npm - @pasko70/pibo - Versions diffs - 1.10.1 → 1.11.1 - Mend

@pasko70/pibo 1.10.1 → 1.11.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (48) hide show

package/dist/apps/chat/static-assets.js +10 -2
package/dist/apps/chat/web-app.js +18 -2
package/dist/apps/chat/workflow-manual-trigger-runtime.js +46 -149
package/dist/apps/chat-ui/assets/{dist-BA6mhAec.js → dist-BBVpFHAq.js} +1 -1
package/dist/apps/chat-ui/assets/{dist-hU-2oAb6.js → dist-BXyVMdHv.js} +1 -1
package/dist/apps/chat-ui/assets/{dist-BPl-fzRB.js → dist-BiGfVaXN.js} +1 -1
package/dist/apps/chat-ui/assets/{dist-BpfBSMzK.js → dist-CCGKu-Wj.js} +1 -1
package/dist/apps/chat-ui/assets/{dist-uF6UXzI7.js → dist-CE0MvPLM.js} +1 -1
package/dist/apps/chat-ui/assets/{dist-Cvx5M97R.js → dist-CuGiEm5l.js} +1 -1
package/dist/apps/chat-ui/assets/{dist-BPnn9e2B.js → dist-DBnh8gXR.js} +1 -1
package/dist/apps/chat-ui/assets/{dist-r31x5Fcc.js → dist-DeOnZ-pw.js} +1 -1
package/dist/apps/chat-ui/assets/{dist-4NlLjLs7.js → dist-DnQYnLQS.js} +1 -1
package/dist/apps/chat-ui/assets/{dist-DnXWNQRm.js → dist-VT4x40uL.js} +1 -1
package/dist/apps/chat-ui/assets/{dist-3Sts0Afa.js → dist-xtnVygdr.js} +1 -1
package/dist/apps/chat-ui/assets/{index-al8DeEjA.css → index-DNeE4HrG.css} +1 -1
package/dist/apps/chat-ui/assets/{index-CaTGYBOS.js → index-vcg8JNj9.js} +69 -69
package/dist/apps/chat-ui/favicon.svg +4 -0
package/dist/apps/chat-ui/index.html +4 -2
package/dist/apps/chat-ui/sw.js +12 -1
package/dist/apps/chat-vscode-web/assets/index-Bf2JvJ9z.css +2 -0
package/dist/apps/chat-vscode-web/assets/index-DVlCO7v_.js +41 -0
package/dist/apps/chat-vscode-web/index.html +2 -2
package/dist/apps/vscode-artifacts/latest.vsix +0 -0
package/dist/apps/vscode-artifacts/pibo-vscode-ext-1.11.1.vsix +0 -0
package/dist/auth/better-auth.js +49 -1
package/dist/auth/cli.js +220 -0
package/dist/auth/machine-keys.js +258 -0
package/dist/auth/machine-session.js +123 -0
package/dist/bin/pibo.js +0 -0
package/dist/bin/rg.js +0 -0
package/dist/cli.js +6 -0
package/dist/compute/cli.js +7 -0
package/dist/compute/resource-health.js +27 -3
package/dist/config/config.js +5 -0
package/dist/core/session-router.js +17 -0
package/dist/data/schema.js +4 -0
package/dist/debug/trace-status.js +25 -0
package/dist/debug/trace.js +9 -10
package/dist/resources/cli.js +15 -0
package/dist/resources/lifecycle.js +28 -4
package/dist/resources/reaper.js +1 -0
package/dist/session-ui/terminalRows.js +10 -0
package/dist/shared/trace-event-projection.js +20 -3
package/dist/shared/trace-transcript.js +4 -0
package/dist/signals/projector.js +10 -1
package/package.json +3 -5
package/dist/apps/chat-vscode-web/assets/index-B5QK07zO.css +0 -2
package/dist/apps/chat-vscode-web/assets/index-CK4SMZuu.js +0 -41

package/dist/apps/chat-vscode-web/index.html CHANGED Viewed

@@ -5,8 +5,8 @@
 		<meta name="viewport" content="width=device-width, initial-scale=1.0" />
 		<meta name="theme-color" content="#101d22" />
 		<title>Pibo</title>
-		<script type="module" crossorigin src="/apps/chat-vscode/assets/index-CK4SMZuu.js"></script>
-		<link rel="stylesheet" crossorigin href="/apps/chat-vscode/assets/index-B5QK07zO.css">
+		<script type="module" crossorigin src="/apps/chat-vscode/assets/index-DVlCO7v_.js"></script>
+		<link rel="stylesheet" crossorigin href="/apps/chat-vscode/assets/index-Bf2JvJ9z.css">
 	</head>
 	<body>
 		<div id="root"></div>

package/dist/apps/vscode-artifacts/latest.vsix ADDED Viewed

Binary file

package/dist/apps/vscode-artifacts/pibo-vscode-ext-1.11.1.vsix ADDED Viewed

Binary file

package/dist/auth/better-auth.js CHANGED Viewed

@@ -6,6 +6,8 @@ import { getMigrations } from "better-auth/db/migration";
 import { bearer } from "better-auth/plugins";
 import { loadPiboConfig } from "../config/config.js";
 import { piboHomePath } from "../core/pibo-home.js";
+import { createMachineKeyAuthenticator } from "./machine-keys.js";
+import { createMachineSessionManager } from "./machine-session.js";
 import { createForbiddenAuthError, createUnauthenticatedError } from "./types.js";
 const SESSION_EXPIRES_IN_SECONDS = 60 * 60 * 24 * 90;
 const SESSION_UPDATE_AGE_SECONDS = 60 * 60;
@@ -64,6 +66,8 @@ export function createBetterAuthService(options = {}) {
     const googleClientSecret = requiredOption(options.googleClientSecret ?? authConfig?.googleClientSecret, "auth.googleClientSecret");
     const secret = requiredSecret(options.secret ?? authConfig?.secret);
     const allowedEmails = requiredAllowedEmails(options, authConfig?.allowedEmails);
+    const machineKeys = createMachineKeyAuthenticator(options.machineKeyStorePath ?? authConfig?.machineKeyStorePath);
+    const machineSessions = createMachineSessionManager({ secret, machineKeys });
     const database = createDatabase(options.databasePath ?? authConfig?.databasePath ?? piboHomePath("auth.sqlite"));
     const trustedOrigins = options.trustedOrigins ?? authConfig?.trustedOrigins;
     const authOptions = {
@@ -86,6 +90,12 @@ export function createBetterAuthService(options = {}) {
         plugins: [bearer()],
     };
     const auth = betterAuth(authOptions);
+    const requireAllowedMachineSession = (session) => {
+        const email = session.identity.email?.toLowerCase();
+        if (!email || !allowedEmails.has(email))
+            throw createForbiddenAuthError();
+        return session;
+    };
     return {
         name: "better-auth",
         async start() {
@@ -96,6 +106,9 @@ export function createBetterAuthService(options = {}) {
             database.close();
         },
         async getSession(headers) {
+            const machineSession = machineKeys.getSession(headers) ?? machineSessions.getSession(headers);
+            if (machineSession)
+                return requireAllowedMachineSession(machineSession);
             const session = await auth.api.getSession({ headers });
             if (!session)
                 return undefined;
@@ -123,7 +136,42 @@ export function createBetterAuthService(options = {}) {
                 throw createUnauthenticatedError();
             return session;
         },
-        handleRequest(request) {
+        async handleRequest(request) {
+            const url = new URL(request.url);
+            if (url.pathname === "/api/auth/machine-session") {
+                if (request.method === "DELETE") {
+                    return new Response(null, {
+                        status: 204,
+                        headers: { "set-cookie": machineSessions.clearHeader(), "cache-control": "no-store" },
+                    });
+                }
+                if (request.method !== "POST") {
+                    return new Response(JSON.stringify({ error: "Method not allowed" }), {
+                        status: 405,
+                        headers: { "content-type": "application/json", allow: "POST, DELETE", "cache-control": "no-store" },
+                    });
+                }
+                const loopbackHosts = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+                if (url.protocol !== "https:" && !loopbackHosts.has(url.hostname)) {
+                    return new Response(JSON.stringify({ error: "Machine session exchange requires HTTPS outside loopback" }), {
+                        status: 400,
+                        headers: { "content-type": "application/json", "cache-control": "no-store" },
+                    });
+                }
+                const authentication = machineKeys.authenticate(request.headers);
+                if (!authentication)
+                    throw createUnauthenticatedError();
+                const session = requireAllowedMachineSession(authentication.session);
+                const created = machineSessions.create({ ...authentication, session });
+                return new Response(JSON.stringify({ identity: created.session.identity, expiresAt: created.expiresAt.toISOString() }), {
+                    status: 200,
+                    headers: {
+                        "content-type": "application/json",
+                        "cache-control": "no-store",
+                        "set-cookie": created.header,
+                    },
+                });
+            }
             return auth.handler(request);
         },
     };

package/dist/auth/cli.js ADDED Viewed

@@ -0,0 +1,220 @@
+import { DatabaseSync } from "node:sqlite";
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync, } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { Command } from "commander";
+import { loadPiboConfig } from "../config/config.js";
+import { piboHomePath } from "../core/pibo-home.js";
+import { generateMachineKey, getDefaultMachineKeyStorePath, importMachineKeyRecord, listMachineKeys, parseMachineKeyRecord, revokeMachineKey, } from "./machine-keys.js";
+function printJson(value) {
+    console.log(JSON.stringify(value, null, 2));
+}
+function printAuthDiscovery() {
+    console.log(`pibo auth - manage Web authentication
+Commands:
+  machine-key  Manage revocable machine identities
+Next:
+  pibo auth machine-key
+`);
+}
+function printMachineKeyDiscovery() {
+    console.log(`pibo auth machine-key - manage machine identities
+Commands:
+  identity  Resolve one existing user from the allowed email set
+  generate  Generate local secret and hash-only record files
+  import    Import one hash-only record into the server store
+  list      List keys without hashes or secrets
+  revoke    Revoke one key by id
+Next:
+  pibo auth machine-key <command> --help
+`);
+}
+function readJsonInput(path) {
+    const text = path === "-" ? readFileSync(0, "utf8") : readFileSync(resolve(path), "utf8");
+    return JSON.parse(text);
+}
+function parseIdentity(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Identity input must be a JSON object");
+    }
+    const input = value;
+    if (typeof input.userId !== "string" || input.userId.length === 0) {
+        throw new Error("Identity input requires userId");
+    }
+    if (typeof input.email !== "string" || input.email.length === 0) {
+        throw new Error("Identity input requires email");
+    }
+    for (const field of ["name", "image"]) {
+        if (input[field] !== undefined && input[field] !== null && typeof input[field] !== "string") {
+            throw new Error(`Identity input ${field} must be a string when present`);
+        }
+    }
+    return {
+        userId: input.userId,
+        email: input.email,
+        ...(typeof input.name === "string" && input.name.length > 0 ? { name: input.name } : {}),
+        ...(typeof input.image === "string" && input.image.length > 0 ? { image: input.image } : {}),
+    };
+}
+function configuredAuthDatabasePath() {
+    return resolve(loadPiboConfig().auth?.databasePath ?? piboHomePath("auth.sqlite"));
+}
+function resolveAllowedIdentity(email) {
+    const allowedEmails = new Set((loadPiboConfig().auth?.allowedEmails ?? []).map((candidate) => candidate.trim().toLowerCase()).filter(Boolean));
+    const normalizedEmail = email?.trim().toLowerCase();
+    if (normalizedEmail && !allowedEmails.has(normalizedEmail)) {
+        throw new Error(`Email "${email}" is not present in auth.allowedEmails`);
+    }
+    const database = new DatabaseSync(configuredAuthDatabasePath(), { readOnly: true });
+    try {
+        const rows = database.prepare('SELECT id, email, name, image FROM "user"').all();
+        const matches = rows.filter((row) => typeof row.id === "string" &&
+            typeof row.email === "string" &&
+            allowedEmails.has(row.email.toLowerCase()) &&
+            (normalizedEmail === undefined || row.email.toLowerCase() === normalizedEmail));
+        if (matches.length === 0) {
+            throw new Error(normalizedEmail
+                ? `No Better Auth user exists for allowed email "${email}"`
+                : "No Better Auth user matches auth.allowedEmails");
+        }
+        if (matches.length > 1) {
+            throw new Error("Multiple Better Auth users match auth.allowedEmails; pass --email to select one");
+        }
+        const row = matches[0];
+        return {
+            userId: row.id,
+            email: row.email,
+            ...(typeof row.name === "string" && row.name.length > 0 ? { name: row.name } : {}),
+            ...(typeof row.image === "string" && row.image.length > 0 ? { image: row.image } : {}),
+        };
+    }
+    finally {
+        database.close();
+    }
+}
+function requireNewOutputPath(path, label) {
+    const resolvedPath = resolve(path);
+    if (existsSync(resolvedPath))
+        throw new Error(`${label} already exists: ${resolvedPath}`);
+    return resolvedPath;
+}
+function writePrivateNewFile(path, content) {
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    writeFileSync(path, content, { encoding: "utf8", mode: 0o600, flag: "wx" });
+}
+function parseExpiresAt(value) {
+    if (value === undefined)
+        return undefined;
+    const timestamp = Date.parse(value);
+    if (Number.isNaN(timestamp))
+        throw new Error("--expires-at must be an ISO timestamp");
+    if (timestamp <= Date.now())
+        throw new Error("--expires-at must be in the future");
+    return new Date(timestamp).toISOString();
+}
+export async function runAuthCli(argv = process.argv) {
+    if (argv.length <= 2 || argv[2] === "--help" || argv[2] === "-h") {
+        printAuthDiscovery();
+        return;
+    }
+    if (argv[2] === "machine-key" && (argv.length <= 3 || argv[3] === "--help" || argv[3] === "-h")) {
+        printMachineKeyDiscovery();
+        return;
+    }
+    const program = new Command();
+    program.name("pibo auth").description("Manage Pibo Web authentication");
+    const machineKey = program.command("machine-key").description("Manage revocable machine identities");
+    machineKey
+        .command("identity")
+        .description("Resolve an existing allowed Better Auth user")
+        .option("--email <email>", "Select one allowed Google account email when multiple users match")
+        .option("--json", "Print JSON")
+        .action((options) => {
+        const identity = resolveAllowedIdentity(options.email);
+        if (options.json)
+            printJson(identity);
+        else
+            console.log(`${identity.userId}\t${identity.email}\t${identity.name ?? ""}`);
+    });
+    machineKey
+        .command("generate")
+        .description("Generate a local raw secret and hash-only import record")
+        .requiredOption("--identity-file <path>", "Identity JSON from the identity command")
+        .requiredOption("--label <label>", "Operator label for this machine")
+        .requiredOption("--secret-output <path>", "New root-only raw-secret file")
+        .requiredOption("--record-output <path>", "New root-only hash-record file")
+        .option("--expires-at <timestamp>", "Optional future ISO expiration timestamp")
+        .action((options) => {
+        const secretOutput = requireNewOutputPath(options.secretOutput, "Secret output");
+        const recordOutput = requireNewOutputPath(options.recordOutput, "Record output");
+        if (secretOutput === recordOutput)
+            throw new Error("Secret and record output paths must differ");
+        const identity = parseIdentity(readJsonInput(options.identityFile));
+        const generated = generateMachineKey({
+            label: options.label,
+            identity,
+            expiresAt: parseExpiresAt(options.expiresAt),
+        });
+        try {
+            writePrivateNewFile(secretOutput, `${generated.token}\n`);
+            writePrivateNewFile(recordOutput, `${JSON.stringify(generated.record, null, 2)}\n`);
+        }
+        catch (error) {
+            if (existsSync(secretOutput))
+                unlinkSync(secretOutput);
+            if (existsSync(recordOutput))
+                unlinkSync(recordOutput);
+            throw error;
+        }
+        printJson({
+            id: generated.record.id,
+            label: generated.record.label,
+            email: generated.record.identity.email,
+            expiresAt: generated.record.expiresAt,
+            secretOutput,
+            recordOutput,
+        });
+    });
+    machineKey
+        .command("import")
+        .description("Import one hash-only machine-key record")
+        .requiredOption("--file <path>", "Record JSON path, or - for stdin")
+        .option("--store <path>", "Alternate machine-key store path")
+        .action((options) => {
+        const parsed = parseMachineKeyRecord(readJsonInput(options.file));
+        const existingIdentity = resolveAllowedIdentity(parsed.identity.email);
+        if (existingIdentity.userId !== parsed.identity.userId) {
+            throw new Error(`Machine identity userId does not match the Better Auth user for "${parsed.identity.email}"`);
+        }
+        const imported = importMachineKeyRecord(parsed, options.store ?? getDefaultMachineKeyStorePath());
+        printJson({ id: imported.id, label: imported.label, email: imported.identity.email, createdAt: imported.createdAt });
+    });
+    machineKey
+        .command("list")
+        .description("List machine keys without hashes or secrets")
+        .option("--store <path>", "Alternate machine-key store path")
+        .option("--json", "Print JSON")
+        .action((options) => {
+        const keys = listMachineKeys(options.store ?? getDefaultMachineKeyStorePath());
+        if (options.json) {
+            printJson(keys);
+            return;
+        }
+        for (const key of keys) {
+            console.log(`${key.id}\t${key.status}\t${key.identity.email ?? ""}\t${key.label}`);
+        }
+    });
+    machineKey
+        .command("revoke")
+        .description("Revoke one machine key")
+        .argument("<id>", "Machine-key id")
+        .option("--store <path>", "Alternate machine-key store path")
+        .action((id, options) => {
+        const record = revokeMachineKey(id, options.store ?? getDefaultMachineKeyStorePath());
+        printJson({ id: record.id, label: record.label, revokedAt: record.revokedAt });
+    });
+    await program.parseAsync(argv);
+}

package/dist/auth/machine-keys.js ADDED Viewed

@@ -0,0 +1,258 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { piboHomePath } from "../core/pibo-home.js";
+export const PIBO_MACHINE_KEY_HEADER = "x-pibo-machine-key";
+export const MACHINE_KEY_STORE_VERSION = 1;
+const MACHINE_KEY_ID_PATTERN = /^[a-f0-9]{16}$/;
+const MACHINE_KEY_HASH_PATTERN = /^[a-f0-9]{64}$/;
+const MACHINE_KEY_TOKEN_PATTERN = /^pibo_mk_([a-f0-9]{16})_([A-Za-z0-9_-]{43})$/;
+const MACHINE_KEY_LABEL_MAX_LENGTH = 120;
+export function getDefaultMachineKeyStorePath() {
+    return piboHomePath("machine-keys.json");
+}
+function hashMachineKeyToken(token) {
+    return createHash("sha256").update(token, "utf8").digest();
+}
+function parseIsoTimestamp(value, field) {
+    if (typeof value !== "string" || value.length === 0 || Number.isNaN(Date.parse(value))) {
+        throw new Error(`${field} must be an ISO timestamp`);
+    }
+    return new Date(value).toISOString();
+}
+function optionalString(value, field) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "string" || value.length === 0)
+        throw new Error(`${field} must be a non-empty string`);
+    return value;
+}
+function parseIdentity(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("identity must be an object");
+    }
+    const input = value;
+    const allowedKeys = new Set(["userId", "email", "name", "image", "provider"]);
+    for (const key of Object.keys(input)) {
+        if (!allowedKeys.has(key))
+            throw new Error(`identity contains unsupported field "${key}"`);
+    }
+    if (typeof input.userId !== "string" || input.userId.length === 0) {
+        throw new Error("identity.userId must be a non-empty string");
+    }
+    if (input.provider !== "machine-key") {
+        throw new Error('identity.provider must be "machine-key"');
+    }
+    const email = optionalString(input.email, "identity.email");
+    if (!email)
+        throw new Error("identity.email must be a non-empty string");
+    return {
+        userId: input.userId,
+        email,
+        name: optionalString(input.name, "identity.name"),
+        image: optionalString(input.image, "identity.image"),
+        provider: "machine-key",
+    };
+}
+export function parseMachineKeyRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Machine-key record must be an object");
+    }
+    const input = value;
+    const allowedKeys = new Set(["id", "label", "hash", "identity", "createdAt", "expiresAt", "revokedAt"]);
+    for (const key of Object.keys(input)) {
+        if (!allowedKeys.has(key))
+            throw new Error(`Machine-key record contains unsupported field "${key}"`);
+    }
+    if (typeof input.id !== "string" || !MACHINE_KEY_ID_PATTERN.test(input.id)) {
+        throw new Error("Machine-key record id must be 16 lowercase hexadecimal characters");
+    }
+    if (typeof input.label !== "string" ||
+        input.label.trim().length === 0 ||
+        input.label.trim().length > MACHINE_KEY_LABEL_MAX_LENGTH) {
+        throw new Error(`Machine-key record label must contain 1-${MACHINE_KEY_LABEL_MAX_LENGTH} characters`);
+    }
+    if (typeof input.hash !== "string" || !MACHINE_KEY_HASH_PATTERN.test(input.hash)) {
+        throw new Error("Machine-key record hash must be 64 lowercase hexadecimal characters");
+    }
+    const createdAt = parseIsoTimestamp(input.createdAt, "createdAt");
+    const expiresAt = input.expiresAt === undefined ? undefined : parseIsoTimestamp(input.expiresAt, "expiresAt");
+    const revokedAt = input.revokedAt === undefined ? undefined : parseIsoTimestamp(input.revokedAt, "revokedAt");
+    return {
+        id: input.id,
+        label: input.label.trim(),
+        hash: input.hash,
+        identity: parseIdentity(input.identity),
+        createdAt,
+        ...(expiresAt ? { expiresAt } : {}),
+        ...(revokedAt ? { revokedAt } : {}),
+    };
+}
+function parseMachineKeyStore(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Machine-key store must be an object");
+    }
+    const input = value;
+    if (input.version !== MACHINE_KEY_STORE_VERSION) {
+        throw new Error(`Machine-key store version must be ${MACHINE_KEY_STORE_VERSION}`);
+    }
+    if (!Array.isArray(input.keys))
+        throw new Error("Machine-key store keys must be an array");
+    const keys = input.keys.map(parseMachineKeyRecord);
+    const ids = new Set();
+    for (const key of keys) {
+        if (ids.has(key.id))
+            throw new Error(`Duplicate machine-key id "${key.id}"`);
+        ids.add(key.id);
+    }
+    return { version: MACHINE_KEY_STORE_VERSION, keys };
+}
+function assertPrivateStoreFile(path) {
+    if (process.platform === "win32")
+        return;
+    const stat = statSync(path);
+    if ((stat.mode & 0o077) !== 0) {
+        throw new Error(`Machine-key store must not be accessible by group or other users: ${path}`);
+    }
+    const currentUid = process.getuid?.();
+    if (currentUid !== undefined && stat.uid !== currentUid) {
+        throw new Error(`Machine-key store must be owned by the current user: ${path}`);
+    }
+}
+export function readMachineKeyStore(path = getDefaultMachineKeyStorePath()) {
+    const resolvedPath = resolve(path);
+    if (!existsSync(resolvedPath))
+        return { version: MACHINE_KEY_STORE_VERSION, keys: [] };
+    assertPrivateStoreFile(resolvedPath);
+    return parseMachineKeyStore(JSON.parse(readFileSync(resolvedPath, "utf8")));
+}
+function writeMachineKeyStore(store, path) {
+    const resolvedPath = resolve(path);
+    mkdirSync(dirname(resolvedPath), { recursive: true, mode: 0o700 });
+    const temporaryPath = `${resolvedPath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+    try {
+        writeFileSync(temporaryPath, `${JSON.stringify(store, null, 2)}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" });
+        renameSync(temporaryPath, resolvedPath);
+        chmodSync(resolvedPath, 0o600);
+    }
+    finally {
+        if (existsSync(temporaryPath))
+            unlinkSync(temporaryPath);
+    }
+}
+export function generateMachineKey(options) {
+    const id = randomBytes(8).toString("hex");
+    const secret = randomBytes(32).toString("base64url");
+    const token = `pibo_mk_${id}_${secret}`;
+    const now = options.now ?? new Date();
+    const expiresAt = options.expiresAt === undefined
+        ? undefined
+        : typeof options.expiresAt === "string"
+            ? parseIsoTimestamp(options.expiresAt, "expiresAt")
+            : options.expiresAt.toISOString();
+    const record = parseMachineKeyRecord({
+        id,
+        label: options.label,
+        hash: hashMachineKeyToken(token).toString("hex"),
+        identity: { ...options.identity, provider: "machine-key" },
+        createdAt: now.toISOString(),
+        ...(expiresAt ? { expiresAt } : {}),
+    });
+    return { token, record };
+}
+export function importMachineKeyRecord(recordValue, path = getDefaultMachineKeyStorePath()) {
+    const record = parseMachineKeyRecord(recordValue);
+    const store = readMachineKeyStore(path);
+    if (store.keys.some((candidate) => candidate.id === record.id)) {
+        throw new Error(`Machine-key id "${record.id}" already exists`);
+    }
+    store.keys.push(record);
+    writeMachineKeyStore(store, path);
+    return record;
+}
+function machineKeyStatus(record, now) {
+    if (record.revokedAt)
+        return "revoked";
+    if (record.expiresAt && Date.parse(record.expiresAt) <= now.getTime())
+        return "expired";
+    return "active";
+}
+export function listMachineKeys(path = getDefaultMachineKeyStorePath(), now = new Date()) {
+    return readMachineKeyStore(path).keys.map((record) => {
+        const { hash: _hash, ...listed } = record;
+        return { ...listed, status: machineKeyStatus(record, now) };
+    });
+}
+export function revokeMachineKey(id, path = getDefaultMachineKeyStorePath(), now = new Date()) {
+    if (!MACHINE_KEY_ID_PATTERN.test(id))
+        throw new Error("Machine-key id must be 16 lowercase hexadecimal characters");
+    const store = readMachineKeyStore(path);
+    const index = store.keys.findIndex((candidate) => candidate.id === id);
+    if (index < 0)
+        throw new Error(`Unknown machine-key id "${id}"`);
+    const current = store.keys[index];
+    const revoked = { ...current, revokedAt: current.revokedAt ?? now.toISOString() };
+    store.keys[index] = revoked;
+    writeMachineKeyStore(store, path);
+    return revoked;
+}
+function storeSignature(path) {
+    try {
+        const stat = statSync(path);
+        return `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeMs}`;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return "missing";
+        throw error;
+    }
+}
+export function createMachineKeyAuthenticator(path = getDefaultMachineKeyStorePath()) {
+    const resolvedPath = resolve(path);
+    let cachedSignature;
+    let keysById = new Map();
+    const refresh = () => {
+        const signature = storeSignature(resolvedPath);
+        if (signature === cachedSignature)
+            return;
+        const store = readMachineKeyStore(resolvedPath);
+        keysById = new Map(store.keys.map((record) => [record.id, record]));
+        cachedSignature = signature;
+    };
+    const sessionForRecord = (record) => ({
+        identity: { ...record.identity },
+        sessionId: `machine-key:${record.id}`,
+        ...(record.expiresAt ? { expiresAt: new Date(record.expiresAt) } : {}),
+    });
+    const getSessionById = (id) => {
+        refresh();
+        const record = keysById.get(id);
+        if (!record || machineKeyStatus(record, new Date()) !== "active")
+            return undefined;
+        return sessionForRecord(record);
+    };
+    const authenticate = (headers) => {
+        const token = headers.get(PIBO_MACHINE_KEY_HEADER)?.trim();
+        if (!token)
+            return undefined;
+        const match = MACHINE_KEY_TOKEN_PATTERN.exec(token);
+        if (!match)
+            return undefined;
+        refresh();
+        const record = keysById.get(match[1]);
+        if (!record || machineKeyStatus(record, new Date()) !== "active")
+            return undefined;
+        const expected = Buffer.from(record.hash, "hex");
+        const actual = hashMachineKeyToken(token);
+        if (expected.length !== actual.length || !timingSafeEqual(expected, actual))
+            return undefined;
+        return { id: record.id, session: sessionForRecord(record) };
+    };
+    return {
+        authenticate,
+        getSession(headers) {
+            return authenticate(headers)?.session;
+        },
+        getSessionById,
+    };
+}