@monster-orange/den 0.2.8 → 0.4.0

package/make/den.mk

@@ -40,11 +40,23 @@ export E2E_ENVIRONMENT=$(env)
 OPEN_REPORT ?= 0
 
 # Secrets backend is a strategy chosen in the org config (secrets.provider:
-# doppler | 1password | env). Override per shell:
+# none | doppler | 1password | env). Override per shell:
 #   DEN_SECRETS_PROVIDER=env make up
-# OP_ACCOUNT is only consulted when the 1password strategy is selected.
-OP_ACCOUNT ?= example.1password.com
-export OP_ACCOUNT
+# Den sets no backend account of its own (no OP_ACCOUNT here): the 1password
+# strategy reads secrets.onepassword.account, or your own OP_ACCOUNT.
+#
+# Backend-specific targets come from make/secrets-<provider>.mk, included
+# only when the distribution selects that backend. The selection is read
+# (with tsx) only when a config or the shell could name 1password, so a
+# distribution that does not use it pays nothing.
+ifeq ($(origin DEN_SECRETS_STRATEGY),undefined)
+ifneq ($(DEN_SECRETS_PROVIDER)$(shell grep -lsE 'provider: *.?1password' $(CURDIR)/config/*.yml $(CURDIR)/config/local/user.yml 2>/dev/null),)
+DEN_SECRETS_STRATEGY := $(shell $(DEN_TSX) $(DEN_ENGINE)/scripts/setup-secrets.ts --provider 2>/dev/null)
+else
+DEN_SECRETS_STRATEGY :=
+endif
+endif
+export DEN_SECRETS_STRATEGY
 
 # Repo for the smoke and browser pillars — no default: make test-smk-all repo=<repo>
 repo ?=
@@ -55,6 +67,9 @@ include $(DEN_ENGINE)/make/local_dev.mk
 include $(DEN_ENGINE)/make/journeys.mk
 include $(DEN_ENGINE)/make/security.mk
 include $(DEN_ENGINE)/make/demo.mk
+ifneq ($(DEN_SECRETS_STRATEGY),)
+-include $(DEN_ENGINE)/make/secrets-$(DEN_SECRETS_STRATEGY).mk
+endif
 
 # ── Help ──────────────────────────────────────────────────────────────────────
 # A distribution gets `make help` from here; Den's own Makefile has a longer

package/make/journeys.mk

@@ -26,7 +26,8 @@
 # the JOURNEYS_MODEL env var, when set, overrides every spec (operator
 # control, e.g. CI cost pinning). A journey with neither is refused by the
 # runner — no default model is ever invented. CURSOR_API_KEY needs no
-# export — the runner falls back to a 1Password `op read` when unset.
+# export — when unset, the runner reads secrets.refs.journeys_agent_key from
+# the selected secrets backend (not configured: the run says so).
 
 .PHONY: test-jrn-all .journeys-check-env
 

package/make/local_dev.mk

@@ -6,8 +6,8 @@
 .PHONY: down $(DEN_TARGET_PREFIX)-up $(DEN_TARGET_PREFIX)-down $(DEN_TARGET_PREFIX)-restart $(DEN_TARGET_PREFIX)-status $(DEN_TARGET_PREFIX)-services \
         $(DEN_TARGET_PREFIX)-graph $(DEN_TARGET_PREFIX)-logs \
         $(DEN_TARGET_PREFIX)-register $(DEN_TARGET_PREFIX)-setup $(DEN_TARGET_PREFIX)-sync $(DEN_TARGET_PREFIX)-workspace \
-        $(DEN_TARGET_PREFIX)-init $(DEN_TARGET_PREFIX)-validate $(DEN_TARGET_PREFIX)-local-dev $(DEN_TARGET_PREFIX)-setup-secrets $(DEN_TARGET_PREFIX)-setup-1password \
-        register-repos aws-configure auth-configure \
+        $(DEN_TARGET_PREFIX)-init $(DEN_TARGET_PREFIX)-validate $(DEN_TARGET_PREFIX)-local-dev $(DEN_TARGET_PREFIX)-setup-secrets \
+        register-repos aws-configure \
         web dev-dns
 
 # ── Service management ────────────────────────────────────────────────────────
@@ -93,14 +93,13 @@ $(DEN_TARGET_PREFIX)-validate:
 $(DEN_TARGET_PREFIX)-local-dev:
 	@$(DEN_BIN) local-dev $(args)
 
-# Set up developer secrets with the configured backend (secrets.provider).
+# Set up developer secrets with the selected backend (secrets.provider):
+# dispatches to that strategy's setup; with none it says there is nothing to
+# set up. Backend-only targets (e.g. -setup-1password) live in
+# make/secrets-<provider>.mk and exist only when that backend is selected.
 $(DEN_TARGET_PREFIX)-setup-secrets:
 	@$(DEN_TSX) $(DEN_ENGINE)/scripts/setup-secrets.ts
 
-# 1Password strategy only: populate the "Developer API Keys" item.
-$(DEN_TARGET_PREFIX)-setup-1password:
-	@$(DEN_TSX) $(DEN_ENGINE)/scripts/setup-1password.ts
-
 # Show where test discovery gets its repos. With Local Dev enabled (default)
 # it follows the workspace — nothing to register. Hosted / no-local setups get
 # the legacy sibling scan (also forceable with args=--legacy), which writes
@@ -113,12 +112,6 @@ register-repos:
 aws-configure:
 	@$(DEN_TSX) $(DEN_ENGINE)/src/scripts/configure-aws-profiles.ts
 
-# Per-engineer admin 1Password setup — staging/production only.
-# Saves config/local/admin-auth-{env}.json (gitignored, no password stored).
-auth-configure:
-	@E2E_ENVIRONMENT=$(env) $(DEN_TSX) $(DEN_ENGINE)/scripts/auth-configure.ts
-	@$(MAKE) int-jwt-clear env=$(env)
-
 # ── Web UI ────────────────────────────────────────────────────────────────────
 
 # Browser-based runner + Local Dev dashboard at http://localhost:<web.port> (default 7777),

package/make/secrets-1password.mk

@@ -0,0 +1,18 @@
+# make/secrets-1password.mk — targets of the 1password secrets strategy.
+#
+# den.mk includes this file only when the distribution selects
+# `secrets.provider: 1password` (or DEN_SECRETS_PROVIDER=1password). No other
+# distribution has these targets.
+
+.PHONY: $(DEN_TARGET_PREFIX)-setup-1password auth-configure
+
+# Populate the developer-keys item at secrets.developer_keys.{vault,item}
+# (else the vault and item of secrets.refs.sudo). No default location.
+$(DEN_TARGET_PREFIX)-setup-1password:
+	@$(DEN_TSX) $(DEN_ENGINE)/scripts/setup-1password.ts
+
+# Per-engineer admin setup in your own 1Password — staging/production only.
+# Saves config/local/admin-auth-{env}.json (gitignored, no password stored).
+auth-configure:
+	@E2E_ENVIRONMENT=$(env) $(DEN_TSX) $(DEN_ENGINE)/scripts/auth-configure.ts
+	@$(MAKE) int-jwt-clear env=$(env)

package/make/test.mk

@@ -338,7 +338,7 @@ int-jwt-status:
 	done
 	@echo ""
 	@echo "  Run: make int-jwt-clear [env=<env>]  to force re-fetch"
-	@echo "  Credentials: 1Password (eval \$$(op signin)) or CI ENV vars"
+	@echo "  Credentials: the selected secrets backend (secrets.provider) or CI ENV vars"
 
 # ── Results & reports ─────────────────────────────────────────────────────────
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@monster-orange/den",
-  "version": "0.2.8",
+  "version": "0.4.0",
   "description": "Den: a local multi-repo dev orchestrator, HTTPS edge and E2E harness",
   "type": "module",
   "bin": {
@@ -12,6 +12,8 @@
     "!src/**/*.test.ts",
     "make/",
     "service/",
+    "schemas/",
+    "themes/",
     "scripts/auth-configure.ts",
     "scripts/heal-config.ts",
     "scripts/jsonl-playwright-reporter.js",
@@ -22,7 +24,8 @@
     "LICENSE",
     "README.md",
     "CHANGELOG.md",
-    "docs/"
+    "docs/",
+    "!docs/images/"
   ],
   "scripts": {
     "cli": "tsx src/ui/cli/index.ts menu",
@@ -39,6 +42,8 @@
     "typecheck": "tsc --noEmit -p tsconfig.typecheck.json && tsc --noEmit -p tsconfig.build.json",
     "test": "jest --forceExit",
     "gate:org-names": "node scripts/org-name-gate.mjs",
+    "docs:shots": "node scripts/doc-shots.mjs",
+    "docs:links": "node scripts/docs-links.js",
     "example:regen": "rm -rf examples/distribution && ./bin/den create acme examples/distribution",
     "dist-smoke": "bash scripts/dist-smoke.sh"
   },
@@ -68,6 +73,7 @@
     "jsonwebtoken": "^9.0.2",
     "openapi-typescript": "^7.13.0",
     "ora": "^8.0.1",
+    "semver": "7.8.6",
     "tsx": "^4.23.1",
     "yaml": "^2.8.2",
     "zod": "^4.3.6"
@@ -77,6 +83,7 @@
     "@types/jest": "^29.5.11",
     "@types/jsonwebtoken": "^9.0.5",
     "@types/node": "^22.20.1",
+    "@types/semver": "7.7.1",
     "@typescript-eslint/eslint-plugin": "^7.18.0",
     "@typescript-eslint/parser": "^7.18.0",
     "eslint": "^8.56.0",
@@ -104,5 +111,8 @@
   "homepage": "https://github.com/Monster-Orange/den",
   "bugs": {
     "url": "https://github.com/Monster-Orange/den/issues"
+  },
+  "optionalDependencies": {
+    "@lydell/node-pty": "1.1.0"
   }
 }

package/schemas/den.plugin.v1.json

@@ -0,0 +1,156 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://raw.githubusercontent.com/Monster-Orange/den/main/schemas/den.plugin.v1.json",
+  "title": "Den plugin (den.plugin/v1)",
+  "description": "A plugin for a Den distribution: one or more extension points (provides) and the capabilities it needs. Kept as den-plugin.json in plugins/<id>/, either the distribution's own (local) or vendored by `<cli> plugin add <git url>[/<subpath>]@<ref>` (added, pinned in plugins.lock.json). A directory holding only a den-theme.json is an implicit theme plugin. v1 only ever gains optional fields; a rename or removal is v2.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "id",
+    "name",
+    "version",
+    "license",
+    "den",
+    "maintainer",
+    "provides"
+  ],
+  "properties": {
+    "$schema": { "type": "string" },
+    "schema": { "const": "den.plugin/v1" },
+    "id": {
+      "description": "Stable identifier, the name of its plugins/<id>/ directory: 2–40 characters, lowercase letters, digits or dashes, starting with a letter. Not \"den\".",
+      "$ref": "den.theme.v1.json#/properties/id"
+    },
+    "name": { "type": "string", "minLength": 1, "maxLength": 60 },
+    "version": {
+      "description": "The plugin's own semver. Tag the repo with it (v1.2.0, or <id>/v1.2.0 in a repo of several plugins).",
+      "$ref": "den.theme.v1.json#/properties/version"
+    },
+    "description": { "type": "string", "maxLength": 280 },
+    "license": {
+      "description": "SPDX license expression for the plugin, the same rule as a theme's (den.theme/v1). Bundled fonts carry their own.",
+      "$ref": "den.theme.v1.json#/$defs/spdx"
+    },
+    "homepage": { "type": "string", "format": "uri" },
+    "den": {
+      "description": "Den versions this plugin supports, as a semver range (\">=0.3.0 <0.4.0\"). Required.",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 60
+    },
+    "maintainer": {
+      "description": "Who answers for it: a person or a team (admission rule 1).",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 120
+    },
+    "readme": {
+      "description": "The README that says its tier, what it may touch and what it must never do (admission rule 2). Default README.md. Files-tier plugins are exempt.",
+      "$ref": "#/$defs/path"
+    },
+    "provides": {
+      "description": "One entry per extension point. Each kind defines its entry's fields.",
+      "type": "array",
+      "minItems": 1,
+      "items": { "$ref": "#/$defs/provide" }
+    },
+    "capabilities": {
+      "description": "What it may touch, from a closed vocabulary. A local plugin's declared set is its approved set; an added plugin's is approved at add and recorded in plugins.lock.json.",
+      "type": "array",
+      "uniqueItems": true,
+      "items": { "$ref": "#/$defs/capability" }
+    }
+  },
+  "$defs": {
+    "path": {
+      "description": "A file inside the plugin's directory: relative, no '..'.",
+      "type": "string",
+      "maxLength": 200,
+      "pattern": "^(?!/)(?!.*\\.\\.)[A-Za-z0-9._/-]+$"
+    },
+    "kind": {
+      "description": "files tier: theme, catalog, persona-pack. browser tier: page. server tier: mcp-tools, work-items, runtime, session-backend, notifier, secrets, identity, health-source.",
+      "enum": [
+        "theme",
+        "catalog",
+        "persona-pack",
+        "page",
+        "mcp-tools",
+        "work-items",
+        "runtime",
+        "session-backend",
+        "notifier",
+        "secrets",
+        "identity",
+        "health-source"
+      ]
+    },
+    "provide": {
+      "type": "object",
+      "required": ["kind"],
+      "properties": { "kind": { "$ref": "#/$defs/kind" } },
+      "allOf": [
+        {
+          "if": { "properties": { "kind": { "const": "theme" } } },
+          "then": {
+            "additionalProperties": false,
+            "required": ["manifest"],
+            "properties": {
+              "kind": true,
+              "manifest": {
+                "description": "The theme's den-theme.json (den.theme/v1), inside the plugin.",
+                "type": "string",
+                "maxLength": 200,
+                "pattern": "^(?!/)(?!.*\\.\\.)([A-Za-z0-9._-]+/)*den-theme\\.json$"
+              }
+            }
+          }
+        },
+        {
+          "if": { "properties": { "kind": { "const": "page" } } },
+          "then": {
+            "additionalProperties": false,
+            "required": ["entry"],
+            "properties": {
+              "kind": true,
+              "entry": {
+                "description": "The page's ES module, inside the plugin.",
+                "type": "string",
+                "maxLength": 200,
+                "pattern": "^(?!/)(?!.*\\.\\.)[A-Za-z0-9._/-]+\\.m?js$"
+              },
+              "nav": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["group", "label"],
+                "properties": {
+                  "group": {
+                    "type": "string",
+                    "pattern": "^[a-z][a-z0-9-]{0,39}$"
+                  },
+                  "label": {
+                    "description": "A catalog key or the text itself.",
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 60
+                  },
+                  "icon": {
+                    "type": "string",
+                    "pattern": "^[a-z][a-z0-9-]{0,39}$"
+                  }
+                }
+              }
+            }
+          }
+        }
+      ]
+    },
+    "capability": {
+      "description": "ui.nav, api.read, api.actions:<id,...>, secrets:<ref,...>, net:<host,...>, exec:<binary,...> or send:<channel>.",
+      "type": "string",
+      "maxLength": 400,
+      "pattern": "^(ui\\.nav|api\\.read|api\\.actions:[a-z][a-z0-9_.-]*(,[a-z][a-z0-9_.-]*)*|secrets:[^,\\s]+(,[^,\\s]+)*|net:[A-Za-z0-9*.-]+(:[0-9]{1,5})?(,[A-Za-z0-9*.-]+(:[0-9]{1,5})?)*|exec:[A-Za-z0-9._/+-]+(,[A-Za-z0-9._/+-]+)*|send:[a-z][a-z0-9_.-]*)$"
+    }
+  }
+}

package/schemas/den.theme.v1.json

@@ -0,0 +1,269 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://raw.githubusercontent.com/Monster-Orange/den/main/schemas/den.theme.v1.json",
+  "title": "Den theme (den.theme/v1)",
+  "description": "A look and feel for Den's web UI: color tokens for dark and light, type, shape and a mark. Published in a git repo as den-theme.json and installed by `<cli> theme add <git url>[/<subpath>]@<ref>`. v1 only ever gains optional fields; a rename or removal is v2.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "id", "name", "version", "license", "modes"],
+  "properties": {
+    "$schema": { "type": "string" },
+    "schema": { "const": "den.theme/v1" },
+    "id": {
+      "description": "Stable identifier, unique within its repo: 2–40 characters, lowercase letters, digits or dashes, starting with a letter.",
+      "type": "string",
+      "pattern": "^[a-z][a-z0-9-]{1,39}$"
+    },
+    "name": { "type": "string", "minLength": 1, "maxLength": 60 },
+    "version": {
+      "description": "The theme's own semver. Tag the repo with it (v1.2.0, or <id>/v1.2.0 in a repo of several themes).",
+      "type": "string",
+      "pattern": "^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(-[0-9A-Za-z.-]+)?$"
+    },
+    "description": { "type": "string", "maxLength": 280 },
+    "author": { "type": "string", "maxLength": 120 },
+    "license": {
+      "description": "SPDX license expression for the theme (tokens, logo), e.g. MIT. Fonts carry their own.",
+      "$ref": "#/$defs/spdx"
+    },
+    "homepage": { "type": "string", "format": "uri" },
+    "den": {
+      "description": "Den versions this theme supports, as a semver range (\">=0.3.0 <0.4.0\"). Omitted: any Den that reads den.theme/v1.",
+      "type": "string"
+    },
+    "default_mode": {
+      "description": "The mode to use when the user's preference is 'system' and the system gives none.",
+      "enum": ["dark", "light"]
+    },
+    "type": { "$ref": "#/$defs/type" },
+    "shape": { "$ref": "#/$defs/shape" },
+    "mark": { "$ref": "#/$defs/mark" },
+    "favicon": {
+      "description": "The browser-tab icon: a PNG, SVG or ICO file in the theme (at most 64 KB). Omitted: the mark's file (its dark variant in dark mode), else Den's own icon.",
+      "$ref": "#/$defs/faviconPath"
+    },
+    "fonts": {
+      "description": "Font files shipped in the theme (no CDN): Den serves them itself, so the theme works offline.",
+      "type": "array",
+      "items": { "$ref": "#/$defs/font" }
+    },
+    "modes": {
+      "description": "Color tokens for both modes. Both are required: every theme has a dark and a light.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["dark", "light"],
+      "properties": {
+        "dark": { "$ref": "#/$defs/colors" },
+        "light": { "$ref": "#/$defs/colors" }
+      }
+    }
+  },
+  "$defs": {
+    "spdx": {
+      "description": "An SPDX license expression: identifiers (MIT, OFL-1.1, LicenseRef-x) joined by AND, OR or WITH. Not UNLICENSED or NONE: a published theme and its fonts must be redistributable.",
+      "type": "string",
+      "maxLength": 120,
+      "pattern": "^\\(?[A-Za-z0-9][A-Za-z0-9.+-]*\\)?( (AND|OR|WITH) \\(?[A-Za-z0-9][A-Za-z0-9.+-]*\\)?)*$",
+      "not": { "pattern": "^(UNLICENSED|NONE|NOASSERTION)$" }
+    },
+    "hex": {
+      "description": "#rrggbb. One format, so contrast can be checked exactly.",
+      "type": "string",
+      "pattern": "^#[0-9a-fA-F]{6}$"
+    },
+    "cssValue": {
+      "description": "A CSS value without declarations, blocks, markup or url(): Den writes it into a custom property.",
+      "type": "string",
+      "maxLength": 200,
+      "not": { "pattern": "[;{}<>\\\\]|url\\s*\\(|@import|expression\\s*\\(" }
+    },
+    "colors": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "bg",
+        "surface",
+        "raised",
+        "sunken",
+        "text",
+        "muted",
+        "faint",
+        "border",
+        "border-strong",
+        "accent",
+        "accent-text",
+        "accent-fill",
+        "on-accent",
+        "ok",
+        "warn",
+        "bad",
+        "remote"
+      ],
+      "properties": {
+        "bg": { "$ref": "#/$defs/hex", "description": "Page ground." },
+        "surface": {
+          "$ref": "#/$defs/hex",
+          "description": "Cards, bars, panels."
+        },
+        "raised": { "$ref": "#/$defs/hex", "description": "Menus, popovers." },
+        "sunken": {
+          "$ref": "#/$defs/hex",
+          "description": "Wells, hover fills, code."
+        },
+        "text": { "$ref": "#/$defs/hex" },
+        "muted": { "$ref": "#/$defs/hex", "description": "Secondary text." },
+        "faint": {
+          "$ref": "#/$defs/hex",
+          "description": "Tertiary text: captions, labels, placeholders. Text, so 4.5:1 on every ground."
+        },
+        "border": { "$ref": "#/$defs/hex" },
+        "border-strong": {
+          "$ref": "#/$defs/hex",
+          "description": "Input and control borders."
+        },
+        "accent": {
+          "$ref": "#/$defs/hex",
+          "description": "Focus rings, selection, active rail item. Never text: links and accent text use accent-text. Checked at 3:1 on every ground."
+        },
+        "accent-text": {
+          "$ref": "#/$defs/hex",
+          "description": "Links and accent text on bg/surface."
+        },
+        "accent-fill": {
+          "$ref": "#/$defs/hex",
+          "description": "Primary button fill."
+        },
+        "on-accent": {
+          "$ref": "#/$defs/hex",
+          "description": "Text on accent-fill."
+        },
+        "ok": { "$ref": "#/$defs/hex" },
+        "warn": { "$ref": "#/$defs/hex" },
+        "bad": { "$ref": "#/$defs/hex" },
+        "remote": {
+          "$ref": "#/$defs/hex",
+          "description": "Remote (cloud) services."
+        },
+        "shadow": {
+          "$ref": "#/$defs/cssValue",
+          "description": "box-shadow for popovers."
+        },
+        "bar": {
+          "$ref": "#/$defs/cssValue",
+          "description": "Top bar accent stripe: a color or a linear-gradient(), or none."
+        }
+      }
+    },
+    "type": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "sans": {
+          "$ref": "#/$defs/cssValue",
+          "description": "Body font stack."
+        },
+        "mono": { "$ref": "#/$defs/cssValue" },
+        "display": {
+          "$ref": "#/$defs/cssValue",
+          "description": "Headings and the product name; defaults to sans."
+        },
+        "ja": {
+          "$ref": "#/$defs/cssValue",
+          "description": "Fallback stack for Japanese text."
+        }
+      }
+    },
+    "shape": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "radius": {
+          "type": "string",
+          "pattern": "^(0|\\d{1,2}(\\.\\d+)?(px|rem))$"
+        },
+        "radius-button": {
+          "type": "string",
+          "pattern": "^(0|\\d{1,2}(\\.\\d+)?(px|rem)|50%)$"
+        },
+        "density": { "enum": ["compact", "comfortable"] }
+      }
+    },
+    "mark": {
+      "description": "The brand mark in the top bar: an SVG file in the theme (shown as an image, never inlined), a PNG or WebP file (for a mark that exists only as a raster: at least 44×44 px, at most 64 KB), or text drawn by Den. One image kind per mark: svg, png or webp.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "svg": { "$ref": "#/$defs/path" },
+        "svg_dark": {
+          "$ref": "#/$defs/path",
+          "description": "A dark-mode variant, if the mark needs one."
+        },
+        "png": { "$ref": "#/$defs/pngPath" },
+        "png_dark": {
+          "$ref": "#/$defs/pngPath",
+          "description": "A dark-mode variant of the png mark."
+        },
+        "webp": { "$ref": "#/$defs/webpPath" },
+        "webp_dark": {
+          "$ref": "#/$defs/webpPath",
+          "description": "A dark-mode variant of the webp mark."
+        },
+        "text": { "type": "string", "maxLength": 3 },
+        "shape": { "enum": ["square", "rounded", "circle"] }
+      }
+    },
+    "font": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["family", "license", "files"],
+      "properties": {
+        "family": { "type": "string", "pattern": "^[A-Za-z0-9 ._-]{1,60}$" },
+        "license": {
+          "description": "SPDX license expression for the font, e.g. OFL-1.1.",
+          "$ref": "#/$defs/spdx"
+        },
+        "files": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["path"],
+            "properties": {
+              "path": { "$ref": "#/$defs/fontPath" },
+              "weight": {
+                "type": "string",
+                "pattern": "^([1-9]00)( [1-9]00)?$"
+              },
+              "style": { "enum": ["normal", "italic"] }
+            }
+          }
+        }
+      }
+    },
+    "path": {
+      "description": "A file inside the theme's directory: relative, no '..'.",
+      "type": "string",
+      "pattern": "^(?!/)(?!.*\\.\\.)[A-Za-z0-9._/-]+\\.svg$"
+    },
+    "pngPath": {
+      "description": "A PNG file inside the theme's directory: relative, no '..'.",
+      "type": "string",
+      "pattern": "^(?!/)(?!.*\\.\\.)[A-Za-z0-9._/-]+\\.png$"
+    },
+    "webpPath": {
+      "description": "A WebP file inside the theme's directory: relative, no '..'.",
+      "type": "string",
+      "pattern": "^(?!/)(?!.*\\.\\.)[A-Za-z0-9._/-]+\\.webp$"
+    },
+    "faviconPath": {
+      "description": "A PNG, SVG or ICO file inside the theme's directory: relative, no '..'.",
+      "type": "string",
+      "pattern": "^(?!/)(?!.*\\.\\.)[A-Za-z0-9._/-]+\\.(png|svg|ico)$"
+    },
+    "fontPath": {
+      "type": "string",
+      "pattern": "^(?!/)(?!.*\\.\\.)[A-Za-z0-9._/-]+\\.woff2$"
+    }
+  }
+}

package/scripts/auth-configure.ts

@@ -20,19 +20,27 @@ import { promisify } from "util";
 import * as readline from "readline";
 import * as path from "path";
 import * as fs from "fs";
-import { fileURLToPath } from "url";
-import { OP_ACCOUNT_DEFAULT } from "../src/shared/constants.js";
+import { getDistRoot } from "../src/shared/paths.js";
+import {
+  readSecretsConfig,
+  secretsStrategy,
+} from "../src/shared/secrets/index.js";
 import {
   readTestAccountsConfig,
   testAccountsVault,
 } from "../src/shared/auth/test-accounts.js";
 
-// Ensure op invocations hit the den-owned account even when this script is
-// run directly via `npx tsx` (not through make, which already exports OP_ACCOUNT).
-process.env.OP_ACCOUNT ||= OP_ACCOUNT_DEFAULT;
+// op uses the distribution's account (secrets.onepassword.account) or the
+// engineer's own OP_ACCOUNT; Den has none of its own.
+Object.assign(
+  process.env,
+  secretsStrategy("1password")?.capabilities.env?.(
+    readSecretsConfig(),
+    process.env,
+  ),
+);
 
 const execFileAsync = promisify(execFile);
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
 // ─── 1Password types ──────────────────────────────────────────────────────────
 
@@ -229,7 +237,7 @@ async function main() {
             if (passwordField && emailField?.value) {
               const opRef = `op://${defaultVault.name}/${defaultItem.title}/${passwordField.label}`;
               const email = emailField.value;
-              const configDir = path.resolve(__dirname, "../config/local");
+              const configDir = path.join(getDistRoot(), "config", "local");
               fs.mkdirSync(configDir, { recursive: true });
               fs.writeFileSync(
                 path.join(configDir, configFilename),
@@ -376,7 +384,7 @@ async function main() {
     // Store item ID + field label alongside opRef.
     // headless-login.ts uses the IDs (via `op item get`) which is robust against
     // special characters in vault/item names that can break `op read op://...`.
-    const configDir = path.resolve(__dirname, "../config/local");
+    const configDir = path.join(getDistRoot(), "config", "local");
     const configFile = path.join(configDir, configFilename);
     fs.mkdirSync(configDir, { recursive: true });
     fs.writeFileSync(