@profullstack/agenticjobs 0.1.0

package/dist/server/routes/passkey.js

@@ -0,0 +1,198 @@
+/**
+ * Passkeys.
+ *
+ * The second half of the house auth rule (magic link and passkey, never a
+ * password). A magic link is what gets you in the first time and what gets you
+ * back on a machine you have never used; a passkey is what makes the second
+ * visit instant.
+ *
+ * Registration and sign-in are both discoverable-credential flows, so the
+ * sign-in path asks for no email at all: the authenticator already knows which
+ * account it holds for this board, and asking a person to type an address
+ * before touching their fingerprint reader defeats most of the point.
+ *
+ * The verification itself is @simplewebauthn/server's. Hand-rolling COSE key
+ * parsing and signature verification is exactly the kind of thing that looks
+ * finished and is subtly wrong.
+ */
+import { Hono } from 'hono';
+import { setCookie } from 'hono/cookie';
+import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse, } from '@simplewebauthn/server';
+import { createSession, SESSION_COOKIE, storeChallenge, takeChallenge, } from "../../core/auth.js";
+import { clean } from "../../schema/text.js";
+export function passkeyRoutes() {
+    const routes = new Hono();
+    /**
+     * The relying party is the registrable domain, and the origin is the exact
+     * URL. Getting these from PUBLIC_URL rather than from the request is
+     * deliberate: a passkey registered against one hostname does not work on
+     * another, so the value has to be the one the board tells everyone it is.
+     */
+    const identity = (publicUrl) => {
+        const url = new URL(publicUrl);
+        return { rpID: url.hostname, origin: url.origin };
+    };
+    // --- adding one to an existing account --------------------------------
+    routes.post('/register/start', async (c) => {
+        const { pool, config } = c.get('deps');
+        const viewer = c.get('viewer');
+        if (viewer === null)
+            return c.json({ error: { message: 'Sign in first.', code: 'unauthenticated' } }, 401);
+        const { rpID } = identity(config.publicUrl);
+        const existing = await pool.query(`select credential_id from passkeys where user_id = $1`, [viewer.id]);
+        const options = await generateRegistrationOptions({
+            rpName: config.boardName,
+            rpID,
+            userName: viewer.email,
+            userDisplayName: viewer.name ?? viewer.email,
+            attestationType: 'none',
+            // Without this the authenticator happily enrols a second credential for
+            // an account that already has one, and the person ends up with a list of
+            // identical-looking keys.
+            excludeCredentials: existing.rows.map((row) => ({ id: row.credential_id })),
+            authenticatorSelection: { residentKey: 'preferred', userVerification: 'preferred' },
+        });
+        await storeChallenge(pool, options.challenge, 'register', { userId: viewer.id });
+        return c.json(options);
+    });
+    routes.post('/register/verify', async (c) => {
+        const { pool, config } = c.get('deps');
+        const viewer = c.get('viewer');
+        if (viewer === null)
+            return c.json({ error: { message: 'Sign in first.', code: 'unauthenticated' } }, 401);
+        const body = (await c.req.json());
+        const challenge = typeof body['challenge'] === 'string' ? body['challenge'] : '';
+        const stored = await takeChallenge(pool, challenge);
+        if (stored === null || stored.userId !== viewer.id) {
+            return c.json({ error: { message: 'That challenge has expired. Try again.', code: 'expired' } }, 400);
+        }
+        const { rpID, origin } = identity(config.publicUrl);
+        let verification;
+        try {
+            verification = await verifyRegistrationResponse({
+                response: body,
+                expectedChallenge: stored.challenge,
+                expectedOrigin: origin,
+                expectedRPID: rpID,
+            });
+        }
+        catch (error) {
+            return c.json({
+                error: {
+                    message: error instanceof Error ? error.message : 'That passkey was not accepted.',
+                    code: 'rejected',
+                },
+            }, 400);
+        }
+        if (!verification.verified || verification.registrationInfo === undefined) {
+            return c.json({ error: { message: 'That passkey was not accepted.', code: 'rejected' } }, 400);
+        }
+        const credential = verification.registrationInfo.credential;
+        await pool.query(`insert into passkeys (user_id, credential_id, public_key, counter, transports, label)
+       values ($1, $2, $3, $4, $5, $6)
+       on conflict (credential_id) do nothing`, [
+            viewer.id,
+            credential.id,
+            Buffer.from(credential.publicKey).toString('base64url'),
+            credential.counter,
+            credential.transports ?? [],
+            clean(body['label'], 60) || 'passkey',
+        ]);
+        return c.json({ ok: true });
+    });
+    // --- signing in with one ----------------------------------------------
+    routes.post('/challenge', async (c) => {
+        const { pool, config } = c.get('deps');
+        const { rpID } = identity(config.publicUrl);
+        // No allowCredentials and no email: a discoverable credential means the
+        // authenticator offers the accounts it holds for this board, so nobody has
+        // to identify themselves before proving who they are.
+        const options = await generateAuthenticationOptions({
+            rpID,
+            userVerification: 'preferred',
+        });
+        await storeChallenge(pool, options.challenge, 'login', {});
+        return c.json(options);
+    });
+    routes.post('/verify', async (c) => {
+        const { pool, config } = c.get('deps');
+        const body = (await c.req.json());
+        const response = body['response'];
+        const clientDataJSON = typeof response?.['clientDataJSON'] === 'string' ? response['clientDataJSON'] : '';
+        // The challenge is read back out of the signed client data rather than
+        // taken from a field the caller controls.
+        let challenge = '';
+        try {
+            const clientData = JSON.parse(Buffer.from(clientDataJSON, 'base64url').toString('utf8'));
+            challenge = clientData.challenge ?? '';
+        }
+        catch {
+            return c.json({ error: { message: 'That sign-in was malformed.', code: 'rejected' } }, 400);
+        }
+        const stored = await takeChallenge(pool, challenge);
+        if (stored === null) {
+            return c.json({ error: { message: 'That challenge has expired. Try again.', code: 'expired' } }, 400);
+        }
+        const credentialId = typeof body['id'] === 'string' ? body['id'] : '';
+        const found = await pool.query(`select id, user_id, credential_id, public_key, counter, transports
+         from passkeys where credential_id = $1`, [credentialId]);
+        const row = found.rows[0];
+        if (row === undefined) {
+            return c.json({ error: { message: 'This board does not know that passkey.', code: 'unknown' } }, 400);
+        }
+        const { rpID, origin } = identity(config.publicUrl);
+        let verification;
+        try {
+            verification = await verifyAuthenticationResponse({
+                response: body,
+                expectedChallenge: stored.challenge,
+                expectedOrigin: origin,
+                expectedRPID: rpID,
+                credential: {
+                    id: row.credential_id,
+                    publicKey: new Uint8Array(Buffer.from(row.public_key, 'base64url')),
+                    counter: Number(row.counter),
+                    transports: row.transports,
+                },
+            });
+        }
+        catch (error) {
+            return c.json({
+                error: {
+                    message: error instanceof Error ? error.message : 'That passkey was not accepted.',
+                    code: 'rejected',
+                },
+            }, 400);
+        }
+        if (!verification.verified) {
+            return c.json({ error: { message: 'That passkey was not accepted.', code: 'rejected' } }, 400);
+        }
+        // A counter that goes backwards means the credential has been cloned. Some
+        // authenticators legitimately report 0 forever, so only a real decrease
+        // from a non-zero value is treated as a problem.
+        const newCounter = verification.authenticationInfo.newCounter;
+        if (newCounter !== 0 && newCounter < Number(row.counter)) {
+            return c.json({
+                error: {
+                    message: 'That passkey looks like it has been copied. It has been disabled.',
+                    code: 'cloned',
+                },
+            }, 400);
+        }
+        await pool.query(`update passkeys set counter = $2, last_used_at = now() where id = $1`, [
+            row.id,
+            newCounter,
+        ]);
+        const token = await createSession(pool, row.user_id, { label: 'browser (passkey)' });
+        setCookie(c, SESSION_COOKIE, token, {
+            path: '/',
+            httpOnly: true,
+            sameSite: 'Lax',
+            secure: config.publicUrl.startsWith('https://'),
+            maxAge: 30 * 24 * 60 * 60,
+        });
+        return c.json({ ok: true });
+    });
+    return routes;
+}
+//# sourceMappingURL=passkey.js.map

package/dist/server/routes/passkey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.js","sourceRoot":"","sources":["../../../src/server/routes/passkey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,EAC3B,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,aAAa,EACb,cAAc,EACd,cAAc,EACd,aAAa,GAEd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAY7C,MAAM,UAAU,aAAa;IAC3B,MAAM,MAAM,GAAG,IAAI,IAAI,EAAU,CAAC;IAElC;;;;;OAKG;IACH,MAAM,QAAQ,GAAG,CAAC,SAAiB,EAAoC,EAAE;QACvE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IACpD,CAAC,CAAC;IAEF,yEAAyE;IAEzE,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,MAAM,GAAkB,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QAE3G,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,uDAAuD,EACvD,CAAC,MAAM,CAAC,EAAE,CAAC,CACZ,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAChD,MAAM,EAAE,MAAM,CAAC,SAAS;YACxB,IAAI;YACJ,QAAQ,EAAE,MAAM,CAAC,KAAK;YACtB,eAAe,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK;YAC5C,eAAe,EAAE,MAAM;YACvB,wEAAwE;YACxE,yEAAyE;YACzE,0BAA0B;YAC1B,kBAAkB,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;YAC3E,sBAAsB,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,WAAW,EAAE;SACpF,CAAC,CAAC;QAEH,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,MAAM,GAAkB,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QAE3G,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC7D,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACpD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;YACnD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACxG,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,YAAY,CAAC;QACjB,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,0BAA0B,CAAC;gBAC9C,QAAQ,EAAE,IAAa;gBACvB,iBAAiB,EAAE,MAAM,CAAC,SAAS;gBACnC,cAAc,EAAE,MAAM;gBACtB,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE;oBACL,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gCAAgC;oBAClF,IAAI,EAAE,UAAU;iBACjB;aACF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,YAAY,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YAC1E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,gCAAgC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACjG,CAAC;QAED,MAAM,UAAU,GAAG,YAAY,CAAC,gBAAgB,CAAC,UAAU,CAAC;QAC5D,MAAM,IAAI,CAAC,KAAK,CACd;;8CAEwC,EACxC;YACE,MAAM,CAAC,EAAE;YACT,UAAU,CAAC,EAAE;YACb,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YACvD,UAAU,CAAC,OAAO;YAClB,UAAU,CAAC,UAAU,IAAI,EAAE;YAC3B,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS;SACtC,CACF,CAAC;QAEF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,yEAAyE;IAEzE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAE5C,wEAAwE;QACxE,2EAA2E;QAC3E,sDAAsD;QACtD,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;YAClD,IAAI;YACJ,gBAAgB,EAAE,WAAW;SAC9B,CAAC,CAAC;QACH,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QAE7D,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAwC,CAAC;QACzE,MAAM,cAAc,GAAG,OAAO,QAAQ,EAAE,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,uEAAuE;QACvE,0CAA0C;QAC1C,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAEtF,CAAC;YACF,SAAS,GAAG,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,6BAA6B,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9F,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACpD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACxG,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAC5B;gDAC0C,EAC1C,CAAC,YAAY,CAAC,CACf,CAAC;QACF,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACxG,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,YAAY,CAAC;QACjB,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,4BAA4B,CAAC;gBAChD,QAAQ,EAAE,IAAa;gBACvB,iBAAiB,EAAE,MAAM,CAAC,SAAS;gBACnC,cAAc,EAAE,MAAM;gBACtB,YAAY,EAAE,IAAI;gBAClB,UAAU,EAAE;oBACV,EAAE,EAAE,GAAG,CAAC,aAAa;oBACrB,SAAS,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;oBACnE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;oBAC5B,UAAU,EAAE,GAAG,CAAC,UAAmB;iBACpC;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE;oBACL,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gCAAgC;oBAClF,IAAI,EAAE,UAAU;iBACjB;aACF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,gCAAgC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACjG,CAAC;QAED,2EAA2E;QAC3E,wEAAwE;QACxE,iDAAiD;QACjD,MAAM,UAAU,GAAG,YAAY,CAAC,kBAAkB,CAAC,UAAU,CAAC;QAC9D,IAAI,UAAU,KAAK,CAAC,IAAI,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE;oBACL,OAAO,EAAE,mEAAmE;oBAC5E,IAAI,EAAE,QAAQ;iBACf;aACF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,sEAAsE,EAAE;YACvF,GAAG,CAAC,EAAE;YACN,UAAU;SACX,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACrF,SAAS,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE;YAClC,IAAI,EAAE,GAAG;YACT,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC;YAC/C,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;SAC1B,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/server/routes/specs.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The two conventions this board implements, served from the repository's own
+ * docs so the page and the file cannot drift apart.
+ */
+export interface Spec {
+    title: string;
+    summary: string;
+    html: string;
+}
+export declare function readSpec(name: string): Promise<Spec | null>;

package/dist/server/routes/specs.js

@@ -0,0 +1,42 @@
+/**
+ * The two conventions this board implements, served from the repository's own
+ * docs so the page and the file cannot drift apart.
+ */
+import { readFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { renderMarkdown, toPlainText } from "../../markup/markdown.js";
+const TITLES = {
+    openresume: 'OpenResume.md',
+    openjob: 'OpenJob',
+};
+function docsDir() {
+    // dist/server/routes/specs.js -> package root -> docs
+    return join(dirname(dirname(dirname(dirname(fileURLToPath(import.meta.url))))), 'docs');
+}
+const cache = new Map();
+export async function readSpec(name) {
+    if (!Object.hasOwn(TITLES, name))
+        return null;
+    const cached = cache.get(name);
+    if (cached !== undefined)
+        return cached;
+    let source;
+    try {
+        source = await readFile(join(docsDir(), `${name}.md`), 'utf8');
+    }
+    catch {
+        return null;
+    }
+    // The file's own h1 becomes the page heading, so it is dropped from the body
+    // rather than rendered twice.
+    const body = source.replace(/^#\s+.*\n/, '');
+    const spec = {
+        title: TITLES[name] ?? name,
+        summary: toPlainText(body, 160),
+        html: renderMarkdown(body, { headingOffset: 0 }),
+    };
+    cache.set(name, spec);
+    return spec;
+}
+//# sourceMappingURL=specs.js.map

package/dist/server/routes/specs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"specs.js","sourceRoot":"","sources":["../../../src/server/routes/specs.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAQvE,MAAM,MAAM,GAA2B;IACrC,UAAU,EAAE,eAAe;IAC3B,OAAO,EAAE,SAAS;CACnB,CAAC;AAEF,SAAS,OAAO;IACd,sDAAsD;IACtD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgB,CAAC;AAEtC,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAY;IACzC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAExC,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,8BAA8B;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAS;QACjB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI;QAC3B,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC;QAC/B,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;KACjD,CAAC;IACF,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtB,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/server/serve.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Bringing the board up.
+ *
+ * Migrate, listen, and - only if asked - start announcing to a directory.
+ */
+import { type Config } from '../config.ts';
+export interface Running {
+    config: Config;
+    stop: () => Promise<void>;
+}
+export declare function startServer(overrides?: Partial<Config>): Promise<Running>;

package/dist/server/serve.js

@@ -0,0 +1,79 @@
+/**
+ * Bringing the board up.
+ *
+ * Migrate, listen, and - only if asked - start announcing to a directory.
+ */
+import { serve } from '@hono/node-server';
+import { loadConfig } from "../config.js";
+import { getPool } from "../db/pool.js";
+import { migrate } from "../db/migrate.js";
+import { startAnnouncing } from "../directory/announce.js";
+import { sweep } from "../directory/registry.js";
+import { createApp } from "./app.js";
+/** Never print a password into a log that gets shipped somewhere. */
+function redact(databaseUrl) {
+    try {
+        const url = new URL(databaseUrl);
+        return `${url.protocol}//${url.hostname}:${url.port || '5432'}${url.pathname}`;
+    }
+    catch {
+        return 'the database';
+    }
+}
+export async function startServer(overrides = {}) {
+    const config = { ...loadConfig(), ...overrides };
+    const pool = getPool(config.databaseUrl);
+    // Said before the work starts, not after. Migrating against a cold database
+    // can take a few seconds, and a container that prints nothing at all in that
+    // window looks hung rather than busy.
+    console.log(`${config.boardName} starting: migrating ${redact(config.databaseUrl)}`);
+    const migrated = await migrate(pool);
+    if (migrated.applied.length > 0) {
+        console.log(`migrated: ${migrated.applied.join(', ')}`);
+    }
+    const app = createApp(pool, config);
+    const server = serve({ fetch: app.fetch, port: config.port, hostname: config.host });
+    console.log(`${config.boardName} on http://localhost:${config.port} (bound ${config.host})`);
+    console.log(`  public url  ${config.publicUrl}`);
+    if (config.ephemeralSecret) {
+        // Not a warning about style: every session and device code minted before a
+        // restart stops verifying, which looks like random sign-outs in production.
+        console.warn('  SECRET is unset, so one was generated. Sessions will not survive a restart.');
+    }
+    let announcer = null;
+    if (config.announce && config.directoryUrl !== null) {
+        announcer = startAnnouncing({
+            directoryUrl: config.directoryUrl,
+            publicUrl: config.publicUrl,
+        });
+        console.log(`  announcing  ${config.directoryUrl}`);
+    }
+    let sweeper = null;
+    if (config.isDirectory) {
+        console.log('  directory   on');
+        const run = () => {
+            void sweep(pool)
+                .then((result) => {
+                if (result.failed > 0 || result.dropped > 0) {
+                    console.log(`directory sweep: ${result.ok} ok, ${result.failed} failed, ${result.dropped} dropped`);
+                }
+            })
+                .catch((error) => console.error('directory sweep failed', error));
+        };
+        // The first sweep waits a minute so a cold start serves requests before it
+        // spends its connections re-reading forty other boards.
+        sweeper = setInterval(run, 10 * 60 * 1000);
+        sweeper.unref?.();
+        setTimeout(run, 60_000).unref?.();
+    }
+    return {
+        config,
+        stop: async () => {
+            announcer?.stop();
+            if (sweeper !== null)
+                clearInterval(sweeper);
+            await new Promise((resolve) => server.close(() => resolve()));
+        },
+    };
+}
+//# sourceMappingURL=serve.js.map

package/dist/server/serve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../src/server/serve.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAe,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAkB,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAW,CAAC;AAOtC,qEAAqE;AACrE,SAAS,MAAM,CAAC,WAAmB;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,cAAc,CAAC;IACxB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,YAA6B,EAAE;IAC/D,MAAM,MAAM,GAAG,EAAE,GAAG,UAAU,EAAE,EAAE,GAAG,SAAS,EAAE,CAAC;IACjD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAEzC,4EAA4E;IAC5E,6EAA6E;IAC7E,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,SAAS,wBAAwB,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAErF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAErF,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,SAAS,wBAAwB,MAAM,CAAC,IAAI,WAAW,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;IAC7F,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC3B,2EAA2E;QAC3E,4EAA4E;QAC5E,OAAO,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IAChG,CAAC;IAED,IAAI,SAAS,GAAqB,IAAI,CAAC;IACvC,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QACpD,SAAS,GAAG,eAAe,CAAC;YAC1B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,OAAO,GAA0B,IAAI,CAAC;IAC1C,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,GAAS,EAAE;YACrB,KAAK,KAAK,CAAC,IAAI,CAAC;iBACb,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;gBACf,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;oBAC5C,OAAO,CAAC,GAAG,CACT,oBAAoB,MAAM,CAAC,EAAE,QAAQ,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,OAAO,UAAU,CACvF,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC,CAAC;QAC/E,CAAC,CAAC;QACF,2EAA2E;QAC3E,wDAAwD;QACxD,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC3C,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAClB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IACpC,CAAC;IAED,OAAO;QACL,MAAM;QACN,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,SAAS,EAAE,IAAI,EAAE,CAAC;YAClB,IAAI,OAAO,KAAK,IAAI;gBAAE,aAAa,CAAC,OAAO,CAAC,CAAC;YAC7C,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/tui/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The full-screen client.
+ *
+ * Both halves of the board in one window: find work, read what an agent has
+ * prepared for you and send it, and on the same account, publish a listing and
+ * read what came back. Which half you use is a tab, not a different program,
+ * because it is one person either way.
+ *
+ * Everything drawn lives in views.ts as pure functions; this file is the
+ * network, the keyboard and the state transitions and nothing else.
+ */
+import type { BoardClient } from '../client/client.ts';
+export declare function startTui(client: BoardClient): Promise<void>;

package/dist/tui/index.js

@@ -0,0 +1,266 @@
+/**
+ * The full-screen client.
+ *
+ * Both halves of the board in one window: find work, read what an agent has
+ * prepared for you and send it, and on the same account, publish a listing and
+ * read what came back. Which half you use is a tab, not a different program,
+ * because it is one person either way.
+ *
+ * Everything drawn lives in views.ts as pure functions; this file is the
+ * network, the keyboard and the state transitions and nothing else.
+ */
+import { createApp } from '@profullstack/hqtui';
+import { ApiError } from "../client/client.js";
+import { loadConfig } from "../client/config.js";
+import { render } from "./views.js";
+import { initialState, move, nextTab, selectedBoard, selectedDraft, selectedJob, } from "./state.js";
+export async function startTui(client) {
+    let state = initialState(client.server);
+    const app = await createApp({
+        // The board is read far more than it changes, so a lower cap keeps a
+        // remote session responsive without redrawing a static list 30 times a
+        // second.
+        fps: 20,
+        quitKeys: [],
+    });
+    const invalidate = (next) => {
+        state = next;
+        app.invalidate();
+    };
+    const busy = async (label, work) => {
+        invalidate({ ...state, busy: label, error: null });
+        try {
+            const value = await work();
+            invalidate({ ...state, busy: null });
+            return value;
+        }
+        catch (error) {
+            invalidate({
+                ...state,
+                busy: null,
+                error: error instanceof ApiError ? error.message : String(error),
+            });
+            return null;
+        }
+    };
+    const loadJobs = async () => {
+        const page = await busy('searching', () => client.search({ ...(state.query === '' ? {} : { q: state.query }), limit: 50 }));
+        if (page === null)
+            return;
+        invalidate({ ...state, jobs: page.items, jobsTotal: page.total, jobIndex: 0 });
+    };
+    const loadDrafts = async () => {
+        if (!state.signedIn)
+            return;
+        const result = await busy('loading drafts', () => client.request('GET', '/api/v1/applications/drafts'));
+        if (result === null)
+            return;
+        invalidate({ ...state, drafts: result.items, draftIndex: 0 });
+    };
+    const loadListings = async () => {
+        if (!state.canPost)
+            return;
+        const me = await busy('loading listings', () => client.me());
+        if (me === null)
+            return;
+        const slugs = new Set(me.orgs.map((org) => org.slug));
+        const pages = await Promise.all(me.orgs.map((org) => client.search({ org: org.slug, limit: 50 }).catch(() => null)));
+        const listings = pages
+            .filter((page) => page !== null)
+            .flatMap((page) => page.items)
+            .filter((job) => slugs.has(job.org.slug));
+        invalidate({ ...state, listings, listingIndex: 0 });
+    };
+    const loadBoards = () => {
+        const config = loadConfig();
+        invalidate({
+            ...state,
+            boards: Object.values(config.boards).map((board) => ({
+                server: board.server,
+                name: board.name ?? board.server,
+                email: board.email ?? null,
+                current: board.server === config.current,
+            })),
+        });
+    };
+    const identify = async () => {
+        if (!client.hasToken())
+            return;
+        try {
+            const me = await client.me();
+            invalidate({ ...state, signedIn: true, canPost: me.orgs.length > 0 });
+        }
+        catch {
+            // An expired token is not an error worth a red bar on the first frame;
+            // the status bar already says "not signed in".
+            invalidate({ ...state, signedIn: false, canPost: false });
+        }
+    };
+    const handleKey = async (event) => {
+        const key = event.key;
+        if (state.editing) {
+            if (key === 'escape') {
+                invalidate({ ...state, editing: false });
+                return;
+            }
+            if (key === 'enter') {
+                invalidate({ ...state, editing: false });
+                await loadJobs();
+                return;
+            }
+            if (key === 'backspace') {
+                invalidate({ ...state, query: state.query.slice(0, -1) });
+                return;
+            }
+            // Anything that is one printable character is typing. Named keys are
+            // longer than one character, which is the whole test.
+            if (key.length === 1 && event.ctrl !== true) {
+                invalidate({ ...state, query: state.query + key });
+            }
+            return;
+        }
+        if (key === 'q' || (key === 'c' && event.ctrl === true)) {
+            app.stop();
+            return;
+        }
+        if (key === '/') {
+            invalidate({ ...state, editing: true, tab: 'find', detail: null, query: '' });
+            return;
+        }
+        if (key === 'tab') {
+            const next = nextTab(state, 1);
+            invalidate(next);
+            await refresh(next.tab);
+            return;
+        }
+        if (key === 'escape' && state.detail !== null) {
+            invalidate({ ...state, detail: null });
+            return;
+        }
+        if (key === 'up' || key === 'k') {
+            invalidate(move(state, -1));
+            return;
+        }
+        if (key === 'down' || key === 'j') {
+            invalidate(move(state, 1));
+            return;
+        }
+        if (key === 'r') {
+            await refresh(state.tab);
+            return;
+        }
+        if (state.detail !== null) {
+            if (key === 'a' || key === 'd')
+                await apply(state.detail, key === 'd');
+            return;
+        }
+        if (key === 'enter') {
+            await activate();
+            return;
+        }
+        if (state.tab === 'listings' && (key === 'p' || key === 'c')) {
+            const job = selectedJob(state);
+            if (job === null)
+                return;
+            const action = key === 'p' ? 'publish' : 'close';
+            const result = await busy(action, () => client.request('POST', `/api/v1/jobs/${encodeURIComponent(job.slug)}/${action}`));
+            if (result !== null) {
+                invalidate({ ...state, message: `${job.title} is now ${result.job.status}.` });
+                await loadListings();
+            }
+            return;
+        }
+    };
+    const activate = async () => {
+        if (state.tab === 'find' || state.tab === 'listings') {
+            const job = selectedJob(state);
+            if (job !== null)
+                invalidate({ ...state, detail: job, message: null });
+            return;
+        }
+        if (state.tab === 'drafts') {
+            const draft = selectedDraft(state);
+            if (draft === null)
+                return;
+            const sent = await busy('sending', () => client.request('POST', `/api/v1/applications/${encodeURIComponent(draft.id)}/submit`));
+            if (sent !== null) {
+                invalidate({ ...state, message: `Sent your application for ${draft.jobTitle}.` });
+                await loadDrafts();
+            }
+            return;
+        }
+        if (state.tab === 'boards') {
+            const board = selectedBoard(state);
+            if (board === null)
+                return;
+            // Switching boards inside the TUI would mean rebuilding every client and
+            // every list; saying so is more honest than half-doing it.
+            invalidate({
+                ...state,
+                message: `Run: agenticjobs use ${board.server}  (then restart the TUI)`,
+            });
+        }
+    };
+    const apply = async (job, draft) => {
+        if (!state.signedIn) {
+            invalidate({ ...state, error: `Sign in first: agenticjobs login ${client.server}` });
+            return;
+        }
+        const resumes = await busy('reading your resumes', () => client.resumes());
+        if (resumes === null)
+            return;
+        const first = resumes.items[0];
+        if (first === undefined) {
+            invalidate({
+                ...state,
+                error: 'No resume saved. Run: agenticjobs resume import <file>',
+            });
+            return;
+        }
+        const me = await busy('applying', () => client.me());
+        if (me === null)
+            return;
+        const sent = await busy(draft ? 'preparing' : 'applying', () => client.apply(job.slug, {
+            name: me.user.name ?? me.user.email,
+            email: me.user.email,
+            cover: `Applying for ${job.title} at ${job.org.name}.`,
+            resumeSlug: first.slug,
+            ...(draft ? { submit: false } : {}),
+        }));
+        if (sent === null)
+            return;
+        invalidate({
+            ...state,
+            detail: null,
+            message: draft
+                ? `Prepared for ${job.title}. Read it on the Drafts tab and send it there.`
+                : `Applied to ${job.title}.`,
+        });
+        if (draft)
+            await loadDrafts();
+    };
+    const refresh = async (tab) => {
+        if (tab === 'find')
+            await loadJobs();
+        else if (tab === 'drafts')
+            await loadDrafts();
+        else if (tab === 'listings')
+            await loadListings();
+        else
+            loadBoards();
+    };
+    // Registered after handleKey exists, so the listener never fires into a
+    // binding that is still in its temporal dead zone.
+    app.on('key', (event) => {
+        void handleKey(event);
+    });
+    app.render((args) => {
+        render(args.ui, args.theme, state);
+    });
+    loadBoards();
+    await identify();
+    await loadJobs();
+    await loadDrafts();
+    await app.start();
+}
+//# sourceMappingURL=index.js.map