@sigrun/sigrun 0.2.0 → 0.3.0

package/dist/blocks/builders.d.ts

@@ -0,0 +1,57 @@
+/**
+ * The typed builders (spec §14.1): one function per block and field,
+ * plus `bind(pointer)` and `tree(root)`. Builders return plain JSON —
+ * there is no runtime besides them.
+ *
+ * Each builder takes its block's props object and returns the block
+ * with the `type` literal stamped in. The literal is spread LAST, so a
+ * stray `type` inside a JavaScript caller's props object can never
+ * override it; TypeScript callers cannot pass one at all (`Props` omits
+ * it). The tree BLOCK builder is exported as `treeBlock`, keeping the
+ * `tree` name for the version-stamping root wrapper.
+ *
+ * `tree(root)` stamps {@link BLOCK_SET_VERSION} from the shared wire
+ * package — the version the SERVER validates against, which is why
+ * extensions import these builders from `@sigrun/sigrun/blocks` (the
+ * host-linked copy, spec §14.1) instead of bundling their own.
+ */
+import type { Binding, Block, CalloutBlock, Card, ChartBlock, ChoiceField, CollectionBlock, ColumnsBlock, DateField, DaterangeField, DatetimeField, DetailsBlock, DiffBlock, FieldsBlock, FileField, FormBlock, GridBlock, ImageBlock, ListField, LogBlock, LongtextField, MarkdownBlock, MeterBlock, NumberField, PageBlock, SectionBlock, SecretField, StackBlock, StatBlock, TextField, ToggleField, Tree, TreeBlock } from "@sigrun/shared/blocks";
+/** One block/field's props: the wire shape minus the `type` literal. */
+type Props<T> = Omit<T, "type">;
+/** `bind("/cards")` → `{ $: "/cards" }` — a pointer into the surface's data model (§4.2). */
+export declare function bind(pointer: string): Binding;
+/** Wrap a root block with the server's block-set version (§4.4). */
+export declare function tree(root: Block): Tree;
+export declare function page(props: Props<PageBlock>): PageBlock;
+export declare function stack(props: Props<StackBlock>): StackBlock;
+export declare function columns(props: Props<ColumnsBlock>): ColumnsBlock;
+export declare function grid(props: Props<GridBlock>): GridBlock;
+export declare function section(props: Props<SectionBlock>): SectionBlock;
+export declare function markdown(props: Props<MarkdownBlock>): MarkdownBlock;
+export declare function fields(props: Props<FieldsBlock>): FieldsBlock;
+export declare function stat(props: Props<StatBlock>): StatBlock;
+export declare function callout(props: Props<CalloutBlock>): CalloutBlock;
+export declare function image(props: Props<ImageBlock>): ImageBlock;
+export declare function chart(props: Props<ChartBlock>): ChartBlock;
+export declare function meter(props: Props<MeterBlock>): MeterBlock;
+export declare function log(props: Props<LogBlock>): LogBlock;
+/** The tree BLOCK builder (§5.3) — `tree` is the root wrapper. */
+export declare function treeBlock(props: Props<TreeBlock>): TreeBlock;
+export declare function diff(props: Props<DiffBlock>): DiffBlock;
+export declare function details(props: Props<DetailsBlock>): DetailsBlock;
+export declare function collection(props: Props<CollectionBlock>): CollectionBlock;
+/** The collection item template (§5.5.1) — a slot bundle, not a block. */
+export declare function card(props: Card): Card;
+export declare function form(props: Props<FormBlock>): FormBlock;
+export declare function text(props: Props<TextField>): TextField;
+export declare function longtext(props: Props<LongtextField>): LongtextField;
+export declare function number(props: Props<NumberField>): NumberField;
+export declare function toggle(props: Props<ToggleField>): ToggleField;
+export declare function choice(props: Props<ChoiceField>): ChoiceField;
+export declare function date(props: Props<DateField>): DateField;
+export declare function datetime(props: Props<DatetimeField>): DatetimeField;
+export declare function daterange(props: Props<DaterangeField>): DaterangeField;
+export declare function secret(props: Props<SecretField>): SecretField;
+export declare function file(props: Props<FileField>): FileField;
+export declare function list(props: Props<ListField>): ListField;
+export {};

package/dist/blocks/images.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Image source rules (spec §11.1): `asset:` paths, `data:` URLs of the
+ * four accepted MIME types (capped at 192 KiB of base64 text), and
+ * `https:` URLs. SVG and AVIF are never accepted (script payload; no
+ * TUI decoder), and `http:` URLs are rejected. The proxy that rewrites
+ * and fetches is U7; this module only validates.
+ */
+/** A source that passed the §11.1 rules. */
+export type ImageSourceOk = {
+    ok: true;
+    kind: "asset" | "data" | "https";
+};
+/** A source the §11.1 rules reject. */
+export type ImageSourceErr = {
+    ok: false;
+    message: string;
+};
+/** The result of checking one `src` value. */
+export type ImageSourceResult = ImageSourceOk | ImageSourceErr;
+/**
+ * Check one image `src` against the §11.1 source rules. Bindings
+ * (`{$: …}` objects) are not checked here — their resolved string is,
+ * where the data model holds one (the data-size limit already covers
+ * the byte cost).
+ */
+export declare function checkImageSource(src: string): ImageSourceResult;

package/dist/blocks/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * `@sigrun/sigrun/blocks` — the extension authoring surface for the
+ * block set (spec §14.1): the typed builders, the wire types, and
+ * `validateTree` (§14.2) so an extension can unit-test its trees
+ * against the same validation the server runs.
+ *
+ * Extensions import this subpath, never a bundled copy: the package is
+ * a `peerDependency: "*"` (see docs/extending.md) and
+ * `@sigrun/sigrun` is a HOST RUNTIME MODULE (src/harness/packages.ts)
+ * — the host links its own running copy into every extension packages
+ * dir, so `tree(...)` always stamps the server's
+ * {@link BLOCK_SET_VERSION}. The `exports` map points here at
+ * `dist/blocks/index.js` (never `src/`), which is what the built
+ * server ships.
+ */
+export * from "./builders.js";
+export { validateTree, validateData, VALID_PLACEMENTS, PLACEMENT_RULES, LIMITS, } from "./validate.js";
+export type { PlacementLimits, PlacementRule, ValidateDataResult, ValidateErr, ValidateOk, ValidateOptions, ValidateResult, ValidationError, } from "./validate.js";
+export { BLOCK_SET_VERSION } from "@sigrun/shared/blocks";
+export type * from "@sigrun/shared/blocks";

package/dist/blocks/limits.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The per-placement size limits of spec §4.5: max blocks per tree, and
+ * max UTF-8 bytes of the serialized JSON for the tree and the data.
+ *
+ * Over a limit the server rejects with `413 surface_too_large` naming
+ * the limit; `validateTree`/`validateData` surface the same error
+ * strings. A collection counts as one block however many items it
+ * binds, and a `data:` image URL counts toward whichever of the tree or
+ * the data holds it (the sizes are measured over the serialized JSON,
+ * so both hold by construction).
+ */
+import type { Placement } from "@sigrun/shared/blocks";
+/** One row of the §4.5 limits table. */
+export interface PlacementLimits {
+    /** Max blocks in one tree (a collection counts as one). */
+    readonly blocks: number;
+    /** Max UTF-8 bytes of the serialized tree JSON. */
+    readonly treeBytes: number;
+    /** Max UTF-8 bytes of the serialized data JSON. */
+    readonly dataBytes: number;
+}
+/** Spec §4.5, one row per placement. */
+export declare const LIMITS: Readonly<Record<Placement, PlacementLimits>>;
+/** UTF-8 byte length of a value's serialized JSON (spec §4.5 sizing). */
+export declare function jsonBytes(value: unknown): number;

package/dist/blocks/placements.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The placement rules of spec §5.7, as data: which blocks, which
+ * collection displays and which form fields each placement allows,
+ * plus the root-block and `page.sidebar` constraints the table carries.
+ *
+ * `validateTree` walks a tree against these rules; the tests pin the
+ * table's literal cells so this data cannot drift from the spec.
+ */
+/** One row of the §5.7 table. */
+export interface PlacementRule {
+    /** Blocks allowed anywhere in the tree. */
+    readonly blocks: ReadonlySet<string>;
+    /** The only legal root block type, when the placement pins it. */
+    readonly rootBlock?: "page" | "form";
+    /** Whether a root `page` may carry `sidebar` (panel: no). */
+    readonly pageSidebar: boolean;
+    /** Collection displays allowed (`undefined`: all five). */
+    readonly collectionDisplays?: readonly string[];
+    /** Field types allowed in `form` blocks. */
+    readonly fields: ReadonlySet<string>;
+}
+/** The placement names, kept local so this module has no imports. */
+type PlacementName = "view" | "panel" | "settings" | "chat" | "interaction" | "ambient";
+/** Spec §5.7, one row per placement. */
+export declare const PLACEMENT_RULES: Readonly<Record<PlacementName, PlacementRule>>;
+export {};

package/dist/blocks/schema.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The typebox wire schemas for every block and field (spec §5/§6.1),
+ * each compiled once into its own `Validator` (spec §14.2 validation).
+ *
+ * Design notes:
+ * - Schemas are the wire contract, so they deliberately do NOT set
+ *   `additionalProperties: false`: unknown props pass through and
+ *   channels ignore them (the block-set version governs what exists).
+ * - `Tone`, `IconName` and `Format` are enums/patterns built from the
+ *   shared constants; an unknown icon name fails here, at the icon
+ *   prop's own path.
+ * - Bindable props are `Union([literal, Binding])` throughout; the
+ *   literal-ness of STRUCTURAL props (`display`, `groups`, `reorder`,
+ *   `mode`, field `name`s, `columns`, handler names) is enforced by the
+ *   second walk in `validate.ts`, not the schema, so the error can say
+ *   "must be a literal" instead of an anyOf mismatch.
+ * - Child slots (`children`, `sidebar`, `main`, `detail`,
+ *   `columns[].block`, `collection.item`, `form` children, a field's
+ *   `list.item`, `page.switcher`, a bulk action's `form.root`) are
+ *   deliberately loose here (any object): `validate.ts` walks the tree
+ *   and validates every child node against ITS compiled validator, so
+ *   one broken block is one precise error instead of a union mismatch
+ *   per sibling branch.
+ * - `Compile` (typebox/compile) builds each validator; its errors are
+ *   read from `instancePath`, relative to the node the validator ran
+ *   against.
+ */
+import type { Validator } from "typebox/compile";
+/** One compiled validator per block type, keyed by its `type` literal. */
+export declare const BLOCK_VALIDATORS: ReadonlyMap<string, Validator>;
+/** One compiled validator per field type, keyed by its `type` literal. */
+export declare const FIELD_VALIDATORS: ReadonlyMap<string, Validator>;
+/** The compiled validator for `Action` objects (spec §6.1). */
+export declare const ACTION_VALIDATOR: Validator;
+/** The compiled validator for action buttons (spec §6.1). */
+export declare const ACTION_BUTTON_VALIDATOR: Validator;
+/** The compiled validator for a collection's card template (spec §5.5.1). */
+export declare const CARD_VALIDATOR: Validator;

package/dist/blocks/validate.d.ts

@@ -0,0 +1,73 @@
+/**
+ * `validateTree` (spec §14.2): every error with its JSON path and a
+ * plain message.
+ *
+ * Two passes:
+ * 1. The compiled typebox validators (`schema.ts`) check each node's
+ *    shape: the walk descends the tree, finds every block, field,
+ *    action, button and card template, and runs the matching compiled
+ *    validator against it. Instance paths (relative to the node) join
+ *    the walk's path, so one broken block is one precise error
+ *    (`root.main[2].text`), never a union mismatch per sibling.
+ * 2. The same walk checks what schemas cannot express: placements
+ *    (§5.7), the literal-ness of structural props (§4.2), handler names
+ *    (§6.1), relative bindings outside item templates (§4.2), ids
+ *    (§4.1), `turn` outside chat (§6.2), `open` schemes (§6.1), image
+ *    sources (§11.1), limits (§4.5), and the ambient one-line rule
+ *    (§9.2).
+ */
+import { type Placement, type Tree } from "@sigrun/shared/blocks";
+export { PLACEMENT_RULES } from "./placements.js";
+export { LIMITS } from "./limits.js";
+export type { PlacementRule } from "./placements.js";
+export type { PlacementLimits } from "./limits.js";
+/** The placements the block set defines (spec §3). */
+export declare const VALID_PLACEMENTS: readonly Placement[];
+/** One validation error: where and what (spec §14.2). */
+export interface ValidationError {
+    path: string;
+    message: string;
+}
+/** Options for `validateTree`. */
+export interface ValidateOptions {
+    placement: Placement;
+    /**
+     * The surface's `actions` map keys (spec §6.1); when given, every
+     * handler-name prop must be in it. When omitted (chat), handler
+     * names are free labels.
+     */
+    handlers?: ReadonlySet<string>;
+    /** The server's block-set version; a mismatched tree is rejected (§4.4). */
+    serverV?: number;
+    /** For ambient trees: which `place` renders this body (§9.2 one-line rule). */
+    ambientPlace?: "status" | "footer" | "panel";
+}
+/** The ok result of `validateTree`: the tree, narrowed to the wire type. */
+export interface ValidateOk {
+    ok: true;
+    tree: Tree;
+}
+/** The failure result: every error found, each with its path. */
+export interface ValidateErr {
+    ok: false;
+    errors: ValidationError[];
+}
+/** `validateTree`'s result. */
+export type ValidateResult = ValidateOk | ValidateErr;
+/** The result of `validateData`. */
+export type ValidateDataResult = {
+    ok: true;
+} | {
+    ok: false;
+    errors: ValidationError[];
+};
+/**
+ * Validate a block tree against a placement (spec §14.2). Returns every
+ * error with its JSON path; on success, the narrowed tree.
+ */
+export declare function validateTree(tree: unknown, opts: ValidateOptions): ValidateResult;
+/**
+ * Validate a surface's data object: a JSON object within the placement's
+ * data-size limit (spec §4.5).
+ */
+export declare function validateData(data: unknown, placement: Placement): ValidateDataResult;

package/dist/cli.js

@@ -47,7 +47,9 @@ import { dirname, join } from "node:path";
 import * as readline from "node:readline/promises";
 import { Writable } from "node:stream";
 import { resolveStoreRoots, writeFileAtomic } from "./harness/stores.js";
-import { openIdentityStores } from "./harness/identity/index.js";
+import { openIdentityStores, AccountLinkConflictError } from "./harness/identity/index.js";
+import { normalizeTypedUsername } from "./harness/identity/typed-username.js";
+import { deriveUsername, foldSubject } from "@sigrun/shared/usernames";
 import { pathToFileURL } from "node:url";
 import { effectiveMethods, loadConfig } from "./config.js";
 import { probeIsolation, runHelperProbe, selfTestHelper } from "./sandbox/availability.js";
@@ -63,7 +65,9 @@ export const USAGE_TEXT = `usage: sigrun [--user <name>]
        sigrun token create <name> --user <user>
        sigrun token list
        sigrun token revoke <id>
-       sigrun user add <user> [--admin] [--name <n>] [--email <e>]
+       sigrun user add [<user>] [--proxy <username>] [--admin] [--name <n>] [--email <e>]
+       sigrun user link <user> --proxy <username>
+       sigrun user unlink --proxy <username>
        sigrun user list
        sigrun provider list [--url <base>] [--token <token>]
        sigrun provider key <id> [--url <base>] [--token <token>]
@@ -134,8 +138,9 @@ function parseTokenArgs(argv) {
     throw usageError(`unknown token subcommand ${JSON.stringify(sub ?? "")} (create, list, revoke)`);
 }
 /**
- * Parse `user <sub> …` (Task 7): `add <user> [--admin] [--name <n>]
- * [--email <e>]`, `list`. One positional (the username), flags anywhere.
+ * Parse `user <sub> …`: `add [<user>] [--proxy <username>]`, explicit
+ * `link`/`unlink`, and `list`. A proxy add may omit the directory key,
+ * deriving it from the external username; ordinary add still requires it.
  */
 function parseUserArgs(argv) {
     const sub = argv[0];
@@ -145,51 +150,61 @@ function parseUserArgs(argv) {
         }
         return { command: "user", sub: "list" };
     }
-    if (sub === "add") {
+    if (sub === "add" || sub === "link" || sub === "unlink") {
         let user;
+        let proxy;
         let admin = false;
         let name;
         let email;
         let index = 1;
         while (index < argv.length) {
             const arg = argv[index];
-            if (arg === "--admin") {
+            if (sub === "add" && arg === "--admin") {
                 admin = true;
                 index += 1;
                 continue;
             }
-            if (arg === "--name" || arg === "--email") {
+            if (arg === "--proxy" || (sub === "add" && (arg === "--name" || arg === "--email"))) {
                 const value = argv[index + 1];
                 if (value === undefined || value.startsWith("--")) {
                     throw usageError(`${arg} requires a value`);
                 }
-                if (arg === "--name")
+                if (arg === "--proxy")
+                    proxy = value;
+                else if (arg === "--name")
                     name = value;
                 else
                     email = value;
                 index += 2;
                 continue;
             }
-            if (user === undefined && !arg.startsWith("--")) {
+            if (sub !== "unlink" && user === undefined && !arg.startsWith("--")) {
                 user = arg;
                 index += 1;
                 continue;
             }
             throw usageError(`unexpected argument ${JSON.stringify(arg)}`);
         }
-        if (user === undefined) {
-            throw usageError("user add requires a <user>");
+        if (proxy === undefined) {
+            if (sub !== "add")
+                throw usageError(`user ${sub} requires --proxy <username>`);
+            if (user === undefined)
+                throw usageError("user add requires a <user>");
+        }
+        if (sub === "link" && user === undefined) {
+            throw usageError("user link requires a <user>");
         }
         return {
             command: "user",
-            sub: "add",
-            user,
+            sub,
+            ...(user === undefined ? {} : { user }),
+            ...(proxy === undefined ? {} : { proxy }),
             ...(admin ? { admin } : {}),
             ...(name === undefined ? {} : { name }),
             ...(email === undefined ? {} : { email }),
         };
     }
-    throw usageError(`unknown user subcommand ${JSON.stringify(sub ?? "")} (add, list)`);
+    throw usageError(`unknown user subcommand ${JSON.stringify(sub ?? "")} (add, link, unlink, list)`);
 }
 /**
  * Parse `provider <sub> …` (release 0.1 Task 2b): `list`, `key <id>`,
@@ -506,9 +521,21 @@ export async function ttyPrompt(question, opts) {
         rl.close();
     }
 }
-/** Resolve the attach/run user: `--user` > `SIGRUN_USER` > tui.json. */
+/**
+ * Resolve the attach/run user: `--user` > `SIGRUN_USER` > tui.json. The
+ * source is operator-typed (unchecked): derive the canonical key before
+ * it reaches the wire (the server derives on receipt too). Unusable
+ * input fails loud, never a silent empty identity.
+ */
 function resolveUser(parsed, env, file) {
-    return parsed.user ?? env.SIGRUN_USER ?? file.user;
+    const raw = parsed.user ?? env.SIGRUN_USER ?? file.user;
+    if (raw === undefined || raw.trim() === "")
+        return undefined;
+    const derived = deriveUsername(raw);
+    if (derived === undefined) {
+        throw new Error(`invalid_username: "${raw}" derives no usable username`);
+    }
+    return derived;
 }
 /**
  * The tui.json UI refresh fields (C1) as a spreadable launch fragment —
@@ -654,7 +681,14 @@ async function runIdentityCommand(parsed, env, io, isolationProbe) {
     if (parsed.command === "token") {
         switch (parsed.sub) {
             case "create": {
-                const user = parsed.user;
+                // A typed source, same rule as `user add`: the resulting key
+                // is what the token (and its printed secret) belongs to.
+                const raw = parsed.user;
+                const derived = deriveUsername(raw);
+                if (derived === undefined) {
+                    throw new Error(`invalid_username: "${raw}" derives no usable username`);
+                }
+                const user = derived;
                 if (stores.users.get(user) === undefined) {
                     throw new Error(`unknown user "${user}" — add it first: sigrun user add ${user}`);
                 }
@@ -685,6 +719,13 @@ async function runIdentityCommand(parsed, env, io, isolationProbe) {
     }
     switch (parsed.sub) {
         case "add": {
+            const input = parsed.user ?? parsed.proxy;
+            const typed = normalizeTypedUsername(input, (key) => stores.users.get(key) !== undefined);
+            if (!typed.ok) {
+                throw new Error(typed.error === "invalid_username"
+                    ? `invalid_username: "${input}" derives no usable username`
+                    : `username_taken: user "${parsed.user === undefined ? input : deriveUsername(input) ?? input}" already exists`);
+            }
             const config = loadConfig(env, new SettingsStore({ dir: defaultConfigDir(env) }).read());
             const coreRoot = selfPackageRoot();
             const isolation = await isolationProbe({
@@ -703,13 +744,53 @@ async function runIdentityCommand(parsed, env, io, isolationProbe) {
                     proxySecretHeader: config.auth.proxy.secretHeader,
                 }),
             });
-            await stores.users.add({
-                user: parsed.user,
+            const record = await stores.users.add({
+                user: typed.key,
                 admin: parsed.admin ?? false,
                 ...(parsed.name === undefined ? {} : { name: parsed.name }),
                 ...(parsed.email === undefined ? {} : { email: parsed.email }),
                 source: "cli",
             });
+            if (parsed.proxy !== undefined) {
+                const subject = foldSubject(parsed.proxy);
+                try {
+                    await stores.accounts.link({
+                        provider: "proxy",
+                        subject,
+                        user: record.user,
+                        via: "admin",
+                    });
+                }
+                catch (error) {
+                    if (!(error instanceof AccountLinkConflictError))
+                        throw error;
+                    await stores.users.remove(record.user);
+                    const holder = stores.accounts.lookup("proxy", subject)?.user;
+                    throw new Error(`account_link_conflict: proxy identity is linked to ${holder ?? "another user"}; removed user "${record.user}"`);
+                }
+            }
+            io.out?.(record.user);
+            return 0;
+        }
+        case "link": {
+            const user = deriveUsername(parsed.user);
+            if (user === undefined || stores.users.get(user) === undefined) {
+                throw new Error(`unknown user "${parsed.user}"`);
+            }
+            const link = await stores.accounts.link({
+                provider: "proxy",
+                subject: foldSubject(parsed.proxy),
+                user,
+                via: "admin",
+            });
+            io.out?.(`${link.provider}:${link.subject}\t${link.user}`);
+            return 0;
+        }
+        case "unlink": {
+            const subject = foldSubject(parsed.proxy);
+            if (!(await stores.accounts.unlink("proxy", subject))) {
+                throw new Error(`no proxy link for "${subject}"`);
+            }
             return 0;
         }
         case "list": {
@@ -719,6 +800,8 @@ async function runIdentityCommand(parsed, env, io, isolationProbe) {
                     record.user,
                     ...(record.name === undefined ? [] : [record.name]),
                     ...(record.email === undefined ? [] : [record.email]),
+                    ...stores.accounts.listForUser(record.user)
+                        .map((link) => `${link.provider}:${link.subject}`),
                 ].join("\t"));
             }
             return 0;
@@ -727,6 +810,15 @@ async function runIdentityCommand(parsed, env, io, isolationProbe) {
     // parseArgs guarantees one of the cases above.
     throw new Error(`unhandled ${parsed.command} subcommand`);
 }
+/**
+ * The CLI-local mirror of the server's proxy-only rule (proxy-trust
+ * Task 6): no token callers exist, so a setup-code prompt can never
+ * be redeemed. Kept here rather than imported from src/server — the
+ * CLI does not import server auth modules.
+ */
+function isProxyOnly(methods) {
+    return methods.includes("proxy") && !methods.includes("token");
+}
 /**
  * The pre-launch onboarding flow (Task 7, spec §5.8): `attach`/`run`
  * ask the server its state; an UNCLAIMED server gets the interactive
@@ -766,6 +858,12 @@ async function onboardIfUnclaimed(server, prompt, fetchImpl) {
     }
     if (state.state !== "unclaimed")
         return undefined;
+    // Proxy-trust Task 6: a proxy-only server without a vouched identity
+    // refuses the claim (403 proxy_identity_required) and never mints a
+    // setup code — prompt for one and the operator can only lose.
+    if (isProxyOnly(state.methods) && state.codeRequired && state.proxyIdentity === undefined) {
+        throw new Error("sigrun: this sigrun onboards through its sign-in proxy; open it in a browser");
+    }
     let code;
     if (state.codeRequired) {
         code = (await prompt("setup code: ")).trim();

package/dist/config.js

@@ -2,6 +2,7 @@ import { isIanaTimeZone } from "./jobs/spec.js";
 import { isAbsolute, join } from "node:path";
 import { resolveStoreRoots } from "./harness/stores.js";
 import { isLoopbackHost } from "./server/auth/loopback.js";
+import { deriveUsername, isUsernameKey } from "@sigrun/shared/usernames";
 /**
  * Sigrun configuration.
  *
@@ -432,6 +433,15 @@ function parseAuth(env, server) {
     }
     const token = env.SIGRUN_API_TOKEN?.trim() || undefined;
     const secret = env.SIGRUN_PROXY_SECRET?.trim() || undefined;
+    // The service-token user is an operator-typed identity that no request
+    // ever re-derives: it must ALREADY be a canonical username key at load
+    // time (unlike the header/CLI sources, which derive). Anything else is
+    // a config error naming the derived suggestion.
+    const serviceTokenUser = env.SIGRUN_API_TOKEN_USER?.trim() || "sigrun";
+    if (token !== undefined && !isUsernameKey(serviceTokenUser)) {
+        throw new Error(`SIGRUN_API_TOKEN_USER must already be a username key, got "${serviceTokenUser}" — ` +
+            `did you mean "${deriveUsername(serviceTokenUser) ?? "sigrun"}"?`);
+    }
     return {
         sessionDays: server?.sessionDays ?? DEFAULT_AUTH.sessionDays,
         methods,
@@ -459,7 +469,7 @@ function parseAuth(env, server) {
             : {
                 serviceToken: {
                     token,
-                    user: env.SIGRUN_API_TOKEN_USER?.trim() || "sigrun",
+                    user: serviceTokenUser,
                 },
             }),
     };
@@ -556,8 +566,13 @@ export function parseBackupSections(raw) {
 function parseCompaction(env, server) {
     // Env parse first (a bad env value fails loud even when the file's
     // value is valid); a file field applies only where its env var is
-    // absent; code defaults last.
+    // absent; code defaults last. `modelOverrides` is file-only (a map
+    // has no env spelling), passed through verbatim — pi-durable's
+    // `compactionPolicy` applies it per model at compaction time.
     return {
+        ...(server?.modelOverrides === undefined
+            ? {}
+            : { modelOverrides: server.modelOverrides }),
         enabled: parseCompactionEnabled(env) ??
             server?.enabled ??
             DEFAULT_COMPACTION.enabled,
@@ -831,6 +846,7 @@ export function resolvedServerSection(config) {
  * | `SIGRUN_PORT` | `port` |
  * | `SIGRUN_WORKSPACE_PATH` | `workspacePath` |
  * | `SIGRUN_STORAGE_PATH` | `storagePath` |
+ * | `SIGRUN_SKIP_MIGRATION_SNAPSHOT` | — (boot escape hatch; never persisted) |
  * | `SIGRUN_DATA_DIR` | `dataDir` |
  * | `SIGRUN_CACHE_DIR` | `cacheDir` |
  * | `SIGRUN_STATE_DIR` | `stateDir` |
@@ -994,6 +1010,9 @@ export function effectiveServerSection(env, fileServer, config) {
     emit("compaction.reserveTokens", config.compaction.reserveTokens, ["compaction", "reserveTokens"]);
     emit("compaction.keepRecentTokens", config.compaction.keepRecentTokens, ["compaction", "keepRecentTokens"]);
     emit("compaction.backgroundTokens", config.compaction.backgroundTokens, ["compaction", "backgroundTokens"]);
+    if (config.compaction.modelOverrides !== undefined) {
+        emit("compaction.modelOverrides", config.compaction.modelOverrides, ["compaction", "modelOverrides"]);
+    }
     emit("memorySeam.hookDeadlineMs", config.memorySeam.hookDeadlineMs, ["memorySeam", "hookDeadlineMs"]);
     emit("memorySeam.idleThresholdMs", config.memorySeam.idleThresholdMs, ["memorySeam", "idleThresholdMs"]);
     emit("memorySeam.workerDeadlineMs", config.memorySeam.workerDeadlineMs, ["memorySeam", "workerDeadlineMs"]);