@prismshadow/penguin-server 0.2.13 → 0.2.16

package/dist/chunk-G7GY7PJU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/db/repos/users.ts","../src/db/repos/auth-sessions.ts"],"sourcesContent":["/**\n * users table repo: pure SQL wrapper, no business rules.\n * user_id is the login name (a semantic id, specified at creation, immutable).\n */\nimport { Component, Use } from \"@prismshadow/penguin-core/kernel\";\nimport type { Db } from \"../../hmr/capabilities.js\";\nimport type { Users } from \"../../mechanisms/identity.js\";\n\nexport interface UserRow {\n  userId: string;\n  passwordHash: string;\n  isAdmin: boolean;\n  /** Still using the initial password (seeded / set by an admin); cleared to 0 once the user changes it. */\n  passwordIsInitial: boolean;\n  /** Nickname shown in place of the id; null = never set. */\n  displayName: string | null;\n  /** Avatar as a data URL; null = never set. */\n  avatar: string | null;\n  createdAt: string;\n}\n\nfunction mapRow(r: Record<string, unknown>): UserRow {\n  return {\n    userId: r.user_id as string,\n    passwordHash: r.password_hash as string,\n    isAdmin: (r.is_admin as number) === 1,\n    passwordIsInitial: (r.password_is_initial as number) === 1,\n    displayName: (r.display_name as string | null) ?? null,\n    avatar: (r.avatar as string | null) ?? null,\n    createdAt: r.created_at as string,\n  };\n}\n\n@Component()\nexport class UsersRepo implements Users {\n  @Use() private readonly db!: Db;\n\n  insert(row: UserRow): void {\n    this.db\n      .prepare(\n        \"INSERT INTO users (user_id, password_hash, is_admin, password_is_initial, display_name, avatar, created_at)\" +\n          \" VALUES (?, ?, ?, ?, ?, ?, ?)\",\n      )\n      .run(\n        row.userId,\n        row.passwordHash,\n        row.isAdmin ? 1 : 0,\n        row.passwordIsInitial ? 1 : 0,\n        row.displayName,\n        row.avatar,\n        row.createdAt,\n      );\n  }\n\n  findById(userId: string): UserRow | null {\n    const r = this.db.prepare(\"SELECT * FROM users WHERE user_id = ?\").get(userId);\n    return r ? mapRow(r) : null;\n  }\n\n  /** All users (for the admin user backend), ordered by creation time ascending. */\n  list(): UserRow[] {\n    const rows = this.db.prepare(\"SELECT * FROM users ORDER BY created_at ASC, user_id ASC\").all();\n    return rows.map(mapRow);\n  }\n\n  count(): number {\n    const r = this.db.prepare(\"SELECT COUNT(*) AS n FROM users\").get();\n    return (r?.n as number) ?? 0;\n  }\n\n  /** Update the password hash; isInitial marks whether the password was set by someone else (seed / admin). */\n  updatePassword(userId: string, passwordHash: string, isInitial: boolean): void {\n    this.db\n      .prepare(\"UPDATE users SET password_hash = ?, password_is_initial = ? WHERE user_id = ?\")\n      .run(passwordHash, isInitial ? 1 : 0, userId);\n  }\n\n  /**\n   * Writes the profile fields the patch names, leaving the rest as they are: an absent key\n   * keeps the stored value, `null` clears it, a string replaces it. A patch naming neither\n   * field writes nothing rather than issuing an UPDATE with an empty SET list.\n   */\n  updateProfile(\n    userId: string,\n    patch: { displayName?: string | null; avatar?: string | null },\n  ): void {\n    const sets: string[] = [];\n    const values: (string | null)[] = [];\n    if (patch.displayName !== undefined) {\n      sets.push(\"display_name = ?\");\n      values.push(patch.displayName);\n    }\n    if (patch.avatar !== undefined) {\n      sets.push(\"avatar = ?\");\n      values.push(patch.avatar);\n    }\n    if (sets.length === 0) return;\n    this.db.prepare(`UPDATE users SET ${sets.join(\", \")} WHERE user_id = ?`).run(...values, userId);\n  }\n\n  /** Used by admin user deletion and account-creation compensation paths (owned Projects must be cleaned up first). */\n  delete(userId: string): void {\n    this.db.prepare(\"DELETE FROM users WHERE user_id = ?\").run(userId);\n  }\n}\n","/**\n * auth_sessions table repo (server-side sessions backing the HttpOnly cookie). Stores only\n * sha256(token); the raw token appears only in the cookie. `issue()` is the ONE minting point,\n * so a CLI-minted row cannot drift from one the server issues itself.\n */\nimport { createHash, randomBytes } from \"node:crypto\";\nimport { Component, Use } from \"@prismshadow/penguin-core/kernel\";\nimport type { Db } from \"../../hmr/capabilities.js\";\nimport type { AuthSessions } from \"../../mechanisms/identity.js\";\n\n/** How a session was established, as stored. NULL on rows formed before the column existed. */\nexport type SessionViaValue = \"password\" | \"desktop\" | \"setup\" | \"cli\" | \"remote\";\n\nexport interface AuthSessionRow {\n  tokenHash: string;\n  userId: string;\n  createdAt: string;\n  expiresAt: string;\n  via: SessionViaValue | null;\n}\n\n/** sha256 hex of a raw session token — the only form the database ever holds. */\nexport function sessionTokenHash(token: string): string {\n  return createHash(\"sha256\").update(token).digest(\"hex\");\n}\n\n@Component()\nexport class AuthSessionsRepo implements AuthSessions {\n  @Use() private readonly db!: Db;\n\n  /**\n   * Mints a session and returns the raw token for a cookie or the terminal. `maxTtlMs` caps a\n   * caller-supplied lifetime (`--ttl-seconds`): one longer than an ordinary session would make\n   * a leaked token file outlive every other credential, sliding forever. Expired rows are\n   * swept here too, so a cron that only mints does not accumulate them.\n   */\n  issue(opts: {\n    userId: string;\n    via: SessionViaValue;\n    now: Date;\n    ttlMs: number;\n    maxTtlMs?: number;\n  }): { token: string; expiresAt: string } {\n    const ttlMs = Math.max(1_000, Math.min(opts.ttlMs, opts.maxTtlMs ?? opts.ttlMs));\n    const token = randomBytes(32).toString(\"base64url\");\n    const createdAt = opts.now.toISOString();\n    const expiresAt = new Date(opts.now.getTime() + ttlMs).toISOString();\n    this.deleteExpired(createdAt);\n    this.insert({\n      tokenHash: sessionTokenHash(token),\n      userId: opts.userId,\n      createdAt,\n      expiresAt,\n      via: opts.via,\n    });\n    return { token, expiresAt };\n  }\n\n  insert(row: AuthSessionRow): void {\n    this.db\n      .prepare(\n        \"INSERT INTO auth_sessions (token_hash, user_id, created_at, expires_at, via) VALUES (?, ?, ?, ?, ?)\",\n      )\n      .run(row.tokenHash, row.userId, row.createdAt, row.expiresAt, row.via);\n  }\n\n  findByTokenHash(tokenHash: string): AuthSessionRow | null {\n    const r = this.db.prepare(\"SELECT * FROM auth_sessions WHERE token_hash = ?\").get(tokenHash);\n    if (!r) return null;\n    return {\n      tokenHash: r.token_hash as string,\n      userId: r.user_id as string,\n      createdAt: r.created_at as string,\n      expiresAt: r.expires_at as string,\n      via: (r.via as SessionViaValue | null) ?? null,\n    };\n  }\n\n  /** Sliding renewal: update the expiration time. */\n  touch(tokenHash: string, expiresAt: string): void {\n    this.db\n      .prepare(\"UPDATE auth_sessions SET expires_at = ? WHERE token_hash = ?\")\n      .run(expiresAt, tokenHash);\n  }\n\n  delete(tokenHash: string): void {\n    this.db.prepare(\"DELETE FROM auth_sessions WHERE token_hash = ?\").run(tokenHash);\n  }\n\n  /** Opportunistically clean up expired sessions (called during login/validation). */\n  deleteExpired(nowIso: string): void {\n    this.db.prepare(\"DELETE FROM auth_sessions WHERE expires_at < ?\").run(nowIso);\n  }\n\n  /** Clear all sessions for a user (forces re-login after an admin resets the password). */\n  deleteByUser(userId: string): void {\n    this.db.prepare(\"DELETE FROM auth_sessions WHERE user_id = ?\").run(userId);\n  }\n\n  /**\n   * Clear a user's sessions of one kind. Used to end EVERY first-login session when a password\n   * is set: an earlier boot's link may still be live in someone's scrollback, and a `setup`\n   * session may change the password without knowing the old one.\n   */\n  deleteByUserAndVia(userId: string, via: SessionViaValue): void {\n    this.db.prepare(\"DELETE FROM auth_sessions WHERE user_id = ? AND via = ?\").run(userId, via);\n  }\n}\n"],"mappings":";;;;;;;;AAIA,SAAS,WAAW,WAAW;AAiB/B,SAAS,OAAO,GAAqC;AACnD,SAAO;AAAA,IACL,QAAQ,EAAE;AAAA,IACV,cAAc,EAAE;AAAA,IAChB,SAAU,EAAE,aAAwB;AAAA,IACpC,mBAAoB,EAAE,wBAAmC;AAAA,IACzD,aAAc,EAAE,gBAAkC;AAAA,IAClD,QAAS,EAAE,UAA4B;AAAA,IACvC,WAAW,EAAE;AAAA,EACf;AACF;AA/BA;AAiCA,yBAAC,UAAU,IAET,WAAC,IAAI;AADA,IAAM,YAAN,MAAiC;AAAA,EAAjC;AACE,wBAAiB,MAAjB;AAAA;AAAA,EAEP,OAAO,KAAoB;AACzB,SAAK,GACF;AAAA,MACC;AAAA,IAEF,EACC;AAAA,MACC,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI,UAAU,IAAI;AAAA,MAClB,IAAI,oBAAoB,IAAI;AAAA,MAC5B,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,IACN;AAAA,EACJ;AAAA,EAEA,SAAS,QAAgC;AACvC,UAAM,IAAI,KAAK,GAAG,QAAQ,uCAAuC,EAAE,IAAI,MAAM;AAC7E,WAAO,IAAI,OAAO,CAAC,IAAI;AAAA,EACzB;AAAA;AAAA,EAGA,OAAkB;AAChB,UAAM,OAAO,KAAK,GAAG,QAAQ,0DAA0D,EAAE,IAAI;AAC7F,WAAO,KAAK,IAAI,MAAM;AAAA,EACxB;AAAA,EAEA,QAAgB;AACd,UAAM,IAAI,KAAK,GAAG,QAAQ,iCAAiC,EAAE,IAAI;AACjE,WAAQ,GAAG,KAAgB;AAAA,EAC7B;AAAA;AAAA,EAGA,eAAe,QAAgB,cAAsB,WAA0B;AAC7E,SAAK,GACF,QAAQ,+EAA+E,EACvF,IAAI,cAAc,YAAY,IAAI,GAAG,MAAM;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,cACE,QACA,OACM;AACN,UAAM,OAAiB,CAAC;AACxB,UAAM,SAA4B,CAAC;AACnC,QAAI,MAAM,gBAAgB,QAAW;AACnC,WAAK,KAAK,kBAAkB;AAC5B,aAAO,KAAK,MAAM,WAAW;AAAA,IAC/B;AACA,QAAI,MAAM,WAAW,QAAW;AAC9B,WAAK,KAAK,YAAY;AACtB,aAAO,KAAK,MAAM,MAAM;AAAA,IAC1B;AACA,QAAI,KAAK,WAAW,EAAG;AACvB,SAAK,GAAG,QAAQ,oBAAoB,KAAK,KAAK,IAAI,CAAC,oBAAoB,EAAE,IAAI,GAAG,QAAQ,MAAM;AAAA,EAChG;AAAA;AAAA,EAGA,OAAO,QAAsB;AAC3B,SAAK,GAAG,QAAQ,qCAAqC,EAAE,IAAI,MAAM;AAAA,EACnE;AACF;AAtEO;AACE,4BAAiB,MAAxB,SADW;AAAA,YAAN,yCADP,uBACa;AAAN,4BAAM;;;AC7Bb,SAAS,YAAY,mBAAmB;AACxC,SAAS,aAAAA,YAAW,OAAAC,YAAW;AAgBxB,SAAS,iBAAiB,OAAuB;AACtD,SAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACxD;AAxBA,IAAAC,UAAA,8BAAAC;AA0BA,gCAACC,WAAU,IAETF,WAAA,CAACG,KAAI;AADA,IAAM,mBAAN,MAA+C;AAAA,EAA/C;AACE,wBAAiB,MAAjB,kBAAAF,QAAA,6BAAAA,QAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQP,MAAM,MAMmC;AACvC,UAAM,QAAQ,KAAK,IAAI,KAAO,KAAK,IAAI,KAAK,OAAO,KAAK,YAAY,KAAK,KAAK,CAAC;AAC/E,UAAM,QAAQ,YAAY,EAAE,EAAE,SAAS,WAAW;AAClD,UAAM,YAAY,KAAK,IAAI,YAAY;AACvC,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,QAAQ,IAAI,KAAK,EAAE,YAAY;AACnE,SAAK,cAAc,SAAS;AAC5B,SAAK,OAAO;AAAA,MACV,WAAW,iBAAiB,KAAK;AAAA,MACjC,QAAQ,KAAK;AAAA,MACb;AAAA,MACA;AAAA,MACA,KAAK,KAAK;AAAA,IACZ,CAAC;AACD,WAAO,EAAE,OAAO,UAAU;AAAA,EAC5B;AAAA,EAEA,OAAO,KAA2B;AAChC,SAAK,GACF;AAAA,MACC;AAAA,IACF,EACC,IAAI,IAAI,WAAW,IAAI,QAAQ,IAAI,WAAW,IAAI,WAAW,IAAI,GAAG;AAAA,EACzE;AAAA,EAEA,gBAAgB,WAA0C;AACxD,UAAM,IAAI,KAAK,GAAG,QAAQ,kDAAkD,EAAE,IAAI,SAAS;AAC3F,QAAI,CAAC,EAAG,QAAO;AACf,WAAO;AAAA,MACL,WAAW,EAAE;AAAA,MACb,QAAQ,EAAE;AAAA,MACV,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,MACb,KAAM,EAAE,OAAkC;AAAA,IAC5C;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,WAAmB,WAAyB;AAChD,SAAK,GACF,QAAQ,8DAA8D,EACtE,IAAI,WAAW,SAAS;AAAA,EAC7B;AAAA,EAEA,OAAO,WAAyB;AAC9B,SAAK,GAAG,QAAQ,gDAAgD,EAAE,IAAI,SAAS;AAAA,EACjF;AAAA;AAAA,EAGA,cAAc,QAAsB;AAClC,SAAK,GAAG,QAAQ,gDAAgD,EAAE,IAAI,MAAM;AAAA,EAC9E;AAAA;AAAA,EAGA,aAAa,QAAsB;AACjC,SAAK,GAAG,QAAQ,6CAA6C,EAAE,IAAI,MAAM;AAAA,EAC3E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,mBAAmB,QAAgB,KAA4B;AAC7D,SAAK,GAAG,QAAQ,yDAAyD,EAAE,IAAI,QAAQ,GAAG;AAAA,EAC5F;AACF;AAhFOA,SAAA;AACE,kBAAAA,QAAA,GAAiB,MAAxBD,UADW;AAAA,mBAAN,kBAAAC,QAAA,uBADP,8BACa;AAAN,kBAAAA,QAAA,GAAM;","names":["Component","Use","_db_dec","_init","Component","Use"]}

package/dist/chunk-HX3WBUYX.js

@@ -0,0 +1,18 @@
+// src/secret-file.ts
+import fs from "fs";
+function writeSecretFile(filePath, contents) {
+  fs.rmSync(filePath, { force: true });
+  const flags = fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | (fs.constants.O_NOFOLLOW ?? 0);
+  const fd = fs.openSync(filePath, flags, 384);
+  try {
+    fs.fchmodSync(fd, 384);
+    fs.writeSync(fd, contents);
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+export {
+  writeSecretFile
+};
+//# sourceMappingURL=chunk-HX3WBUYX.js.map

package/dist/chunk-HX3WBUYX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/secret-file.ts"],"sourcesContent":["/**\n * Writes a bearer secret to a 0600 file, refusing to follow a symlink parked at the path:\n * someone who can write the directory but not read the file could otherwise redirect the write\n * into a file they CAN read. Hence unlink + exclusive create, and chmod on the fd rather than\n * the path. Exported as `@prismshadow/penguin-server/secret-file` so the CLI shares it.\n */\nimport fs from \"node:fs\";\n\nexport function writeSecretFile(filePath: string, contents: string): void {\n  fs.rmSync(filePath, { force: true });\n  const flags =\n    fs.constants.O_WRONLY |\n    fs.constants.O_CREAT |\n    fs.constants.O_EXCL |\n    (fs.constants.O_NOFOLLOW ?? 0);\n  const fd = fs.openSync(filePath, flags, 0o600);\n  try {\n    fs.fchmodSync(fd, 0o600);\n    fs.writeSync(fd, contents);\n  } finally {\n    fs.closeSync(fd);\n  }\n}\n"],"mappings":";AAMA,OAAO,QAAQ;AAER,SAAS,gBAAgB,UAAkB,UAAwB;AACxE,KAAG,OAAO,UAAU,EAAE,OAAO,KAAK,CAAC;AACnC,QAAM,QACJ,GAAG,UAAU,WACb,GAAG,UAAU,UACb,GAAG,UAAU,UACZ,GAAG,UAAU,cAAc;AAC9B,QAAM,KAAK,GAAG,SAAS,UAAU,OAAO,GAAK;AAC7C,MAAI;AACF,OAAG,WAAW,IAAI,GAAK;AACvB,OAAG,UAAU,IAAI,QAAQ;AAAA,EAC3B,UAAE;AACA,OAAG,UAAU,EAAE;AAAA,EACjB;AACF;","names":[]}

package/dist/chunk-QFV3ERQO.js

@@ -0,0 +1,20 @@
+import {
+  readHarnessInfo,
+  readManifest
+} from "./chunk-LPPVGHYD.js";
+
+// src/version-report.ts
+import { buildInfo } from "@prismshadow/penguin-core";
+async function versionReport(root) {
+  const [harness, manifest] = await Promise.all([readHarnessInfo(root), readManifest(root)]);
+  const dir = manifest?.assets?.dir;
+  return {
+    ...buildInfo(),
+    harness: harness === null ? null : { ...harness, assets: typeof dir === "string" && dir.length > 0 ? dir : null }
+  };
+}
+
+export {
+  versionReport
+};
+//# sourceMappingURL=chunk-QFV3ERQO.js.map

package/dist/chunk-QFV3ERQO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/version-report.ts"],"sourcesContent":["/**\n * The one assembler behind `penguin version --json` and GET /api/version.\n *\n * The report has two halves that no single layer can produce. Core knows the artifact this\n * process is executing and nothing about data roots; the HMR store knows what harness was\n * pushed to a root and nothing about the process reading it. Joining them here — rather\n * than in each caller — is what makes \"the CLI and the API report the same thing\" a\n * structural fact instead of two spreads that have to be kept in step.\n *\n * It lives in the server package because that is where the harness.json format is owned\n * (see ./hmr/manifest.ts), and is exported as its own entry point so the CLI can reach it\n * without pulling in a server: the module graph here is core plus a `node:fs` read.\n */\nimport { buildInfo } from \"@prismshadow/penguin-core\";\nimport type { VersionReport } from \"@prismshadow/penguin-core\";\nimport { readHarnessInfo, readManifest } from \"./hmr/manifest.js\";\n\n/**\n * The running build's identity plus the harness committed to `root`'s HMR store.\n *\n * Never throws: an unreadable or malformed store reports `harness: null`, which is also\n * what a root with nothing ever pushed to it reports. Version reporting degrades to fewer\n * facts, never to a failure.\n *\n * `harness.assets` is read here rather than by the mechanism's readHarnessInfo, which the\n * runtime layer owns: the report adds the pointer, the reader stays as it is.\n */\nexport async function versionReport(root: string): Promise<VersionReport> {\n  const [harness, manifest] = await Promise.all([readHarnessInfo(root), readManifest(root)]);\n  const dir = manifest?.assets?.dir;\n  return {\n    ...buildInfo(),\n    harness:\n      harness === null\n        ? null\n        : { ...harness, assets: typeof dir === \"string\" && dir.length > 0 ? dir : null },\n  };\n}\n"],"mappings":";;;;;;AAaA,SAAS,iBAAiB;AAc1B,eAAsB,cAAc,MAAsC;AACxE,QAAM,CAAC,SAAS,QAAQ,IAAI,MAAM,QAAQ,IAAI,CAAC,gBAAgB,IAAI,GAAG,aAAa,IAAI,CAAC,CAAC;AACzF,QAAM,MAAM,UAAU,QAAQ;AAC9B,SAAO;AAAA,IACL,GAAG,UAAU;AAAA,IACb,SACE,YAAY,OACR,OACA,EAAE,GAAG,SAAS,QAAQ,OAAO,QAAQ,YAAY,IAAI,SAAS,IAAI,MAAM,KAAK;AAAA,EACrF;AACF;","names":[]}

package/dist/chunk-W7JNIJ25.js

@@ -0,0 +1,19 @@
+// src/api/types.ts
+var MACHINE_PHASES = [
+  "build",
+  "check",
+  "install",
+  "handover",
+  "restart",
+  "connect",
+  "sync",
+  "stop",
+  "remove"
+];
+var TICKET_SLUG_PATTERN = /^[a-z]+(?:-[a-z]+)*$/;
+
+export {
+  MACHINE_PHASES,
+  TICKET_SLUG_PATTERN
+};
+//# sourceMappingURL=chunk-W7JNIJ25.js.map