@prismshadow/penguin-server 0.2.2 → 0.2.3

package/dist/chunk-3QINBW3W.js

@@ -0,0 +1,565 @@
+// src/db/database.ts
+import { mkdirSync } from "fs";
+import path from "path";
+
+// src/db/schema.ts
+var SCHEMA_SQL = `
+CREATE TABLE IF NOT EXISTS users (
+  user_id             TEXT PRIMARY KEY,            -- semantic id doubles as login name: ^[a-z][a-z0-9_-]{1,31}$
+  password_hash       TEXT NOT NULL,               -- scrypt$N$r$p$salt$hash(base64)
+  is_admin            INTEGER NOT NULL DEFAULT 0,  -- 1 for the built-in admin (seeded at startup)
+  password_is_initial INTEGER NOT NULL DEFAULT 0,  -- 1=initial password (seeded/admin-set); cleared once the user changes it
+  created_at          TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS auth_sessions (
+  token_hash TEXT PRIMARY KEY,               -- sha256(token) hex; the cookie stores only the raw token
+  user_id    TEXT NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,                  -- 7-day sliding renewal (topped up when <6 days remain)
+  via        TEXT                            -- 'password' | 'desktop'; NULL = legacy row (password)
+);
+CREATE TABLE IF NOT EXISTS projects (
+  project_id    TEXT PRIMARY KEY,            -- directory name doubles as id; display name lives in project_config.toml
+  owner_user_id TEXT NOT NULL REFERENCES users(user_id),
+  created_at    TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS project_members (  -- member grants only; owners are not stored here
+  project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+  user_id    TEXT NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,
+  created_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, user_id)
+);
+CREATE TABLE IF NOT EXISTS agents (           -- index only; name/description live in system_config.yaml
+  project_id TEXT NOT NULL,
+  agent_id   TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, agent_id)
+);
+CREATE TABLE IF NOT EXISTS sessions (
+  session_id    TEXT PRIMARY KEY,
+  project_id    TEXT NOT NULL,
+  agent_id      TEXT NOT NULL,
+  provider      TEXT NOT NULL,                     -- provider group of the session model (paired with model_id as a model reference)
+  model_id      TEXT NOT NULL,                     -- upstream model id (sent to AgentHub as-is; never concatenate <provider>/<id>)
+  workspace     TEXT NOT NULL,
+  approval_mode TEXT NOT NULL DEFAULT 'allow-all',   -- allow-all|deny-all|read-only|always-ask
+  thinking_level TEXT,                               -- level pinned for THIS session (none|low|medium|high|xhigh|max); NULL=not pinned, runs follow the Agent config
+  title         TEXT,                                -- auto-generated by the model after the first exchange; NULL=not yet (frontend shows "New chat")
+  archived_at   TEXT,                                -- archive time; NULL=not archived (shown by default; archived ones move under "Archived")
+  client        TEXT,                                -- creating client: 'web' (created via the Web App) | 'cli' (adopted from a CLI Trace); NULL = legacy row, treated as web
+  has_trace     INTEGER NOT NULL DEFAULT 0,          -- cache: a Trace record exists (set at task start / adoption / subagent registration; lazily backfilled by list hydration)
+  fork_count    INTEGER NOT NULL DEFAULT 0,          -- monotonically allocated child-fork number for this source Session; never decremented when a fork is deleted
+  last_active_at TEXT,                               -- last activity this server drove for the session (ISO; stamped once when a run starts and once when it ends, initialized to created_at); monotonic, never moves backwards; NULL only before openDatabase's one-time backfill
+  created_at    TEXT NOT NULL
+);                                            -- the schedule/subagent SOURCE is NOT stored: session_meta in the Trace is the single source of truth (see runtime/session-sources.ts); "client" is a different, DB-only axis (who created the row)
+CREATE INDEX IF NOT EXISTS idx_sessions_agent_created ON sessions(project_id, agent_id, created_at DESC);
+CREATE TABLE IF NOT EXISTS usage_records (
+  id                INTEGER PRIMARY KEY AUTOINCREMENT,
+  ts                TEXT NOT NULL,
+  date              TEXT NOT NULL,            -- local date yyyy-mm-dd (aggregation key; same convention as Trace date directories)
+  project_id        TEXT NOT NULL,
+  agent_id          TEXT NOT NULL,
+  session_id        TEXT NOT NULL,            -- top-level Session (child-session usage counts toward its main Session)
+  origin_session_id TEXT,                     -- immediate source child Session (last of the origin chain); NULL=main session
+  provider          TEXT NOT NULL,            -- provider group: paired with model_id as the attribution key; always GROUP BY provider, model_id
+  model_id          TEXT NOT NULL,            -- upstream model id (paired with provider; same model_id across providers aggregates separately)
+  cache_read        INTEGER NOT NULL,
+  cache_write       INTEGER NOT NULL,
+  output            INTEGER NOT NULL,
+  total             INTEGER NOT NULL,         -- from token_usage.request (one row per Request)
+  status            TEXT NOT NULL DEFAULT 'completed'  -- request outcome: completed=success (with tokens); others=failure (0 tokens, for success rate)
+);                                            -- cost is not stored: computed at query time from current pricing
+CREATE INDEX IF NOT EXISTS idx_usage_project_date ON usage_records(project_id, date);
+CREATE INDEX IF NOT EXISTS idx_usage_session_ts ON usage_records(session_id, ts);  -- (session_id) alone was idx_usage_session (dropped on open): ts makes the last_active_at backfill's MAX(ts) a covering index scan instead of a random row lookup per usage record
+CREATE TABLE IF NOT EXISTS error_records (     -- server-side error capture (the Costs page's "Errors" tab)
+  id         INTEGER PRIMARY KEY AUTOINCREMENT,
+  ts         TEXT NOT NULL,
+  date       TEXT NOT NULL,            -- local date yyyy-mm-dd (same convention as usage_records)
+  project_id TEXT,                     -- nullable: sign-in/registration and process-level errors have no Project context
+  agent_id   TEXT,
+  session_id TEXT,
+  source     TEXT NOT NULL,            -- http | session | usage | title | subagent | process | llm | environment | compaction | schedule
+  kind       TEXT NOT NULL,            -- expected (HttpError, business 4xx) | unexpected (500/runtime)
+  code       TEXT NOT NULL,            -- HttpError.code / internal / session_run_failed / ...
+  status     INTEGER,                  -- HTTP status code; NULL for non-HTTP sources
+  message    TEXT NOT NULL             -- truncated to 500 chars (no stack stored: stacks go to logs only)
+);
+CREATE INDEX IF NOT EXISTS idx_error_project_date ON error_records(project_id, date);
+CREATE TABLE IF NOT EXISTS schedule_state (    -- schedule runtime state (files are declarative intent; the system never writes back)
+  project_id      TEXT NOT NULL,
+  agent_id        TEXT NOT NULL,
+  name            TEXT NOT NULL,               -- file name (without .toml) doubles as the identifier
+  creator_user_id TEXT,                        -- creator (recorded on API create; hand-edited file reconciliation falls back to the Project owner)
+  start_at_ms     INTEGER NOT NULL,            -- defines identity: a start_at change counts as a new task instance, resetting fire state
+  def_hash        TEXT NOT NULL,               -- file content fingerprint: any change clears the invalid flag (the file takes effect again after edits)
+  last_slot_ms    INTEGER,                     -- latest due slot already consumed (advances on fire or skip; no re-fire across restarts)
+  last_fired_at   TEXT,                        -- last actual fire time (for display)
+  fired_once      INTEGER NOT NULL DEFAULT 0,  -- one-shot task has fired
+  missed          INTEGER NOT NULL DEFAULT 0,  -- one-shot task was missed (flagged by startup/registration reconciliation; not backfilled)
+  invalid_reason  TEXT,                        -- invalidation reason (e.g. the bound Session was deleted); NULL=healthy
+  PRIMARY KEY (project_id, agent_id, name)
+);
+CREATE TABLE IF NOT EXISTS goal_state (        -- goal-mode runtime state (GOAL.yaml on disk is the model-facing protocol; this row is what the UI reads)
+  id          INTEGER PRIMARY KEY AUTOINCREMENT,  -- one row per goal run; a Session may run goals repeatedly, latest row wins for display
+  session_id  TEXT NOT NULL,
+  project_id  TEXT NOT NULL,
+  agent_id    TEXT NOT NULL,
+  objective   TEXT NOT NULL,
+  status      TEXT NOT NULL,               -- active | complete | blocked | budget_limited | aborted (aborted is server-side only; on-disk status stays active)
+  budget      INTEGER NOT NULL,            -- token budget; -1 = unlimited
+  used        INTEGER NOT NULL DEFAULT 0,  -- uncached input + output, refreshed per round (mirrors the runner's accounting)
+  rounds      INTEGER NOT NULL DEFAULT 0,
+  created_at  TEXT NOT NULL,
+  updated_at  TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_goal_session ON goal_state(session_id);
+CREATE TABLE IF NOT EXISTS ui_prefs (
+  user_id    TEXT PRIMARY KEY REFERENCES users(user_id) ON DELETE CASCADE,
+  prefs_json TEXT NOT NULL                    -- {theme?, lastProjectId?, ...} free-form JSON
+);
+CREATE TABLE IF NOT EXISTS server_settings (   -- admin-level server-global settings (GET/PUT /api/admin/settings)
+  key   TEXT PRIMARY KEY,                     -- setting name, e.g. 'proxy_for_app'
+  value TEXT NOT NULL                         -- JSON-encoded value; an absent row means the setting's built-in default
+);
+CREATE TABLE IF NOT EXISTS trace_files (       -- DERIVED CACHE of the on-disk Trace tree (services/trace-index.ts): the directories stay the single source of truth, every row is rebuildable from disk, and a row is never authority for absence \u2014 consumers reconcile + retry on a miss, so a stale index costs one extra scan, never a false 404
+  project_id TEXT NOT NULL,
+  agent_id   TEXT NOT NULL,
+  session_id TEXT NOT NULL,
+  file_index INTEGER NOT NULL,               -- shard index NNN of <session_id>_NNN.jsonl (name/path are reconstructed from the row, never stored: the data root may move)
+  date       TEXT NOT NULL,                  -- date directory name (local yyyy-mm-dd)
+  size_bytes INTEGER NOT NULL,               -- last observed size (listings stat-refresh the returned page and write back; an actively-appended shard may lag in between)
+  page_stats TEXT,                           -- cached message-window scan state at this shard's END (services/message-window.ts ShardPrefixRecord JSON); immutable shards only, NULL = not yet computed, nulled whenever size_bytes changes
+  PRIMARY KEY (project_id, agent_id, session_id, file_index)
+);
+CREATE INDEX IF NOT EXISTS idx_trace_files_agent_date ON trace_files(project_id, agent_id, date);
+CREATE INDEX IF NOT EXISTS idx_trace_files_session ON trace_files(session_id);
+CREATE TABLE IF NOT EXISTS trace_sessions (    -- per-session facts read ONCE at registration from the earliest shard's head (same derived-cache rules as trace_files; listing needs zero head-reads)
+  session_id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL,
+  agent_id   TEXT NOT NULL,
+  source     TEXT,                           -- session_meta origin: 'subagent' | 'schedule' | NULL = user-created (or head not yet readable)
+  workspace  TEXT NOT NULL DEFAULT '',
+  title      TEXT,                           -- first-prompt fallback title (sessions.title always wins when present)
+  provider   TEXT,                           -- model reference from session_meta (CLI adoption reads it from here; NULL = meta unreadable / legacy without provider)
+  model_id   TEXT,
+  first_ts   TEXT,                           -- first record's timestamp (adoption's createdAt fallback when the id embeds no time)
+  meta_read  INTEGER NOT NULL DEFAULT 0      -- 1 once the head parsed; 0 = facts unknown, retried by the next reconcile that touches the session
+);
+CREATE INDEX IF NOT EXISTS idx_trace_sessions_agent ON trace_sessions(project_id, agent_id);
+`;
+
+// src/db/database.ts
+var sqlite = process.getBuiltinModule("node:sqlite");
+function openDatabase(dbPath) {
+  if (dbPath !== ":memory:") {
+    mkdirSync(path.dirname(dbPath), { recursive: true });
+  }
+  const db = new sqlite.DatabaseSync(dbPath);
+  db.exec("PRAGMA journal_mode = WAL;");
+  db.exec("PRAGMA foreign_keys = ON;");
+  db.exec(SCHEMA_SQL);
+  ensureColumn(db, "sessions", "client", "TEXT");
+  ensureColumn(db, "sessions", "has_trace", "INTEGER NOT NULL DEFAULT 0");
+  ensureColumn(db, "sessions", "fork_count", "INTEGER NOT NULL DEFAULT 0");
+  ensureColumn(db, "sessions", "thinking_level", "TEXT");
+  ensureColumn(db, "auth_sessions", "via", "TEXT");
+  ensureColumn(db, "trace_files", "page_stats", "TEXT");
+  db.exec("DROP INDEX IF EXISTS idx_usage_session");
+  upgradeLastActiveAt(db);
+  return db;
+}
+function upgradeLastActiveAt(db) {
+  db.exec("BEGIN");
+  try {
+    if (ensureColumn(db, "sessions", "last_active_at", "TEXT")) {
+      db.exec(
+        `UPDATE sessions SET last_active_at = COALESCE(
+           (SELECT MAX(ts) FROM usage_records WHERE usage_records.session_id = sessions.session_id),
+           created_at
+         )`
+      );
+    }
+    db.exec("COMMIT");
+  } catch (err) {
+    db.exec("ROLLBACK");
+    throw err;
+  }
+}
+function ensureColumn(db, table, column, ddl) {
+  const cols = db.prepare(`PRAGMA table_info(${table})`).all();
+  if (cols.some((c) => c.name === column)) return false;
+  db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${ddl}`);
+  return true;
+}
+
+// src/db/repos/auth-sessions.ts
+var AuthSessionsRepo = class {
+  constructor(db) {
+    this.db = db;
+  }
+  db;
+  insert(row) {
+    this.db.prepare(
+      "INSERT INTO auth_sessions (token_hash, user_id, created_at, expires_at, via) VALUES (?, ?, ?, ?, ?)"
+    ).run(row.tokenHash, row.userId, row.createdAt, row.expiresAt, row.via);
+  }
+  findByTokenHash(tokenHash) {
+    const r = this.db.prepare("SELECT * FROM auth_sessions WHERE token_hash = ?").get(tokenHash);
+    if (!r) return null;
+    return {
+      tokenHash: r.token_hash,
+      userId: r.user_id,
+      createdAt: r.created_at,
+      expiresAt: r.expires_at,
+      via: r.via ?? null
+    };
+  }
+  /** Sliding renewal: update the expiration time. */
+  touch(tokenHash, expiresAt) {
+    this.db.prepare("UPDATE auth_sessions SET expires_at = ? WHERE token_hash = ?").run(expiresAt, tokenHash);
+  }
+  delete(tokenHash) {
+    this.db.prepare("DELETE FROM auth_sessions WHERE token_hash = ?").run(tokenHash);
+  }
+  /** Opportunistically clean up expired sessions (called during login/validation). */
+  deleteExpired(nowIso) {
+    this.db.prepare("DELETE FROM auth_sessions WHERE expires_at < ?").run(nowIso);
+  }
+  /** Clear all sessions for a user (forces re-login after an admin resets the password). */
+  deleteByUser(userId) {
+    this.db.prepare("DELETE FROM auth_sessions WHERE user_id = ?").run(userId);
+  }
+};
+
+// src/db/repos/users.ts
+function mapRow(r) {
+  return {
+    userId: r.user_id,
+    passwordHash: r.password_hash,
+    isAdmin: r.is_admin === 1,
+    passwordIsInitial: r.password_is_initial === 1,
+    createdAt: r.created_at
+  };
+}
+var UsersRepo = class {
+  constructor(db) {
+    this.db = db;
+  }
+  db;
+  insert(row) {
+    this.db.prepare(
+      "INSERT INTO users (user_id, password_hash, is_admin, password_is_initial, created_at) VALUES (?, ?, ?, ?, ?)"
+    ).run(
+      row.userId,
+      row.passwordHash,
+      row.isAdmin ? 1 : 0,
+      row.passwordIsInitial ? 1 : 0,
+      row.createdAt
+    );
+  }
+  findById(userId) {
+    const r = this.db.prepare("SELECT * FROM users WHERE user_id = ?").get(userId);
+    return r ? mapRow(r) : null;
+  }
+  /** All users (for the admin user backend), ordered by creation time ascending. */
+  list() {
+    const rows = this.db.prepare("SELECT * FROM users ORDER BY created_at ASC, user_id ASC").all();
+    return rows.map(mapRow);
+  }
+  count() {
+    const r = this.db.prepare("SELECT COUNT(*) AS n FROM users").get();
+    return r?.n ?? 0;
+  }
+  /** Update the password hash; isInitial marks whether the password was set by someone else (seed / admin). */
+  updatePassword(userId, passwordHash, isInitial) {
+    this.db.prepare("UPDATE users SET password_hash = ?, password_is_initial = ? WHERE user_id = ?").run(passwordHash, isInitial ? 1 : 0, userId);
+  }
+  /** Used by admin user deletion and account-creation compensation paths (owned Projects must be cleaned up first). */
+  delete(userId) {
+    this.db.prepare("DELETE FROM users WHERE user_id = ?").run(userId);
+  }
+};
+
+// src/auth/password.ts
+import { randomBytes, scrypt, timingSafeEqual } from "crypto";
+var SCRYPT_N = 16384;
+var SCRYPT_R = 8;
+var SCRYPT_P = 1;
+var SALT_BYTES = 16;
+var KEY_BYTES = 64;
+function scryptAsync(password, salt, keyLen, n, r, p) {
+  return new Promise((resolve, reject) => {
+    scrypt(password, salt, keyLen, { N: n, r, p, maxmem: 128 * 1024 * 1024 }, (err, key) => {
+      if (err) reject(err);
+      else resolve(key);
+    });
+  });
+}
+async function hashPassword(password) {
+  const salt = randomBytes(SALT_BYTES);
+  const key = await scryptAsync(password, salt, KEY_BYTES, SCRYPT_N, SCRYPT_R, SCRYPT_P);
+  return [
+    "scrypt",
+    String(SCRYPT_N),
+    String(SCRYPT_R),
+    String(SCRYPT_P),
+    salt.toString("base64"),
+    key.toString("base64")
+  ].join("$");
+}
+async function verifyPassword(password, stored) {
+  const parts = stored.split("$");
+  if (parts.length !== 6 || parts[0] !== "scrypt") return false;
+  const n = Number(parts[1]);
+  const r = Number(parts[2]);
+  const p = Number(parts[3]);
+  if (!Number.isInteger(n) || !Number.isInteger(r) || !Number.isInteger(p)) return false;
+  let salt;
+  let expected;
+  try {
+    salt = Buffer.from(parts[4], "base64");
+    expected = Buffer.from(parts[5], "base64");
+  } catch {
+    return false;
+  }
+  if (salt.length === 0 || expected.length === 0) return false;
+  let actual;
+  try {
+    actual = await scryptAsync(password, salt, expected.length, n, r, p);
+  } catch {
+    return false;
+  }
+  return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+
+// src/auth/service.ts
+import { createHash, randomBytes as randomBytes2, randomInt } from "crypto";
+
+// src/http/errors.ts
+var HttpError = class extends Error {
+  constructor(status, code, message) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.name = "HttpError";
+  }
+  status;
+  code;
+};
+function errorBody(code, message) {
+  return { error: { code, message } };
+}
+function isMissingCredential(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  return /missing credentials|api[_ ]?key/i.test(message);
+}
+function modelCredentialMissing(modelId) {
+  return new HttpError(
+    400,
+    "model_credential_missing",
+    `Model ${modelId} has no API key yet. Configure it on the Models page first.`
+  );
+}
+function handleError(err, c) {
+  if (err instanceof HttpError) {
+    return c.json(errorBody(err.code, err.message), err.status);
+  }
+  console.error(`[server] Unhandled exception: ${err.stack ?? err.message}`);
+  return c.json(errorBody("internal", "Internal server error."), 500);
+}
+
+// src/auth/service.ts
+var MIN_PASSWORD_LENGTH = 8;
+var ADMIN_USER_ID = "admin";
+var LOGIN_FREE_ATTEMPTS = 5;
+var LOGIN_BACKOFF_START_MS = 1e3;
+var LOGIN_BACKOFF_CAP_MS = 6e4;
+var LOGIN_FAILURE_IDLE_MS = 15 * 6e4;
+function generateInitialAdminPassword() {
+  return "penguin-" + String(randomInt(0, 1e4)).padStart(4, "0");
+}
+function sha256Hex(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+function toUserInfo(row) {
+  return {
+    userId: row.userId,
+    isAdmin: row.isAdmin,
+    passwordIsInitial: row.passwordIsInitial,
+    createdAt: row.createdAt
+  };
+}
+var AuthService = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  }
+  deps;
+  now;
+  /**
+   * Startup seeding (idempotent): creates the built-in admin and adopts
+   * default_project when the users table is empty; if the initial Project fails,
+   * the user row is rolled back and the server retries on next startup.
+   * Returns the initial password when it actually seeded — the caller prints it,
+   * the only place a generated password is ever shown — and null when users
+   * already exist.
+   */
+  async seedAdmin() {
+    if (this.deps.users.count() > 0) return null;
+    const password = this.deps.seedAdminPassword ?? generateInitialAdminPassword();
+    if (password.length < MIN_PASSWORD_LENGTH) {
+      throw new Error(
+        `PENGUIN_SEED_ADMIN_PASSWORD must be at least ${MIN_PASSWORD_LENGTH} characters.`
+      );
+    }
+    const user = {
+      userId: ADMIN_USER_ID,
+      passwordHash: await hashPassword(password),
+      isAdmin: true,
+      passwordIsInitial: true,
+      createdAt: this.now().toISOString()
+    };
+    this.deps.users.insert(user);
+    try {
+      await this.deps.provisionInitialProject(user, true);
+    } catch (err) {
+      this.deps.users.delete(user.userId);
+      throw err;
+    }
+    return password;
+  }
+  /** Whether the built-in admin still runs on its initial password (drives the startup reminder notice). */
+  adminPasswordIsInitial() {
+    return this.deps.users.findById(ADMIN_USER_ID)?.passwordIsInitial === true;
+  }
+  /** Consecutive login failures per userId (see the throttling comment on the constants). */
+  loginFailures = /* @__PURE__ */ new Map();
+  /** The wait imposed after `failures` consecutive failures (0 while within the free attempts). */
+  loginDelayMs(failures) {
+    const excess = failures - LOGIN_FREE_ATTEMPTS;
+    if (excess <= 0) return 0;
+    return Math.min(LOGIN_BACKOFF_START_MS * 2 ** (excess - 1), LOGIN_BACKOFF_CAP_MS);
+  }
+  async login(userId, password) {
+    const nowMs = this.now().getTime();
+    for (const [key, entry] of this.loginFailures) {
+      if (nowMs - entry.lastFailureAt > LOGIN_FAILURE_IDLE_MS) this.loginFailures.delete(key);
+    }
+    const failed = this.loginFailures.get(userId);
+    if (failed) {
+      const readyAt = failed.lastFailureAt + this.loginDelayMs(failed.failures);
+      if (nowMs < readyAt) {
+        throw new HttpError(
+          429,
+          "too_many_attempts",
+          `Too many failed sign-in attempts. Try again in ${Math.ceil((readyAt - nowMs) / 1e3)}s.`
+        );
+      }
+    }
+    const row = this.deps.users.findById(userId);
+    const ok = row !== null && await verifyPassword(password, row.passwordHash);
+    if (!row || !ok) {
+      this.loginFailures.set(userId, {
+        failures: (failed?.failures ?? 0) + 1,
+        lastFailureAt: this.now().getTime()
+      });
+      throw new HttpError(401, "invalid_credentials", "Incorrect username or password.");
+    }
+    this.loginFailures.delete(userId);
+    this.deps.authSessions.deleteExpired(this.now().toISOString());
+    return { user: toUserInfo(row), token: this.issueSession(row.userId, "password") };
+  }
+  /**
+   * Desktop-mode sign-in: issues an admin session WITHOUT a password check — the caller
+   * (the desktop-login route) has already redeemed the shell's one-shot token, which is
+   * the credential here. Throws if the admin has not been seeded yet (desktop-login runs
+   * after startup seeding, so this only trips on a broken deployment).
+   */
+  loginDesktop() {
+    const row = this.deps.users.findById(ADMIN_USER_ID);
+    if (!row) {
+      throw new HttpError(500, "internal", "Built-in admin has not been seeded.");
+    }
+    this.deps.authSessions.deleteExpired(this.now().toISOString());
+    return { user: toUserInfo(row), token: this.issueSession(row.userId, "desktop") };
+  }
+  /** Self password change (user settings): validates the old password, and on success clears the initial-password flag; the current session remains valid. */
+  async changePassword(userId, oldPassword, newPassword) {
+    const row = this.deps.users.findById(userId);
+    if (!row || !await verifyPassword(oldPassword, row.passwordHash)) {
+      throw new HttpError(400, "password_mismatch", "Current password is incorrect.");
+    }
+    if (newPassword.length < MIN_PASSWORD_LENGTH) {
+      throw new HttpError(400, "invalid_password", "Password must be at least 8 characters.");
+    }
+    this.deps.users.updatePassword(userId, await hashPassword(newPassword), false);
+    this.deps.onPasswordChanged?.(userId);
+  }
+  /**
+   * Desktop-session password set: no old-password check. Only reachable for sessions
+   * established via desktop-login (the me route gates on sessionVia) — the seed password
+   * of a desktop-created root is random and never shown, so its holder has nothing to
+   * type into an old-password field; the shell's token already proved machine ownership.
+   */
+  async setPasswordDesktop(userId, newPassword) {
+    if (newPassword.length < MIN_PASSWORD_LENGTH) {
+      throw new HttpError(400, "invalid_password", "Password must be at least 8 characters.");
+    }
+    this.deps.users.updatePassword(userId, await hashPassword(newPassword), false);
+    this.deps.onPasswordChanged?.(userId);
+  }
+  logout(token) {
+    this.deps.authSessions.delete(sha256Hex(token));
+  }
+  /** Validates the cookie token: returns null if expired/unknown; sliding renewal once less than 6 days remain. */
+  authenticateWithMeta(token) {
+    const tokenHash = sha256Hex(token);
+    const session = this.deps.authSessions.findByTokenHash(tokenHash);
+    if (!session) return null;
+    const now = this.now();
+    const expiresAt = Date.parse(session.expiresAt);
+    if (!(expiresAt > now.getTime())) {
+      this.deps.authSessions.delete(tokenHash);
+      return null;
+    }
+    if (expiresAt - now.getTime() < this.deps.sessionRenewMs) {
+      this.deps.authSessions.touch(
+        tokenHash,
+        new Date(now.getTime() + this.deps.sessionTtlMs).toISOString()
+      );
+    }
+    const user = this.deps.users.findById(session.userId);
+    if (!user) return null;
+    return { user, via: session.via === "desktop" ? "desktop" : "password" };
+  }
+  issueSession(userId, via) {
+    const token = randomBytes2(32).toString("base64url");
+    const now = this.now();
+    this.deps.authSessions.insert({
+      tokenHash: sha256Hex(token),
+      userId,
+      createdAt: now.toISOString(),
+      expiresAt: new Date(now.getTime() + this.deps.sessionTtlMs).toISOString(),
+      via
+    });
+    return token;
+  }
+};
+
+export {
+  openDatabase,
+  AuthSessionsRepo,
+  UsersRepo,
+  HttpError,
+  errorBody,
+  isMissingCredential,
+  modelCredentialMissing,
+  handleError,
+  hashPassword,
+  MIN_PASSWORD_LENGTH,
+  ADMIN_USER_ID,
+  generateInitialAdminPassword,
+  toUserInfo,
+  AuthService
+};
+//# sourceMappingURL=chunk-3QINBW3W.js.map