@profullstack/agenticjobs 0.1.0

package/dist/client/index.d.ts

@@ -0,0 +1,4 @@
+export * from './config.ts';
+export * from './client.ts';
+export * from './login.ts';
+export * from './fanout.ts';

package/dist/client/index.js

@@ -0,0 +1,5 @@
+export * from "./config.js";
+export * from "./client.js";
+export * from "./login.js";
+export * from "./fanout.js";
+//# sourceMappingURL=index.js.map

package/dist/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/client/login.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The device flow, without a UI.
+ *
+ * Anything that can block - the CLI, a script, an MCP server being set up -
+ * uses this rather than writing the polling loop again. The TUI drives the
+ * same two client calls itself, interleaved with its own event loop.
+ */
+import { type BoardClient } from './client.ts';
+export interface LoginOptions {
+    /** What the token is called in the member's session list. */
+    label: string;
+    /** Called once, with the code and the page a human has to open. */
+    onPrompt: (grant: {
+        userCode: string;
+        verifyUrl: string;
+        expiresAt: number;
+    }) => void;
+    /** Overridable so tests do not wait in real time. */
+    sleep?: (ms: number) => Promise<void>;
+}
+export declare class LoginError extends Error {
+}
+export declare function login(client: BoardClient, options: LoginOptions): Promise<string>;

package/dist/client/login.js

@@ -0,0 +1,45 @@
+/**
+ * The device flow, without a UI.
+ *
+ * Anything that can block - the CLI, a script, an MCP server being set up -
+ * uses this rather than writing the polling loop again. The TUI drives the
+ * same two client calls itself, interleaved with its own event loop.
+ */
+import { ApiError } from "./client.js";
+export class LoginError extends Error {
+}
+export async function login(client, options) {
+    const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    let grant;
+    try {
+        grant = await client.startDeviceAuth(options.label);
+    }
+    catch (error) {
+        // A server that does not answer the device endpoint is either not a board
+        // or is too old for one, and "404" alone does not say which.
+        if (error instanceof ApiError && error.status === 404) {
+            throw new LoginError(`${client.server} has no device sign-in endpoint. Is it an agenticjobs board, and recent enough?`);
+        }
+        throw error;
+    }
+    options.onPrompt({
+        userCode: grant.userCode,
+        verifyUrl: grant.verifyUrl,
+        expiresAt: grant.expiresAt,
+    });
+    // The board says how often it wants to be asked. Ignoring that interval is
+    // how a client gets itself rate-limited on the one request it cannot skip.
+    const interval = Math.max(1, grant.interval || 2) * 1000;
+    for (;;) {
+        await sleep(interval);
+        const poll = await client.pollDeviceAuth(grant.deviceCode);
+        if (poll.status === 'approved' && typeof poll.token === 'string') {
+            client.setToken(poll.token);
+            return poll.token;
+        }
+        if (poll.status === 'expired') {
+            throw new LoginError('That code expired before it was approved. Run the command again.');
+        }
+    }
+}
+//# sourceMappingURL=login.js.map

package/dist/client/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/client/login.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAoB,MAAM,aAAa,CAAC;AAWzD,MAAM,OAAO,UAAW,SAAQ,KAAK;CAAG;AAExC,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,MAAmB,EAAE,OAAqB;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAEnG,IAAI,KAA0D,CAAC;IAC/D,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0EAA0E;QAC1E,6DAA6D;QAC7D,IAAI,KAAK,YAAY,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACtD,MAAM,IAAI,UAAU,CAClB,GAAG,MAAM,CAAC,MAAM,iFAAiF,CAClG,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,OAAO,CAAC,QAAQ,CAAC;QACf,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;IAEH,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAEzD,SAAS,CAAC;QACR,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACjE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,UAAU,CAAC,kEAAkE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Everything this instance needs to know about itself, read once at boot.
+ *
+ * Reading `process.env` at the point of use is how one surface ends up on a
+ * different port than another, so it happens here and nowhere else.
+ */
+export interface Config {
+    databaseUrl: string;
+    port: number;
+    /** Interface to bind. `::` accepts IPv6 and IPv4-mapped addresses alike. */
+    host: string;
+    /** Public origin, no trailing slash. Every absolute URL is built from it. */
+    publicUrl: string;
+    boardName: string;
+    boardTagline: string;
+    topics: string[];
+    secret: string;
+    /** Directory to announce to, or null to stay unlisted. */
+    directoryUrl: string | null;
+    announce: boolean;
+    /** Whether this instance also runs a directory. */
+    isDirectory: boolean;
+    smtpUrl: string | null;
+    mailFrom: string;
+    version: string;
+    /** True when SECRET was generated rather than supplied. */
+    ephemeralSecret: boolean;
+}
+export declare function loadConfig(env?: NodeJS.ProcessEnv): Config;
+/** Kept in step with package.json by the release script. */
+export declare const VERSION = "0.1.0";
+export declare const SOFTWARE_NAME = "agenticjobs";
+/**
+ * Tokens are stored as a hash of what was handed out, so this is the only
+ * place that turns one into the other. Plain SHA-256 rather than a password
+ * KDF on purpose: these are 256-bit random values, not something a person
+ * chose, so there is no dictionary to slow an attacker down against.
+ */
+export declare function hashToken(token: string): string;
+export declare function mintToken(): string;

package/dist/config.js

@@ -0,0 +1,64 @@
+/**
+ * Everything this instance needs to know about itself, read once at boot.
+ *
+ * Reading `process.env` at the point of use is how one surface ends up on a
+ * different port than another, so it happens here and nowhere else.
+ */
+import { createHash, randomBytes } from 'node:crypto';
+function trimSlash(value) {
+    return value.replace(/\/+$/, '');
+}
+function flag(value, fallback = false) {
+    if (value === undefined || value.trim() === '')
+        return fallback;
+    return ['1', 'true', 'yes', 'on'].includes(value.trim().toLowerCase());
+}
+export function loadConfig(env = process.env) {
+    const port = Number.parseInt(env['PORT'] ?? '8787', 10) || 8787;
+    const publicUrl = trimSlash(env['PUBLIC_URL']?.trim() || `http://localhost:${port}`);
+    const supplied = env['SECRET']?.trim() ?? '';
+    // A missing secret is survivable for a laptop run and fatal for a deploy:
+    // every session and device code minted before a restart stops verifying.
+    // Generating one keeps `pnpm dev` working without making the failure quiet.
+    const ephemeralSecret = supplied === '';
+    const secret = ephemeralSecret ? randomBytes(32).toString('hex') : supplied;
+    const directoryRaw = env['DIRECTORY_URL']?.trim() ?? '';
+    return {
+        host: env['HOST']?.trim() || '0.0.0.0',
+        databaseUrl: env['DATABASE_URL']?.trim() ||
+            'postgres://agenticjobs:agenticjobs@localhost:5432/agenticjobs',
+        port,
+        publicUrl,
+        boardName: env['BOARD_NAME']?.trim() || 'Agentic Jobs',
+        boardTagline: env['BOARD_TAGLINE']?.trim() || 'Jobs posted here, not scraped from somewhere else.',
+        topics: (env['BOARD_TOPICS'] ?? 'agentic,ai,engineering')
+            .split(',')
+            .map((topic) => topic.trim().toLowerCase())
+            .filter((topic) => topic !== '')
+            .slice(0, 12),
+        secret,
+        ephemeralSecret,
+        directoryUrl: directoryRaw === '' ? null : trimSlash(directoryRaw),
+        announce: flag(env['ANNOUNCE']),
+        isDirectory: flag(env['DIRECTORY']),
+        smtpUrl: env['SMTP_URL']?.trim() || null,
+        mailFrom: env['MAIL_FROM']?.trim() || 'jobs@localhost',
+        version: env['npm_package_version']?.trim() || VERSION,
+    };
+}
+/** Kept in step with package.json by the release script. */
+export const VERSION = '0.1.0';
+export const SOFTWARE_NAME = 'agenticjobs';
+/**
+ * Tokens are stored as a hash of what was handed out, so this is the only
+ * place that turns one into the other. Plain SHA-256 rather than a password
+ * KDF on purpose: these are 256-bit random values, not something a person
+ * chose, so there is no dictionary to slow an attacker down against.
+ */
+export function hashToken(token) {
+    return createHash('sha256').update(token).digest('hex');
+}
+export function mintToken() {
+    return randomBytes(32).toString('base64url');
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAyBtD,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,IAAI,CAAC,KAAyB,EAAE,QAAQ,GAAG,KAAK;IACvD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAChE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;IAChE,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,oBAAoB,IAAI,EAAE,CAAC,CAAC;IAErF,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC7C,0EAA0E;IAC1E,yEAAyE;IACzE,4EAA4E;IAC5E,MAAM,eAAe,GAAG,QAAQ,KAAK,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAE5E,MAAM,YAAY,GAAG,GAAG,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAExD,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS;QACtC,WAAW,EACT,GAAG,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE;YAC3B,+DAA+D;QACjE,IAAI;QACJ,SAAS;QACT,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,cAAc;QACtD,YAAY,EACV,GAAG,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,oDAAoD;QACtF,MAAM,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,wBAAwB,CAAC;aACtD,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aAC1C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC;aAC/B,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QACf,MAAM;QACN,eAAe;QACf,YAAY,EAAE,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC;QAClE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC/B,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACnC,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI;QACxC,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,gBAAgB;QACtD,OAAO,EAAE,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,IAAI,OAAO;KACvD,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAC/B,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC"}

package/dist/core/applications.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Applications.
+ *
+ * The board's own application form is the one an agent can complete, so this
+ * is where the "agentic" part of the board is actually load-bearing: the same
+ * validator runs whether the answers arrived from an HTML form, a REST call or
+ * an MCP tool, and the agent disclosure is a first-class field rather than a
+ * sentence someone might write in the cover letter.
+ */
+import type pg from 'pg';
+import { type AgentDisclosure, type Application, type ApplicationStatus, type ApplySchema, type Job } from '../schema/index.ts';
+export interface ValidationProblem {
+    field: string;
+    message: string;
+}
+export interface ValidatedApplication {
+    answers: Record<string, string>;
+    agent: AgentDisclosure | null;
+}
+/**
+ * Check answers against the schema the job published.
+ *
+ * Every problem is collected rather than thrown at the first one. A caller
+ * that is a model gets one round trip to fix everything instead of one per
+ * mistake, and a caller that is a person gets a form that does not lose four
+ * fields to reveal a fifth.
+ */
+export declare function validateApplication(schema: ApplySchema, input: Record<string, unknown>, policy: Job['agentPolicy']): {
+    ok: true;
+    value: ValidatedApplication;
+} | {
+    ok: false;
+    problems: ValidationProblem[];
+};
+/**
+ * Create an application, sent or held.
+ *
+ * `submit: false` writes a draft: an agent has prepared it and the candidate
+ * has not released it yet. A draft is not an application - the employer never
+ * sees one - which is the point. It is the same seam a job posting has, where
+ * an employer's agent writes the listing and a person publishes it.
+ */
+export declare function createApplication(pool: pg.Pool, jobId: string, value: ValidatedApplication, options?: {
+    submit?: boolean;
+}): Promise<Application>;
+/**
+ * Release a draft the candidate has read.
+ *
+ * Scoped to the owner and to the draft state in one statement, so a second
+ * click cannot send it twice and nobody can release someone else's.
+ */
+export declare function submitApplication(pool: pg.Pool, id: string, userId: string): Promise<boolean>;
+export declare function listDraftApplications(pool: pg.Pool, userId: string): Promise<(Application & {
+    jobTitle: string;
+    jobSlug: string;
+})[]>;
+export declare function listApplications(pool: pg.Pool, jobId: string, limit?: number): Promise<Application[]>;
+export declare function setApplicationStatus(pool: pg.Pool, id: string, status: ApplicationStatus): Promise<boolean>;
+/**
+ * How many applications an address has sent to one board recently.
+ *
+ * Used as a rate limit. Counting by the answer to the email field rather than
+ * by IP is deliberate: an agent applying on someone's behalf legitimately runs
+ * from a different address every time, and the thing worth limiting is one
+ * person flooding a board, not one network.
+ */
+export declare function recentApplicationCount(pool: pg.Pool, email: string, withinMinutes?: number): Promise<number>;

package/dist/core/applications.js

@@ -0,0 +1,187 @@
+/**
+ * Applications.
+ *
+ * The board's own application form is the one an agent can complete, so this
+ * is where the "agentic" part of the board is actually load-bearing: the same
+ * validator runs whether the answers arrived from an HTML form, a REST call or
+ * an MCP tool, and the agent disclosure is a first-class field rather than a
+ * sentence someone might write in the cover letter.
+ */
+import { APPLICATION_STATUSES, } from "../schema/index.js";
+import { clean } from "../schema/text.js";
+function toApplication(row) {
+    return {
+        id: row.id,
+        jobId: row.job_id,
+        answers: row.answers ?? {},
+        agent: row.agent,
+        status: APPLICATION_STATUSES.includes(row.status)
+            ? row.status
+            : 'new',
+        submittedAt: row.submitted_at ?? null,
+        createdAt: row.created_at,
+    };
+}
+/**
+ * Check answers against the schema the job published.
+ *
+ * Every problem is collected rather than thrown at the first one. A caller
+ * that is a model gets one round trip to fix everything instead of one per
+ * mistake, and a caller that is a person gets a form that does not lose four
+ * fields to reveal a fifth.
+ */
+export function validateApplication(schema, input, policy) {
+    const problems = [];
+    const answers = {};
+    for (const field of schema.fields) {
+        const raw = input[field.name];
+        const value = clean(raw, field.maxLength ?? 2000);
+        if (value === '') {
+            if (field.required)
+                problems.push({ field: field.name, message: `${field.label} is required.` });
+            continue;
+        }
+        if (field.type === 'email' && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value)) {
+            problems.push({ field: field.name, message: `${field.label} is not a valid email address.` });
+            continue;
+        }
+        if (field.type === 'url') {
+            try {
+                const url = new URL(value.includes('://') ? value : `https://${value}`);
+                if (url.protocol !== 'https:' && url.protocol !== 'http:')
+                    throw new Error('scheme');
+                answers[field.name] = url.toString();
+                continue;
+            }
+            catch {
+                problems.push({ field: field.name, message: `${field.label} is not a valid link.` });
+                continue;
+            }
+        }
+        if (field.type === 'select' && field.options !== undefined && field.options.length > 0) {
+            const match = field.options.find((option) => option.toLowerCase() === value.toLowerCase());
+            if (match === undefined) {
+                problems.push({
+                    field: field.name,
+                    message: `${field.label} must be one of: ${field.options.join(', ')}.`,
+                });
+                continue;
+            }
+            answers[field.name] = match;
+            continue;
+        }
+        answers[field.name] = value;
+    }
+    const agent = parseDisclosure(input['agent']);
+    // The policy is enforced here rather than at the edge so that it holds for
+    // the HTML form and the API alike. `human-only` is a request, not a
+    // technical control, and saying so plainly is more honest than pretending
+    // the board can tell.
+    if (policy === 'disclose' && agent === null && input['agent'] !== undefined) {
+        problems.push({
+            field: 'agent',
+            message: 'This employer asks applications written with an agent to say so.',
+        });
+    }
+    if (policy === 'human-only' && agent !== null) {
+        problems.push({
+            field: 'agent',
+            message: 'This employer asks for applications written by a person.',
+        });
+    }
+    if (problems.length > 0)
+        return { ok: false, problems };
+    return { ok: true, value: { answers, agent } };
+}
+function parseDisclosure(value) {
+    if (value === null || value === undefined || value === false || value === '')
+        return null;
+    if (typeof value === 'string') {
+        const name = clean(value, 120);
+        return name === '' ? null : { name, supervised: false };
+    }
+    if (typeof value !== 'object')
+        return null;
+    const record = value;
+    const name = clean(record['name'], 120);
+    if (name === '')
+        return null;
+    return { name, supervised: record['supervised'] === true };
+}
+/**
+ * Create an application, sent or held.
+ *
+ * `submit: false` writes a draft: an agent has prepared it and the candidate
+ * has not released it yet. A draft is not an application - the employer never
+ * sees one - which is the point. It is the same seam a job posting has, where
+ * an employer's agent writes the listing and a person publishes it.
+ */
+export async function createApplication(pool, jobId, value, options = {}) {
+    const submit = options.submit !== false;
+    const result = await pool.query(`insert into applications (job_id, answers, agent, status, submitted_at)
+     values ($1, $2::jsonb, $3::jsonb, $4, case when $5 then now() else null end)
+     returning id, job_id, answers, agent, status, created_at, submitted_at`, [
+        jobId,
+        JSON.stringify(value.answers),
+        value.agent === null ? null : JSON.stringify(value.agent),
+        submit ? 'new' : 'draft',
+        submit,
+    ]);
+    const row = result.rows[0];
+    if (row === undefined)
+        throw new Error('application insert returned no row');
+    return toApplication(row);
+}
+/**
+ * Release a draft the candidate has read.
+ *
+ * Scoped to the owner and to the draft state in one statement, so a second
+ * click cannot send it twice and nobody can release someone else's.
+ */
+export async function submitApplication(pool, id, userId) {
+    const result = await pool.query(`update applications
+        set status = 'new', submitted_at = now()
+      where id = $1 and user_id = $2 and submitted_at is null`, [id, userId]);
+    return (result.rowCount ?? 0) > 0;
+}
+export async function listDraftApplications(pool, userId) {
+    const result = await pool.query(`select a.id, a.job_id, a.answers, a.agent, a.status, a.created_at, a.submitted_at,
+            j.title as job_title, j.slug as job_slug
+       from applications a join jobs j on j.id = a.job_id
+      where a.user_id = $1 and a.submitted_at is null
+      order by a.created_at desc limit 100`, [userId]);
+    return result.rows.map((row) => ({
+        ...toApplication(row),
+        jobTitle: row.job_title,
+        jobSlug: row.job_slug,
+    }));
+}
+export async function listApplications(pool, jobId, limit = 100) {
+    const result = await pool.query(`select id, job_id, answers, agent, status, created_at, submitted_at
+       from applications
+      where job_id = $1 and submitted_at is not null
+      order by created_at desc
+      limit $2`, [jobId, Math.min(500, Math.max(1, limit))]);
+    return result.rows.map(toApplication);
+}
+export async function setApplicationStatus(pool, id, status) {
+    const result = await pool.query(`update applications set status = $2 where id = $1`, [id, status]);
+    return (result.rowCount ?? 0) > 0;
+}
+/**
+ * How many applications an address has sent to one board recently.
+ *
+ * Used as a rate limit. Counting by the answer to the email field rather than
+ * by IP is deliberate: an agent applying on someone's behalf legitimately runs
+ * from a different address every time, and the thing worth limiting is one
+ * person flooding a board, not one network.
+ */
+export async function recentApplicationCount(pool, email, withinMinutes = 60) {
+    const result = await pool.query(`select count(*)::bigint as count
+       from applications
+      where created_at > now() - ($2 || ' minutes')::interval
+        and submitted_at is not null
+        and lower(answers ->> 'email') = lower($1)`, [email, String(withinMinutes)]);
+    return result.rows[0]?.count ?? 0;
+}
+//# sourceMappingURL=applications.js.map

package/dist/core/applications.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"applications.js","sourceRoot":"","sources":["../../src/core/applications.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EACL,oBAAoB,GAMrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAY1C,SAAS,aAAa,CAAC,GAAmB;IACxC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,MAAM;QACjB,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE;QAC1B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,MAAM,EAAG,oBAA0C,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YACtE,CAAC,CAAE,GAAG,CAAC,MAA4B;YACnC,CAAC,CAAC,KAAK;QACT,WAAW,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI;QACrC,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC;AAYD;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAmB,EACnB,KAA8B,EAC9B,MAA0B;IAE1B,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,MAAM,OAAO,GAA2B,EAAE,CAAC;IAE3C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;QAElD,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACjB,IAAI,KAAK,CAAC,QAAQ;gBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,KAAK,eAAe,EAAE,CAAC,CAAC;YACjG,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,KAAK,gCAAgC,EAAE,CAAC,CAAC;YAC9F,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC;gBACxE,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACrF,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACrC,SAAS;YACX,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,KAAK,uBAAuB,EAAE,CAAC,CAAC;gBACrF,SAAS;YACX,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;YAC3F,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,QAAQ,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,KAAK,CAAC,IAAI;oBACjB,OAAO,EAAE,GAAG,KAAK,CAAC,KAAK,oBAAoB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;iBACvE,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YAC5B,SAAS;QACX,CAAC;QAED,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC9B,CAAC;IAED,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAE9C,2EAA2E;IAC3E,oEAAoE;IACpE,0EAA0E;IAC1E,sBAAsB;IACtB,IAAI,MAAM,KAAK,UAAU,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5E,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,kEAAkE;SAC5E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,KAAK,YAAY,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC9C,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,0DAA0D;SACpE,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACxD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1F,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/B,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IACxC,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAa,EACb,KAAa,EACb,KAA2B,EAC3B,UAAgC,EAAE;IAElC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;4EAEwE,EACxE;QACE,KAAK;QACL,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;QAC7B,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;QACzD,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO;QACxB,MAAM;KACP,CACF,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,GAAG,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC7E,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAa,EACb,EAAU,EACV,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;8DAE0D,EAC1D,CAAC,EAAE,EAAE,MAAM,CAAC,CACb,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAa,EACb,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;2CAIuC,EACvC,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/B,GAAG,aAAa,CAAC,GAAG,CAAC;QACrB,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,OAAO,EAAE,GAAG,CAAC,QAAQ;KACtB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAa,EACb,KAAa,EACb,KAAK,GAAG,GAAG;IAEX,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;eAIW,EACX,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAC3C,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAa,EACb,EAAU,EACV,MAAyB;IAEzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,mDAAmD,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACnG,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAa,EACb,KAAa,EACb,aAAa,GAAG,EAAE;IAElB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;mDAI+C,EAC/C,CAAC,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAC/B,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;AACpC,CAAC"}

package/dist/core/auth.d.ts

@@ -0,0 +1,120 @@
+/**
+ * Who someone is, established four ways: a magic link, a passkey, an existing
+ * session cookie, or the device flow for anything without a browser.
+ *
+ * No passwords anywhere. That is the house rule and it is also the reason the
+ * device flow exists: a terminal cannot follow a magic link, so it asks the
+ * board for a short code instead and a browser approves it.
+ */
+import type pg from 'pg';
+export interface Viewer {
+    id: string;
+    email: string;
+    name: string | null;
+    isAdmin: boolean;
+    /**
+     * True when the caller authenticated with a device-flow token rather than a
+     * browser session. Such a caller is never an administrator, whatever the
+     * account says — see `requireAdmin`.
+     */
+    viaToken: boolean;
+}
+export declare const SESSION_COOKIE = "aj_session";
+export declare function normaliseEmail(value: unknown): string | null;
+interface UserRow {
+    id: string;
+    email: string;
+    name: string | null;
+    is_admin: boolean;
+}
+/**
+ * Find or create the account for an address.
+ *
+ * The first account on a board becomes its administrator. Any other rule
+ * requires a setup step someone has to be told about, and an installer that
+ * leaves the operator locked out of their own board is not an installer.
+ */
+export declare function ensureUser(pool: pg.Pool, email: string, name?: string): Promise<UserRow>;
+export declare function createSession(pool: pg.Pool, userId: string, options?: {
+    label?: string;
+    viaToken?: boolean;
+    ttlMs?: number;
+}): Promise<string>;
+export declare function viewerFromToken(pool: pg.Pool, token: string): Promise<Viewer | null>;
+export declare function revokeSession(pool: pg.Pool, token: string): Promise<void>;
+/**
+ * A device-flow token is never an administrator.
+ *
+ * The token was typed into a terminal and lives in a file on disk; a browser
+ * session was established in front of the person it belongs to. Treating them
+ * as equivalent would make every CLI token a full admin credential.
+ */
+export declare function requireAdmin(viewer: Viewer | null): viewer is Viewer;
+export interface MagicLink {
+    token: string;
+    expiresAt: string;
+}
+/** Only same-origin paths. An open redirect on a login link is a phish. */
+export declare function safeRedirect(value: unknown): string | null;
+export declare function startMagicLink(pool: pg.Pool, email: string, redirect: string | null): Promise<MagicLink>;
+export interface ConsumedLink {
+    user: UserRow;
+    redirect: string | null;
+}
+/**
+ * Spend a magic link.
+ *
+ * The update is what claims it, not a read followed by a write: two clicks
+ * arriving together (a mail client prefetching the link, then the person
+ * clicking it) would both pass a read-then-write check.
+ */
+export declare function consumeMagicLink(pool: pg.Pool, token: string): Promise<ConsumedLink | null>;
+export interface DeviceGrant {
+    deviceCode: string;
+    userCode: string;
+    verifyUrl: string;
+    interval: number;
+    expiresAt: number;
+}
+export declare function startDeviceAuth(pool: pg.Pool, label: string, publicUrl: string): Promise<DeviceGrant>;
+export type DevicePoll = {
+    status: 'pending';
+} | {
+    status: 'expired';
+} | {
+    status: 'approved';
+    token: string;
+};
+/**
+ * Collect the token for an approved code.
+ *
+ * The token is cleared in the same statement that returns it, so it is handed
+ * over exactly once: a second poll with the same device code gets nothing,
+ * which is what makes a leaked poll response useless.
+ *
+ * An unknown or expired code reports `expired` rather than `pending`. A client
+ * told `pending` for a code the server has forgotten polls until its own
+ * timeout with no way to tell that it is waiting for nothing.
+ */
+export declare function pollDeviceAuth(pool: pg.Pool, deviceCode: string): Promise<DevicePoll>;
+export interface PendingDevice {
+    userCode: string;
+    label: string;
+}
+export declare function findDeviceCode(pool: pg.Pool, code: string): Promise<PendingDevice | null>;
+export declare function approveDeviceCode(pool: pg.Pool, code: string, userId: string): Promise<boolean>;
+export declare function storeChallenge(pool: pg.Pool, challenge: string, purpose: 'register' | 'login', who: {
+    email?: string;
+    userId?: string;
+}): Promise<void>;
+export interface StoredChallenge {
+    challenge: string;
+    email: string | null;
+    userId: string | null;
+    purpose: string;
+}
+/** Claimed on read: a challenge is single use by definition. */
+export declare function takeChallenge(pool: pg.Pool, challenge: string): Promise<StoredChallenge | null>;
+/** Swept opportunistically rather than on a timer, so there is no worker. */
+export declare function sweepExpired(pool: pg.Pool): Promise<void>;
+export {};