@sigrun/sigrun 0.1.6 → 0.2.1

package/dist/server/index.js

@@ -31,6 +31,8 @@
  * enumeration; the storage scan is authoritative.
  */
 import Fastify from "fastify";
+import { join } from "node:path";
+import { LoginFlows } from "./login/flows.js";
 import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
 import { buildCommandCatalog, SLASH_COMMANDS } from "./commands.js";
 import { effectiveMethods } from "../config.js";
@@ -41,7 +43,9 @@ import { storeAgentChange } from "./helpers.js";
 import { registerCoreOwnershipParticipant } from "./ownership.js";
 import { createHostBridge } from "./host-bridge.js";
 import { registerJobsOwnershipParticipant } from "../jobs/transfer.js";
+import { registerAdminRoutes } from "./routes/admin.js";
 import { registerAuthRoutes } from "./routes/auth.js";
+import { registerLoginRoutes } from "./routes/login.js";
 import { registerConversationRoutes } from "./routes/conversations.js";
 import { registerEventRoutes } from "./routes/events.js";
 import { registerExtensionRoutes as registerExtensionSettingsRoutes } from "./routes/extensions.js";
@@ -50,17 +54,26 @@ import { registerExtAssetRoutes } from "./routes/ext-assets.js";
 import { registerFileRoutes } from "./routes/files.js";
 import { registerJobRoutes } from "./routes/jobs.js";
 import { registerInteractionRoutes } from "./routes/interactions.js";
+import { registerMeRoutes } from "./routes/me.js";
 import { registerMetaRoutes } from "./routes/meta.js";
 import { registerMetricsRoutes } from "./routes/metrics.js";
 import { registerOnboardingRoutes } from "./routes/onboarding.js";
 import { registerProbeRoutes } from "./routes/probes.js";
 import { registerProviderRoutes } from "./routes/providers.js";
 import { registerSettingsRoutes } from "./routes/settings.js";
+import { registerSettingsSectionsRoutes } from "./routes/settings-sections.js";
 import { registerStreamRoutes } from "./routes/stream.js";
 import { startNotifications } from "./notifications.js";
+import { selfPackageRoot } from "../harness/packages.js";
 import { registerSubmissionRoutes } from "./routes/submissions.js";
 import { registerSurfaceRoutes } from "./routes/surfaces.js";
+import { subscribeChatSurfaceChanged } from "../harness/blocks/tools.js";
+import { loadOrCreateKey, signUrl } from "./images/sign.js";
+import { ImageCache } from "./images/cache.js";
+import { registerImageRoutes } from "./routes/images.js";
 import { SurfaceService } from "./surfaces/service.js";
+import { settingsSurfaceFor } from "./surfaces/settings-surfaces.js";
+import { CORE_SETTINGS_SECTIONS } from "../settings/core-sections.js";
 import { registerUserRoutes } from "./routes/users.js";
 import { resolveWebuiBundle, serveWebuiBundle, } from "./static.js";
 /**
@@ -79,8 +92,10 @@ import { resolveWebuiBundle, serveWebuiBundle, } from "./static.js";
  * checks, the public surface, the env service token, the setup gate,
  * then the configured methods — the resolved principal stamps
  * `SessionMeta.owner` at create/fork/import.
- * @param options.listenHost the host the server will bind (default
- * `"0.0.0.0"`); the pipeline's Host check and the default method list
+ * @param options.listenHost the host the server will bind (fallback
+ * `"0.0.0.0"` when omitted; `serve()` passes its ONE resolved host —
+ * `options.host` → `SIGRUN_LISTEN_HOST` → the dual-stack `::`, serving
+ * spec §1); the pipeline's Host check and the default method list
  * (`effectiveMethods`) both derive from it.
  * @param contributedBundles the extension-contributed webui-bundle registry
  * (build-and-webui Task 6 threads it here from boot; the serve-time
@@ -93,7 +108,17 @@ import { resolveWebuiBundle, serveWebuiBundle, } from "./static.js";
  * env-less boot).
  */
 export async function createServer(opened, config, contributedBundles = [], options) {
-    const app = Fastify({ logger: false });
+    const app = Fastify({
+        logger: false,
+        // U7 Task 3: the image route's GET `src=data:` form carries up to
+        // 192 KiB of base64 in the query string, which counts toward
+        // Node's 16 KiB default header cap and would be 431-rejected at
+        // the HTTP layer before the route's own §11.1 413 could answer.
+        // 256 KiB admits the cap-sized URL; the route enforces the real
+        // limit (192 KiB) itself. The POST form (the body path) stays the
+        // recommended shape for long data URLs.
+        http: { maxHeaderSize: 256 * 1024 },
+    });
     const listenHost = options?.listenHost ?? "0.0.0.0";
     const env = options?.env ?? {};
     // The one body-limit error shape (spec §6.2, W2): Fastify's
@@ -162,13 +187,38 @@ export async function createServer(opened, config, contributedBundles = [], opti
     // effective method list), and the boot env (the settings routes'
     // `effective` block reads it).
     const sse = new SseRegistry();
+    // The chat-surface seam's unsubscribe (filled in just below, after
+    // the events hub exists to publish onto; never reassigned after).
+    let unsubscribeChatSurfaceChanged = () => { };
     // Decorated for the shutdown path (serve.ts): fastify's own drain waits
     // on in-flight requests, so the SSE registry must be endable from the
     // OUTSIDE before app.close() — a decoration is the typed, discoverable
     // way to hand that handle up without widening ServerContext's consumers.
     app.decorate("sse", sse);
+    // The image-proxy signer (U7 Task 1, spec §11.2): the key is loaded
+    // (created at first boot) from the state dir — deleting the file
+    // rotates it — and every surface tree/data answer rewrites https
+    // image sources through it at serve time.
+    const imageKey = await loadOrCreateKey(config.stateDir);
+    const imageSign = (u) => signUrl(imageKey, u, Date.now());
+    // The proxy cache + fetch deps (U7 Task 3, spec §11.2): the on-disk
+    // LRU under `<cacheDir>/images/`; the deps are the real resolver +
+    // clock unless a test injects its own.
+    const imageCache = new ImageCache(config.cacheDir);
+    const imageDeps = {
+        resolve: async (host) => {
+            const { lookup } = await import("node:dns/promises");
+            const addresses = await lookup(host, { all: true, verbatim: true });
+            return addresses.map((entry) => entry.address);
+        },
+        now: Date.now,
+        ...options?.imageFetch,
+    };
     const surfacesService = new SurfaceService(opened.extensionSurfaces, {
         maxUploadBytes: config.maxUploadBytes,
+        // Signs https image URLs into expiring proxy URLs (U7 Task 1,
+        // spec §11.2) on every tree/data response.
+        imageSign,
         // Task 4: bumpRev (actions AND the host seam's changed()) fans the
         // surface.changed event out to the hub; the events route's
         // visibility case delivers it to watching streams only.
@@ -180,21 +230,97 @@ export async function createServer(opened, config, contributedBundles = [], opti
             opened.events.publish(event);
         },
     });
+    // The settings sections (UI-blocks U4 Task 3, spec §13.3): each
+    // declared section adapts to a settings-placement surface served under
+    // the declaring extension's own `/v1/ext/<slug>/surfaces/` mount. The
+    // save handlers close over the service (the optimistic-concurrency
+    // rev read), so the adaptation attaches AFTER the service exists.
+    surfacesService.attachSettingsSurfaces(opened.extensionSettingsSections.map((binding) => ({
+        extension: binding.extension,
+        defs: binding.defs.map((section) => settingsSurfaceFor(binding.extension, section, {
+            stores: opened.extensionStores,
+            publishSettingsChanged: opened.publishSettingsChanged,
+            service: surfacesService,
+        })),
+    })));
+    // The core settings sections (U4 Task 4, spec §13.4): the same
+    // renderer under the reserved `core` slug — core and extensions run
+    // ONE code path. The core saves write the core SettingsStore (dotted
+    // names land at their nested paths, apply-typed), not the extension
+    // settings dir.
+    surfacesService.attachSettingsSurfaces([
+        {
+            extension: "core",
+            defs: CORE_SETTINGS_SECTIONS.map((section) => settingsSurfaceFor("core", section, {
+                stores: opened.extensionStores,
+                publishSettingsChanged: opened.publishSettingsChanged,
+                service: surfacesService,
+                core: {
+                    settings: opened.settings,
+                    bootSnapshot: opened.settingsBootSnapshot,
+                    env,
+                    // The Tools section's default-tools options (the boot
+                    // registry's tool names, deduped — the roster the
+                    // checkbox list edits against).
+                    toolRoster: [
+                        ...new Set(opened.registry
+                            .snapshot()
+                            .tools()
+                            .map((entry) => entry.tool.name)),
+                    ],
+                },
+            })),
+        },
+    ]);
     app.decorate("surfaces", surfacesService);
+    // The chat-block change seam (UI-blocks U5 Task 2, spec §8.2):
+    // show_blocks/update_blocks AND the user-edit route publish
+    // `surface.changed` through the Task-1 in-process seam; binding it
+    // here forwards every event onto the hub, where the events route's
+    // exhaustive switch gives the CHAT shape the conversation-scoped
+    // delivery path (SessionMeta re-snapshot + accessOf per event).
+    unsubscribeChatSurfaceChanged = subscribeChatSurfaceChanged((event) => {
+        // SAFETY: the chat event IS the wire union's second surface.changed
+        // member (same declaration, re-exported through the seam type) —
+        // the publish types on the union the events switch discriminates.
+        opened.events.publish(event);
+    });
+    const roots = opened.extensionStores.roots;
     const ctx = {
         opened,
         config,
+        managedPaths: {
+            roots,
+            storagePath: config.storagePath,
+            coreRoot: selfPackageRoot() ?? process.cwd(),
+            userAreas: (user) => join(roots.dataDir, "users", user),
+        },
         rootId,
         webuiBundle,
         commandCatalog,
         listenHost,
         methods,
+        // The listener record (release-readiness Task 1, serving spec §2):
+        // host + port are the server construction's inputs; `families`
+        // starts EMPTY (never listened) and `serve()` fills it in place
+        // with the measured families after `app.listen` resolves — the
+        // meta route reads whichever state exists at request time, never
+        // probing itself. A hand-built test server serves intent only.
+        listener: { host: listenHost, port: config.port, families: [] },
         env,
+        // U4 §13.2: the harness's settings-changed fan-out (hub publish +
+        // extension onSettingsChanged + the scheduler re-arm).
+        publishSettingsChanged: opened.publishSettingsChanged,
         watchersByConversation: new Map(),
         surfaces: surfacesService,
         sse,
+        imageProxy: { cache: imageCache, deps: imageDeps, key: imageKey },
         ...(options?.gateway === undefined ? {} : { gateway: options.gateway }),
+        ...(options?.onRestart === undefined
+            ? {}
+            : { requestRestart: options.onRestart }),
     };
+    app.decorate("sigrunContext", ctx);
     // The host bridge (W5 Task 5, spec §9.5/§9.7): ONE bridge over this
     // server's context, bound onto every seam host — the extension-facing
     // conversations/users/access/identity surface then runs the SAME
@@ -202,7 +328,11 @@ export async function createServer(opened, config, contributedBundles = [], opti
     // implementation). Bound here, after the context exists and before any
     // route or extension code can serve a request; calls issued earlier
     // (a factory body) have been waiting on exactly this assignment.
-    opened.bindHostBridge(createHostBridge(ctx));
+    const hostBridge = createHostBridge(ctx);
+    opened.bindHostBridge(hostBridge);
+    // Decorated like `sse`/`surfaces`: the bridge is the server-owned
+    // handle tests (and only tests) reach the W5 bridge path through.
+    app.decorate("hostBridge", hostBridge);
     // The notifications surface (W5 Task 6, spec §9.6): one hub
     // subscription turning host events into per-recipient
     // NotificationEvents for every collected notifier contribution,
@@ -217,10 +347,16 @@ export async function createServer(opened, config, contributedBundles = [], opti
     // `request.principal` before any route runs.
     registerAuthPipeline(app, ctx);
     registerAuthRoutes(app, ctx);
+    registerLoginRoutes(app, ctx, {
+        ...(options?.loginResolver === undefined ? {} : { resolver: options.loginResolver }),
+        ...(options?.loginNow === undefined ? {} : { flows: new LoginFlows(options.loginNow) }),
+    });
     registerOnboardingRoutes(app, ctx);
     registerUserRoutes(app, ctx);
+    registerMeRoutes(app, ctx);
     registerProbeRoutes(app, ctx);
     registerMetaRoutes(app, ctx);
+    registerAdminRoutes(app, ctx);
     registerMetricsRoutes(app, ctx);
     registerConversationRoutes(app, ctx);
     registerStreamRoutes(app, ctx);
@@ -230,6 +366,7 @@ export async function createServer(opened, config, contributedBundles = [], opti
     registerFileRoutes(app, ctx);
     registerProviderRoutes(app, ctx);
     registerSettingsRoutes(app, ctx);
+    registerSettingsSectionsRoutes(app, ctx);
     registerExtensionSettingsRoutes(app, ctx);
     // The extension HTTP routes (W5 Task 2, spec §9.2): every collected
     // `routes` contribution mounted at `/v1/ext/<slug>/<path>` behind the
@@ -244,6 +381,10 @@ export async function createServer(opened, config, contributedBundles = [], opti
     // `/v1/ext/<slug>/assets/*` serves the package's declared
     // `sigrun.assets` dir, realpath-contained, sniffed content types.
     registerExtAssetRoutes(app, ctx);
+    // The image-proxy routes (UI-blocks U7 Task 3, spec §11.2): signed
+    // remote fetches through the on-disk LRU, the `src=` asset/data form,
+    // and the POST long-data-URL form.
+    registerImageRoutes(app, ctx);
     // The jobs routes (W4 Task 4, spec §8.4): the access-scoped CRUD +
     // run-now + history surface over `OpenedHarness.jobs` (Task 3's
     // service). Hidden-is-404 per §5.9; `file:`/`ext:` ids are immutable
@@ -263,5 +404,12 @@ export async function createServer(opened, config, contributedBundles = [], opti
     // next boot's reconciliation warns (the declared owner no longer
     // exists — the job runs ownerless until the file is edited).
     registerJobsOwnershipParticipant(ctx);
+    // The chat-surface seam's teardown: the subscription lives for the
+    // app's lifetime (the module seam is process-global), but the
+    // unsubscribe is kept so a future embedder (a second createServer
+    // over one harness in tests) can detach a bound server cleanly.
+    app.addHook("onClose", async () => {
+        unsubscribeChatSurfaceChanged();
+    });
     return app;
 }

package/dist/server/login/flows.js

@@ -0,0 +1,126 @@
+import { randomBytes } from "node:crypto";
+const FLOW_TTL_MS = 600_000;
+/** Generous per-server ceiling; oldest entries are evicted under pressure. */
+export const MAX_ACTIVE_LOGIN_FLOWS = 10_000;
+/** One short-lived random browser/state credential. */
+function key() {
+    return randomBytes(32).toString("base64url");
+}
+/**
+ * In-memory, per-server login flows. `take` is atomic and single-use: a
+ * replay, a different browser key, or an expired entry returns undefined.
+ */
+export class LoginFlows {
+    #now;
+    #flows = new Map();
+    #consumed = new Map();
+    #pending = new Map();
+    constructor(now = Date.now) {
+        this.#now = now;
+    }
+    get size() {
+        return this.#flows.size;
+    }
+    get consumedSize() {
+        return this.#consumed.size;
+    }
+    start(provider, opts) {
+        this.#prune();
+        const state = key();
+        const browserKey = key();
+        const flow = {
+            provider,
+            state,
+            callbackUrl: "",
+            data: {},
+            returnTo: opts.returnTo,
+            ...(opts.link === undefined ? {} : { link: opts.link }),
+            browserKey,
+            expiresAt: this.#now() + FLOW_TTL_MS,
+        };
+        this.#flows.set(state, flow);
+        this.#evictOldest(this.#flows);
+        return flow;
+    }
+    /** Save provider scratch data and the callback URL after `begin` succeeds. */
+    save(state, flow) {
+        const stored = this.#flows.get(state);
+        if (stored === undefined)
+            return;
+        stored.callbackUrl = flow.callbackUrl;
+        stored.data = flow.data;
+    }
+    take(state, browserKey) {
+        this.#prune();
+        const flow = this.#flows.get(state);
+        if (flow === undefined || flow.browserKey !== browserKey)
+            return undefined;
+        this.#flows.delete(state);
+        this.#consumed.set(state, {
+            browserKey,
+            expiresAt: flow.expiresAt,
+        });
+        this.#evictOldest(this.#consumed);
+        return flow;
+    }
+    /** Park a verified proof for ten more minutes under a separate, single-use key. */
+    park(flow, result) {
+        this.#prune();
+        const pendingKey = key();
+        const pending = {
+            provider: flow.provider,
+            result,
+            returnTo: flow.returnTo,
+            expiresAt: this.#now() + FLOW_TTL_MS,
+        };
+        this.#pending.set(pendingKey, pending);
+        this.#evictOldest(this.#pending);
+        return { key: pendingKey, pending };
+    }
+    /** Put a pending proof back after a rejected code, preserving its original expiry. */
+    restorePending(pendingKey, pending) {
+        this.#prune();
+        this.#pending.set(pendingKey, pending);
+        this.#evictOldest(this.#pending);
+    }
+    /** Consume a code-resume key atomically; replay/expiry/restart all fail closed. */
+    takePending(pendingKey) {
+        this.#prune();
+        const pending = this.#pending.get(pendingKey);
+        if (pending !== undefined)
+            this.#pending.delete(pendingKey);
+        return pending;
+    }
+    /** Explain a failed take without exposing flow data (replay vs expired/unknown). */
+    failure(state, browserKey) {
+        this.#prune();
+        if (this.#flows.has(state))
+            return "invalid_state";
+        return this.#consumed.get(state)?.browserKey === browserKey
+            ? "invalid_state"
+            : "login_expired";
+    }
+    #evictOldest(entries) {
+        while (entries.size > MAX_ACTIVE_LOGIN_FLOWS) {
+            const oldest = entries.keys().next();
+            if (oldest.done === true)
+                break;
+            entries.delete(oldest.value);
+        }
+    }
+    #prune() {
+        const now = this.#now();
+        for (const [state, flow] of this.#flows) {
+            if (flow.expiresAt <= now)
+                this.#flows.delete(state);
+        }
+        for (const [state, consumed] of this.#consumed) {
+            if (consumed.expiresAt <= now)
+                this.#consumed.delete(state);
+        }
+        for (const [pendingKey, pending] of this.#pending) {
+            if (pending.expiresAt <= now)
+                this.#pending.delete(pendingKey);
+        }
+    }
+}

package/dist/server/login/http.js

@@ -0,0 +1,31 @@
+import { buildSessionCookie, sessionTtlMs } from "../routes/auth.js";
+/** Translate one policy outcome into the browser's redirect/cookie response. */
+export async function sendLoginResolution(outcome, input) {
+    if (outcome.kind === "refused") {
+        if (input.asJson === true)
+            return input.reply.code(403).send({ error: outcome.error });
+        return input.reply.code(403)
+            .header("location", `/login?error=${encodeURIComponent(outcome.error)}`)
+            .send();
+    }
+    if (outcome.kind === "needs_code") {
+        if (input.asJson === true)
+            return input.reply.code(403).send({ error: "invalid_code" });
+        return input.reply.code(403).header("location", "/login?error=invalid_code").send();
+    }
+    if (outcome.kind === "linked") {
+        const returnTo = "/settings?section=accounts";
+        if (input.asJson === true)
+            return input.reply.send({ returnTo });
+        return input.reply.code(302).header("location", returnTo).send();
+    }
+    const session = await input.ctx.opened.identity.tokens.createSession(outcome.user, input.provider, sessionTtlMs(input.ctx));
+    const cookie = buildSessionCookie(session.token, input.request, input.ctx);
+    if (input.asJson === true) {
+        return input.reply.header("set-cookie", cookie).send({ returnTo: input.returnTo });
+    }
+    return input.reply.code(302)
+        .header("location", input.returnTo)
+        .header("set-cookie", cookie)
+        .send();
+}

package/dist/server/login/resolve.js

@@ -0,0 +1,133 @@
+import { AccountLinkConflictError, } from "../../harness/identity/accounts.js";
+import { AdmissionRefusedError, } from "../../harness/identity/users.js";
+import { setupCodeMatches } from "../../harness/identity/setup-code-check.js";
+import { hashToken } from "../../harness/identity/tokens.js";
+import { withClaimLock } from "../auth/claim-lock.js";
+import { assignUsername } from "./usernames.js";
+function allowed(result, policy) {
+    if (policy.allowedGroups !== undefined &&
+        !policy.allowedGroups.some((group) => result.groups?.includes(group) === true))
+        return false;
+    if (policy.allowedDomains !== undefined) {
+        if (result.profile.emailVerified !== true)
+            return false;
+        const email = result.profile.email;
+        const domain = email?.slice(email.lastIndexOf("@") + 1).toLowerCase();
+        if (email === undefined ||
+            email.lastIndexOf("@") <= 0 ||
+            !policy.allowedDomains.some((allowedDomain) => allowedDomain.toLowerCase() === domain))
+            return false;
+    }
+    return true;
+}
+function profileFields(profile) {
+    return {
+        ...(profile.name === undefined ? {} : { name: profile.name }),
+        ...(profile.email === undefined ? {} : { email: profile.email }),
+    };
+}
+/** Resolve one verified external identity without ever inferring an existing-user link. */
+export async function resolveLogin(input, deps) {
+    const { provider, result } = input;
+    try {
+        if (input.linkUser !== undefined) {
+            await deps.accounts.link({
+                provider,
+                subject: result.subject,
+                user: input.linkUser,
+                via: "login",
+            });
+            // A link records identity only. Groups arrive on this account's
+            // next sign-in, never on a session/token-authenticated request.
+            return { kind: "linked", user: input.linkUser };
+        }
+        const existing = deps.accounts.lookup(provider, result.subject);
+        if (existing !== undefined) {
+            if (deps.users.get(existing.user) === undefined) {
+                return { kind: "refused", error: "not_allowed" };
+            }
+            await deps.users.setGroups(existing.user, provider, result.groups ?? []);
+            return { kind: "session", user: existing.user };
+        }
+        const setupResolution = await withClaimLock(async () => {
+            const validSetupCode = input.code !== undefined && setupCodeMatches(input.code, deps.setupCode());
+            if (deps.users.isClaimed()) {
+                // A setup code never creates a user on a claimed server. It may
+                // only finish the exact claim whose subject/user/code were recorded.
+                if (!validSetupCode)
+                    return undefined;
+                const claim = deps.setupClaims.matches(provider, result.subject, input.code);
+                if (claim === undefined || deps.users.get(claim.user) === undefined) {
+                    return { kind: "refused", error: "not_allowed" };
+                }
+                await deps.accounts.link({ provider, subject: result.subject, user: claim.user, via: "login" });
+                await deps.users.setGroups(claim.user, provider, result.groups ?? []);
+                await deps.clearSetupCode();
+                await deps.setupClaims.clear();
+                return { kind: "session", user: claim.user };
+            }
+            if (!validSetupCode)
+                return { kind: "needs_code", reason: "setup" };
+            const claim = deps.setupClaims.matches(provider, result.subject, input.code);
+            const user = claim?.user ?? assignUsername(result.profile, result.subject, (name) => deps.users.get(name) !== undefined);
+            // Persist the recovery breadcrumb before creating the user. On a
+            // retry, only this exact subject may finish the claim; if the user
+            // write did not happen, it is retried under the recorded name.
+            await deps.setupClaims.record({
+                user,
+                provider,
+                subject: result.subject,
+                codeSha256: hashToken(input.code),
+            });
+            const record = deps.users.get(user) ?? await deps.users.add({
+                user,
+                ...profileFields(result.profile),
+                admin: true,
+                source: "login",
+            });
+            await deps.accounts.link({ provider, subject: result.subject, user, via: "login" });
+            await deps.users.setGroups(user, provider, result.groups ?? []);
+            await deps.clearSetupCode();
+            await deps.setupClaims.clear();
+            return { kind: "session", user: record.user };
+        });
+        if (setupResolution !== undefined)
+            return setupResolution;
+        if (deps.policy.autoProvision === true && !allowed(result, deps.policy)) {
+            return { kind: "refused", error: "not_allowed" };
+        }
+        if (deps.policy.autoProvision !== true && input.code === undefined) {
+            return { kind: "needs_code", reason: "invite" };
+        }
+        // Admission is checked before redemption so an M1 refusal burns no invite.
+        deps.users.checkAdmission();
+        const user = assignUsername(result.profile, result.subject, (name) => deps.users.get(name) !== undefined);
+        const grant = deps.policy.autoProvision === true
+            ? { admin: false }
+            : await deps.invites.redeem(input.code, user);
+        if (grant === undefined)
+            return { kind: "refused", error: "not_allowed" };
+        const record = await deps.users.add({
+            user,
+            ...profileFields(result.profile),
+            admin: grant.admin,
+            source: "login",
+        });
+        await deps.accounts.link({ provider, subject: result.subject, user, via: "login" });
+        await deps.users.setGroups(user, provider, result.groups ?? []);
+        return { kind: "session", user: record.user };
+    }
+    catch (error) {
+        if (error instanceof AccountLinkConflictError || (error instanceof Error && error.message.startsWith("account_link_conflict:")))
+            return { kind: "refused", error: "account_link_conflict" };
+        if (error instanceof AdmissionRefusedError)
+            return { kind: "refused", error: error.code };
+        if (error instanceof Error && error.message.startsWith("isolation_required:")) {
+            return { kind: "refused", error: "isolation_required" };
+        }
+        if (error instanceof Error && error.message.startsWith("auth_required:")) {
+            return { kind: "refused", error: "auth_required" };
+        }
+        throw error;
+    }
+}

package/dist/server/login/setup-claim.js

@@ -0,0 +1,55 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { hashToken } from "../../harness/identity/tokens.js";
+import { writeJson } from "../../harness/identity/json-store.js";
+/**
+ * A durable breadcrumb for the one setup-code-paid claim. It lets a retry
+ * finish a crashed link without ever inferring ownership from a username.
+ */
+export class SetupClaimStore {
+    #path;
+    #memory;
+    constructor(cacheDir) {
+        this.#path = cacheDir === undefined ? undefined : join(cacheDir, "login-setup-claim.json");
+    }
+    read() {
+        if (this.#path === undefined)
+            return this.#memory;
+        try {
+            const value = JSON.parse(readFileSync(this.#path, "utf8"));
+            if (typeof value !== "object" || value === null)
+                throw new Error("not an object");
+            const record = value;
+            if (typeof record.user !== "string" || typeof record.provider !== "string" ||
+                typeof record.subject !== "string" || typeof record.codeSha256 !== "string")
+                throw new Error("invalid fields");
+            return record;
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return undefined;
+            throw new Error(`sigrun: malformed login setup claim in ${this.#path}`, { cause: error });
+        }
+    }
+    async record(claim) {
+        if (this.#path === undefined) {
+            this.#memory = claim;
+            return;
+        }
+        await writeJson(this.#path, claim);
+    }
+    matches(provider, subject, code) {
+        const claim = this.read();
+        return claim?.provider === provider && claim.subject === subject && claim.codeSha256 === hashToken(code)
+            ? claim
+            : undefined;
+    }
+    async clear() {
+        if (this.#path === undefined) {
+            this.#memory = undefined;
+            return;
+        }
+        const { rm } = await import("node:fs/promises");
+        await rm(this.#path, { force: true });
+    }
+}

package/dist/server/login/usernames.js

@@ -0,0 +1,15 @@
+/** Assign a new directory username; this never selects an existing user. */
+export function assignUsername(profile, subject, taken) {
+    const candidate = profile.username ?? profile.email?.split("@", 1)[0] ?? subject;
+    const base = candidate
+        .toLowerCase()
+        .replace(/[^a-z0-9._-]/g, "-")
+        .replace(/^[^a-z0-9]+/, "") || "user";
+    if (!taken(base))
+        return base;
+    for (let suffix = 2;; suffix++) {
+        const candidateWithSuffix = `${base}-${suffix}`;
+        if (!taken(candidateWithSuffix))
+            return candidateWithSuffix;
+    }
+}