership")
+	};
+}
+//#endregion
 //#region src/deployed-runtime.ts
 var DeployedRuntimeError = class extends Error {
 	constructor(code, message, component) {
@@ -1707,7 +1727,8 @@ async function initializeLocalApplicationRuntime(options) {
 		const acquired = await acquireLocalDatabase(paths, sourceRoot, appId);
 		db = acquired.db;
 		const { canonicalSourceRoot } = acquired;
-		await prepareLocalFilesystem(paths, canonicalSourceRoot);
+		const identity = await prepareLocalFilesystem(paths, canonicalSourceRoot);
+		setDatabaseSyncDeviceId(db, identity.deviceId);
 		await tuneLocalSqlite(db);
 		try {
 			await options.prepareDatabase?.(db);
@@ -1727,6 +1748,7 @@ async function initializeLocalApplicationRuntime(options) {
 			paidCapabilities: options.paidCapabilities === true,
 			ownerTenant,
 			passwordPolicy: options.passwordPolicy,
+			identity,
 			now: options.now ?? (() => /* @__PURE__ */ new Date()),
 			canonicalSourceRoot
 		});
@@ -1771,6 +1793,7 @@ var InitializedLocalApplicationRuntime = class {
 	passwordPolicy;
 	now;
 	canonicalSourceRoot;
+	identity;
 	constructor(state) {
 		this.db = state.db;
 		this.paths = state.paths;
@@ -1784,6 +1807,7 @@ var InitializedLocalApplicationRuntime = class {
 		this.paidCapabilitiesEnabled = state.paidCapabilities;
 		this.now = state.now;
 		this.canonicalSourceRoot = state.canonicalSourceRoot;
+		this.identity = state.identity;
 		this.mcpTokens = localMcpTokenStore(state.db, state.paths, state.canonicalSourceRoot, state.now);
 	}
 	/**
@@ -1833,7 +1857,7 @@ var InitializedLocalApplicationRuntime = class {
            AND expires_at > ?
          RETURNING expires_at`, nowIso, tokenHash, nowIso)).rows.length === 0) await throwBootstrapClaimFailure(tx, now);
 			if (await findExistingOwner(tx)) throw new LocalRuntimeError("bootstrap_claimed", "The local owner has already been claimed.");
-			return createLocalOwnerRecords(tx, input, this.sessionTtlSeconds, this.ownerTenant, this.passwordPolicy);
+			return createLocalOwnerRecords(tx, input, this.sessionTtlSeconds, this.ownerTenant, this.identity, this.passwordPolicy);
 		});
 	}
 	/** Restore the normal server-side session created by owner bootstrap. */
@@ -1923,54 +1947,71 @@ var InitializedLocalApplicationRuntime = class {
 		return createHmac("sha256", (await validateApplicationSecret(this.paths.applicationSecret, this.canonicalSourceRoot)).trim()).update(token).digest("hex");
 	}
 };
-async function createLocalOwnerRecords(db, input, sessionTtlSeconds, ownerTenant, passwordPolicy) {
-	const existingTenant = await (await TenantCollection.create({ db })).findBySlug(ownerTenant.slug);
+async function createLocalOwnerRecords(db, input, sessionTtlSeconds, ownerTenant, identity, passwordPolicy) {
+	const tenants = await TenantCollection.create({ db });
+	const existingTenant = await tenants.findBySlug(ownerTenant.slug);
+	const defaultTenant = ownerTenant.slug === DEFAULT_OWNER_TENANT_SLUG;
+	const reservedTenant = defaultTenant ? await tenants.get(identity.tenantId) : null;
+	if (reservedTenant && reservedTenant.id !== existingTenant?.id) throw new LocalRuntimeError("owner_tenant_conflict", "The reserved local tenant identity is already in use.");
+	const users = await UserCollection.create({ db });
+	if (await users.get(identity.ownerId) || await users.findByEmail(input.email.trim())) throw new LocalRuntimeError("owner_identity_conflict", "The local owner identity is already in use.");
 	const memberships = await MembershipCollection.create({ db });
 	if (existingTenant) await assertAdoptableOwnerTenant(existingTenant, ownerTenant, memberships);
 	const profileTypes = await ProfileTypeCollection.create({ db });
+	const personType = await withSystemContext(() => profileTypes.getOrCreateGlobalBySlug("person", {
+		name: "Person",
+		description: "An individual person"
+	}));
 	const person = new Person({
 		db,
-		typeId: requireId((await withSystemContext(() => profileTypes.getOrCreateGlobalBySlug("person", {
-			name: "Person",
-			description: "An individual person"
-		}))).id, "Person profile type"),
+		id: identity.profileId,
+		_skipLoad: true,
+		typeId: requireId(personType.id, "Person profile type"),
 		tenantId: null,
 		name: input.name.trim(),
 		email: input.email.trim()
 	});
 	await person.initialize();
+	person.requireInsertOnSave({ preserveDerivedSlug: true });
 	await person.save();
-	const user = await (await UserCollection.create({ db })).create({
+	const user = await users.create({
+		id: identity.ownerId,
+		_insertOnly: true,
 		profileId: requireId(person.id, "Person"),
 		email: input.email.trim(),
 		status: UserStatus.ACTIVE,
 		lastLoginAt: /* @__PURE__ */ new Date()
 	});
-	await user.save();
 	const userId = requireId(user.id, "User");
-	let tenant;
-	let membership;
+	let ownership;
 	if (existingTenant) {
 		const ownerRole = await (await RoleCollection.create({ db })).findSystemRoleBySlug(DEFAULT_ROLE_SLUGS.OWNER);
-		const created = await memberships.create({
-			userId,
-			tenantId: requireId(existingTenant.id, "Tenant"),
-			roleId: requireId(ownerRole?.id, "Owner role"),
-			status: MembershipStatus.ACTIVE
-		});
-		await created.save();
-		tenant = existingTenant;
-		membership = created;
+		ownership = {
+			tenant: existingTenant,
+			membership: await memberships.create({
+				id: identity.membershipId,
+				_insertOnly: true,
+				userId,
+				tenantId: requireId(existingTenant.id, "Tenant"),
+				roleId: requireId(ownerRole?.id, "Owner role"),
+				status: MembershipStatus.ACTIVE
+			})
+		};
 	} else {
 		const tenantName = input.tenantName?.trim() || ownerTenant.name;
-		const tenantService = new TenantService({ db }, {
+		ownership = await (await TenantService.create({ db }, {
 			mode: "required",
 			maxTenants: 1,
 			defaultName: tenantName
+		})).createTenantWithOwnership(userId, tenantName, {
+			slug: ownerTenant.slug,
+			reservedIdentity: {
+				tenantId: defaultTenant ? identity.tenantId : void 0,
+				membershipId: identity.membershipId
+			}
 		});
-		await tenantService.initialize();
-		({tenant, membership} = await tenantService.createTenantWithOwnership(userId, tenantName, { slug: ownerTenant.slug }));
 	}
+	const { tenant, membership } = ownership;
 	person.tenantId = requireId(tenant.id, "Tenant");
 	await person.save();
 	const session = await (await SessionCollection.create({ db })).createSession({
@@ -2233,6 +2274,7 @@ async function prepareLocalFilesystem(paths, canonicalSourceRoot) {
 	await ensureSafeDirectoryTree(paths.assets, canonicalSourceRoot);
 	await ensureSafeDirectoryTree(paths.secrets, canonicalSourceRoot);
 	await ensureApplicationSecret(paths.applicationSecret, canonicalSourceRoot);
+	return deriveLocalInstallationIdentity(await validateApplicationSecret(paths.applicationSecret, canonicalSourceRoot));
 }
 async function prepareDedicatedRoot(path, canonicalSourceRoot, appId, createdDirectories) {
 	const finalMarker = resolve(path, `${ROOT_MARKER_PREFIX}${appId}`);
@@ -2775,4 +2817,4 @@ function isDirectoryNotEmpty(error) {
 //#endregion
 export { reclaimStaleRecord as A, deepFrozenPlainCopy as B, findInstalledPackage as C, processExists as D, lockOwnerPid as E, LOCAL_MCP_TOKEN_PRINCIPAL as F, initializeDeployedApplicationRuntime as G, resolveBoundMembershipPermissions as H, LOCAL_MCP_TOKEN_TABLE as I, isSessionTenantAuthorized as K, MAX_LOCAL_MCP_TOKEN_TTL_SECONDS as L, runtimeConfigurationFingerprint as M, DEFAULT_LOCAL_MCP_TOKEN_TTL_SECONDS as N, withOperationLock as O, LOCAL_MCP_TOKEN_PREFIX as P, isLocalMcpTokenPrincipal as R, createProviderReadinessProbe as S, isStaleOperationLock as T, DeployedRuntimeCleanupError as U, ownValue as V, DeployedRuntimeError as W, MAX_RUNTIME_DIAGNOSTIC_TOOLS as _, openLocalMcpTokenStore as a, projectRuntimeDiagnostics as b, validateApplicationId as c, readActiveWriterLease as d, ONBOARDING_HANDOFF_FILES as f, MAX_RUNTIME_DIAGNOSTIC_ERRORS as g, resolveApplicationStateRoot as h, initializeLocalApplicationRuntime as i, resolveApplicationId as j, RECLAIM_MUTEX_FILE as k, validateLocalDatabaseStorage as l, removeOnboardingHandoff as m, MIGRATION_FAILED_MESSAGE as n, prepareLocalDatabaseStorage as o, prepareApplicationStateRoot as p, encodeApplicationId as r, resolveLocalRuntimePaths as s, LocalRuntimeError as t, acquireWriterLease as u, RUNTIME_DIAGNOSTICS_SCHEMA_VERSION as v, resolveReadinessModule as w, PROVIDER_READINESS_SETTINGS as x, RUNTIME_WORKER_FRESHNESS_SECONDS as y, PlainDataError as z };
 
-//# sourceMappingURL=src-DP7SxcSY.js.map
+//# sourceMappingURL=src-DOepXMDO.js.map