@tapflowio/relay 0.23.0 → 0.25.0

package/dist/lib/connectionAuth.js

@@ -1,18 +1,77 @@
 export const AGENT_SCOPE = 'agent';
+export const VIEW_SCOPE = 'view';
+const ADMIN_ROLE = 'Admin';
 // ws close reason은 123바이트 한도 (RFC 6455 §5.5.1).
 export const WS_REJECT_REASON = "Unauthorized: agents need a PAT with 'agent' scope (--token / TAPFLOW_AGENT_TOKEN); browsers must sign in";
+/** A PAT with neither `view` nor `agent`: it may upload builds, not open device sessions. */
+export const WS_SCOPE_REASON = "Forbidden: this token lacks the 'view' scope needed for device sessions; create an API-type token";
+/** An `agent` token is issued by an Admin and is only as good as that Admin role, checked at every use. */
+export const WS_AGENT_OWNER_REASON = "Unauthorized: this agent token's owner is no longer an Admin; an Admin must issue a new agent token";
+/** An open socket whose token was revoked, expired, or went with its owner. */
+export const WS_TOKEN_GONE_REASON = 'Unauthorized: this token was revoked or has expired, or its owner was removed';
 // 새 WebSocket 연결을 첫 메시지 도착 전에 분류한다. (주소 × 자격) 매트릭스를
 // 단위 테스트할 수 있도록 순수 함수로 분리 (#271).
-export function classifyConnection({ isLocal, hasCookieAuth, patScopes }) {
+//
+// **A PAT confers the browser role only with `view`.** Any valid PAT used to, so a `builds:write`
+// token meant for CI uploads could drive devices, and an agent-only token whose first frame was not a
+// handshake fell through to `browser` as well. The HTTP side already asked for `view` (screenshots,
+// UI trees); the socket now asks the same question.
+export function classifyConnection({ isLocal, hasCookieAuth, patScopes, patOwnerRole }) {
+    if (isLocal) {
+        return hasCookieAuth
+            ? { action: 'accept', role: 'browser' }
+            : { action: 'accept', role: 'first-message', mayBrowse: true, mayRegisterAgent: true };
+    }
+    const canView = patScopes?.includes(VIEW_SCOPE) ?? false;
     // 명시적 에이전트 자격은 떠돌이 쿠키보다 우선한다 — 원격 에이전트의 인증 경로.
-    if (!isLocal && patScopes?.includes(AGENT_SCOPE))
-        return { action: 'accept', role: 'first-message' };
+    if (patScopes?.includes(AGENT_SCOPE)) {
+        if (patOwnerRole === ADMIN_ROLE) {
+            return { action: 'accept', role: 'first-message', mayBrowse: canView, mayRegisterAgent: true };
+        }
+        // A demoted owner's `view,agent` token keeps what `view` alone would give: a Viewer's `view` token
+        // may run QA sessions, so taking browsing away here would be stricter than the role model.
+        if (canView)
+            return { action: 'accept', role: 'browser' };
+        return { action: 'reject', reason: WS_AGENT_OWNER_REASON };
+    }
     if (hasCookieAuth)
         return { action: 'accept', role: 'browser' };
-    if (isLocal)
-        return { action: 'accept', role: 'first-message' };
-    if (patScopes)
+    if (canView)
         return { action: 'accept', role: 'browser' };
+    if (patScopes)
+        return { action: 'reject', reason: WS_SCOPE_REASON };
     return { action: 'reject', reason: WS_REJECT_REASON };
 }
+/**
+ * Would this socket still be accepted, given what the database says now? Returns the close reason, or
+ * null when it would.
+ *
+ * **One predicate instead of one rule per event.** Removal, demotion, revocation, expiry and an
+ * invitation accept that changes a role all reach an open socket through the same question, asked on
+ * the heartbeat and again right after any of those writes. A list of "which sockets does this event
+ * affect" is the design this replaced, and it had already missed expiry and the invitation path.
+ *
+ * `role` is what the socket has become: `agent` and `stream` rest on the `agent` scope and its owner's
+ * Admin role; `browser` rests on `view`. A socket that has not sent its first frame yet (`undefined`)
+ * is re-classified as a fresh handshake would be.
+ */
+export function revalidatePrincipal(principal, role, current, nowSeconds) {
+    if (principal.via === 'cookie') {
+        if (!current.userExists)
+            return WS_REJECT_REASON;
+        if (principal.jwtExp !== undefined && principal.jwtExp <= nowSeconds)
+            return WS_REJECT_REASON;
+        return null;
+    }
+    const pat = current.pat;
+    if (!pat)
+        return WS_TOKEN_GONE_REASON;
+    if (role === 'agent' || role === 'stream') {
+        return pat.scopes.includes(AGENT_SCOPE) && pat.ownerRole === ADMIN_ROLE ? null : WS_AGENT_OWNER_REASON;
+    }
+    if (role === 'browser')
+        return pat.scopes.includes(VIEW_SCOPE) ? null : WS_SCOPE_REASON;
+    const again = classifyConnection({ isLocal: false, hasCookieAuth: false, patScopes: pat.scopes, patOwnerRole: pat.ownerRole });
+    return again.action === 'reject' ? again.reason : null;
+}
 //# sourceMappingURL=connectionAuth.js.map

package/dist/lib/connectionAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"connectionAuth.js","sourceRoot":"","sources":["../../src/lib/connectionAuth.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAA;AAElC,gDAAgD;AAChD,MAAM,CAAC,MAAM,gBAAgB,GAC3B,2GAA2G,CAAA;AAe7G,oDAAoD;AACpD,kCAAkC;AAClC,MAAM,UAAU,kBAAkB,CAChC,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAuB;IAE1D,+CAA+C;IAC/C,IAAI,CAAC,OAAO,IAAI,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAA;IACpG,IAAI,aAAa;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC/D,IAAI,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAA;IAC/D,IAAI,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC3D,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;AACvD,CAAC"}
+{"version":3,"file":"connectionAuth.js","sourceRoot":"","sources":["../../src/lib/connectionAuth.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAA;AAClC,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAA;AAChC,MAAM,UAAU,GAAG,OAAO,CAAA;AAE1B,gDAAgD;AAChD,MAAM,CAAC,MAAM,gBAAgB,GAC3B,2GAA2G,CAAA;AAC7G,6FAA6F;AAC7F,MAAM,CAAC,MAAM,eAAe,GAC1B,mGAAmG,CAAA;AACrG,2GAA2G;AAC3G,MAAM,CAAC,MAAM,qBAAqB,GAChC,qGAAqG,CAAA;AACvG,+EAA+E;AAC/E,MAAM,CAAC,MAAM,oBAAoB,GAC/B,+EAA+E,CAAA;AAqBjF,oDAAoD;AACpD,kCAAkC;AAClC,EAAE;AACF,kGAAkG;AAClG,sGAAsG;AACtG,oGAAoG;AACpG,oDAAoD;AACpD,MAAM,UAAU,kBAAkB,CAChC,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAuB;IAExE,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,aAAa;YAClB,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;YACvC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAA;IAC1F,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAA;IACxD,+CAA+C;IAC/C,IAAI,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACrC,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;YAChC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAA;QAChG,CAAC;QACD,mGAAmG;QACnG,2FAA2F;QAC3F,IAAI,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;QACzD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;IAC5D,CAAC;IACD,IAAI,aAAa;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC/D,IAAI,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IACzD,IAAI,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;IACnE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;AACvD,CAAC;AAoBD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAA0B,EAC1B,IAAgD,EAChD,OAA0B,EAC1B,UAAkB;IAElB,IAAI,SAAS,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,UAAU;YAAE,OAAO,gBAAgB,CAAA;QAChD,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,IAAI,UAAU;YAAE,OAAO,gBAAgB,CAAA;QAC7F,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;IACvB,IAAI,CAAC,GAAG;QAAE,OAAO,oBAAoB,CAAA;IACrC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAA;IACxG,CAAC;IACD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAA;IACvF,MAAM,KAAK,GAAG,kBAAkB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAA;IAC9H,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;AACxD,CAAC"}

package/dist/lib/dataDir.d.ts

@@ -1,8 +1,55 @@
 export declare const LEGACY_DATA_DIR = ".tapflow-data";
 export declare const UNIFIED_DATA_DIR: string;
+export declare const OWN_DATA_DIR = "data";
+export declare const CONFIG_FILE = "tapflow.config.json";
+export declare const DEFAULT_INSTALL_DIR_NAME = ".tapflow";
 export interface DefaultDataDir {
     dataDir: string;
     usingLegacy: boolean;
+    existing: boolean;
 }
-export declare function resolveDefaultDataDir(cwd: string): DefaultDataDir;
+/**
+ * Whether `dir` holds an install's data. An empty dir counts — the Docker image and the systemd
+ * docs create one before the relay first starts. A dir whose only entry is `jwt-secret` does not:
+ * every CLI command up to this change wrote one wherever it ran, because the relay config created
+ * it at import, and the relay itself always creates `tapflow.db` on boot. So a dir holding the
+ * secret alone is one no relay ever ran in, and treating it as an install made an app repo that
+ * had once run `tapflow flow run` look like one.
+ */
+export declare function holdsInstallData(dir: string): boolean;
+export declare function resolveDefaultDataDir(installDir: string, fallback?: string): DefaultDataDir;
+export type InstallReason = 'TAPFLOW_HOME' | 'config in the current directory' | 'data in the current directory' | 'default';
+export interface InstallDir {
+    dir: string;
+    reason: InstallReason;
+    configPath: string;
+    defaultDataLayout: string;
+    missing: boolean;
+    shadowed: string[];
+}
+/**
+ * **Which directory is this machine's tapflow install.** Every command asks this and none takes a
+ * path, so `init` writes where `start` reads:
+ *
+ * 1. `TAPFLOW_HOME`, when set and non-empty (relative values resolve against the cwd).
+ * 2. The current directory, when it already is an install — it holds `tapflow.config.json`, or a
+ *    `.tapflow/data` / `.tapflow-data` with install data in it. This is how installs from before the
+ *    home existed keep running where they are, and how `pnpm dev` keeps its own.
+ * 3. `~/.tapflow`.
+ *
+ * A permanent rule, like npm's project `.npmrc` before the user one — not a migration path.
+ *
+ * Two cases around the home directory, both found in design review:
+ * - At `~`, `~/.tapflow/data` is the default install's own data, so it is not a signal there. And
+ *   once `~/.tapflow/tapflow.config.json` exists, `~` is never an install: an older install at `~`
+ *   would otherwise serve the new install's data under the old config.
+ * - An install at `~/.tapflow` with no config of its own reads `~/tapflow.config.json`, which is
+ *   where `tapflow init` run from a new terminal used to write it. Without that, starting it from
+ *   anywhere but `~` served the same database and secret with its TLS, tunnel and SMTP gone.
+ */
+export declare function resolveInstallDir({ env, cwd, home }?: {
+    env?: NodeJS.ProcessEnv;
+    cwd?: string;
+    home?: string;
+}): InstallDir;
 //# sourceMappingURL=dataDir.d.ts.map

package/dist/lib/dataDir.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dataDir.d.ts","sourceRoot":"","sources":["../../src/lib/dataDir.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,eAAe,kBAAkB,CAAA;AAC9C,eAAO,MAAM,gBAAgB,QAAgC,CAAA;AAE7D,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAA;IAEf,WAAW,EAAE,OAAO,CAAA;CACrB;AAMD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAMjE"}
+{"version":3,"file":"dataDir.d.ts","sourceRoot":"","sources":["../../src/lib/dataDir.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,eAAe,kBAAkB,CAAA;AAC9C,eAAO,MAAM,gBAAgB,QAAgC,CAAA;AAG7D,eAAO,MAAM,YAAY,SAAS,CAAA;AAClC,eAAO,MAAM,WAAW,wBAAwB,CAAA;AAChD,eAAO,MAAM,wBAAwB,aAAa,CAAA;AAElD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAA;IAEf,WAAW,EAAE,OAAO,CAAA;IAEpB,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CASrD;AAOD,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAyB,GAAG,cAAc,CAM7G;AAED,MAAM,MAAM,aAAa,GAAG,cAAc,GAAG,iCAAiC,GAAG,+BAA+B,GAAG,SAAS,CAAA;AAE5H,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,aAAa,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;IAElB,iBAAiB,EAAE,MAAM,CAAA;IAGzB,OAAO,EAAE,OAAO,CAAA;IAEhB,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAUD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAC/B,EAAE,GAAiB,EAAE,GAAmB,EAAE,IAAmB,EAAE,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7H,UAAU,CAoCZ"}

package/dist/lib/dataDir.js

@@ -1,18 +1,114 @@
 import fs from 'fs';
+import os from 'os';
 import path from 'path';
 export const LEGACY_DATA_DIR = '.tapflow-data';
 export const UNIFIED_DATA_DIR = path.join('.tapflow', 'data');
-// Read-only resolution of the default data dir. The relay never MOVES anything — that is the job of
-// `tapflow migrate data-dir`. It prefers the unified .tapflow/data/, but if that does not exist yet
-// and a legacy .tapflow-data/ does, it keeps reading the legacy dir so an un-migrated default install
-// is not silently reset to empty. The caller warns when usingLegacy is true.
-export function resolveDefaultDataDir(cwd) {
-    const target = path.join(cwd, UNIFIED_DATA_DIR);
-    if (fs.existsSync(target))
-        return { dataDir: target, usingLegacy: false };
-    const legacy = path.join(cwd, LEGACY_DATA_DIR);
-    if (fs.existsSync(legacy))
-        return { dataDir: legacy, usingLegacy: true };
-    return { dataDir: target, usingLegacy: false };
+// The layout of an install dir tapflow owns: config and data side by side, nothing wrapped.
+// `.tapflow/data` wraps because it dates from when tapflow lived inside the user's own folder.
+export const OWN_DATA_DIR = 'data';
+export const CONFIG_FILE = 'tapflow.config.json';
+export const DEFAULT_INSTALL_DIR_NAME = '.tapflow';
+/**
+ * Whether `dir` holds an install's data. An empty dir counts — the Docker image and the systemd
+ * docs create one before the relay first starts. A dir whose only entry is `jwt-secret` does not:
+ * every CLI command up to this change wrote one wherever it ran, because the relay config created
+ * it at import, and the relay itself always creates `tapflow.db` on boot. So a dir holding the
+ * secret alone is one no relay ever ran in, and treating it as an install made an app repo that
+ * had once run `tapflow flow run` look like one.
+ */
+export function holdsInstallData(dir) {
+    let entries;
+    try {
+        entries = fs.readdirSync(dir);
+    }
+    catch {
+        return false;
+    }
+    const real = entries.filter((e) => e !== '.DS_Store');
+    return !(real.length === 1 && real[0] === 'jwt-secret');
+}
+// Read-only resolution of an install's data dir when nothing names one. The relay never MOVES
+// anything — that is the job of `tapflow migrate data-dir`. Existing layouts come first, so an
+// install that has data keeps it: `.tapflow/data`, then the legacy `.tapflow-data`, and only then
+// `fallback`. The existing ones win over a new-layout `data/` because an install living inside an
+// app repo can have an unrelated `data/` of the app's own. The caller warns when usingLegacy is true.
+export function resolveDefaultDataDir(installDir, fallback = UNIFIED_DATA_DIR) {
+    const unified = path.join(installDir, UNIFIED_DATA_DIR);
+    if (holdsInstallData(unified))
+        return { dataDir: unified, usingLegacy: false, existing: true };
+    const legacy = path.join(installDir, LEGACY_DATA_DIR);
+    if (holdsInstallData(legacy))
+        return { dataDir: legacy, usingLegacy: true, existing: true };
+    return { dataDir: path.join(installDir, fallback), usingLegacy: false, existing: false };
+}
+function realpathOr(p) {
+    try {
+        return fs.realpathSync(p);
+    }
+    catch {
+        return path.resolve(p);
+    }
+}
+/**
+ * **Which directory is this machine's tapflow install.** Every command asks this and none takes a
+ * path, so `init` writes where `start` reads:
+ *
+ * 1. `TAPFLOW_HOME`, when set and non-empty (relative values resolve against the cwd).
+ * 2. The current directory, when it already is an install — it holds `tapflow.config.json`, or a
+ *    `.tapflow/data` / `.tapflow-data` with install data in it. This is how installs from before the
+ *    home existed keep running where they are, and how `pnpm dev` keeps its own.
+ * 3. `~/.tapflow`.
+ *
+ * A permanent rule, like npm's project `.npmrc` before the user one — not a migration path.
+ *
+ * Two cases around the home directory, both found in design review:
+ * - At `~`, `~/.tapflow/data` is the default install's own data, so it is not a signal there. And
+ *   once `~/.tapflow/tapflow.config.json` exists, `~` is never an install: an older install at `~`
+ *   would otherwise serve the new install's data under the old config.
+ * - An install at `~/.tapflow` with no config of its own reads `~/tapflow.config.json`, which is
+ *   where `tapflow init` run from a new terminal used to write it. Without that, starting it from
+ *   anywhere but `~` served the same database and secret with its TLS, tunnel and SMTP gone.
+ */
+export function resolveInstallDir({ env = process.env, cwd = process.cwd(), home = os.homedir() } = {}) {
+    const defaultDir = path.join(home, DEFAULT_INSTALL_DIR_NAME);
+    let reason = 'default';
+    let shadowed = [];
+    if (env.TAPFLOW_HOME) {
+        const dir = path.resolve(cwd, env.TAPFLOW_HOME);
+        if (realpathOr(dir) !== realpathOr(defaultDir)) {
+            return {
+                dir, reason: 'TAPFLOW_HOME', configPath: path.join(dir, CONFIG_FILE),
+                defaultDataLayout: OWN_DATA_DIR, missing: !fs.existsSync(dir), shadowed,
+            };
+        }
+        reason = 'TAPFLOW_HOME';
+    }
+    else {
+        const atHome = realpathOr(cwd) === realpathOr(home);
+        const homeInstallConfigured = atHome && fs.existsSync(path.join(defaultDir, CONFIG_FILE));
+        if (homeInstallConfigured) {
+            shadowed = [path.join(home, CONFIG_FILE)].filter((p) => fs.existsSync(p));
+            if (holdsInstallData(path.join(home, LEGACY_DATA_DIR)))
+                shadowed.push(path.join(home, LEGACY_DATA_DIR));
+        }
+        else {
+            const inCwd = (why) => ({
+                dir: cwd, reason: why, configPath: path.join(cwd, CONFIG_FILE),
+                // An install in its own folder from before the home existed: keep its layout.
+                defaultDataLayout: UNIFIED_DATA_DIR, missing: false, shadowed: [],
+            });
+            if (fs.existsSync(path.join(cwd, CONFIG_FILE)))
+                return inCwd('config in the current directory');
+            if (!atHome && holdsInstallData(path.join(cwd, UNIFIED_DATA_DIR)))
+                return inCwd('data in the current directory');
+            if (holdsInstallData(path.join(cwd, LEGACY_DATA_DIR)))
+                return inCwd('data in the current directory');
+        }
+    }
+    let configPath = path.join(defaultDir, CONFIG_FILE);
+    const homeConfig = path.join(home, CONFIG_FILE);
+    if (!fs.existsSync(configPath) && fs.existsSync(homeConfig))
+        configPath = homeConfig;
+    return { dir: defaultDir, reason, configPath, defaultDataLayout: OWN_DATA_DIR, missing: false, shadowed };
 }
 //# sourceMappingURL=dataDir.js.map

package/dist/lib/dataDir.js.map

@@ -1 +1 @@
-{"version":3,"file":"dataDir.js","sourceRoot":"","sources":["../../src/lib/dataDir.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAA;AACnB,OAAO,IAAI,MAAM,MAAM,CAAA;AAEvB,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAA;AAC9C,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;AAQ7D,oGAAoG;AACpG,oGAAoG;AACpG,sGAAsG;AACtG,6EAA6E;AAC7E,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAA;IAC/C,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAA;IACzE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;IAC9C,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;IACxE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAA;AAChD,CAAC"}
+{"version":3,"file":"dataDir.js","sourceRoot":"","sources":["../../src/lib/dataDir.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAA;AACnB,OAAO,EAAE,MAAM,IAAI,CAAA;AACnB,OAAO,IAAI,MAAM,MAAM,CAAA;AAEvB,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAA;AAC9C,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;AAC7D,4FAA4F;AAC5F,+FAA+F;AAC/F,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAA;AAClC,MAAM,CAAC,MAAM,WAAW,GAAG,qBAAqB,CAAA;AAChD,MAAM,CAAC,MAAM,wBAAwB,GAAG,UAAU,CAAA;AAUlD;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,OAAiB,CAAA;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,WAAW,CAAC,CAAA;IACrD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAA;AACzD,CAAC;AAED,8FAA8F;AAC9F,+FAA+F;AAC/F,kGAAkG;AAClG,kGAAkG;AAClG,sGAAsG;AACtG,MAAM,UAAU,qBAAqB,CAAC,UAAkB,EAAE,WAAmB,gBAAgB;IAC3F,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAA;IACvD,IAAI,gBAAgB,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAC9F,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAA;IACrD,IAAI,gBAAgB,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAC3F,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;AAC1F,CAAC;AAiBD,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IACxB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,KAA+D,EAAE;IAE9H,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAA;IAC5D,IAAI,MAAM,GAAkB,SAAS,CAAA;IACrC,IAAI,QAAQ,GAAa,EAAE,CAAA;IAE3B,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAA;QAC/C,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/C,OAAO;gBACL,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC;gBACpE,iBAAiB,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,QAAQ;aACxE,CAAA;QACH,CAAC;QACD,MAAM,GAAG,cAAc,CAAA;IACzB,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,CAAA;QACnD,MAAM,qBAAqB,GAAG,MAAM,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAA;QACzF,IAAI,qBAAqB,EAAE,CAAC;YAC1B,QAAQ,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;YACzE,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAA;QACzG,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,CAAC,GAAkB,EAAc,EAAE,CAAC,CAAC;gBACjD,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC;gBAC9D,8EAA8E;gBAC9E,iBAAiB,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;aAClE,CAAC,CAAA;YACF,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC,iCAAiC,CAAC,CAAA;YAC/F,IAAI,CAAC,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC,+BAA+B,CAAC,CAAA;YAChH,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC,+BAA+B,CAAC,CAAA;QACtG,CAAC;IACH,CAAC;IAED,IAAI,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;IAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,UAAU,GAAG,UAAU,CAAA;IACpF,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;AAC3G,CAAC"}

package/dist/middleware/auth.d.ts

@@ -7,13 +7,53 @@ export interface AuthContext {
 export declare function signJwt(payload: AuthContext): string;
 export declare function verifyJwtOrThrow(token: string): AuthContext;
 export declare function verifyJwt(token: string): AuthContext | null;
-export declare function getAuth(req: http.IncomingMessage): AuthContext | null;
+/** A signed-in session: who the cookie names, as the users table describes them now. */
+export interface SessionAuth extends AuthContext {
+    /** The JWT's `exp` (seconds since the epoch), so an open socket can be closed when it passes. */
+    exp?: number;
+}
+/**
+ * The cookie's user, **checked against the users table on every call**.
+ *
+ * The JWT lives seven days and removing a member deletes their row, so a signature check alone kept a
+ * removed member signed in for up to a week on every cookie path: this function, `requireViewAuth`,
+ * `requireBuildAuth`, recordings, and the WebSocket handshake. This is the one place all of them pass,
+ * so the row check lives here. User ids are `AUTOINCREMENT`, so a removed id never comes back and "the
+ * row exists" is a sound test. `email` and `role` come from the row, never from the JWT.
+ *
+ * Only the JWT verification failure becomes `null`. A database error propagates: turning a transient
+ * `SQLITE_BUSY` into "not signed in" would sign everyone out and hide the fault.
+ */
+export declare function getAuth(req: http.IncomingMessage): SessionAuth | null;
+export declare function findUser(userId: number): {
+    email: string;
+    role: string;
+} | null;
 export declare function requireAuth(req: http.IncomingMessage, res: http.ServerResponse): AuthContext | null;
+export declare function currentRole(res: http.ServerResponse, userId: number): string | null;
 export declare function requireRole(req: http.IncomingMessage, res: http.ServerResponse, roles: string[]): AuthContext | null;
-export declare function verifyPat(req: http.IncomingMessage): {
+export declare function assertCanWrite(res: http.ServerResponse, userId: number): boolean;
+/** A live PAT and its owner, as the database describes them now. */
+export interface PatAuth {
+    patId: number;
     userId: number;
-    scope: string;
-} | null;
+    scopes: string[];
+    ownerEmail: string;
+    ownerRole: string;
+}
+/**
+ * The PAT on this request, or null when there is none, it is unknown, or it has expired.
+ *
+ * **Reads only.** `last_used_at` is written by `touchPat` once the credential check has accepted the
+ * token: a token refused there (a scope it lacks, a WebSocket refused for its scope or its owner's
+ * role) is not used, and a "last used" that moved on those told an Admin a leaked token was in use
+ * when nothing got through. A route that accepts the token and then refuses the request on the
+ * owner's role (`assertCanWrite` for a Viewer) still counts as a use — the token did reach the route.
+ */
+export declare function verifyPat(req: http.IncomingMessage): PatAuth | null;
+/** The same lookup by id, for re-checking a token an open socket was accepted with. */
+export declare function findPat(patId: number): PatAuth | null;
+export declare function touchPat(patId: number): void;
 export declare function hashPat(token: string): string;
 export declare function requireViewAuth(req: http.IncomingMessage, res: http.ServerResponse): AuthContext | null;
 export declare function requireBuildAuth(req: http.IncomingMessage, res: http.ServerResponse): {

package/dist/middleware/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AAOvB,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;CACb;AAID,wBAAgB,OAAO,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAEpD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAM3D;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAM3D;AAED,wBAAgB,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,WAAW,GAAG,IAAI,CAKrE;AAED,wBAAgB,WAAW,CACzB,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB,WAAW,GAAG,IAAI,CAQpB;AAED,wBAAgB,WAAW,CACzB,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,MAAM,EAAE,GACd,WAAW,GAAG,IAAI,CASpB;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAe7F;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB,WAAW,GAAG,IAAI,CAuBpB;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAa3B"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AAOvB,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;CACb;AAID,wBAAgB,OAAO,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAEpD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAM3D;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAM3D;AAED,wFAAwF;AACxF,MAAM,WAAW,WAAY,SAAQ,WAAW;IAC9C,iGAAiG;IACjG,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,WAAW,GAAG,IAAI,CASrE;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAK/E;AAED,wBAAgB,WAAW,CACzB,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB,WAAW,GAAG,IAAI,CAQpB;AAKD,wBAAgB,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAUnF;AAED,wBAAgB,WAAW,CACzB,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,MAAM,EAAE,GACd,WAAW,GAAG,IAAI,CAWpB;AAMD,wBAAgB,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAShF;AAED,oEAAoE;AACpE,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;CAClB;AAyBD;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,GAAG,IAAI,CAMnE;AAED,uFAAuF;AACvF,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAGrD;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE5C;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB,WAAW,GAAG,IAAI,CAgBpB;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAc3B"}

package/dist/middleware/auth.js

@@ -2,14 +2,14 @@ import crypto from 'crypto';
 import jwt from 'jsonwebtoken';
 import { AuthError } from '@tapflowio/agent-core';
 import { getDb } from '../db.js';
-import { jwtSecret } from '../lib/config.js';
+import { getJwtSecret } from '../lib/config.js';
 const JWT_EXPIRES = '7d';
 export function signJwt(payload) {
-    return jwt.sign(payload, jwtSecret, { expiresIn: JWT_EXPIRES });
+    return jwt.sign(payload, getJwtSecret(), { expiresIn: JWT_EXPIRES });
 }
 export function verifyJwtOrThrow(token) {
     try {
-        return jwt.verify(token, jwtSecret);
+        return jwt.verify(token, getJwtSecret());
     }
     catch (cause) {
         throw new AuthError('Invalid or expired auth token', { cause });
@@ -23,12 +23,34 @@ export function verifyJwt(token) {
         return null;
     }
 }
+/**
+ * The cookie's user, **checked against the users table on every call**.
+ *
+ * The JWT lives seven days and removing a member deletes their row, so a signature check alone kept a
+ * removed member signed in for up to a week on every cookie path: this function, `requireViewAuth`,
+ * `requireBuildAuth`, recordings, and the WebSocket handshake. This is the one place all of them pass,
+ * so the row check lives here. User ids are `AUTOINCREMENT`, so a removed id never comes back and "the
+ * row exists" is a sound test. `email` and `role` come from the row, never from the JWT.
+ *
+ * Only the JWT verification failure becomes `null`. A database error propagates: turning a transient
+ * `SQLITE_BUSY` into "not signed in" would sign everyone out and hide the fault.
+ */
 export function getAuth(req) {
     const cookie = req.headers.cookie ?? '';
     const match = /(?:^|;\s*)tapflow_token=([^;]+)/.exec(cookie);
     if (!match)
         return null;
-    return verifyJwt(match[1]);
+    const claims = verifyJwt(match[1]);
+    if (!claims)
+        return null;
+    const user = findUser(claims.userId);
+    if (!user)
+        return null;
+    return { userId: claims.userId, email: user.email, role: user.role, exp: claims.exp };
+}
+export function findUser(userId) {
+    const row = getDb().prepare('SELECT email, role FROM users WHERE id = ?').get(userId);
+    return row ?? null;
 }
 export function requireAuth(req, res) {
     const auth = getAuth(req);
@@ -39,34 +61,90 @@ export function requireAuth(req, res) {
     }
     return auth;
 }
+// The cookie JWT carries a role for its whole 7-day life, so a demoted member would keep their old
+// rights for a week and a promoted one would be refused for a week. Every role decision reads the
+// users table instead; the JWT only says who is asking. A missing row means the member was removed.
+export function currentRole(res, userId) {
+    const row = getDb().prepare('SELECT role FROM users WHERE id = ?').get(userId);
+    if (!row) {
+        res.writeHead(401, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Unauthorized' }));
+        return null;
+    }
+    return row.role;
+}
 export function requireRole(req, res, roles) {
     const auth = requireAuth(req, res);
     if (!auth)
         return null;
-    if (!roles.includes(auth.role)) {
+    const role = currentRole(res, auth.userId);
+    if (role === null)
+        return null;
+    if (!roles.includes(role)) {
         res.writeHead(403, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ error: 'Forbidden' }));
         return null;
     }
-    return auth;
+    return { ...auth, role };
 }
+// Viewer is read-only: it can look at builds, test them in a QA Session and comment, but not change
+// builds, apps or webhooks. Called after a route's own auth, so it never changes which credentials
+// the route accepts. The PAT path matters most here: any role can mint a builds:write token through
+// the API, so the owner's role is what decides, at the moment the token is used.
+export function assertCanWrite(res, userId) {
+    const role = currentRole(res, userId);
+    if (role === null)
+        return false;
+    if (role === 'Viewer') {
+        res.writeHead(403, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Viewers have read-only access' }));
+        return false;
+    }
+    return true;
+}
+function toPatAuth(row) {
+    return {
+        patId: row.id,
+        userId: row.user_id,
+        scopes: row.scope.split(',').map((s) => s.trim()),
+        ownerEmail: row.email,
+        ownerRole: row.role,
+    };
+}
+// Joined with users so the owner's current role comes with the token: an `agent` token is only as good
+// as its owner's Admin role, and a Viewer's `builds:write` token is refused on write routes.
+// `datetime(expires_at)`, not the bare column: it is written by `toISOString()` ('2026-09-27T10:00:00.000Z')
+// and `datetime('now')` is '2026-09-27 10:00:00'. Compared as text, 'T' sorts after ' ', so a token that
+// expired this morning kept passing until the end of its UTC day.
+const PAT_SELECT = `
+  SELECT pat.id, pat.user_id, pat.scope, u.email, u.role
+  FROM personal_access_tokens pat
+  JOIN users u ON u.id = pat.user_id
+  WHERE (pat.expires_at IS NULL OR datetime(pat.expires_at) > datetime('now'))`;
+/**
+ * The PAT on this request, or null when there is none, it is unknown, or it has expired.
+ *
+ * **Reads only.** `last_used_at` is written by `touchPat` once the credential check has accepted the
+ * token: a token refused there (a scope it lacks, a WebSocket refused for its scope or its owner's
+ * role) is not used, and a "last used" that moved on those told an Admin a leaked token was in use
+ * when nothing got through. A route that accepts the token and then refuses the request on the
+ * owner's role (`assertCanWrite` for a Viewer) still counts as a use — the token did reach the route.
+ */
 export function verifyPat(req) {
     const header = req.headers.authorization ?? '';
     if (!header.startsWith('Bearer tflw_pat_'))
         return null;
-    const token = header.slice(7);
-    const hash = hashPat(token);
-    const db = getDb();
-    const row = db.prepare(`
-    SELECT pat.user_id, pat.scope
-    FROM personal_access_tokens pat
-    WHERE pat.token_hash = ?
-      AND (pat.expires_at IS NULL OR pat.expires_at > datetime('now'))
-  `).get(hash);
-    if (!row)
-        return null;
-    db.prepare(`UPDATE personal_access_tokens SET last_used_at = datetime('now') WHERE token_hash = ?`).run(hash);
-    return { userId: row.user_id, scope: row.scope };
+    const hash = hashPat(header.slice(7));
+    const row = getDb().prepare(`${PAT_SELECT} AND pat.token_hash = ?`).get(hash);
+    return row ? toPatAuth(row) : null;
+}
+/** The same lookup by id, for re-checking a token an open socket was accepted with. */
+export function findPat(patId) {
+    const row = getDb().prepare(`${PAT_SELECT} AND pat.id = ?`).get(patId);
+    return row ? toPatAuth(row) : null;
+}
+export function touchPat(patId) {
+    getDb().prepare(`UPDATE personal_access_tokens SET last_used_at = datetime('now') WHERE id = ?`).run(patId);
 }
 export function hashPat(token) {
     return crypto.createHash('sha256').update(token).digest('hex');
@@ -81,29 +159,23 @@ export function requireViewAuth(req, res) {
         res.end(JSON.stringify({ error: 'Unauthorized' }));
         return null;
     }
-    if (!pat.scope.split(',').map((s) => s.trim()).includes('view')) {
+    if (!pat.scopes.includes('view')) {
         res.writeHead(403, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ error: 'Insufficient scope' }));
         return null;
     }
-    const user = getDb()
-        .prepare('SELECT email, role FROM users WHERE id = ?')
-        .get(pat.userId);
-    if (!user) {
-        res.writeHead(401, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ error: 'Unauthorized' }));
-        return null;
-    }
-    return { userId: pat.userId, email: user.email, role: user.role };
+    touchPat(pat.patId);
+    return { userId: pat.userId, email: pat.ownerEmail, role: pat.ownerRole };
 }
 export function requireBuildAuth(req, res) {
     const pat = verifyPat(req);
     if (pat !== null) {
-        if (!pat.scope.split(',').map((s) => s.trim()).includes('builds:write')) {
+        if (!pat.scopes.includes('builds:write')) {
             res.writeHead(403, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Insufficient scope' }));
             return null;
         }
+        touchPat(pat.patId);
         return { userId: pat.userId };
     }
     const auth = requireAuth(req, res);

package/dist/middleware/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,GAAG,MAAM,cAAc,CAAA;AAC9B,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAQ5C,MAAM,WAAW,GAAG,IAAI,CAAA;AAExB,MAAM,UAAU,OAAO,CAAC,OAAoB;IAC1C,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAA;AACjE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAgB,CAAA;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,SAAS,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IACjE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAyB;IAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAA;IACvC,MAAM,KAAK,GAAG,iCAAiC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC5D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;AAC5B,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,GAAyB,EACzB,GAAwB;IAExB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IACzB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,GAAyB,EACzB,GAAwB,EACxB,KAAe;IAEf,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;QAC/C,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAyB;IACjD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAA;IAC9C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;QAAE,OAAO,IAAI,CAAA;IACvD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;IAC3B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;;;;;GAKtB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAmD,CAAA;IAC9D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,EAAE,CAAC,OAAO,CAAC,uFAAuF,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC7G,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAA;AAClD,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAChE,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,GAAyB,EACzB,GAAwB;IAExB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,UAAU;QAAE,OAAO,UAAU,CAAA;IACjC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAA;QACxD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,EAAE;SACjB,OAAO,CAAC,4CAA4C,CAAC;SACrD,GAAG,CAAC,GAAG,CAAC,MAAM,CAAgD,CAAA;IACjE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAA;AACnE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,GAAyB,EACzB,GAAwB;IAExB,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;YAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAA;YACxD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAA;IAC/B,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;AAChC,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,GAAG,MAAM,cAAc,CAAA;AAC9B,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAQ/C,MAAM,WAAW,GAAG,IAAI,CAAA;AAExB,MAAM,UAAU,OAAO,CAAC,OAAoB;IAC1C,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAA;AACtE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,CAAgB,CAAA;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,SAAS,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IACjE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAQD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,OAAO,CAAC,GAAyB;IAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAA;IACvC,MAAM,KAAK,GAAG,iCAAiC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC5D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAA4C,CAAA;IAC7E,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAA;AACvF,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,MAAc;IACrC,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC,GAAG,CAAC,MAAM,CAEvE,CAAA;IACb,OAAO,GAAG,IAAI,IAAI,CAAA;AACpB,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,GAAyB,EACzB,GAAwB;IAExB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IACzB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,mGAAmG;AACnG,kGAAkG;AAClG,oGAAoG;AACpG,MAAM,UAAU,WAAW,CAAC,GAAwB,EAAE,MAAc;IAClE,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,GAAG,CAAC,MAAM,CAEhE,CAAA;IACb,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,GAAyB,EACzB,GAAwB,EACxB,KAAe;IAEf,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAC1C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;QAC/C,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC;AAED,oGAAoG;AACpG,mGAAmG;AACnG,oGAAoG;AACpG,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,GAAwB,EAAE,MAAc;IACrE,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACrC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC/B,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC,CAAA;QACnE,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAaD,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,EAAE;QACb,MAAM,EAAE,GAAG,CAAC,OAAO;QACnB,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,UAAU,EAAE,GAAG,CAAC,KAAK;QACrB,SAAS,EAAE,GAAG,CAAC,IAAI;KACpB,CAAA;AACH,CAAC;AAED,uGAAuG;AACvG,6FAA6F;AAC7F,6GAA6G;AAC7G,yGAAyG;AACzG,kEAAkE;AAClE,MAAM,UAAU,GAAG;;;;+EAI4D,CAAA;AAE/E;;;;;;;;GAQG;AACH,MAAM,UAAU,SAAS,CAAC,GAAyB;IACjD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAA;IAC9C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;QAAE,OAAO,IAAI,CAAA;IACvD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACrC,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,UAAU,yBAAyB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAuB,CAAA;IACnG,OAAO,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACpC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,UAAU,iBAAiB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAuB,CAAA;IAC5F,OAAO,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACpC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,KAAK,EAAE,CAAC,OAAO,CAAC,+EAA+E,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;AAC7G,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAChE,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,GAAyB,EACzB,GAAwB;IAExB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,UAAU;QAAE,OAAO,UAAU,CAAA;IACjC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAA;QACxD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACnB,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,CAAA;AAC3E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,GAAyB,EACzB,GAAwB;IAExB,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;YAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAA;YACxD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACnB,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAA;IAC/B,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;AAChC,CAAC"}

package/dist/server.js

@@ -1,7 +1,7 @@
 import path from 'path';
 import { initDb } from './db.js';
 import { RelayServer } from './RelayServer.js';
-import { config, loadedEnvPath } from './lib/config.js';
+import { config, loadedEnvPath, assertInstallDir } from './lib/config.js';
 import { buildCorsOrigins, containerWithoutPublicUrlWarning, proxyWithoutPublicUrlWarning } from './lib/proxyConfig.js';
 import { runningInContainer } from './lib/lanAddress.js';
 import { bootstrapAdminFromEnv, AdminBootstrapError } from './lib/adminBootstrap.js';
@@ -9,6 +9,7 @@ import { createCertProvider, resolveRelayDisplayHost } from './lib/cert/index.js
 import { startTlsBackgroundTasks } from './lib/tlsTasks.js';
 import { createLogger } from '@tapflowio/agent-core';
 const logger = createLogger('relay');
+assertInstallDir();
 const { port, dataDir } = config.local;
 // config loaded <dataDir>/.env before reading any secret (JWT/SMTP/DNS tokens); just report it here.
 if (loadedEnvPath)