@kky42/pievo-server 1.0.0

package/.output/server/_ssr/machineFns-Dvr5ICUy.mjs

@@ -0,0 +1,266 @@
+import { $t as updateMachine, At as machineIdFromToken, D as createMachine$1, F as ensureServer, Kt as sha256, Mt as mintDeviceToken, N as deleteMachine$1, Rt as rememberConnectKey, Z as getMachine, bt as listMachines$1, kt as loopsForMachine, xt as listMachinesForTeam } from "./boot-BbtG0ImW.mjs";
+import { n as createServerFn } from "./ssr.mjs";
+import { requestScope } from "./auth-DY1DuYZd.mjs";
+import { t as createServerRpc } from "./createServerRpc-BD8Xn_0_.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/machineScope-2h-fcKmG.js
+/**
+* Whether a machine is visible/actionable in the request scope. Mirrors
+* listMachines: open mode sees everything; otherwise the requester must own the
+* machine or share the active team with its owner. `teamMachineIds` is a THUNK
+* (the team set needs a DB join) invoked only after the owner check misses — the
+* hot path (machineStatus polls every ~2.5s while the connect dialog is open,
+* usually by the owner) pays no query.
+*/
+function machineInScope(m, scope, teamMachineIds) {
+	if (!scope.enforce) return true;
+	if (!scope.userId) return false;
+	if (m.userId === scope.userId) return true;
+	return teamMachineIds().has(m.id);
+}
+/**
+* Whether the machine's PLAINTEXT device token may be serialized to this
+* requester. Owner-only under the gate — the token fully impersonates the
+* machine, so even a teammate/admin who may see (or delete) the row gets
+* `token: null`. Open mode keeps the v1 behavior (token shown, e.g. for the
+* reconnect command).
+*/
+function tokenVisibleTo(m, scope) {
+	return !scope.enforce || m.userId === scope.userId;
+}
+//#endregion
+//#region node_modules/.nitro/vite/services/ssr/assets/machineFns-Dvr5ICUy.js
+/**
+* Latest published @kky42/pievo version — a cached, fail-silent lookup of the
+* npm dist-tag `latest`, so the web can tell a user their daemon is outdated and
+* show the exact update command.
+*
+* Zero-exec invariant: this is a plain HTTP GET against the public npm registry —
+* the server runs no LLM and executes no user code. It NEVER surfaces an error:
+* if npm is unreachable/slow/garbage, the cache simply stays as-is (undefined at
+* first) and the web shows no update hint. Bounded timeout + ~1h in-memory cache
+* so the machine-list hot path never blocks on the network.
+*
+* The fetch is injectable (mirroring the gateway's injectable notifier/blobStore)
+* so tests need no network: construct a `LatestDaemonVersion` with a fake fetch
+* and `now`, or call the pure `fetchNpmLatest` directly.
+*/
+var NPM_URL = "https://registry.npmjs.org/@kky42/pievo";
+var DEFAULT_TTL_MS = 3600 * 1e3;
+var FETCH_TIMEOUT_MS = 4e3;
+/**
+* One npm `latest` read — bounded + fail-silent. Returns the version string or
+* null (unreachable/timeout/malformed). Pure w.r.t. the injected fetch, so it's
+* directly unit-testable with no network.
+*/
+async function fetchNpmLatest(fetchImpl, timeoutMs = FETCH_TIMEOUT_MS) {
+	const ctrl = new AbortController();
+	const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+	try {
+		const res = await fetchImpl(NPM_URL, {
+			headers: { accept: "application/vnd.npm.install-v1+json" },
+			signal: ctrl.signal
+		});
+		if (!res.ok) return null;
+		const latest = (await res.json())?.["dist-tags"]?.latest;
+		return typeof latest === "string" && latest.trim() ? latest.trim() : null;
+	} catch {
+		return null;
+	} finally {
+		clearTimeout(timer);
+	}
+}
+/**
+* In-memory cached accessor. `get()` returns the currently cached value (null
+* until the first successful fetch) and, when the cache is stale, kicks off a
+* background refresh — it never blocks the caller and never throws. A single
+* refresh is in-flight at a time (concurrent `get()`s share it).
+*/
+var LatestDaemonVersion = class {
+	fetchImpl;
+	ttlMs;
+	now;
+	cached = null;
+	fetchedAt = 0;
+	inflight = null;
+	constructor(fetchImpl = fetch, ttlMs = DEFAULT_TTL_MS, now = Date.now) {
+		this.fetchImpl = fetchImpl;
+		this.ttlMs = ttlMs;
+		this.now = now;
+	}
+	/** Cached latest version, refreshing in the background when stale. Non-blocking. */
+	get() {
+		if (this.now() - this.fetchedAt >= this.ttlMs) this.refresh();
+		return this.cached;
+	}
+	/** Force a refresh and resolve with the (possibly unchanged) cached value.
+	*  Await-able for tests; production callers use `get()`. Never throws. */
+	async refresh() {
+		if (this.inflight) return this.inflight;
+		this.inflight = (async () => {
+			const v = await fetchNpmLatest(this.fetchImpl);
+			this.fetchedAt = this.now();
+			if (v) this.cached = v;
+			return this.cached;
+		})();
+		try {
+			return await this.inflight;
+		} finally {
+			this.inflight = null;
+		}
+	}
+};
+/** Process-wide singleton the machine server fns read (fail-silent, cached). */
+var latestDaemonVersion = new LatestDaemonVersion();
+/**
+* Machine management server functions. Connect flow (two acts):
+*   1. createMachine() → mint a token, create a PENDING (unnamed) row, return
+*      {id, token}. The UI shows the connect command + "waiting…".
+*   2. the daemon connects → poll records online + hostname/platform/arch. The
+*      UI polls machineStatus(id); once connected it shows the name field
+*      (prefilled with the hostname). finalizeMachine({id,name}) names it →
+*      it appears in the list. cancelMachine(id) drops a pending row.
+*
+* Scoping: when the auth gate is on, every fn requires a signed-in user, and a
+* machine is visible/actionable only when the requester owns it, its owner is a
+* member of the active team, or the scope is the admin "All teams" view (the
+* same rule listMachines filters by). The PLAINTEXT device token is serialized
+* ONLY to the machine's owner — it fully impersonates the machine (poll /
+* create-loop / log), so a teammate who can see the row must never exfiltrate
+* it. Open mode (gate off) keeps the shared workspace: everyone sees/manages
+* all machines, tokens included. No workdir jail (fully open) for now.
+*/
+/** Ids of the machines membership-visible in the scope's active team (the same
+*  set listMachines serves). Empty when the scope needs no team check (open
+*  mode or signed-out — machineInScope settles those before ever invoking its
+*  team-set thunk). */
+async function teamMachineIds(scope) {
+	if (!scope.enforce || !scope.userId) return /* @__PURE__ */ new Set();
+	return new Set((await listMachinesForTeam(scope.teamId)).map((m) => m.id));
+}
+/**
+* Resolve a machine and authorize it against the request scope (the machine-fn
+* twin of loopApi's `ownedLoop`). `machine` is undefined when it's missing OR
+* out of scope — callers treat both as "not found" so existence never leaks.
+* The scope rides along so callers don't re-run requestScope (a second session
+* decrypt); the team-set thunk keeps the owner fast path query-free.
+*/
+async function scopedMachine(id) {
+	const scope = await requestScope();
+	const m = await getMachine(id);
+	const teamIds = await teamMachineIds(scope);
+	return {
+		scope,
+		machine: m && machineInScope(m, scope, () => teamIds) ? m : void 0
+	};
+}
+async function toSummary(m, scope) {
+	return {
+		id: m.id,
+		name: m.name,
+		online: !!m.online,
+		lastSeen: m.lastSeen ?? null,
+		hostname: m.hostname ?? null,
+		platform: m.platform ?? null,
+		arch: m.arch ?? null,
+		daemonVersion: m.daemonVersion ?? null,
+		daemonProtocol: m.daemonProtocol ?? null,
+		latestDaemonVersion: latestDaemonVersion.get(),
+		token: tokenVisibleTo(m, scope) ? m.token ?? null : null,
+		loopCount: (await loopsForMachine(m.id)).length
+	};
+}
+/** Named machines only (pending/unnamed rows are mid-connect). Scoped to the
+*  given/active team when the gate is on; the full shared list in open mode. An
+*  explicit `teamId` (the `/t/<id>` route) scopes this request independent of the
+*  cookie, so a tab on /t/A and one on /t/B list different machines at once. */
+var listMachines_createServerFn_handler = createServerRpc({
+	id: "aa46310016bb8a58b273a648ffd498c87f1f450d12827e30110a3b83ba6a27d9",
+	name: "listMachines",
+	filename: "src/server/machineFns.ts"
+}, (opts) => listMachines.__executeServer(opts));
+var listMachines = createServerFn({ method: "GET" }).validator((teamId) => teamId).handler(listMachines_createServerFn_handler, async ({ data: teamId }) => {
+	await ensureServer();
+	const scope = await requestScope(teamId);
+	const { enforce, userId, teamId: active } = scope;
+	if (enforce && !userId) return [];
+	const list = enforce ? await listMachinesForTeam(active) : await listMachines$1();
+	return Promise.all(list.filter((m) => m.name.trim()).map((m) => toSummary(m, scope)));
+});
+var createMachine_createServerFn_handler = createServerRpc({
+	id: "ed679b4e1e05e903a5d4ba4a70d9b9d883991ab22ed59b4d2d69078941818415",
+	name: "createMachine",
+	filename: "src/server/machineFns.ts"
+}, (opts) => createMachine.__executeServer(opts));
+var createMachine = createServerFn({ method: "POST" }).validator((teamId) => teamId).handler(createMachine_createServerFn_handler, async ({ data: teamId }) => {
+	await ensureServer();
+	const { enforce, userId, teamId: active } = await requestScope(teamId);
+	if (enforce && !userId) return { error: "not signed in" };
+	const token = mintDeviceToken();
+	const id = machineIdFromToken(token);
+	const owner = userId ?? "shared";
+	await rememberConnectKey(token, {
+		userId: owner,
+		teamId: active
+	});
+	await createMachine$1({
+		id,
+		userId: owner,
+		teamId: active,
+		name: "",
+		tokenHash: sha256(token),
+		token,
+		online: false
+	});
+	return {
+		id,
+		token
+	};
+});
+var machineStatus_createServerFn_handler = createServerRpc({
+	id: "169566e7637a22599b4eb32ee3775574e99677406922bbef7482a102036c33dd",
+	name: "machineStatus",
+	filename: "src/server/machineFns.ts"
+}, (opts) => machineStatus.__executeServer(opts));
+var machineStatus = createServerFn({ method: "GET" }).validator((id) => id).handler(machineStatus_createServerFn_handler, async ({ data: id }) => {
+	await ensureServer();
+	const { scope, machine } = await scopedMachine(id);
+	return machine ? toSummary(machine, scope) : null;
+});
+var finalizeMachine_createServerFn_handler = createServerRpc({
+	id: "27d7eba0b6a2257949392fdd56057275a5c5366484ae01faf3b5897a225ecd83",
+	name: "finalizeMachine",
+	filename: "src/server/machineFns.ts"
+}, (opts) => finalizeMachine.__executeServer(opts));
+var finalizeMachine = createServerFn({ method: "POST" }).validator((d) => d).handler(finalizeMachine_createServerFn_handler, async ({ data }) => {
+	await ensureServer();
+	const name = data.name?.trim();
+	if (!name) return { ok: false };
+	const { machine } = await scopedMachine(data.id);
+	if (!machine) return { ok: false };
+	return { ok: !!await updateMachine(data.id, { name }) };
+});
+var deleteMachine_createServerFn_handler = createServerRpc({
+	id: "a6384dc7154d9930422d29396f5de64b3ac69c62ad3824bc4a22d745fc07b293",
+	name: "deleteMachine",
+	filename: "src/server/machineFns.ts"
+}, (opts) => deleteMachine.__executeServer(opts));
+var deleteMachine = createServerFn({ method: "POST" }).validator((id) => id).handler(deleteMachine_createServerFn_handler, async ({ data: id }) => {
+	await ensureServer();
+	const { scope, machine } = await scopedMachine(id);
+	if (scope.enforce && !scope.userId) return {
+		ok: false,
+		error: "unauthorized"
+	};
+	if (!machine) return {
+		ok: false,
+		error: "machine not found"
+	};
+	const loops = await loopsForMachine(id);
+	if (loops.length > 0) return {
+		ok: false,
+		error: `This machine still has ${loops.length} loop${loops.length === 1 ? "" : "s"} — delete ${loops.length === 1 ? "it" : "them"} first.`
+	};
+	return { ok: await deleteMachine$1(id) };
+});
+//#endregion
+export { createMachine_createServerFn_handler, deleteMachine_createServerFn_handler, finalizeMachine_createServerFn_handler, listMachines_createServerFn_handler, machineStatus_createServerFn_handler };

package/.output/server/_ssr/node-sqlite-dialect-DhyOpJTX.mjs

@@ -0,0 +1,162 @@
+import { n as DefaultQueryCompiler, o as CompiledQuery, s as sql$1 } from "./auth-DY1DuYZd.mjs";
+import { n as DEFAULT_MIGRATION_TABLE, t as DEFAULT_MIGRATION_LOCK_TABLE } from "./kysely-migration-tables-JkVUjPF_-bPAX9LR_.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/node-sqlite-dialect-DhyOpJTX.js
+var NodeSqliteAdapter = class {
+	get supportsCreateIfNotExists() {
+		return true;
+	}
+	get supportsTransactionalDdl() {
+		return false;
+	}
+	get supportsMultipleConnections() {
+		return false;
+	}
+	get supportsReturning() {
+		return true;
+	}
+	async acquireMigrationLock() {}
+	async releaseMigrationLock() {}
+	get supportsOutput() {
+		return true;
+	}
+};
+var NodeSqliteDriver = class {
+	#config;
+	#connectionMutex = new ConnectionMutex();
+	#db;
+	#connection;
+	constructor(config) {
+		this.#config = { ...config };
+	}
+	async init() {
+		this.#db = this.#config.database;
+		this.#connection = new NodeSqliteConnection(this.#db);
+		if (this.#config.onCreateConnection) await this.#config.onCreateConnection(this.#connection);
+	}
+	async acquireConnection() {
+		await this.#connectionMutex.lock();
+		return this.#connection;
+	}
+	async beginTransaction(connection) {
+		await connection.executeQuery(CompiledQuery.raw("begin"));
+	}
+	async commitTransaction(connection) {
+		await connection.executeQuery(CompiledQuery.raw("commit"));
+	}
+	async rollbackTransaction(connection) {
+		await connection.executeQuery(CompiledQuery.raw("rollback"));
+	}
+	async releaseConnection() {
+		this.#connectionMutex.unlock();
+	}
+	async destroy() {
+		this.#db?.close();
+	}
+};
+var NodeSqliteConnection = class {
+	#db;
+	constructor(db) {
+		this.#db = db;
+	}
+	executeQuery(compiledQuery) {
+		const { sql, parameters } = compiledQuery;
+		const stmt = this.#db.prepare(sql);
+		const params = parameters;
+		if (stmt.columns().length > 0) return Promise.resolve({ rows: stmt.all(...params) });
+		const { changes, lastInsertRowid } = stmt.run(...params);
+		return Promise.resolve({
+			rows: [],
+			numAffectedRows: BigInt(changes),
+			insertId: typeof lastInsertRowid === "bigint" ? lastInsertRowid : BigInt(lastInsertRowid)
+		});
+	}
+	async *streamQuery() {
+		throw new Error("Streaming query is not supported by SQLite driver.");
+	}
+};
+var ConnectionMutex = class {
+	#promise;
+	#resolve;
+	async lock() {
+		while (this.#promise !== void 0) await this.#promise;
+		this.#promise = new Promise((resolve) => {
+			this.#resolve = resolve;
+		});
+	}
+	unlock() {
+		const resolve = this.#resolve;
+		this.#promise = void 0;
+		this.#resolve = void 0;
+		resolve?.();
+	}
+};
+var NodeSqliteIntrospector = class {
+	#db;
+	constructor(db) {
+		this.#db = db;
+	}
+	async getSchemas() {
+		return [];
+	}
+	async getTables(options = { withInternalKyselyTables: false }) {
+		let query = this.#db.selectFrom("sqlite_schema").where("type", "=", "table").where("name", "not like", "sqlite_%").select("name").$castTo();
+		if (!options.withInternalKyselyTables) query = query.where("name", "!=", DEFAULT_MIGRATION_TABLE).where("name", "!=", DEFAULT_MIGRATION_LOCK_TABLE);
+		const tables = await query.execute();
+		return Promise.all(tables.map(({ name }) => this.#getTableMetadata(name)));
+	}
+	async #getTableMetadata(table) {
+		const db = this.#db;
+		const autoIncrementCol = (await db.selectFrom("sqlite_master").where("name", "=", table).select("sql").$castTo().execute())[0]?.sql?.split(/[\(\),]/)?.find((it) => it.toLowerCase().includes("autoincrement"))?.split(/\s+/)?.[0]?.replace(/["`]/g, "");
+		return {
+			name: table,
+			columns: (await db.selectFrom(sql$1`pragma_table_info(${table})`.as("table_info")).select([
+				"name",
+				"type",
+				"notnull",
+				"dflt_value"
+			]).execute()).map((col) => ({
+				name: col.name,
+				dataType: col.type,
+				isNullable: !col.notnull,
+				isAutoIncrementing: col.name === autoIncrementCol,
+				hasDefaultValue: col.dflt_value != null
+			})),
+			isView: false,
+			isForeign: false
+		};
+	}
+};
+var NodeSqliteQueryCompiler = class extends DefaultQueryCompiler {
+	getCurrentParameterPlaceholder() {
+		return "?";
+	}
+	getLeftIdentifierWrapper() {
+		return "\"";
+	}
+	getRightIdentifierWrapper() {
+		return "\"";
+	}
+	getAutoIncrement() {
+		return "autoincrement";
+	}
+};
+var NodeSqliteDialect = class {
+	#config;
+	constructor(config) {
+		this.#config = { ...config };
+	}
+	createDriver() {
+		return new NodeSqliteDriver(this.#config);
+	}
+	createQueryCompiler() {
+		return new NodeSqliteQueryCompiler();
+	}
+	createAdapter() {
+		return new NodeSqliteAdapter();
+	}
+	createIntrospector(db) {
+		return new NodeSqliteIntrospector(db);
+	}
+};
+//#endregion
+export { NodeSqliteDialect };

package/.output/server/_ssr/notifyFns-BcMRY5kP.mjs

@@ -0,0 +1,118 @@
+import { C as createChannel$1, F as ensureServer, W as getChannel, j as deleteChannel$1, s as CHANNELS, vt as listChannels$1 } from "./boot-BbtG0ImW.mjs";
+import { n as createServerFn } from "./ssr.mjs";
+import { requestScope } from "./auth-DY1DuYZd.mjs";
+import { t as createServerRpc } from "./createServerRpc-BD8Xn_0_.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/notifyFns-BcMRY5kP.js
+/**
+* Notification-channel server functions. Channels are per-team push targets a
+* loop can route its run messages to. Secrets (bot token / chat id) live in the
+* channel's `config` and are NEVER returned to the client — list/test surface
+* only a redacted summary. Scoped to the request's team (see requestScope).
+*
+* Per-type behavior (validate / hint / send) lives in `CHANNELS` (gateway/notify);
+* this module just wires it to auth + storage.
+*/
+function toSummary(c) {
+	return {
+		id: c.id,
+		type: c.type,
+		name: c.name,
+		hint: CHANNELS[c.type]?.hint(c.config) ?? "—"
+	};
+}
+/** Resolve a channel and authorize it against the request's team — undefined when
+*  missing OR (gate on) owned by another team, so existence never leaks. Mirrors
+*  loopApi's ownedLoop for the channel routes. */
+async function ownedChannel(id) {
+	const ch = await getChannel(id);
+	if (!ch) return void 0;
+	const { enforce, teamId } = await requestScope();
+	if (enforce && ch.teamId !== teamId) return void 0;
+	return ch;
+}
+/** GET — the team's channels (redacted summaries, newest first). */
+var listChannels_createServerFn_handler = createServerRpc({
+	id: "ced5641f28e3e64d3b8773ea4c875b78ee305bd08caba90a2207e86ef1ab3327",
+	name: "listChannels",
+	filename: "src/server/notifyFns.ts"
+}, (opts) => listChannels.__executeServer(opts));
+var listChannels = createServerFn({ method: "GET" }).handler(listChannels_createServerFn_handler, async () => {
+	await ensureServer();
+	const { enforce, userId, teamId } = await requestScope();
+	if (enforce && !userId) return [];
+	return (await listChannels$1(teamId)).map(toSummary);
+});
+var createChannel_createServerFn_handler = createServerRpc({
+	id: "d6cb1ea6f7fdaf940fbbe91d6b0898a0d5ac2308f8bc572dc3b856824a1f4581",
+	name: "createChannel",
+	filename: "src/server/notifyFns.ts"
+}, (opts) => createChannel.__executeServer(opts));
+var createChannel = createServerFn({ method: "POST" }).validator((d) => d).handler(createChannel_createServerFn_handler, async ({ data }) => {
+	await ensureServer();
+	const { enforce, userId, teamId } = await requestScope();
+	if (enforce && !userId) return {
+		ok: false,
+		error: "not signed in"
+	};
+	const name = data.name?.trim();
+	if (!name) return {
+		ok: false,
+		error: "name required"
+	};
+	const kind = CHANNELS[data.type];
+	if (!kind) return {
+		ok: false,
+		error: "unknown channel type"
+	};
+	const cfg = data.config ?? {};
+	const missing = kind.required.filter((k) => !cfg[k]?.trim());
+	if (missing.length) return {
+		ok: false,
+		error: `${data.type} needs: ${missing.join(", ")}`
+	};
+	const keys = [...kind.required, ...kind.optional ?? []];
+	const config = Object.fromEntries(keys.filter((k) => cfg[k]?.trim()).map((k) => [k, cfg[k].trim()]));
+	const invalid = kind.validate?.(config);
+	if (invalid) return {
+		ok: false,
+		error: invalid
+	};
+	return {
+		ok: true,
+		id: (await createChannel$1({
+			teamId,
+			type: data.type,
+			name,
+			config
+		})).id
+	};
+});
+var deleteChannel_createServerFn_handler = createServerRpc({
+	id: "9defc1b5d0f4316d61621e2c4614a70dc052ad6b7a3aa2ead00836f7d5cb5b4c",
+	name: "deleteChannel",
+	filename: "src/server/notifyFns.ts"
+}, (opts) => deleteChannel.__executeServer(opts));
+var deleteChannel = createServerFn({ method: "POST" }).validator((id) => id).handler(deleteChannel_createServerFn_handler, async ({ data: id }) => {
+	await ensureServer();
+	if (!await ownedChannel(id)) return {
+		ok: false,
+		error: "channel not found"
+	};
+	return { ok: await deleteChannel$1(id) };
+});
+var testChannel_createServerFn_handler = createServerRpc({
+	id: "a4e3ae06af7087a3dc291236cf6d5ad272e2f754884c1f948e75a18a4ebada93",
+	name: "testChannel",
+	filename: "src/server/notifyFns.ts"
+}, (opts) => testChannel.__executeServer(opts));
+var testChannel = createServerFn({ method: "POST" }).validator((id) => id).handler(testChannel_createServerFn_handler, async ({ data: id }) => {
+	await ensureServer();
+	const ch = await ownedChannel(id);
+	if (!ch) return {
+		ok: false,
+		error: "channel not found"
+	};
+	return CHANNELS[ch.type].send(ch.config, ch.name, "Pievo test message — this channel is wired up. ✓");
+});
+//#endregion
+export { createChannel_createServerFn_handler, deleteChannel_createServerFn_handler, listChannels_createServerFn_handler, testChannel_createServerFn_handler };