@prismshadow/penguin-server 0.2.2 → 0.2.3

package/dist/reset-admin-password.d.ts

@@ -0,0 +1,28 @@
+import { ServerLock } from './lock.js';
+
+type ResetAdminPasswordResult = 
+/** Refused: a live server owns this data root (stop it first — web.db is single-writer). */
+{
+    outcome: "server_running";
+    lock: ServerLock;
+}
+/** Nothing to reset: the root has no Web database (the server has never run here). */
+ | {
+    outcome: "no_database";
+    dbPath: string;
+}
+/** Nothing to reset: the database exists but the admin was never seeded. */
+ | {
+    outcome: "no_admin";
+} | {
+    outcome: "reset";
+    password: string;
+};
+/**
+ * Resets the built-in admin to a fresh initial password. `dbPath` defaults to the
+ * root's `web.db`; callers honoring PENGUIN_WEB_DB pass the resolved path (the
+ * plaintext reminder file always lives in `root`, matching the server's own layout).
+ */
+declare function resetAdminPassword(root: string, dbPath?: string): Promise<ResetAdminPasswordResult>;
+
+export { type ResetAdminPasswordResult, resetAdminPassword };

package/dist/reset-admin-password.js

@@ -0,0 +1,39 @@
+import {
+  ADMIN_USER_ID,
+  AuthSessionsRepo,
+  UsersRepo,
+  generateInitialAdminPassword,
+  hashPassword,
+  openDatabase
+} from "./chunk-3QINBW3W.js";
+import {
+  liveServerLock
+} from "./chunk-OMBFPEGQ.js";
+import {
+  storeInitialAdminPassword
+} from "./chunk-UUJCF46V.js";
+
+// src/reset-admin-password.ts
+import fs from "fs";
+import path from "path";
+async function resetAdminPassword(root, dbPath = path.join(root, "web.db")) {
+  const lock = await liveServerLock(root);
+  if (lock !== null) return { outcome: "server_running", lock };
+  if (!fs.existsSync(dbPath)) return { outcome: "no_database", dbPath };
+  const db = openDatabase(dbPath);
+  try {
+    const users = new UsersRepo(db);
+    if (users.findById(ADMIN_USER_ID) === null) return { outcome: "no_admin" };
+    const password = generateInitialAdminPassword();
+    users.updatePassword(ADMIN_USER_ID, await hashPassword(password), true);
+    new AuthSessionsRepo(db).deleteByUser(ADMIN_USER_ID);
+    storeInitialAdminPassword(root, password);
+    return { outcome: "reset", password };
+  } finally {
+    db.close();
+  }
+}
+export {
+  resetAdminPassword
+};
+//# sourceMappingURL=reset-admin-password.js.map

package/dist/reset-admin-password.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/reset-admin-password.ts"],"sourcesContent":["/**\n * Offline admin-password reset — the rescue path when the Web admin password is\n * forgotten (`penguin server reset-admin-password`).\n *\n * The admin can reset every OTHER user from the user-management page, but nobody can\n * reset the admin itself once its password is lost: the plaintext file in the data root\n * only survives while the password is still the initial one. This module closes that\n * gap from the machine that owns the data root: it re-arms the whole initial-password\n * machinery — a fresh `penguin-<4 digits>` password flagged password_is_initial, the\n * plaintext stored via initial-password.ts so every server start re-prints the framed\n * reminder until the password is changed, and all of the admin's login sessions\n * cleared (matching an admin-initiated reset).\n *\n * web.db is single-process / single-writer (see db/database.ts and lock.ts), so the\n * reset refuses while a live server owns the root: the caller tells the user to stop it\n * first. Requiring local filesystem access is the authorization model — whoever can run\n * this already owns the SQLite database sitting next to the file it writes.\n *\n * Published as `@prismshadow/penguin-server/reset-admin-password` (side-effect-free,\n * like ./lock) so the CLI can run the reset without importing the package entry, which\n * starts listening.\n */\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport { hashPassword } from \"./auth/password.js\";\nimport { ADMIN_USER_ID, generateInitialAdminPassword } from \"./auth/service.js\";\nimport { openDatabase } from \"./db/database.js\";\nimport { AuthSessionsRepo } from \"./db/repos/auth-sessions.js\";\nimport { UsersRepo } from \"./db/repos/users.js\";\nimport { storeInitialAdminPassword } from \"./initial-password.js\";\nimport { liveServerLock } from \"./lock.js\";\nimport type { ServerLock } from \"./lock.js\";\n\nexport type ResetAdminPasswordResult =\n  /** Refused: a live server owns this data root (stop it first — web.db is single-writer). */\n  | { outcome: \"server_running\"; lock: ServerLock }\n  /** Nothing to reset: the root has no Web database (the server has never run here). */\n  | { outcome: \"no_database\"; dbPath: string }\n  /** Nothing to reset: the database exists but the admin was never seeded. */\n  | { outcome: \"no_admin\" }\n  | { outcome: \"reset\"; password: string };\n\n/**\n * Resets the built-in admin to a fresh initial password. `dbPath` defaults to the\n * root's `web.db`; callers honoring PENGUIN_WEB_DB pass the resolved path (the\n * plaintext reminder file always lives in `root`, matching the server's own layout).\n */\nexport async function resetAdminPassword(\n  root: string,\n  dbPath: string = path.join(root, \"web.db\"),\n): Promise<ResetAdminPasswordResult> {\n  const lock = await liveServerLock(root);\n  if (lock !== null) return { outcome: \"server_running\", lock };\n  // Existence check before openDatabase, which would otherwise CREATE an empty database\n  // (and the root directory) on a root the server has never used.\n  if (!fs.existsSync(dbPath)) return { outcome: \"no_database\", dbPath };\n  const db = openDatabase(dbPath);\n  try {\n    const users = new UsersRepo(db);\n    if (users.findById(ADMIN_USER_ID) === null) return { outcome: \"no_admin\" };\n    const password = generateInitialAdminPassword();\n    users.updatePassword(ADMIN_USER_ID, await hashPassword(password), true);\n    new AuthSessionsRepo(db).deleteByUser(ADMIN_USER_ID);\n    storeInitialAdminPassword(root, password);\n    return { outcome: \"reset\", password };\n  } finally {\n    db.close();\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAsBA,OAAO,QAAQ;AACf,OAAO,UAAU;AAwBjB,eAAsB,mBACpB,MACA,SAAiB,KAAK,KAAK,MAAM,QAAQ,GACN;AACnC,QAAM,OAAO,MAAM,eAAe,IAAI;AACtC,MAAI,SAAS,KAAM,QAAO,EAAE,SAAS,kBAAkB,KAAK;AAG5D,MAAI,CAAC,GAAG,WAAW,MAAM,EAAG,QAAO,EAAE,SAAS,eAAe,OAAO;AACpE,QAAM,KAAK,aAAa,MAAM;AAC9B,MAAI;AACF,UAAM,QAAQ,IAAI,UAAU,EAAE;AAC9B,QAAI,MAAM,SAAS,aAAa,MAAM,KAAM,QAAO,EAAE,SAAS,WAAW;AACzE,UAAM,WAAW,6BAA6B;AAC9C,UAAM,eAAe,eAAe,MAAM,aAAa,QAAQ,GAAG,IAAI;AACtE,QAAI,iBAAiB,EAAE,EAAE,aAAa,aAAa;AACnD,8BAA0B,MAAM,QAAQ;AACxC,WAAO,EAAE,SAAS,SAAS,SAAS;AAAA,EACtC,UAAE;AACA,OAAG,MAAM;AAAA,EACX;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prismshadow/penguin-server",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "type": "module",
   "description": "PenguinHarness web server: multi-user authentication and authorization, Session execution with SSE streaming, and usage accounting, built on @prismshadow/penguin-core.",
   "license": "Apache-2.0",
@@ -25,6 +25,14 @@
     "./initial-password": {
       "types": "./dist/initial-password.d.ts",
       "import": "./dist/initial-password.js"
+    },
+    "./reset-admin-password": {
+      "types": "./dist/reset-admin-password.d.ts",
+      "import": "./dist/reset-admin-password.js"
+    },
+    "./hmr/manifest": {
+      "types": "./dist/hmr/manifest.d.ts",
+      "import": "./dist/hmr/manifest.js"
     }
   },
   "main": "./dist/index.js",
@@ -41,8 +49,8 @@
     "tar": "^7.5.21",
     "undici": "^7.29.0",
     "yaml": "^2.5.0",
-    "@prismshadow/penguin-core": "0.2.2",
-    "@prismshadow/penguin-skills": "0.2.2"
+    "@prismshadow/penguin-core": "0.2.3",
+    "@prismshadow/penguin-skills": "0.2.3"
   },
   "devDependencies": {
     "@types/node": "^24.0.0",