@prismshadow/penguin-server 0.2.11 → 0.2.15

package/dist/{chunk-Q65VPAQS.js → chunk-5Z4UCHDB.js}

@@ -1,8 +1,18 @@
+import {
+  HttpError
+} from "./chunk-Q4ON2L6E.js";
 import {
   sessionTokenHash
-} from "./chunk-HOS3W3UP.js";
+} from "./chunk-TOOTEEM4.js";
+import {
+  __decorateElement,
+  __decoratorStart,
+  __publicField,
+  __runInitializers
+} from "./chunk-B5IP37ZQ.js";
 
 // src/auth/password.ts
+import { Component, Interface } from "@prismshadow/penguin-core/kernel";
 import { randomBytes, scrypt, timingSafeEqual } from "crypto";
 var SCRYPT_COST = 16384;
 var SCRYPT_R = 8;
@@ -29,30 +39,50 @@ async function hashPassword(password, cost = SCRYPT_COST) {
     key.toString("base64")
   ].join("$");
 }
-async function verifyPassword(password, stored) {
+async function checkPassword(password, stored) {
   const parts = stored.split("$");
-  if (parts.length !== 6 || parts[0] !== "scrypt") return false;
+  if (parts.length !== 6 || parts[0] !== "scrypt") return "unverifiable";
   const n = Number(parts[1]);
   const r = Number(parts[2]);
   const p = Number(parts[3]);
-  if (!Number.isInteger(n) || !Number.isInteger(r) || !Number.isInteger(p)) return false;
-  let salt;
-  let expected;
-  try {
-    salt = Buffer.from(parts[4], "base64");
-    expected = Buffer.from(parts[5], "base64");
-  } catch {
-    return false;
-  }
-  if (salt.length === 0 || expected.length === 0) return false;
+  if (!Number.isInteger(n) || !Number.isInteger(r) || !Number.isInteger(p)) return "unverifiable";
+  const salt = Buffer.from(parts[4], "base64");
+  const expected = Buffer.from(parts[5], "base64");
+  if (salt.length === 0 || expected.length === 0) return "unverifiable";
   let actual;
   try {
     actual = await scryptAsync(password, salt, expected.length, n, r, p);
   } catch {
-    return false;
+    return "unverifiable";
   }
-  return actual.length === expected.length && timingSafeEqual(actual, expected);
+  return timingSafeEqual(actual, expected) ? "match" : "mismatch";
+}
+async function verifyPassword(password, stored) {
+  return await checkPassword(password, stored) === "match";
+}
+async function verifyAccountPassword(password, stored, dummyHash, check = checkPassword) {
+  const outcome = stored === null ? "unverifiable" : await check(password, stored);
+  if (outcome !== "unverifiable") return outcome === "match";
+  await check(password, await dummyHash());
+  return false;
 }
+var _PasswordHasher_decorators, _init;
+_PasswordHasher_decorators = [Interface()];
+var PasswordHasher = class {
+};
+_init = __decoratorStart(null);
+PasswordHasher = __decorateElement(_init, 0, "PasswordHasher", _PasswordHasher_decorators, PasswordHasher);
+__runInitializers(_init, 1, PasswordHasher);
+var _ScryptHasher_decorators, _init2;
+_ScryptHasher_decorators = [Component()];
+var ScryptHasher = class {
+  hash(password) {
+    return hashPassword(password, SCRYPT_COST);
+  }
+};
+_init2 = __decoratorStart(null);
+ScryptHasher = __decorateElement(_init2, 0, "ScryptHasher", _ScryptHasher_decorators, ScryptHasher);
+__runInitializers(_init2, 1, ScryptHasher);
 
 // src/auth/service.ts
 import { randomBytes as randomBytes3 } from "crypto";
@@ -83,40 +113,8 @@ function tokensEqual(a, b) {
   return timingSafeEqual2(digest(a), digest(b));
 }
 
-// src/http/errors.ts
-var HttpError = class extends Error {
-  constructor(status, code, message) {
-    super(message);
-    this.status = status;
-    this.code = code;
-    this.name = "HttpError";
-  }
-  status;
-  code;
-};
-function errorBody(code, message) {
-  return { error: { code, message } };
-}
-function isMissingCredential(err) {
-  const message = err instanceof Error ? err.message : String(err);
-  return /missing credentials|api[_ ]?key/i.test(message);
-}
-function modelCredentialMissing(modelId) {
-  return new HttpError(
-    400,
-    "model_credential_missing",
-    `Model ${modelId} has no API key yet. Configure it on the Models page first.`
-  );
-}
-function handleError(err, c) {
-  if (err instanceof HttpError) {
-    return c.json(errorBody(err.code, err.message), err.status);
-  }
-  console.error(`[server] Unhandled exception: ${err.stack ?? err.message}`);
-  return c.json(errorBody("internal", "Internal server error."), 500);
-}
-
 // src/auth/service.ts
+import { Component as Component2, Use, Interface as Interface2 } from "@prismshadow/penguin-core/kernel";
 var MIN_PASSWORD_LENGTH = 8;
 var ADMIN_USER_ID = "admin";
 var LOGIN_FREE_ATTEMPTS = 5;
@@ -132,22 +130,40 @@ function toUserInfo(row) {
     userId: row.userId,
     isAdmin: row.isAdmin,
     passwordIsInitial: row.passwordIsInitial,
+    ...row.displayName !== null ? { displayName: row.displayName } : {},
+    ...row.avatar !== null ? { avatar: row.avatar } : {},
     createdAt: row.createdAt
   };
 }
+var _hasher_dec, _clock_dec, _config_dec, _provisioner_dec, _state_dec, _authSessions_dec, _users_dec, _AuthService_decorators, _init3;
+_AuthService_decorators = [Component2()], _users_dec = [Use()], _authSessions_dec = [Use()], _state_dec = [Use()], _provisioner_dec = [Use()], _config_dec = [Use()], _clock_dec = [Use()], _hasher_dec = [Use()];
 var AuthService = class {
-  constructor(deps) {
-    this.deps = deps;
-    this.now = deps.now ?? (() => /* @__PURE__ */ new Date());
-    this.hashCost = deps.passwordHashCost ?? SCRYPT_COST;
-    this.deps.authSessions.deleteExpired(this.now().toISOString());
+  constructor() {
+    __publicField(this, "users", __runInitializers(_init3, 8, this)), __runInitializers(_init3, 11, this);
+    __publicField(this, "authSessions", __runInitializers(_init3, 12, this)), __runInitializers(_init3, 15, this);
+    __publicField(this, "state", __runInitializers(_init3, 16, this)), __runInitializers(_init3, 19, this);
+    __publicField(this, "provisioner", __runInitializers(_init3, 20, this)), __runInitializers(_init3, 23, this);
+    __publicField(this, "config", __runInitializers(_init3, 24, this)), __runInitializers(_init3, 27, this);
+    __publicField(this, "clock", __runInitializers(_init3, 28, this)), __runInitializers(_init3, 31, this);
+    __publicField(this, "hasher", __runInitializers(_init3, 32, this)), __runInitializers(_init3, 35, this);
+    /** Consecutive login failures per userId (see the throttling comment on the constants). */
+    __publicField(this, "loginFailures", /* @__PURE__ */ new Map());
+    /** Cache for loginDummyHash. */
+    __publicField(this, "dummyHash", null);
   }
-  deps;
-  now;
-  hashCost;
   /** Session lifetime, for the cookie that must expire WITH the session, not before it. */
   get sessionTtlMs() {
-    return this.deps.sessionTtlMs;
+    return this.config.authSessionTtlMs;
+  }
+  get sessionRenewMs() {
+    return this.config.authSessionRenewMs;
+  }
+  /** Fixed initial password for the seeded admin; null generates a random one at seed time. */
+  get seedAdminPassword() {
+    return this.config.seedAdminPassword;
+  }
+  setup() {
+    this.authSessions.deleteExpired(this.clock.now().toISOString());
   }
   /**
    * Null once the server is claimed, so the only setup session that exists is a printed one.
@@ -156,11 +172,11 @@ var AuthService = class {
    */
   mintFirstLogin() {
     if (!this.adminPasswordIsInitial()) return null;
-    if (this.deps.state.firstLoginToken !== null && this.authenticateWithMeta(this.deps.state.firstLoginToken) === null) {
-      this.deps.state.firstLoginToken = null;
+    if (this.state.firstLoginToken !== null && this.authenticateWithMeta(this.state.firstLoginToken) === null) {
+      this.state.firstLoginToken = null;
     }
-    this.deps.state.firstLoginToken ??= this.issueSession(ADMIN_USER_ID, "setup");
-    return this.deps.state.firstLoginToken;
+    this.state.firstLoginToken ??= this.issueSession(ADMIN_USER_ID, "setup");
+    return this.state.firstLoginToken;
   }
   /**
    * For the startup notice's pinned-seed gate (index.ts): a pin usually means the operator
@@ -168,7 +184,7 @@ var AuthService = class {
    * that or the rescue link stays suppressed.
    */
   async adminPasswordIs(password) {
-    const row = this.deps.users.findById(ADMIN_USER_ID);
+    const row = this.users.findById(ADMIN_USER_ID);
     return row !== null && await verifyPassword(password, row.passwordHash);
   }
   /**
@@ -177,8 +193,8 @@ var AuthService = class {
    * the server retries on next startup.
    */
   async seedAdmin() {
-    if (this.deps.users.count() > 0) return;
-    const password = this.deps.seedAdminPassword ?? generateInitialAdminPassword();
+    if (this.users.count() > 0) return;
+    const password = this.seedAdminPassword ?? generateInitialAdminPassword();
     if (password.length < MIN_PASSWORD_LENGTH) {
       throw new Error(
         `PENGUIN_SEED_ADMIN_PASSWORD must be at least ${MIN_PASSWORD_LENGTH} characters.`
@@ -186,16 +202,18 @@ var AuthService = class {
     }
     const user = {
       userId: ADMIN_USER_ID,
-      passwordHash: await hashPassword(password, this.hashCost),
+      passwordHash: await this.hasher.hash(password),
       isAdmin: true,
       passwordIsInitial: true,
-      createdAt: this.now().toISOString()
+      displayName: null,
+      avatar: null,
+      createdAt: this.clock.now().toISOString()
     };
-    this.deps.users.insert(user);
+    this.users.insert(user);
     try {
-      await this.deps.provisionInitialProject(user, true);
+      await this.provisioner.provisionInitialProject(user, true);
     } catch (err) {
-      this.deps.users.delete(user.userId);
+      this.users.delete(user.userId);
       throw err;
     }
   }
@@ -205,16 +223,24 @@ var AuthService = class {
    * because a prefetching browser would burn it before its reader clicked.
    */
   redeemFirstLogin(given) {
-    const expected = this.deps.state.firstLoginToken;
+    const expected = this.state.firstLoginToken;
     if (expected === null || given === "" || !tokensEqual(given, expected)) return null;
     return this.authenticateWithMeta(expected) === null ? null : expected;
   }
   /** Whether the built-in admin still runs on its initial password (gates the first-login link). */
   adminPasswordIsInitial() {
-    return this.deps.users.findById(ADMIN_USER_ID)?.passwordIsInitial === true;
+    return this.users.findById(ADMIN_USER_ID)?.passwordIsInitial === true;
+  }
+  /**
+   * The hash a sign-in with no account to check is verified against (verifyAccountPassword), so
+   * it costs what a wrong password costs. Made by this server's own hasher, hence at the cost its
+   * real hashes carry, from a random password nobody holds; computed on the first such sign-in
+   * and kept.
+   */
+  async loginDummyHash() {
+    this.dummyHash ??= await this.hasher.hash(randomBytes3(18).toString("base64url"));
+    return this.dummyHash;
   }
-  /** Consecutive login failures per userId (see the throttling comment on the constants). */
-  loginFailures = /* @__PURE__ */ new Map();
   /** The wait imposed after `failures` consecutive failures (0 while within the free attempts). */
   loginDelayMs(failures) {
     const excess = failures - LOGIN_FREE_ATTEMPTS;
@@ -222,7 +248,7 @@ var AuthService = class {
     return Math.min(LOGIN_BACKOFF_START_MS * 2 ** (excess - 1), LOGIN_BACKOFF_CAP_MS);
   }
   async login(userId, password) {
-    const nowMs = this.now().getTime();
+    const nowMs = this.clock.now().getTime();
     for (const [key, entry] of this.loginFailures) {
       if (nowMs - entry.lastFailureAt > LOGIN_FAILURE_IDLE_MS) this.loginFailures.delete(key);
     }
@@ -237,26 +263,40 @@ var AuthService = class {
         );
       }
     }
-    const row = this.deps.users.findById(userId);
-    const ok = row !== null && await verifyPassword(password, row.passwordHash);
+    const row = this.users.findById(userId);
+    const ok = await verifyAccountPassword(
+      password,
+      row?.passwordHash ?? null,
+      () => this.loginDummyHash()
+    );
     if (!row || !ok) {
       this.loginFailures.set(userId, {
         failures: (failed?.failures ?? 0) + 1,
-        lastFailureAt: this.now().getTime()
+        lastFailureAt: this.clock.now().getTime()
       });
       throw new HttpError(401, "invalid_credentials", "Incorrect username or password.");
     }
     this.loginFailures.delete(userId);
-    this.deps.authSessions.deleteExpired(this.now().toISOString());
+    this.authSessions.deleteExpired(this.clock.now().toISOString());
     return { user: toUserInfo(row), token: this.issueSession(row.userId, "password") };
   }
+  /**
+   * Whether a user is an admin, by id — for a caller that has a user's NAME rather than an
+   * authenticated request: the terminal relay reads the owner out of a pty reference the
+   * runtime has already matched against the signed-in user (machines/terminal-relay.ts), and
+   * what is left to decide is whether that user may reach machines at all. Unknown users are
+   * not admins.
+   */
+  isAdmin(userId) {
+    return this.users.findById(userId)?.isAdmin === true;
+  }
   /**
    * Desktop-mode sign-in: an admin session with no password check — the claim route already
    * redeemed the shell's one-shot token, which is the credential here. Throws only on a
    * broken deployment (seeding runs before the route exists).
    */
   loginDesktop() {
-    const row = this.deps.users.findById(ADMIN_USER_ID);
+    const row = this.users.findById(ADMIN_USER_ID);
     if (!row) {
       throw new HttpError(500, "internal", "Built-in admin has not been seeded.");
     }
@@ -264,7 +304,7 @@ var AuthService = class {
   }
   /** Self password change (user settings): validates the old password first; the current session stays valid. */
   async changePassword(userId, oldPassword, newPassword) {
-    const row = this.deps.users.findById(userId);
+    const row = this.users.findById(userId);
     if (!row || !await verifyPassword(oldPassword, row.passwordHash)) {
       throw new HttpError(400, "password_mismatch", "Current password is incorrect.");
     }
@@ -282,16 +322,16 @@ var AuthService = class {
     if (newPassword.length < MIN_PASSWORD_LENGTH) {
       throw new HttpError(400, "invalid_password", "Password must be at least 8 characters.");
     }
-    this.deps.users.updatePassword(userId, await hashPassword(newPassword, this.hashCost), false);
+    this.users.updatePassword(userId, await this.hasher.hash(newPassword), false);
     this.loginFailures.delete(userId);
     if (userId === ADMIN_USER_ID) {
-      this.deps.authSessions.deleteByUserAndVia(userId, "setup");
-      this.deps.state.firstLoginToken = null;
+      this.authSessions.deleteByUserAndVia(userId, "setup");
+      this.state.firstLoginToken = null;
     }
   }
   /** Ends a session: the row is the session, so logout deletes it. Unknown token is a no-op. */
   logout(token) {
-    this.deps.authSessions.delete(sessionTokenHash(token));
+    this.authSessions.delete(sessionTokenHash(token));
   }
   /**
    * The current boot's local API token (what control-env injection hands to tool
@@ -300,7 +340,7 @@ var AuthService = class {
    * outlive the App a push replaces (auth/runtime-state.ts).
    */
   localApiToken() {
-    return this.deps.state.apiToken;
+    return this.state.apiToken;
   }
   /**
    * Validates a Bearer token against the boot's local API token (constant-time compare):
@@ -309,10 +349,10 @@ var AuthService = class {
    * null on mismatch, when no token was minted, or when the admin row is missing.
    */
   authenticateApiToken(token) {
-    const apiToken = this.deps.state.apiToken;
+    const apiToken = this.state.apiToken;
     if (apiToken === null || token.length === 0) return null;
     if (!tokensEqual(token, apiToken)) return null;
-    const user = this.deps.users.findById(ADMIN_USER_ID);
+    const user = this.users.findById(ADMIN_USER_ID);
     return user === null ? null : { user, via: "token" };
   }
   /**
@@ -323,52 +363,76 @@ var AuthService = class {
    */
   authenticateWithMeta(token) {
     const tokenHash = sessionTokenHash(token);
-    const session = this.deps.authSessions.findByTokenHash(tokenHash);
+    const session = this.authSessions.findByTokenHash(tokenHash);
     if (!session) return null;
-    const now = this.now();
+    const now = this.clock.now();
     const expiresAt = Date.parse(session.expiresAt);
     if (expiresAt <= now.getTime()) {
-      this.deps.authSessions.delete(tokenHash);
+      this.authSessions.delete(tokenHash);
       return null;
     }
-    const user = this.deps.users.findById(session.userId);
+    const user = this.users.findById(session.userId);
     if (!user) return null;
-    const renewable = expiresAt - Date.parse(session.createdAt) >= this.deps.sessionRenewMs;
+    const renewable = expiresAt - Date.parse(session.createdAt) >= this.sessionRenewMs;
     let renewed = false;
-    if (renewable && expiresAt - now.getTime() < this.deps.sessionRenewMs) {
-      this.deps.authSessions.touch(
-        tokenHash,
-        new Date(now.getTime() + this.deps.sessionTtlMs).toISOString()
-      );
+    if (renewable && expiresAt - now.getTime() < this.sessionRenewMs) {
+      this.authSessions.touch(tokenHash, new Date(now.getTime() + this.sessionTtlMs).toISOString());
       renewed = true;
     }
     const via = session.via === "desktop" ? "desktop" : session.via === "setup" ? "setup" : "password";
     return { user, via, renewed };
   }
+  /**
+   * Whether the session behind a cookie token still exists and has not expired — the same
+   * two facts {@link authenticateWithMeta} establishes, without its sliding renewal or its
+   * user lookup. A connection that outlives the request that opened it has to re-ask
+   * periodically (the SSE heartbeat does, once per beat), and asking through the renewing
+   * path would top the expiry up every time: a window nobody has touched since last week
+   * would stay signed in purely because it is still connected.
+   */
+  sessionIsLive(token) {
+    const session = this.authSessions.findByTokenHash(sessionTokenHash(token));
+    if (!session) return false;
+    return Date.parse(session.expiresAt) > this.clock.now().getTime();
+  }
   issueSession(userId, via) {
-    return this.deps.authSessions.issue({
+    return this.authSessions.issue({
       userId,
       via,
-      now: this.now(),
-      ttlMs: this.deps.sessionTtlMs
+      now: this.clock.now(),
+      ttlMs: this.sessionTtlMs
     }).token;
   }
 };
+_init3 = __decoratorStart(null);
+__decorateElement(_init3, 5, "users", _users_dec, AuthService);
+__decorateElement(_init3, 5, "authSessions", _authSessions_dec, AuthService);
+__decorateElement(_init3, 5, "state", _state_dec, AuthService);
+__decorateElement(_init3, 5, "provisioner", _provisioner_dec, AuthService);
+__decorateElement(_init3, 5, "config", _config_dec, AuthService);
+__decorateElement(_init3, 5, "clock", _clock_dec, AuthService);
+__decorateElement(_init3, 5, "hasher", _hasher_dec, AuthService);
+AuthService = __decorateElement(_init3, 0, "AuthService", _AuthService_decorators, AuthService);
+__runInitializers(_init3, 1, AuthService);
+var _InitialProjectProvisioner_decorators, _init4;
+_InitialProjectProvisioner_decorators = [Interface2()];
+var InitialProjectProvisioner = class {
+};
+_init4 = __decoratorStart(null);
+InitialProjectProvisioner = __decorateElement(_init4, 0, "InitialProjectProvisioner", _InitialProjectProvisioner_decorators, InitialProjectProvisioner);
+__runInitializers(_init4, 1, InitialProjectProvisioner);
 
 export {
-  HttpError,
-  errorBody,
-  isMissingCredential,
-  modelCredentialMissing,
-  handleError,
   mintApiToken,
   storeApiToken,
-  SCRYPT_COST,
   hashPassword,
+  PasswordHasher,
+  ScryptHasher,
   MIN_PASSWORD_LENGTH,
   ADMIN_USER_ID,
   generateInitialAdminPassword,
   toUserInfo,
-  AuthService
+  AuthService,
+  InitialProjectProvisioner
 };
-//# sourceMappingURL=chunk-Q65VPAQS.js.map
+//# sourceMappingURL=chunk-5Z4UCHDB.js.map

package/dist/chunk-5Z4UCHDB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/auth/password.ts","../src/auth/service.ts","../src/auth/api-token.ts"],"sourcesContent":["import { Component, Interface } from \"@prismshadow/penguin-core/kernel\";\n/**\n * Password hashing (slow-hash storage).\n *\n * Uses node:crypto's scrypt (built-in, no extra dependency, meets the same\n * slow-hash requirement as bcrypt/argon2). Storage format:\n * `scrypt$N$r$p$<salt b64>$<hash b64>` — parameters are stored alongside the hash,\n * so old hashes remain verifiable after future parameter tuning; comparison uses\n * timingSafeEqual to guard against timing side-channels, and a sign-in for an account\n * that does not exist costs the same derivation as a wrong password\n * (verifyAccountPassword).\n */\nimport { randomBytes, scrypt, timingSafeEqual } from \"node:crypto\";\n\n/**\n * Work factor for new hashes. `hashPassword` takes it as a defaulted argument so the server's\n * own test suite can hash at a token cost: almost every case there seeds an admin, provisions\n * users and logs them in, and one derivation at this strength costs on the order of 100ms.\n * Nothing on the production path passes the argument, and no configuration reaches it —\n * `buildAppDeps`, which carries the test override, is not part of this package's exports.\n */\nexport const SCRYPT_COST = 16384;\nconst SCRYPT_R = 8;\nconst SCRYPT_P = 1;\nconst SALT_BYTES = 16;\nconst KEY_BYTES = 64;\n\nfunction scryptAsync(\n  password: string,\n  salt: Buffer,\n  keyLen: number,\n  n: number,\n  r: number,\n  p: number,\n): Promise<Buffer> {\n  return new Promise((resolve, reject) => {\n    scrypt(password, salt, keyLen, { N: n, r, p, maxmem: 128 * 1024 * 1024 }, (err, key) => {\n      if (err) reject(err);\n      else resolve(key);\n    });\n  });\n}\n\n/**\n * Generates a password hash in `scrypt$N$r$p$salt$hash` format. `cost` is scrypt's N and\n * is recorded in the hash, so `verifyPassword` re-derives at whatever cost produced the\n * stored string.\n */\nexport async function hashPassword(password: string, cost: number = SCRYPT_COST): Promise<string> {\n  const salt = randomBytes(SALT_BYTES);\n  const key = await scryptAsync(password, salt, KEY_BYTES, cost, SCRYPT_R, SCRYPT_P);\n  return [\n    \"scrypt\",\n    String(cost),\n    String(SCRYPT_R),\n    String(SCRYPT_P),\n    salt.toString(\"base64\"),\n    key.toString(\"base64\"),\n  ].join(\"$\");\n}\n\n/**\n * What checking a password against a stored string found. `match` and `mismatch` each cost one\n * scrypt derivation; `unverifiable` — not the `scrypt$N$r$p$salt$hash` format, or parameters\n * scrypt refuses — cost none.\n */\nexport type PasswordCheck = \"match\" | \"mismatch\" | \"unverifiable\";\n\n/** Checks a password against a stored hash. Never throws. */\nexport async function checkPassword(password: string, stored: string): Promise<PasswordCheck> {\n  const parts = stored.split(\"$\");\n  if (parts.length !== 6 || parts[0] !== \"scrypt\") return \"unverifiable\";\n  const n = Number(parts[1]);\n  const r = Number(parts[2]);\n  const p = Number(parts[3]);\n  if (!Number.isInteger(n) || !Number.isInteger(r) || !Number.isInteger(p)) return \"unverifiable\";\n  const salt = Buffer.from(parts[4]!, \"base64\");\n  const expected = Buffer.from(parts[5]!, \"base64\");\n  if (salt.length === 0 || expected.length === 0) return \"unverifiable\";\n  let actual: Buffer;\n  try {\n    actual = await scryptAsync(password, salt, expected.length, n, r, p);\n  } catch {\n    return \"unverifiable\";\n  }\n  return timingSafeEqual(actual, expected) ? \"match\" : \"mismatch\";\n}\n\n/** Verifies a password; returns false if the stored string has an invalid format (never throws, so the login path can uniformly treat it as a credential error). */\nexport async function verifyPassword(password: string, stored: string): Promise<boolean> {\n  return (await checkPassword(password, stored)) === \"match\";\n}\n\n/**\n * Verifies a sign-in password for an account that may not exist, at the cost a real account's\n * check has. `stored` is the account's hash, or null when there is no such account. When there is\n * nothing to derive against — no account, an empty hash, or one `checkPassword` finds\n * unverifiable — the password is checked against `dummyHash` instead and the result is false, so\n * every call runs exactly one scrypt derivation and how long a failure takes does not tell a\n * missing username from a wrong password. `check` is a parameter so a test can count the\n * derivations.\n */\nexport async function verifyAccountPassword(\n  password: string,\n  stored: string | null,\n  dummyHash: () => Promise<string>,\n  check: (password: string, stored: string) => Promise<PasswordCheck> = checkPassword,\n): Promise<boolean> {\n  const outcome = stored === null ? \"unverifiable\" : await check(password, stored);\n  if (outcome !== \"unverifiable\") return outcome === \"match\";\n  await check(password, await dummyHash());\n  return false;\n}\n\n/** Hashes the passwords this server writes; a test stands in a cheap one. */\n@Interface()\nexport abstract class PasswordHasher {\n  abstract hash(password: string): Promise<string>;\n}\n\n/** scrypt at full strength. */\n@Component()\nexport class ScryptHasher implements PasswordHasher {\n  hash(password: string): Promise<string> {\n    return hashPassword(password, SCRYPT_COST);\n  }\n}\n","/**\n * Auth service: admin seeding / login / logout / password change / session validation.\n *\n * No open registration: an empty users table seeds `admin` with a random password hashed and\n * discarded unseen, claimed through the first-login link; every other user is created by an\n * admin. Sessions are rows in auth_sessions (cookie holds the token, the row its sha256), so\n * they outlive a restart and renew in place.\n */\nimport { randomBytes } from \"node:crypto\";\nimport { tokensEqual } from \"./api-token.js\";\nimport type { UserInfo } from \"../api/types.js\";\nimport { HttpError } from \"../http/errors.js\";\nimport type { UserRow } from \"../db/repos/users.js\";\nimport { sessionTokenHash } from \"../db/repos/auth-sessions.js\";\nimport type { SessionViaValue, AuthSessionsRepo } from \"../db/repos/auth-sessions.js\";\nimport type { AuthRuntimeState } from \"./runtime-state.js\";\nimport { verifyAccountPassword, verifyPassword } from \"./password.js\";\nimport type { PasswordHasher } from \"./password.js\";\nimport { Component, Use, Interface } from \"@prismshadow/penguin-core/kernel\";\nimport type { AuthState, Clock, Config } from \"../hmr/capabilities.js\";\nimport type { Auth, AuthSessions, Users } from \"../mechanisms/identity.js\";\n\nexport const MIN_PASSWORD_LENGTH = 8;\n\n/** Built-in admin user_id. */\nexport const ADMIN_USER_ID = \"admin\";\n\n/**\n * Login throttling, per userId. After LOGIN_FREE_ATTEMPTS failures each attempt waits an\n * exponentially growing delay (1s doubling to a 60s cap), settling at a guess per minute.\n * Kept for nonexistent userIds too, so it is not an account-existence oracle — and neither is\n * the time a failure takes: a nonexistent userId is checked against a dummy hash (loginDummyHash).\n * Deliberately NOT covered: a concurrent burst before the first failure lands, and guesses\n * spread across many accounts.\n */\nconst LOGIN_FREE_ATTEMPTS = 5;\nconst LOGIN_BACKOFF_START_MS = 1000;\nconst LOGIN_BACKOFF_CAP_MS = 60_000;\n/** Failure entries idle longer than this are swept (bounds the map; far above the cap). */\nconst LOGIN_FAILURE_IDLE_MS = 15 * 60_000;\n\n/** Characters of base64url in a seeded password — 18 random bytes, 144 bits. */\nconst SEED_PASSWORD_CHARS = 24;\n\n/**\n * Never read or typed — hashed at once and discarded — which is what lets it be long enough\n * that the login endpoint, reachable the moment the account exists, has no search space.\n */\nexport function generateInitialAdminPassword(): string {\n  return randomBytes(SEED_PASSWORD_CHARS).toString(\"base64url\").slice(0, SEED_PASSWORD_CHARS);\n}\n\n/**\n * \"desktop\" and \"setup\" may set a password without the old one (theirs is random and was never\n * shown); desktop-only routes open to \"desktop\" alone. \"token\" is the local API token's Bearer\n * header — per request, never a stored row. Anything else reads as \"password\".\n */\nexport type SessionVia = \"password\" | \"desktop\" | \"setup\" | \"token\";\n\n/** Row -> DTO. The two profile columns are omitted rather than sent as null when unset. */\nexport function toUserInfo(row: UserRow): UserInfo {\n  return {\n    userId: row.userId,\n    isAdmin: row.isAdmin,\n    passwordIsInitial: row.passwordIsInitial,\n    ...(row.displayName !== null ? { displayName: row.displayName } : {}),\n    ...(row.avatar !== null ? { avatar: row.avatar } : {}),\n    createdAt: row.createdAt,\n  };\n}\n\n@Component()\nexport class AuthService implements Auth {\n  @Use() private readonly users!: Users;\n  @Use() private readonly authSessions!: AuthSessions;\n  /**\n   * Process-scoped auth values (runtime-state.ts). Held by the RUNTIME so the link a boot\n   * printed survives a platform push; everything else about auth is rebuilt with the App.\n   */\n  @Use() private readonly state!: AuthState;\n  /** Provisions the initial Project at signup — declared at the consumer, below. */\n  @Use() private readonly provisioner!: InitialProjectProvisioner;\n  @Use() private readonly config!: Config;\n  @Use() private readonly clock!: Clock;\n  @Use() private readonly hasher!: PasswordHasher;\n  /** Session lifetime, for the cookie that must expire WITH the session, not before it. */\n  get sessionTtlMs(): number {\n    return this.config.authSessionTtlMs;\n  }\n  private get sessionRenewMs(): number {\n    return this.config.authSessionRenewMs;\n  }\n  /** Fixed initial password for the seeded admin; null generates a random one at seed time. */\n  private get seedAdminPassword(): string | null {\n    return this.config.seedAdminPassword;\n  }\n\n  setup(): void {\n    this.authSessions.deleteExpired(this.clock.now().toISOString());\n  }\n\n  /**\n   * Null once the server is claimed, so the only setup session that exists is a printed one.\n   * On demand rather than in the constructor: seedAdmin() runs after it, so \"claimed?\" has no\n   * answer there. A cached link whose row is gone is re-minted, not handed out dead.\n   */\n  mintFirstLogin(): string | null {\n    if (!this.adminPasswordIsInitial()) return null;\n    if (\n      this.state.firstLoginToken !== null &&\n      this.authenticateWithMeta(this.state.firstLoginToken) === null\n    ) {\n      this.state.firstLoginToken = null;\n    }\n    this.state.firstLoginToken ??= this.issueSession(ADMIN_USER_ID, \"setup\");\n    return this.state.firstLoginToken;\n  }\n\n  /**\n   * For the startup notice's pinned-seed gate (index.ts): a pin usually means the operator\n   * knows the password, but an offline reset makes it stale, and the gate must see through\n   * that or the rescue link stays suppressed.\n   */\n  async adminPasswordIs(password: string): Promise<boolean> {\n    const row = this.users.findById(ADMIN_USER_ID);\n    return row !== null && (await verifyPassword(password, row.passwordHash));\n  }\n\n  /**\n   * Startup seeding (idempotent): creates the built-in admin and adopts default_project when\n   * the users table is empty; if the initial Project fails, the user row is rolled back and\n   * the server retries on next startup.\n   */\n  async seedAdmin(): Promise<void> {\n    if (this.users.count() > 0) return;\n    const password = this.seedAdminPassword ?? generateInitialAdminPassword();\n    // A pinned override must meet the same policy as every other password — rejected before\n    // any insert, so a configuration typo cannot create a trivially weak privileged account.\n    if (password.length < MIN_PASSWORD_LENGTH) {\n      throw new Error(\n        `PENGUIN_SEED_ADMIN_PASSWORD must be at least ${MIN_PASSWORD_LENGTH} characters.`,\n      );\n    }\n    const user: UserRow = {\n      userId: ADMIN_USER_ID,\n      passwordHash: await this.hasher.hash(password),\n      isAdmin: true,\n      passwordIsInitial: true,\n      displayName: null,\n      avatar: null,\n      createdAt: this.clock.now().toISOString(),\n    };\n    this.users.insert(user);\n    try {\n      await this.provisioner.provisionInitialProject(user, true);\n    } catch (err) {\n      this.users.delete(user.userId);\n      throw err;\n    }\n  }\n\n  /**\n   * Compared against the printed value, not merely verified: a cookie made out of ANY valid\n   * token would let one person hand another a link into the sender's account. Not single-use,\n   * because a prefetching browser would burn it before its reader clicked.\n   */\n  redeemFirstLogin(given: string): string | null {\n    const expected = this.state.firstLoginToken;\n    if (expected === null || given === \"\" || !tokensEqual(given, expected)) return null;\n    return this.authenticateWithMeta(expected) === null ? null : expected;\n  }\n\n  /** Whether the built-in admin still runs on its initial password (gates the first-login link). */\n  adminPasswordIsInitial(): boolean {\n    return this.users.findById(ADMIN_USER_ID)?.passwordIsInitial === true;\n  }\n\n  /** Consecutive login failures per userId (see the throttling comment on the constants). */\n  private readonly loginFailures = new Map<string, { failures: number; lastFailureAt: number }>();\n\n  /** Cache for loginDummyHash. */\n  private dummyHash: string | null = null;\n\n  /**\n   * The hash a sign-in with no account to check is verified against (verifyAccountPassword), so\n   * it costs what a wrong password costs. Made by this server's own hasher, hence at the cost its\n   * real hashes carry, from a random password nobody holds; computed on the first such sign-in\n   * and kept.\n   */\n  private async loginDummyHash(): Promise<string> {\n    this.dummyHash ??= await this.hasher.hash(randomBytes(18).toString(\"base64url\"));\n    return this.dummyHash;\n  }\n\n  /** The wait imposed after `failures` consecutive failures (0 while within the free attempts). */\n  private loginDelayMs(failures: number): number {\n    const excess = failures - LOGIN_FREE_ATTEMPTS;\n    if (excess <= 0) return 0;\n    return Math.min(LOGIN_BACKOFF_START_MS * 2 ** (excess - 1), LOGIN_BACKOFF_CAP_MS);\n  }\n\n  async login(userId: string, password: string): Promise<{ user: UserInfo; token: string }> {\n    const nowMs = this.clock.now().getTime();\n    for (const [key, entry] of this.loginFailures) {\n      if (nowMs - entry.lastFailureAt > LOGIN_FAILURE_IDLE_MS) this.loginFailures.delete(key);\n    }\n    const failed = this.loginFailures.get(userId);\n    if (failed) {\n      const readyAt = failed.lastFailureAt + this.loginDelayMs(failed.failures);\n      if (nowMs < readyAt) {\n        throw new HttpError(\n          429,\n          \"too_many_attempts\",\n          `Too many failed sign-in attempts. Try again in ${Math.ceil((readyAt - nowMs) / 1000)}s.`,\n        );\n      }\n    }\n    const row = this.users.findById(userId);\n    // A missing account, or one whose hash cannot be checked, still costs one scrypt\n    // derivation, and fails with the same 401 as a wrong password.\n    const ok = await verifyAccountPassword(password, row?.passwordHash ?? null, () =>\n      this.loginDummyHash(),\n    );\n    if (!row || !ok) {\n      this.loginFailures.set(userId, {\n        failures: (failed?.failures ?? 0) + 1,\n        lastFailureAt: this.clock.now().getTime(),\n      });\n      throw new HttpError(401, \"invalid_credentials\", \"Incorrect username or password.\");\n    }\n    this.loginFailures.delete(userId);\n    this.authSessions.deleteExpired(this.clock.now().toISOString());\n    return { user: toUserInfo(row), token: this.issueSession(row.userId, \"password\") };\n  }\n\n  /**\n   * Whether a user is an admin, by id — for a caller that has a user's NAME rather than an\n   * authenticated request: the terminal relay reads the owner out of a pty reference the\n   * runtime has already matched against the signed-in user (machines/terminal-relay.ts), and\n   * what is left to decide is whether that user may reach machines at all. Unknown users are\n   * not admins.\n   */\n  isAdmin(userId: string): boolean {\n    return this.users.findById(userId)?.isAdmin === true;\n  }\n\n  /**\n   * Desktop-mode sign-in: an admin session with no password check — the claim route already\n   * redeemed the shell's one-shot token, which is the credential here. Throws only on a\n   * broken deployment (seeding runs before the route exists).\n   */\n  loginDesktop(): { user: UserInfo; token: string } {\n    const row = this.users.findById(ADMIN_USER_ID);\n    if (!row) {\n      throw new HttpError(500, \"internal\", \"Built-in admin has not been seeded.\");\n    }\n    return { user: toUserInfo(row), token: this.issueSession(row.userId, \"desktop\") };\n  }\n\n  /** Self password change (user settings): validates the old password first; the current session stays valid. */\n  async changePassword(userId: string, oldPassword: string, newPassword: string): Promise<void> {\n    const row = this.users.findById(userId);\n    if (!row || !(await verifyPassword(oldPassword, row.passwordHash))) {\n      throw new HttpError(400, \"password_mismatch\", \"Current password is incorrect.\");\n    }\n    await this.setPassword(userId, newPassword);\n  }\n\n  /** No old-password check; the me route gates which sessions may call this. */\n  async setInitialPassword(userId: string, newPassword: string): Promise<void> {\n    await this.setPassword(userId, newPassword);\n  }\n\n  /**\n   * Validation comes FIRST, so a rejected password leaves the first-login link alive: burning\n   * it on a typo would strand the claimer until a restart.\n   */\n  private async setPassword(userId: string, newPassword: string): Promise<void> {\n    if (newPassword.length < MIN_PASSWORD_LENGTH) {\n      throw new HttpError(400, \"invalid_password\", \"Password must be at least 8 characters.\");\n    }\n    this.users.updatePassword(userId, await this.hasher.hash(newPassword), false);\n    // A successful set proves at least what the successful login that resets the counter\n    // proves (the old password, or a desktop/setup session), so it resets it too. Without\n    // this, anyone spamming the login endpoint holds the backoff window open, and the sign-in\n    // that follows a first-login claim (routes/me.ts) would 429 AFTER the password committed —\n    // reporting failure for a change that took, with the claimer's setup session already gone.\n    this.loginFailures.delete(userId);\n    // EVERY first-login session for this account, not just the link this process printed: an\n    // earlier boot's link can still be live in a terminal scrollback, and a `setup` session is\n    // allowed to change the password without knowing the old one — so one left behind is an\n    // account takeover waiting to happen.\n    if (userId === ADMIN_USER_ID) {\n      this.authSessions.deleteByUserAndVia(userId, \"setup\");\n      this.state.firstLoginToken = null;\n    }\n  }\n\n  /** Ends a session: the row is the session, so logout deletes it. Unknown token is a no-op. */\n  logout(token: string): void {\n    this.authSessions.delete(sessionTokenHash(token));\n  }\n\n  /**\n   * The current boot's local API token (what control-env injection hands to tool\n   * subprocesses); null when none was minted. It lives on the runtime state, not on this\n   * service: the token was written to `<root>/api-token` by the process, so it must\n   * outlive the App a push replaces (auth/runtime-state.ts).\n   */\n  localApiToken(): string | null {\n    return this.state.apiToken;\n  }\n\n  /**\n   * Validates a Bearer token against the boot's local API token (constant-time compare):\n   * a match authenticates as the built-in admin — holding the token proves filesystem\n   * access to the data root, which is admin authority (see auth/api-token.ts). Returns\n   * null on mismatch, when no token was minted, or when the admin row is missing.\n   */\n  authenticateApiToken(token: string): { user: UserRow; via: SessionVia } | null {\n    const apiToken = this.state.apiToken;\n    if (apiToken === null || token.length === 0) return null;\n    if (!tokensEqual(token, apiToken)) return null;\n    const user = this.users.findById(ADMIN_USER_ID);\n    return user === null ? null : { user, via: \"token\" };\n  }\n\n  /**\n   * Validates the cookie token. Sliding renewal tops the expiry up IN PLACE, so the cookie\n   * value never changes and there is no second identity to revoke. Only a session whose own\n   * span reaches the renewal window slides — a one-hour minted token must expire at its hour,\n   * not stretch by being used.\n   */\n  authenticateWithMeta(token: string): { user: UserRow; via: SessionVia; renewed: boolean } | null {\n    const tokenHash = sessionTokenHash(token);\n    const session = this.authSessions.findByTokenHash(tokenHash);\n    if (!session) return null;\n    const now = this.clock.now();\n    const expiresAt = Date.parse(session.expiresAt);\n    if (expiresAt <= now.getTime()) {\n      this.authSessions.delete(tokenHash);\n      return null;\n    }\n    const user = this.users.findById(session.userId);\n    if (!user) return null;\n    const renewable = expiresAt - Date.parse(session.createdAt) >= this.sessionRenewMs;\n    let renewed = false;\n    if (renewable && expiresAt - now.getTime() < this.sessionRenewMs) {\n      this.authSessions.touch(tokenHash, new Date(now.getTime() + this.sessionTtlMs).toISOString());\n      renewed = true;\n    }\n    const via: SessionVia =\n      session.via === \"desktop\" ? \"desktop\" : session.via === \"setup\" ? \"setup\" : \"password\";\n    return { user, via, renewed };\n  }\n\n  /**\n   * Whether the session behind a cookie token still exists and has not expired — the same\n   * two facts {@link authenticateWithMeta} establishes, without its sliding renewal or its\n   * user lookup. A connection that outlives the request that opened it has to re-ask\n   * periodically (the SSE heartbeat does, once per beat), and asking through the renewing\n   * path would top the expiry up every time: a window nobody has touched since last week\n   * would stay signed in purely because it is still connected.\n   */\n  sessionIsLive(token: string): boolean {\n    const session = this.authSessions.findByTokenHash(sessionTokenHash(token));\n    if (!session) return false;\n    return Date.parse(session.expiresAt) > this.clock.now().getTime();\n  }\n\n  private issueSession(userId: string, via: SessionViaValue): string {\n    return this.authSessions.issue({\n      userId,\n      via,\n      now: this.clock.now(),\n      ttlMs: this.sessionTtlMs,\n    }).token;\n  }\n}\n\n/** What signing a new user in needs of project administration — declared at the consumer. */\n@Interface()\nexport abstract class InitialProjectProvisioner {\n  abstract provisionInitialProject(user: UserRow, isAdmin: boolean): Promise<void>;\n}\n","/**\n * Local API token (`<root>/api-token`): the machine-local credential behind\n * `Authorization: Bearer`.\n *\n * Minted fresh at every server boot (same recipe as auth-session tokens) and written to\n * the data root with owner-only permissions, so anything that can read the file can call\n * the API as the admin. That equivalence is the authorization model, not an accident:\n * local filesystem access to the data root already IS admin authority — the same rule\n * `penguin server reset-admin-password` stands on (whoever can run it owns web.db\n * anyway) — and agents driving their own harness through the CLI is the product feature\n * this token exists for (server-driven Sessions hand it to tool subprocesses as\n * PENGUIN_API_TOKEN). Rotation per boot bounds the life of any leaked copy to the\n * process that minted it.\n */\nimport { createHash, randomBytes, timingSafeEqual } from \"node:crypto\";\nimport fs from \"node:fs\";\nimport path from \"node:path\";\n\nexport function apiTokenPath(root: string): string {\n  return path.join(root, \"api-token\");\n}\n\n/** Mints a boot-scoped local API token (the auth-session token recipe). */\nexport function mintApiToken(): string {\n  return randomBytes(32).toString(\"base64url\");\n}\n\n/**\n * Persists the boot token (owner-only file, tmp + rename so a concurrent reader never\n * sees a partial write). Best-effort like the initial-password file: an exotic read-only\n * root must not stop the server — local CLI callers then fall back to\n * PENGUIN_API_TOKEN.\n */\nexport function storeApiToken(root: string, token: string): void {\n  try {\n    fs.mkdirSync(root, { recursive: true });\n    const target = apiTokenPath(root);\n    const tmp = `${target}.${process.pid}.tmp`;\n    fs.writeFileSync(tmp, `${token}\\n`, { mode: 0o600 });\n    fs.renameSync(tmp, target);\n  } catch {\n    // Best-effort: Bearer auth still works for callers holding the token some other way.\n  }\n}\n\n/** The stored token, or null when absent/unreadable/empty (shared with the CLI's file fallback). */\nexport function readApiToken(root: string): string | null {\n  try {\n    const value = fs.readFileSync(apiTokenPath(root), \"utf8\").trim();\n    return value === \"\" ? null : value;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Constant-time equality for token checks: both sides are reduced to fixed-size sha256\n * digests first, so the comparison's timing depends on neither the content nor the\n * length of an attacker-supplied value.\n */\nexport function tokensEqual(a: string, b: string): boolean {\n  const digest = (v: string): Buffer => createHash(\"sha256\").update(v).digest();\n  return timingSafeEqual(digest(a), digest(b));\n}\n"],"mappings":";;;;;;;;;;;;;;AAAA,SAAS,WAAW,iBAAiB;AAYrC,SAAS,aAAa,QAAQ,uBAAuB;AAS9C,IAAM,cAAc;AAC3B,IAAM,WAAW;AACjB,IAAM,WAAW;AACjB,IAAM,aAAa;AACnB,IAAM,YAAY;AAElB,SAAS,YACP,UACA,MACA,QACA,GACA,GACA,GACiB;AACjB,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,WAAO,UAAU,MAAM,QAAQ,EAAE,GAAG,GAAG,GAAG,GAAG,QAAQ,MAAM,OAAO,KAAK,GAAG,CAAC,KAAK,QAAQ;AACtF,UAAI,IAAK,QAAO,GAAG;AAAA,UACd,SAAQ,GAAG;AAAA,IAClB,CAAC;AAAA,EACH,CAAC;AACH;AAOA,eAAsB,aAAa,UAAkB,OAAe,aAA8B;AAChG,QAAM,OAAO,YAAY,UAAU;AACnC,QAAM,MAAM,MAAM,YAAY,UAAU,MAAM,WAAW,MAAM,UAAU,QAAQ;AACjF,SAAO;AAAA,IACL;AAAA,IACA,OAAO,IAAI;AAAA,IACX,OAAO,QAAQ;AAAA,IACf,OAAO,QAAQ;AAAA,IACf,KAAK,SAAS,QAAQ;AAAA,IACtB,IAAI,SAAS,QAAQ;AAAA,EACvB,EAAE,KAAK,GAAG;AACZ;AAUA,eAAsB,cAAc,UAAkB,QAAwC;AAC5F,QAAM,QAAQ,OAAO,MAAM,GAAG;AAC9B,MAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,SAAU,QAAO;AACxD,QAAM,IAAI,OAAO,MAAM,CAAC,CAAC;AACzB,QAAM,IAAI,OAAO,MAAM,CAAC,CAAC;AACzB,QAAM,IAAI,OAAO,MAAM,CAAC,CAAC;AACzB,MAAI,CAAC,OAAO,UAAU,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,EAAG,QAAO;AACjF,QAAM,OAAO,OAAO,KAAK,MAAM,CAAC,GAAI,QAAQ;AAC5C,QAAM,WAAW,OAAO,KAAK,MAAM,CAAC,GAAI,QAAQ;AAChD,MAAI,KAAK,WAAW,KAAK,SAAS,WAAW,EAAG,QAAO;AACvD,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,YAAY,UAAU,MAAM,SAAS,QAAQ,GAAG,GAAG,CAAC;AAAA,EACrE,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO,gBAAgB,QAAQ,QAAQ,IAAI,UAAU;AACvD;AAGA,eAAsB,eAAe,UAAkB,QAAkC;AACvF,SAAQ,MAAM,cAAc,UAAU,MAAM,MAAO;AACrD;AAWA,eAAsB,sBACpB,UACA,QACA,WACA,QAAsE,eACpD;AAClB,QAAM,UAAU,WAAW,OAAO,iBAAiB,MAAM,MAAM,UAAU,MAAM;AAC/E,MAAI,YAAY,eAAgB,QAAO,YAAY;AACnD,QAAM,MAAM,UAAU,MAAM,UAAU,CAAC;AACvC,SAAO;AACT;AAhHA;AAmHA,8BAAC,UAAU;AACJ,IAAe,iBAAf,MAA8B;AAErC;AAFO;AAAe,iBAAf,8CADP,4BACsB;AAAf,4BAAe;AApHtB,8BAAAA;AAyHA,4BAAC,UAAU;AACJ,IAAM,eAAN,MAA6C;AAAA,EAClD,KAAK,UAAmC;AACtC,WAAO,aAAa,UAAU,WAAW;AAAA,EAC3C;AACF;AAJOA,SAAA;AAAM,eAAN,kBAAAA,QAAA,mBADP,0BACa;AAAN,kBAAAA,QAAA,GAAM;;;AClHb,SAAS,eAAAC,oBAAmB;;;ACM5B,SAAS,YAAY,eAAAC,cAAa,mBAAAC,wBAAuB;AACzD,OAAO,QAAQ;AACf,OAAO,UAAU;AAEV,SAAS,aAAa,MAAsB;AACjD,SAAO,KAAK,KAAK,MAAM,WAAW;AACpC;AAGO,SAAS,eAAuB;AACrC,SAAOD,aAAY,EAAE,EAAE,SAAS,WAAW;AAC7C;AAQO,SAAS,cAAc,MAAc,OAAqB;AAC/D,MAAI;AACF,OAAG,UAAU,MAAM,EAAE,WAAW,KAAK,CAAC;AACtC,UAAM,SAAS,aAAa,IAAI;AAChC,UAAM,MAAM,GAAG,MAAM,IAAI,QAAQ,GAAG;AACpC,OAAG,cAAc,KAAK,GAAG,KAAK;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AACnD,OAAG,WAAW,KAAK,MAAM;AAAA,EAC3B,QAAQ;AAAA,EAER;AACF;AAiBO,SAAS,YAAY,GAAW,GAAoB;AACzD,QAAM,SAAS,CAAC,MAAsB,WAAW,QAAQ,EAAE,OAAO,CAAC,EAAE,OAAO;AAC5E,SAAOE,iBAAgB,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AAC7C;;;AD7CA,SAAS,aAAAC,YAAW,KAAK,aAAAC,kBAAiB;AAInC,IAAM,sBAAsB;AAG5B,IAAM,gBAAgB;AAU7B,IAAM,sBAAsB;AAC5B,IAAM,yBAAyB;AAC/B,IAAM,uBAAuB;AAE7B,IAAM,wBAAwB,KAAK;AAGnC,IAAM,sBAAsB;AAMrB,SAAS,+BAAuC;AACrD,SAAOC,aAAY,mBAAmB,EAAE,SAAS,WAAW,EAAE,MAAM,GAAG,mBAAmB;AAC5F;AAUO,SAAS,WAAW,KAAwB;AACjD,SAAO;AAAA,IACL,QAAQ,IAAI;AAAA,IACZ,SAAS,IAAI;AAAA,IACb,mBAAmB,IAAI;AAAA,IACvB,GAAI,IAAI,gBAAgB,OAAO,EAAE,aAAa,IAAI,YAAY,IAAI,CAAC;AAAA,IACnE,GAAI,IAAI,WAAW,OAAO,EAAE,QAAQ,IAAI,OAAO,IAAI,CAAC;AAAA,IACpD,WAAW,IAAI;AAAA,EACjB;AACF;AArEA,gIAAAC;AAuEA,2BAACC,WAAU,IAET,cAAC,IAAI,IACL,qBAAC,IAAI,IAKL,cAAC,IAAI,IAEL,oBAAC,IAAI,IACL,eAAC,IAAI,IACL,cAAC,IAAI,IACL,eAAC,IAAI;AAZA,IAAM,cAAN,MAAkC;AAAA,EAAlC;AACE,wBAAiB,SAAjB,kBAAAD,QAAA,6BAAAA,QAAA;AACA,wBAAiB,gBAAjB,kBAAAA,QAAA,8BAAAA,QAAA;AAKA,wBAAiB,SAAjB,kBAAAA,QAAA,8BAAAA,QAAA;AAEA,wBAAiB,eAAjB,kBAAAA,QAAA,8BAAAA,QAAA;AACA,wBAAiB,UAAjB,kBAAAA,QAAA,8BAAAA,QAAA;AACA,wBAAiB,SAAjB,kBAAAA,QAAA,8BAAAA,QAAA;AACA,wBAAiB,UAAjB,kBAAAA,QAAA,8BAAAA,QAAA;AA8FP;AAAA,wBAAiB,iBAAgB,oBAAI,IAAyD;AAG9F;AAAA,wBAAQ,aAA2B;AAAA;AAAA;AAAA,EA/FnC,IAAI,eAAuB;AACzB,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EACA,IAAY,iBAAyB;AACnC,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA;AAAA,EAEA,IAAY,oBAAmC;AAC7C,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,QAAc;AACZ,SAAK,aAAa,cAAc,KAAK,MAAM,IAAI,EAAE,YAAY,CAAC;AAAA,EAChE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,iBAAgC;AAC9B,QAAI,CAAC,KAAK,uBAAuB,EAAG,QAAO;AAC3C,QACE,KAAK,MAAM,oBAAoB,QAC/B,KAAK,qBAAqB,KAAK,MAAM,eAAe,MAAM,MAC1D;AACA,WAAK,MAAM,kBAAkB;AAAA,IAC/B;AACA,SAAK,MAAM,oBAAoB,KAAK,aAAa,eAAe,OAAO;AACvE,WAAO,KAAK,MAAM;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,gBAAgB,UAAoC;AACxD,UAAM,MAAM,KAAK,MAAM,SAAS,aAAa;AAC7C,WAAO,QAAQ,QAAS,MAAM,eAAe,UAAU,IAAI,YAAY;AAAA,EACzE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,YAA2B;AAC/B,QAAI,KAAK,MAAM,MAAM,IAAI,EAAG;AAC5B,UAAM,WAAW,KAAK,qBAAqB,6BAA6B;AAGxE,QAAI,SAAS,SAAS,qBAAqB;AACzC,YAAM,IAAI;AAAA,QACR,gDAAgD,mBAAmB;AAAA,MACrE;AAAA,IACF;AACA,UAAM,OAAgB;AAAA,MACpB,QAAQ;AAAA,MACR,cAAc,MAAM,KAAK,OAAO,KAAK,QAAQ;AAAA,MAC7C,SAAS;AAAA,MACT,mBAAmB;AAAA,MACnB,aAAa;AAAA,MACb,QAAQ;AAAA,MACR,WAAW,KAAK,MAAM,IAAI,EAAE,YAAY;AAAA,IAC1C;AACA,SAAK,MAAM,OAAO,IAAI;AACtB,QAAI;AACF,YAAM,KAAK,YAAY,wBAAwB,MAAM,IAAI;AAAA,IAC3D,SAAS,KAAK;AACZ,WAAK,MAAM,OAAO,KAAK,MAAM;AAC7B,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,iBAAiB,OAA8B;AAC7C,UAAM,WAAW,KAAK,MAAM;AAC5B,QAAI,aAAa,QAAQ,UAAU,MAAM,CAAC,YAAY,OAAO,QAAQ,EAAG,QAAO;AAC/E,WAAO,KAAK,qBAAqB,QAAQ,MAAM,OAAO,OAAO;AAAA,EAC/D;AAAA;AAAA,EAGA,yBAAkC;AAChC,WAAO,KAAK,MAAM,SAAS,aAAa,GAAG,sBAAsB;AAAA,EACnE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAc,iBAAkC;AAC9C,SAAK,cAAc,MAAM,KAAK,OAAO,KAAKD,aAAY,EAAE,EAAE,SAAS,WAAW,CAAC;AAC/E,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGQ,aAAa,UAA0B;AAC7C,UAAM,SAAS,WAAW;AAC1B,QAAI,UAAU,EAAG,QAAO;AACxB,WAAO,KAAK,IAAI,yBAAyB,MAAM,SAAS,IAAI,oBAAoB;AAAA,EAClF;AAAA,EAEA,MAAM,MAAM,QAAgB,UAA8D;AACxF,UAAM,QAAQ,KAAK,MAAM,IAAI,EAAE,QAAQ;AACvC,eAAW,CAAC,KAAK,KAAK,KAAK,KAAK,eAAe;AAC7C,UAAI,QAAQ,MAAM,gBAAgB,sBAAuB,MAAK,cAAc,OAAO,GAAG;AAAA,IACxF;AACA,UAAM,SAAS,KAAK,cAAc,IAAI,MAAM;AAC5C,QAAI,QAAQ;AACV,YAAM,UAAU,OAAO,gBAAgB,KAAK,aAAa,OAAO,QAAQ;AACxE,UAAI,QAAQ,SAAS;AACnB,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA,kDAAkD,KAAK,MAAM,UAAU,SAAS,GAAI,CAAC;AAAA,QACvF;AAAA,MACF;AAAA,IACF;AACA,UAAM,MAAM,KAAK,MAAM,SAAS,MAAM;AAGtC,UAAM,KAAK,MAAM;AAAA,MAAsB;AAAA,MAAU,KAAK,gBAAgB;AAAA,MAAM,MAC1E,KAAK,eAAe;AAAA,IACtB;AACA,QAAI,CAAC,OAAO,CAAC,IAAI;AACf,WAAK,cAAc,IAAI,QAAQ;AAAA,QAC7B,WAAW,QAAQ,YAAY,KAAK;AAAA,QACpC,eAAe,KAAK,MAAM,IAAI,EAAE,QAAQ;AAAA,MAC1C,CAAC;AACD,YAAM,IAAI,UAAU,KAAK,uBAAuB,iCAAiC;AAAA,IACnF;AACA,SAAK,cAAc,OAAO,MAAM;AAChC,SAAK,aAAa,cAAc,KAAK,MAAM,IAAI,EAAE,YAAY,CAAC;AAC9D,WAAO,EAAE,MAAM,WAAW,GAAG,GAAG,OAAO,KAAK,aAAa,IAAI,QAAQ,UAAU,EAAE;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,QAAQ,QAAyB;AAC/B,WAAO,KAAK,MAAM,SAAS,MAAM,GAAG,YAAY;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,eAAkD;AAChD,UAAM,MAAM,KAAK,MAAM,SAAS,aAAa;AAC7C,QAAI,CAAC,KAAK;AACR,YAAM,IAAI,UAAU,KAAK,YAAY,qCAAqC;AAAA,IAC5E;AACA,WAAO,EAAE,MAAM,WAAW,GAAG,GAAG,OAAO,KAAK,aAAa,IAAI,QAAQ,SAAS,EAAE;AAAA,EAClF;AAAA;AAAA,EAGA,MAAM,eAAe,QAAgB,aAAqB,aAAoC;AAC5F,UAAM,MAAM,KAAK,MAAM,SAAS,MAAM;AACtC,QAAI,CAAC,OAAO,CAAE,MAAM,eAAe,aAAa,IAAI,YAAY,GAAI;AAClE,YAAM,IAAI,UAAU,KAAK,qBAAqB,gCAAgC;AAAA,IAChF;AACA,UAAM,KAAK,YAAY,QAAQ,WAAW;AAAA,EAC5C;AAAA;AAAA,EAGA,MAAM,mBAAmB,QAAgB,aAAoC;AAC3E,UAAM,KAAK,YAAY,QAAQ,WAAW;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,YAAY,QAAgB,aAAoC;AAC5E,QAAI,YAAY,SAAS,qBAAqB;AAC5C,YAAM,IAAI,UAAU,KAAK,oBAAoB,yCAAyC;AAAA,IACxF;AACA,SAAK,MAAM,eAAe,QAAQ,MAAM,KAAK,OAAO,KAAK,WAAW,GAAG,KAAK;AAM5E,SAAK,cAAc,OAAO,MAAM;AAKhC,QAAI,WAAW,eAAe;AAC5B,WAAK,aAAa,mBAAmB,QAAQ,OAAO;AACpD,WAAK,MAAM,kBAAkB;AAAA,IAC/B;AAAA,EACF;AAAA;AAAA,EAGA,OAAO,OAAqB;AAC1B,SAAK,aAAa,OAAO,iBAAiB,KAAK,CAAC;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,gBAA+B;AAC7B,WAAO,KAAK,MAAM;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,qBAAqB,OAA0D;AAC7E,UAAM,WAAW,KAAK,MAAM;AAC5B,QAAI,aAAa,QAAQ,MAAM,WAAW,EAAG,QAAO;AACpD,QAAI,CAAC,YAAY,OAAO,QAAQ,EAAG,QAAO;AAC1C,UAAM,OAAO,KAAK,MAAM,SAAS,aAAa;AAC9C,WAAO,SAAS,OAAO,OAAO,EAAE,MAAM,KAAK,QAAQ;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,qBAAqB,OAA4E;AAC/F,UAAM,YAAY,iBAAiB,KAAK;AACxC,UAAM,UAAU,KAAK,aAAa,gBAAgB,SAAS;AAC3D,QAAI,CAAC,QAAS,QAAO;AACrB,UAAM,MAAM,KAAK,MAAM,IAAI;AAC3B,UAAM,YAAY,KAAK,MAAM,QAAQ,SAAS;AAC9C,QAAI,aAAa,IAAI,QAAQ,GAAG;AAC9B,WAAK,aAAa,OAAO,SAAS;AAClC,aAAO;AAAA,IACT;AACA,UAAM,OAAO,KAAK,MAAM,SAAS,QAAQ,MAAM;AAC/C,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,YAAY,YAAY,KAAK,MAAM,QAAQ,SAAS,KAAK,KAAK;AACpE,QAAI,UAAU;AACd,QAAI,aAAa,YAAY,IAAI,QAAQ,IAAI,KAAK,gBAAgB;AAChE,WAAK,aAAa,MAAM,WAAW,IAAI,KAAK,IAAI,QAAQ,IAAI,KAAK,YAAY,EAAE,YAAY,CAAC;AAC5F,gBAAU;AAAA,IACZ;AACA,UAAM,MACJ,QAAQ,QAAQ,YAAY,YAAY,QAAQ,QAAQ,UAAU,UAAU;AAC9E,WAAO,EAAE,MAAM,KAAK,QAAQ;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,cAAc,OAAwB;AACpC,UAAM,UAAU,KAAK,aAAa,gBAAgB,iBAAiB,KAAK,CAAC;AACzE,QAAI,CAAC,QAAS,QAAO;AACrB,WAAO,KAAK,MAAM,QAAQ,SAAS,IAAI,KAAK,MAAM,IAAI,EAAE,QAAQ;AAAA,EAClE;AAAA,EAEQ,aAAa,QAAgB,KAA8B;AACjE,WAAO,KAAK,aAAa,MAAM;AAAA,MAC7B;AAAA,MACA;AAAA,MACA,KAAK,KAAK,MAAM,IAAI;AAAA,MACpB,OAAO,KAAK;AAAA,IACd,CAAC,EAAE;AAAA,EACL;AACF;AAlTOC,SAAA;AACE,kBAAAA,QAAA,GAAiB,SAAxB,YADW;AAEJ,kBAAAA,QAAA,GAAiB,gBAAxB,mBAFW;AAOJ,kBAAAA,QAAA,GAAiB,SAAxB,YAPW;AASJ,kBAAAA,QAAA,GAAiB,eAAxB,kBATW;AAUJ,kBAAAA,QAAA,GAAiB,UAAxB,aAVW;AAWJ,kBAAAA,QAAA,GAAiB,SAAxB,YAXW;AAYJ,kBAAAA,QAAA,GAAiB,UAAxB,aAZW;AAAA,cAAN,kBAAAA,QAAA,kBADP,yBACa;AAAN,kBAAAA,QAAA,GAAM;AAxEb,2CAAAA;AA6XA,yCAACE,WAAU;AACJ,IAAe,4BAAf,MAAyC;AAEhD;AAFOF,SAAA;AAAe,4BAAf,kBAAAA,QAAA,gCADP,uCACsB;AAAf,kBAAAA,QAAA,GAAe;","names":["_init","randomBytes","randomBytes","timingSafeEqual","timingSafeEqual","Component","Interface","randomBytes","_init","Component","Interface"]}

package/dist/chunk-B5IP37ZQ.js

@@ -0,0 +1,56 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __knownSymbol = (name, symbol) => (symbol = Symbol[name]) ? symbol : /* @__PURE__ */ Symbol.for("Symbol." + name);
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __decoratorStart = (base) => [, , , __create(base?.[__knownSymbol("metadata")] ?? null)];
+var __decoratorStrings = ["class", "method", "getter", "setter", "accessor", "field", "value", "get", "set"];
+var __expectFn = (fn) => fn !== void 0 && typeof fn !== "function" ? __typeError("Function expected") : fn;
+var __decoratorContext = (kind, name, done, metadata, fns) => ({ kind: __decoratorStrings[kind], name, metadata, addInitializer: (fn) => done._ ? __typeError("Already initialized") : fns.push(__expectFn(fn || null)) });
+var __decoratorMetadata = (array, target) => __defNormalProp(target, __knownSymbol("metadata"), array[3]);
+var __runInitializers = (array, flags, self, value) => {
+  for (var i = 0, fns = array[flags >> 1], n = fns && fns.length; i < n; i++) flags & 1 ? fns[i].call(self) : value = fns[i].call(self, value);
+  return value;
+};
+var __decorateElement = (array, flags, name, decorators, target, extra) => {
+  var fn, it, done, ctx, access, k = flags & 7, s = !!(flags & 8), p = !!(flags & 16);
+  var j = k > 3 ? array.length + 1 : k ? s ? 1 : 2 : 0, key = __decoratorStrings[k + 5];
+  var initializers = k > 3 && (array[j - 1] = []), extraInitializers = array[j] || (array[j] = []);
+  var desc = k && (!p && !s && (target = target.prototype), k < 5 && (k > 3 || !p) && __getOwnPropDesc(k < 4 ? target : { get [name]() {
+    return __privateGet(this, extra);
+  }, set [name](x) {
+    return __privateSet(this, extra, x);
+  } }, name));
+  k ? p && k < 4 && __name(extra, (k > 2 ? "set " : k > 1 ? "get " : "") + name) : __name(target, name);
+  for (var i = decorators.length - 1; i >= 0; i--) {
+    ctx = __decoratorContext(k, name, done = {}, array[3], extraInitializers);
+    if (k) {
+      ctx.static = s, ctx.private = p, access = ctx.access = { has: p ? (x) => __privateIn(target, x) : (x) => name in x };
+      if (k ^ 3) access.get = p ? (x) => (k ^ 1 ? __privateGet : __privateMethod)(x, target, k ^ 4 ? extra : desc.get) : (x) => x[name];
+      if (k > 2) access.set = p ? (x, y) => __privateSet(x, target, y, k ^ 4 ? extra : desc.set) : (x, y) => x[name] = y;
+    }
+    it = (0, decorators[i])(k ? k < 4 ? p ? extra : desc[key] : k > 4 ? void 0 : { get: desc.get, set: desc.set } : target, ctx), done._ = 1;
+    if (k ^ 4 || it === void 0) __expectFn(it) && (k > 4 ? initializers.unshift(it) : k ? p ? extra = it : desc[key] = it : target = it);
+    else if (typeof it !== "object" || it === null) __typeError("Object expected");
+    else __expectFn(fn = it.get) && (desc.get = fn), __expectFn(fn = it.set) && (desc.set = fn), __expectFn(fn = it.init) && initializers.unshift(fn);
+  }
+  return k || __decoratorMetadata(array, target), desc && __defProp(target, name, desc), p ? k ^ 4 ? extra : desc : target;
+};
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateIn = (member, obj) => Object(obj) !== obj ? __typeError('Cannot use the "in" operator on this value') : member.has(obj);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
+var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method);
+
+export {
+  __decoratorStart,
+  __runInitializers,
+  __decorateElement,
+  __publicField
+};
+//# sourceMappingURL=chunk-B5IP37ZQ.js.map

package/dist/chunk-HX3WBUYX.js

@@ -0,0 +1,18 @@
+// src/secret-file.ts
+import fs from "fs";
+function writeSecretFile(filePath, contents) {
+  fs.rmSync(filePath, { force: true });
+  const flags = fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | (fs.constants.O_NOFOLLOW ?? 0);
+  const fd = fs.openSync(filePath, flags, 384);
+  try {
+    fs.fchmodSync(fd, 384);
+    fs.writeSync(fd, contents);
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+export {
+  writeSecretFile
+};
+//# sourceMappingURL=chunk-HX3WBUYX.js.map

package/dist/chunk-HX3WBUYX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/secret-file.ts"],"sourcesContent":["/**\n * Writes a bearer secret to a 0600 file, refusing to follow a symlink parked at the path:\n * someone who can write the directory but not read the file could otherwise redirect the write\n * into a file they CAN read. Hence unlink + exclusive create, and chmod on the fd rather than\n * the path. Exported as `@prismshadow/penguin-server/secret-file` so the CLI shares it.\n */\nimport fs from \"node:fs\";\n\nexport function writeSecretFile(filePath: string, contents: string): void {\n  fs.rmSync(filePath, { force: true });\n  const flags =\n    fs.constants.O_WRONLY |\n    fs.constants.O_CREAT |\n    fs.constants.O_EXCL |\n    (fs.constants.O_NOFOLLOW ?? 0);\n  const fd = fs.openSync(filePath, flags, 0o600);\n  try {\n    fs.fchmodSync(fd, 0o600);\n    fs.writeSync(fd, contents);\n  } finally {\n    fs.closeSync(fd);\n  }\n}\n"],"mappings":";AAMA,OAAO,QAAQ;AAER,SAAS,gBAAgB,UAAkB,UAAwB;AACxE,KAAG,OAAO,UAAU,EAAE,OAAO,KAAK,CAAC;AACnC,QAAM,QACJ,GAAG,UAAU,WACb,GAAG,UAAU,UACb,GAAG,UAAU,UACZ,GAAG,UAAU,cAAc;AAC9B,QAAM,KAAK,GAAG,SAAS,UAAU,OAAO,GAAK;AAC7C,MAAI;AACF,OAAG,WAAW,IAAI,GAAK;AACvB,OAAG,UAAU,IAAI,QAAQ;AAAA,EAC3B,UAAE;AACA,OAAG,UAAU,EAAE;AAAA,EACjB;AACF;","names":[]}

package/dist/chunk-JKJXQTHH.js

@@ -0,0 +1,19 @@
+// src/api/types.ts
+var MACHINE_PHASES = [
+  "build",
+  "check",
+  "install",
+  "handover",
+  "restart",
+  "connect",
+  "sync",
+  "stop",
+  "remove"
+];
+var TICKET_SLUG_PATTERN = /^[a-z]+(?:-[a-z]+)*$/;
+
+export {
+  MACHINE_PHASES,
+  TICKET_SLUG_PATTERN
+};
+//# sourceMappingURL=chunk-JKJXQTHH.js.map