@midhunxavier/code-flow 0.0.0-stage → 0.1.0-preview.3

package/src/shared-access.js

@@ -0,0 +1,103 @@
+import { redactExport } from "./privacy.js";
+import { sensitiveContextPath } from "./context-inspection.js";
+class SharedPathError extends Error {
+  status = 400;
+}
+function canonicalSharedPath(target) {
+  const raw = target.split("?")[0];
+  if (!raw.startsWith("/") || raw.length > 4e3 || /[\\#\x00-\x20\x7f]/.test(raw) || /%(?:2f|5c|00|25)/i.test(raw)) throw new SharedPathError("Invalid request path");
+  let path;
+  try {
+    path = decodeURIComponent(raw);
+  } catch {
+    throw new SharedPathError("Invalid request path encoding");
+  }
+  if (/[\\#\x00-\x20\x7f]/.test(path)) throw new SharedPathError("Invalid request path");
+  const parts = path === "/" ? [] : path.slice(1).split("/");
+  if (parts.some((part) => !part || part === "." || part === "..")) throw new SharedPathError("Ambiguous request path");
+  if (parts[0] === "api" && parts[1] === "v1" && parts[2] !== "capabilities") parts.splice(1, 1);
+  return { pathname: `/${parts.join("/")}`, parts };
+}
+function sharedRoutePolicy(method, parts) {
+  const route = parts.join("/");
+  if (method === "GET" && route === "api/auth/self" || method === "POST" && route === "api/auth/logout") return "identity";
+  if (method === "GET" && ["api/patterns", "api/templates"].includes(route)) return "catalog";
+  if (method === "GET" && route === "api/projects") return "project-list";
+  if (method === "GET" && ["api/runs", "api/events"].includes(route)) return "run-list";
+  if (parts[0] === "api" && parts[1] === "runs" && /^[a-zA-Z0-9_-]{1,100}$/.test(parts[2] ?? "")) {
+    if (method === "GET" && (parts.length === 3 || parts.length === 4 && ["events", "export", "diff", "review-coverage", "collaboration"].includes(parts[3]))) return "run-read";
+    if (method === "POST" && parts.length === 4 && ["review-coverage", "collaboration"].includes(parts[3])) return "run-review";
+  }
+  return "owner";
+}
+function sharedProjectRole(identity, projectId) {
+  return projectId && Object.hasOwn(identity.roles, projectId) ? identity.roles[projectId] : void 0;
+}
+function sharedCanReadRun(identity, run, projects) {
+  if (run.projectTeam || run.pattern === "team-task-draft") return false;
+  const candidates = run.project ? projects.filter((project) => project.id === run.project) : projects.filter((project) => project.repos.includes(run.repo));
+  return candidates.length === 1 && candidates[0].repos.includes(run.repo) && !!sharedProjectRole(identity, candidates[0].id);
+}
+function sharedProjectProjection(project) {
+  return { id: project.id, name: project.name, createdAt: project.createdAt };
+}
+function sharedDiffProjection(files) {
+  return redactExport(files.filter((file) => !sensitiveContextPath(file.path) && (!file.oldPath || !sensitiveContextPath(file.oldPath))));
+}
+function sharedCoverageProjection(value) {
+  const files = value.files.filter((path) => !sensitiveContextPath(path));
+  const reviewed = value.reviewed.filter((path) => files.includes(path));
+  return { scope: "shared-reviewable-files", omittedCount: value.files.length - files.length, head: value.head, files, reviewed, stale: !!value.stale, coverage: { changed: files.length, reviewed: reviewed.length, percent: files.length ? Math.round(reviewed.length / files.length * 100) : 100 } };
+}
+function pick(value, keys) {
+  return Object.fromEntries(keys.filter((key) => value[key] !== void 0).map((key) => [key, value[key]]));
+}
+function boundedText(value, ceiling) {
+  if (value === void 0) return { text: void 0, truncated: false };
+  const data = Buffer.from(value);
+  if (data.length <= ceiling) return { text: value, truncated: false };
+  let end = ceiling;
+  while (end > 0 && (data[end] & 192) === 128) end--;
+  return { text: data.subarray(0, end).toString("utf8"), truncated: true };
+}
+function stepProjection(step) {
+  const finalText = boundedText(step.finalText, 8 * 1024), error = boundedText(step.error, 4 * 1024);
+  return redactExport({ ...pick(step, ["id", "kind", "title", "role", "agent", "memberId", "taskId", "coordination", "invocations", "status", "startedAt", "endedAt", "retries"]), ...finalText.text !== void 0 ? { finalText: finalText.text } : {}, ...error.text !== void 0 ? { error: error.text } : {}, finalTextTruncated: finalText.truncated, errorTruncated: error.truncated, ...step.contextInput ? { contextInput: pick(step.contextInput, ["scope", "measuredAt", "promptBytes", "schemaBytes", "bytes", "approximateTokens", "resumed", "excluded", "policy", "exceeded", "violations"]) } : {} });
+}
+function sharedRunProjection(run, canReadRun = () => false) {
+  const verification = run.verification, task = boundedText(run.task, 24 * 1024), summary = boundedText(run.summary, 32 * 1024), error = boundedText(run.error, 4 * 1024);
+  const cold = run.cold ? { cold: true, detailAvailable: true } : {};
+  const steps = "steps" in run ? run.steps.slice(-200).map(stepProjection) : void 0;
+  return redactExport({
+    ...pick(run, ["id", "project", "pattern", "status", "createdAt", "endedAt", "baseRef", "baseLabel", "stopReason", "verdict", "facts"]),
+    ...cold,
+    task: task.text,
+    ...summary.text !== void 0 ? { summary: summary.text } : {},
+    ...error.text !== void 0 ? { error: error.text } : {},
+    truncation: { task: task.truncated, summary: summary.truncated, error: error.truncated, omittedSteps: "steps" in run ? Math.max(0, run.steps.length - 200) : 0 },
+    worktrees: run.worktrees.map((worktree) => pick(worktree, ["name", "branch"])),
+    ...steps ? { steps } : {},
+    ...run.parentRunId && canReadRun(run.parentRunId) ? { parentRunId: run.parentRunId } : {},
+    ...run.supersededBy && canReadRun(run.supersededBy) ? { supersededBy: run.supersededBy } : {},
+    ...verification ? { verification: { ...pick(verification, ["version", "profile", "state", "startedAt", "endedAt", "head", "branch"]), checks: verification.checks.map((evidence) => ({ check: pick(evidence.check, ["id", "title", "kind", "required"]), diagnosis: evidence.diagnosis })), ...verification.requirements ? { requirements: verification.requirements.map((requirement) => pick(requirement, ["id", "description", "covered", "missing"])) } : {} } } : {}
+  });
+}
+function sharedEventProjection(event, canReadRun = () => false) {
+  if (!canReadRun(event.runId)) return void 0;
+  const common = { seq: event.seq, ts: event.ts, runId: event.runId };
+  if (event.type === "run") return { ...common, type: "run", run: sharedRunProjection(event.run, canReadRun) };
+  if (event.type === "step") return { ...common, type: "step", step: stepProjection(event.step) };
+  return void 0;
+}
+export {
+  SharedPathError,
+  canonicalSharedPath,
+  sharedCanReadRun,
+  sharedCoverageProjection,
+  sharedDiffProjection,
+  sharedEventProjection,
+  sharedProjectProjection,
+  sharedProjectRole,
+  sharedRoutePolicy,
+  sharedRunProjection
+};

package/src/shared-accounts.js

@@ -0,0 +1,381 @@
+import { constants } from "node:fs";
+import { chmod, lstat, mkdir, open, rename, rm } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { createHash, randomBytes, randomUUID, scrypt, timingSafeEqual } from "node:crypto";
+import { CODEFLOW_HOME } from "./config.js";
+const SHARED_ROLES = ["viewer", "reviewer", "contributor", "maintainer"];
+function roleAtLeast(role, needed) {
+  const rank = role === void 0 ? -1 : SHARED_ROLES.indexOf(role), floor = SHARED_ROLES.indexOf(needed);
+  return rank >= 0 && floor >= 0 && rank >= floor;
+}
+class SharedAccountError extends Error {
+  constructor(message, status = 400) {
+    super(message);
+    this.status = status;
+  }
+}
+const MAX_USERS = 128, MAX_SESSIONS = 1024, SESSION_MS = 12 * 60 * 6e4, IDLE_MS = 30 * 6e4;
+const digest = (value) => createHash("sha256").update(value).digest("hex");
+const object = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+const keys = (v, allowed) => Object.keys(v).every((key) => allowed.includes(key));
+const integer = (v) => typeof v === "number" && Number.isSafeInteger(v) && v >= 0;
+const hex = (v, length) => typeof v === "string" && new RegExp(`^[a-f0-9]{${length}}$`).test(v);
+const userId = (v) => typeof v === "string" && /^u-[a-f0-9-]{36}$/.test(v);
+function username(value, reserved = true) {
+  if (typeof value !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{2,63}$/.test(value)) throw new SharedAccountError("Use 3\u201364 letters, digits, dots, underscores or dashes for the username");
+  const name = value.toLowerCase();
+  if (reserved && name === "owner") throw new SharedAccountError("The username owner is reserved for the server owner");
+  return name;
+}
+function displayName(value) {
+  if (typeof value !== "string" || !value.trim() || value.length > 120 || /[\x00-\x1f\x7f]/.test(value)) throw new SharedAccountError("Enter a display name of up to 120 characters");
+  return value.trim();
+}
+function passwordText(value, creating = true) {
+  if (typeof value !== "string" || Buffer.byteLength(value) > 1024 || creating && [...value].length < 15) throw new SharedAccountError("Passwords need at least 15 characters and at most 1024 UTF-8 bytes");
+  return value;
+}
+function validateSharedRoles(value) {
+  if (!object(value) || Object.keys(value).length > 200) throw new SharedAccountError("Project roles must be a map with at most 200 assigned projects");
+  const roles = {};
+  for (const [id, role] of Object.entries(value)) {
+    if (!/^[a-zA-Z0-9_-]{1,100}$/.test(id) || ["__proto__", "constructor", "prototype"].includes(id) || !SHARED_ROLES.includes(role)) throw new SharedAccountError("Only project viewer, reviewer, contributor and maintainer roles may be assigned");
+    roles[id] = role;
+  }
+  return roles;
+}
+let activeDerivations = 0;
+async function derive(value, salt) {
+  if (activeDerivations >= 2) throw new SharedAccountError("Sign-in is busy; try again shortly", 429);
+  activeDerivations++;
+  try {
+    return await new Promise((resolve, reject) => scrypt(value, Buffer.from(salt, "hex"), 32, { N: 131072, r: 8, p: 1, maxmem: 256 * 1024 * 1024 }, (error, result) => error ? reject(error) : resolve(result)));
+  } finally {
+    activeDerivations--;
+  }
+}
+async function makePassword(value) {
+  const text = passwordText(value);
+  const salt = randomBytes(16).toString("hex");
+  return { algorithm: "scrypt", N: 131072, r: 8, p: 1, salt, hash: (await derive(text, salt)).toString("hex") };
+}
+const dummySalt = randomBytes(16).toString("hex"), dummyHash = randomBytes(32);
+function publicUser(user) {
+  return { id: user.id, username: user.username, displayName: user.displayName, enabled: user.enabled, revision: user.revision, roles: { ...user.roles }, createdAt: user.createdAt, updatedAt: user.updatedAt };
+}
+function principal(user) {
+  return { kind: "shared", userId: user.id, username: user.username, displayName: user.displayName, revision: user.revision, roles: { ...user.roles } };
+}
+function validateState(raw) {
+  if (!object(raw) || !keys(raw, ["version", "revision", "users", "sessions", "invitations"]) || raw.version !== 1 || !integer(raw.revision) || !Array.isArray(raw.users) || raw.users.length > MAX_USERS || !Array.isArray(raw.sessions) || raw.sessions.length > MAX_SESSIONS) throw new Error("Invalid shared account storage");
+  if (raw.invitations !== void 0) {
+    if (!Array.isArray(raw.invitations) || raw.invitations.length > 256) throw new Error("Invalid invitations");
+    for (const invite of raw.invitations) {
+      if (!object(invite) || !keys(invite, ["id", "projectId", "role", "createdAt", "expiresAt", "acceptedAt", "revokedAt", "hash"]) || typeof invite.projectId !== "string" || typeof invite.id !== "string" || !/^i-[a-f0-9-]{36}$/.test(invite.id) || !hex(invite.hash, 64) || !integer(invite.createdAt) || !integer(invite.expiresAt) || invite.expiresAt !== invite.createdAt + 24 * 60 * 6e4 || invite.acceptedAt !== void 0 && !integer(invite.acceptedAt) || invite.revokedAt !== void 0 && !integer(invite.revokedAt)) throw new Error("Invalid invitation");
+      validateSharedRoles({ [String(invite.projectId)]: invite.role });
+    }
+    if (new Set(raw.invitations.map((invite) => invite.id)).size !== raw.invitations.length || new Set(raw.invitations.map((invite) => invite.hash)).size !== raw.invitations.length) throw new Error("Duplicate invitation");
+  }
+  for (const u of raw.users) {
+    if (!object(u) || !keys(u, ["id", "username", "displayName", "enabled", "revision", "roles", "createdAt", "updatedAt", "password"]) || !userId(u.id) || username(u.username, false) !== u.username || displayName(u.displayName) !== u.displayName || typeof u.enabled !== "boolean" || !integer(u.revision) || u.revision < 1 || !integer(u.createdAt) || !integer(u.updatedAt) || u.updatedAt < u.createdAt || !object(u.password) || !keys(u.password, ["algorithm", "N", "r", "p", "salt", "hash"]) || u.password.algorithm !== "scrypt" || u.password.N !== 131072 || u.password.r !== 8 || u.password.p !== 1 || !hex(u.password.salt, 32) || !hex(u.password.hash, 64)) throw new Error("Invalid shared account record");
+    validateSharedRoles(u.roles);
+  }
+  if (new Set(raw.users.map((u) => u.id)).size !== raw.users.length || new Set(raw.users.map((u) => u.username)).size !== raw.users.length) throw new Error("Duplicate shared account identity");
+  for (const s of raw.sessions) if (!object(s) || !keys(s, ["hash", "userId", "revision", "createdAt", "lastSeenAt", "expiresAt"]) || !hex(s.hash, 64) || !userId(s.userId) || !integer(s.revision) || !integer(s.createdAt) || !integer(s.lastSeenAt) || !integer(s.expiresAt) || s.lastSeenAt < s.createdAt || s.expiresAt !== s.createdAt + SESSION_MS || s.lastSeenAt > s.expiresAt || !raw.users.some((u) => u.id === s.userId)) throw new Error("Invalid shared account session");
+  if (new Set(raw.sessions.map((s) => s.hash)).size !== raw.sessions.length) throw new Error("Duplicate shared session");
+  return raw;
+}
+class LoginLimiter {
+  buckets = /* @__PURE__ */ new Map();
+  check(address, name, now) {
+    for (const [key, value] of this.buckets) if (value.expires <= now) this.buckets.delete(key);
+    const keys2 = [["global", 100], [`ip:${address.slice(0, 128)}`, 20], [`user:${digest(name)}`, 8]];
+    if (keys2.some(([key, max]) => (this.buckets.get(key)?.count ?? 0) >= max)) throw new SharedAccountError("Too many sign-in attempts; try again later", 429);
+    for (const [key] of keys2) {
+      const bucket = this.buckets.get(key) ?? { count: 0, expires: now + 15 * 6e4 };
+      bucket.count++;
+      this.buckets.delete(key);
+      this.buckets.set(key, bucket);
+    }
+    while (this.buckets.size > 2048) this.buckets.delete(this.buckets.keys().next().value);
+  }
+}
+class SharedAccounts {
+  constructor(file = join(CODEFLOW_HOME, "shared-accounts.json")) {
+    this.file = file;
+  }
+  state = { version: 1, revision: 0, users: [], sessions: [] };
+  loaded = false;
+  loading;
+  readable = true;
+  writes = Promise.resolve();
+  listeners = /* @__PURE__ */ new Set();
+  limiter = new LoginLimiter();
+  get available() {
+    return this.loaded && this.readable;
+  }
+  get hasUsers() {
+    return this.available && this.state.users.length > 0;
+  }
+  get hasInvitations() {
+    return this.available && !!this.state.invitations?.length;
+  }
+  load() {
+    return this.loading ??= (async () => {
+      try {
+        const handle = await open(this.file, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        try {
+          const stat = await handle.stat();
+          if (!stat.isFile() || stat.size > 4 * 1024 * 1024) throw new Error("Shared account storage is not a bounded regular file");
+          this.state = validateState(JSON.parse(await handle.readFile("utf8")));
+        } finally {
+          await handle.close();
+        }
+      } catch (error) {
+        if (error.code !== "ENOENT") {
+          this.readable = false;
+          throw new SharedAccountError("Shared accounts cannot be read; owner recovery remains available and the account file was left untouched", 503);
+        }
+      } finally {
+        this.loaded = true;
+      }
+    })();
+  }
+  snapshot() {
+    this.require();
+    return { revision: this.state.revision, users: this.state.users.map(publicUser) };
+  }
+  onChange(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  invitations() {
+    this.require();
+    return (this.state.invitations ?? []).map(({ hash: _hash, ...invite }) => ({ ...invite }));
+  }
+  async invite(input) {
+    const roles = validateSharedRoles({ [input.projectId]: input.role });
+    const token = randomBytes(32).toString("base64url"), now = Date.now();
+    const invitation = { id: `i-${randomUUID()}`, projectId: input.projectId, role: roles[input.projectId], createdAt: now, expiresAt: now + 24 * 60 * 6e4 };
+    await this.load();
+    await this.mutate((state) => {
+      state.invitations = (state.invitations ?? []).filter((entry) => entry.expiresAt > now);
+      if (state.invitations.length >= 256) throw new SharedAccountError("Too many invitations; wait for existing links to expire", 409);
+      state.invitations.push({ ...invitation, hash: digest(token) });
+    }, false);
+    return { invitation, token };
+  }
+  async revokeInvitation(id) {
+    await this.load();
+    await this.mutate((state) => {
+      const invite = state.invitations?.find((entry) => entry.id === id);
+      if (!invite) throw new SharedAccountError("Invitation not found", 404);
+      invite.revokedAt ??= Date.now();
+    }, false);
+  }
+  previewInvitation(token) {
+    this.require();
+    const { hash: _hash, ...invite } = this.findInvitation(this.state, token);
+    return { ...invite };
+  }
+  findInvitation(state, token) {
+    const invite = typeof token === "string" && /^[a-zA-Z0-9_-]{43}$/.test(token) ? state.invitations?.find((entry) => entry.hash === digest(token)) : void 0;
+    if (!invite || invite.expiresAt <= Date.now() || invite.revokedAt !== void 0 || invite.acceptedAt !== void 0) throw new SharedAccountError("This invitation expired, was used, or was revoked. Ask the project owner for a new link.", 410);
+    return invite;
+  }
+  /** Consume the invitation, membership and sign-in in one durable write; concurrent acceptance can succeed only once. */
+  async acceptInvitation(input, commit = (_projectId, save) => save()) {
+    await this.load();
+    this.require();
+    if (!input.secure && !input.loopback) throw new SharedAccountError("Joining a project requires HTTPS outside this computer", 403);
+    const invitation = this.previewInvitation(input.token);
+    const existing = input.existing ? await this.verify(input) : void 0;
+    if (!existing) this.limiter.check(input.address, String(input.username).slice(0, 128), Date.now());
+    const name = existing?.username ?? username(input.username), label = existing?.displayName ?? displayName(input.displayName);
+    const password = existing ? void 0 : await makePassword(input.password);
+    const token = randomBytes(32).toString("base64url");
+    let result;
+    await commit(invitation.projectId, () => this.change((state) => {
+      const invite = this.findInvitation(state, input.token), now = Date.now();
+      let user;
+      if (existing) {
+        user = this.find(state, existing.id);
+        if (!user.enabled || user.revision !== existing.revision) throw new SharedAccountError("Account changed; sign in again", 409);
+        if (!roleAtLeast(user.roles[invite.projectId], invite.role)) user.roles[invite.projectId] = invite.role;
+        user.revision++;
+        user.updatedAt = now;
+        state.sessions = state.sessions.filter((session) => session.userId !== user.id);
+      } else {
+        if (state.users.some((entry) => entry.username === name)) throw new SharedAccountError("That username is already in use. Choose Sign in with an existing account or another username.", 409);
+        if (state.users.length >= MAX_USERS) throw new SharedAccountError("This server has reached its account limit; contact the owner", 409);
+        user = { id: `u-${randomUUID()}`, username: name, displayName: label, enabled: true, revision: 1, roles: { [invite.projectId]: invite.role }, password, createdAt: now, updatedAt: now };
+        state.users.push(user);
+      }
+      invite.acceptedAt = now;
+      state.sessions = state.sessions.filter((session) => session.expiresAt > now && session.lastSeenAt + IDLE_MS > now).sort((a, b) => b.createdAt - a.createdAt).slice(0, MAX_SESSIONS - 1);
+      state.sessions.push({ hash: digest(token), userId: user.id, revision: user.revision, createdAt: now, lastSeenAt: now, expiresAt: now + SESSION_MS });
+      result = { token, user: publicUser(user), projectId: invite.projectId, expiresAt: now + SESSION_MS };
+    }));
+    return result;
+  }
+  create(input) {
+    return this.change(async (state) => {
+      this.cas(state, input.revision);
+      if (state.users.length >= MAX_USERS) throw new SharedAccountError("At most 128 shared accounts may be created");
+      const name = username(input.username), label = displayName(input.displayName), roles = validateSharedRoles(input.roles);
+      if (state.users.some((user) => user.username === name)) throw new SharedAccountError("That username is already in use", 409);
+      const password = await makePassword(input.password);
+      const now = Date.now();
+      state.users.push({ id: `u-${randomUUID()}`, username: name, displayName: label, enabled: true, revision: 1, roles, password, createdAt: now, updatedAt: now });
+    });
+  }
+  update(id, input) {
+    return this.change(async (state) => {
+      this.cas(state, input.revision);
+      const user = this.find(state, id);
+      if (input.displayName !== void 0) user.displayName = displayName(input.displayName);
+      if (input.enabled !== void 0) {
+        if (typeof input.enabled !== "boolean") throw new SharedAccountError("Enabled must be true or false");
+        user.enabled = input.enabled;
+      }
+      if (input.roles !== void 0) user.roles = validateSharedRoles(input.roles);
+      if (input.password !== void 0) user.password = await makePassword(input.password);
+      user.revision++;
+      user.updatedAt = Date.now();
+      state.sessions = state.sessions.filter((session) => session.userId !== id);
+    });
+  }
+  revokeSessions(id, input) {
+    return this.change((state) => {
+      this.cas(state, input.revision);
+      const user = this.find(state, id);
+      user.revision++;
+      user.updatedAt = Date.now();
+      state.sessions = state.sessions.filter((session) => session.userId !== id);
+    });
+  }
+  /** Runner enrolment (POST /api/team/runners/connect) proves a password exactly like sign-in, with the same transport rule, limiter and constant-time compare, but must not mint a cookie session. */
+  async verifyCredentials(input) {
+    return publicUser(await this.verify(input));
+  }
+  async login(input) {
+    const user = await this.verify(input);
+    const token = randomBytes(32).toString("base64url"), now = Date.now();
+    const revision = user.revision;
+    await this.mutate((state) => {
+      const current = this.find(state, user.id);
+      if (!current.enabled || current.revision !== revision) throw new SharedAccountError("Account changed during sign-in; try again", 401);
+      state.sessions = state.sessions.filter((session) => session.expiresAt > now && session.lastSeenAt + IDLE_MS > now && session.userId !== user.id);
+      const own = this.state.sessions.filter((session) => session.userId === user.id && session.expiresAt > now && session.lastSeenAt + IDLE_MS > now).sort((a, b) => b.createdAt - a.createdAt).slice(0, 7);
+      state.sessions.push(...own, { hash: digest(token), userId: user.id, revision, createdAt: now, lastSeenAt: now, expiresAt: now + SESSION_MS });
+      state.sessions.sort((a, b) => b.createdAt - a.createdAt);
+      state.sessions = state.sessions.slice(0, MAX_SESSIONS);
+    }, false);
+    return { token, user: publicUser(user), expiresAt: now + SESSION_MS };
+  }
+  authenticate(token, options = Date.now()) {
+    const now = typeof options === "number" ? options : options.now ?? Date.now();
+    if (!this.available || !/^[a-zA-Z0-9_-]{43}$/.test(token)) return void 0;
+    const hash = digest(token);
+    const session = this.state.sessions.find((session2) => session2.hash === hash);
+    if (!session || session.expiresAt <= now || session.lastSeenAt + IDLE_MS <= now) return void 0;
+    const user = this.state.users.find((user2) => user2.id === session.userId);
+    if (!user?.enabled || user.revision !== session.revision) return void 0;
+    if (typeof options === "number" || options.touch !== false) session.lastSeenAt = Math.max(session.lastSeenAt, now);
+    return principal(user);
+  }
+  async logout(token) {
+    await this.load();
+    await this.mutate((state) => {
+      state.sessions = state.sessions.filter((session) => session.hash !== digest(token));
+    }, true);
+  }
+  /** The single password check: an unknown account still derives against a dummy salt, so timing never reveals which usernames exist. */
+  async verify(input) {
+    await this.load();
+    this.require();
+    if (!input.secure && !input.loopback) throw new SharedAccountError("Shared sign-in requires HTTPS outside this computer", 403);
+    const name = typeof input.username === "string" ? input.username.toLowerCase() : "";
+    this.limiter.check(input.address, name.slice(0, 128), Date.now());
+    const supplied = passwordText(input.password, false), user = this.state.users.find((entry) => entry.username === name);
+    const expected = user ? Buffer.from(user.password.hash, "hex") : dummyHash;
+    const result = await derive(supplied, user?.password.salt ?? dummySalt);
+    if (!timingSafeEqual(result, expected) || !user?.enabled) throw new SharedAccountError("Invalid username or password", 401);
+    return user;
+  }
+  require() {
+    if (!this.available) throw new SharedAccountError("Shared account storage is unavailable; use the owner recovery link", 503);
+  }
+  find(state, id) {
+    const user = state.users.find((user2) => user2.id === id);
+    if (!user) throw new SharedAccountError("Shared account not found", 404);
+    return user;
+  }
+  cas(state, revision) {
+    if (!integer(revision) || revision !== state.revision) throw new SharedAccountError("Accounts changed; reload before saving", 409);
+  }
+  async change(update) {
+    await this.load();
+    await this.mutate(async (state) => {
+      await update(state);
+      state.revision++;
+    }, true);
+    return this.snapshot();
+  }
+  mutate(update, notify) {
+    const write = this.writes.catch(() => void 0).then(async () => {
+      this.require();
+      const next = structuredClone(this.state);
+      await update(next);
+      await this.write(next);
+      this.state = next;
+      if (notify) for (const listener of this.listeners) {
+        try {
+          listener();
+        } catch {
+        }
+      }
+    });
+    this.writes = write;
+    return write;
+  }
+  async write(state) {
+    await mkdir(dirname(this.file), { recursive: true, mode: 448 });
+    try {
+      const info = await lstat(this.file);
+      if (!info.isFile() || info.isSymbolicLink()) throw new SharedAccountError("Refusing to replace non-regular account storage", 503);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    const temp = `${this.file}.${randomUUID()}.tmp`;
+    try {
+      const handle = await open(temp, "wx", 384);
+      try {
+        await handle.writeFile(JSON.stringify(state));
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
+      await rename(temp, this.file);
+      await chmod(this.file, 384);
+      if (process.platform !== "win32") {
+        const dir = await open(dirname(this.file), "r");
+        try {
+          await dir.sync();
+        } finally {
+          await dir.close();
+        }
+      }
+    } finally {
+      await rm(temp, { force: true }).catch(() => {
+      });
+    }
+  }
+}
+export {
+  SHARED_ROLES,
+  SharedAccountError,
+  SharedAccounts,
+  roleAtLeast,
+  validateSharedRoles
+};