@wpelevator/tug 0.4.0 → 0.5.0

package/dist/db-driver.d.ts

@@ -0,0 +1,20 @@
+/** The portable subset shared by synchronous SQLite runtimes. Only anonymous ? bindings are supported. */
+export type SqlValue = string | number | bigint | null | Uint8Array;
+export type SqlRow = Record<string, SqlValue>;
+export interface Db {
+    get<T = SqlRow>(sql: string, ...values: SqlValue[]): T | undefined;
+    all<T = SqlRow>(sql: string, ...values: SqlValue[]): T[];
+    run(sql: string, ...values: SqlValue[]): {
+        changes: number;
+    };
+    exec(sql: string): void;
+    close(): void;
+}
+export type ConnectDb = (filename: string, options: {
+    readOnly: boolean;
+}) => Db;
+export declare class DbError extends Error {
+    readonly kind: 'unique' | 'busy';
+    constructor(kind: DbError['kind'], cause: Error);
+}
+export declare function isUniqueViolation(error: unknown): boolean;

package/dist/db-driver.js

@@ -0,0 +1,11 @@
+export class DbError extends Error {
+    kind;
+    constructor(kind, cause) {
+        super(cause.message, { cause });
+        this.name = 'DbError';
+        this.kind = kind;
+    }
+}
+export function isUniqueViolation(error) {
+    return error instanceof DbError && error.kind === 'unique';
+}

package/dist/db-node.d.ts

@@ -0,0 +1,3 @@
+import type { ConnectDb } from './db-driver.ts';
+/** This module is the only runtime-specific adapter; replace it at build time for a future Bun bundle. */
+export declare const connectNodeDb: ConnectDb;

package/dist/db-node.js

@@ -0,0 +1,60 @@
+import { DatabaseSync } from 'node:sqlite';
+import { DbError } from "./db-driver.js";
+function sqliteCall(operation) {
+    try {
+        return operation();
+    }
+    catch (error) {
+        if (error instanceof Error && 'errcode' in error) {
+            const code = Number(error.errcode);
+            if (code === 1555 || code === 2067)
+                throw new DbError('unique', error);
+            if ((code & 255) === 5 || (code & 255) === 6)
+                throw new DbError('busy', error);
+        }
+        throw error;
+    }
+}
+/** Count anonymous placeholders outside SQL literals, quoted identifiers and comments. */
+function checkBindings(sql, values) {
+    const tokens = sql.match(/'(?:''|[^'])*'|"(?:""|[^"])*"|`(?:``|[^`])*`|\[[^\]]*\]|--[^\r\n]*|\/\*[\s\S]*?\*\/|\?\d*|[:@$][\w]+/g) ?? [];
+    const parameters = tokens.filter((token) => /^[?:@$]/.test(token));
+    if (parameters.some((token) => token !== '?'))
+        throw new TypeError('Only anonymous ? SQL parameters are supported');
+    if (parameters.length !== values.length)
+        throw new TypeError(`Expected ${parameters.length} SQL bindings, received ${values.length}`);
+    for (const value of values) {
+        if (value !== null &&
+            typeof value !== 'string' &&
+            typeof value !== 'bigint' &&
+            !(typeof value === 'number' && Number.isFinite(value)) &&
+            !(value instanceof Uint8Array))
+            throw new TypeError('SQL bindings must be strings, finite numbers, bigints, null or Uint8Array');
+    }
+}
+/** This module is the only runtime-specific adapter; replace it at build time for a future Bun bundle. */
+export const connectNodeDb = (filename, { readOnly }) => {
+    const database = sqliteCall(() => new DatabaseSync(filename, { readOnly }));
+    const prepare = (sql, values) => {
+        checkBindings(sql, values);
+        return database.prepare(sql);
+    };
+    return {
+        get: (sql, ...values) => sqliteCall(() => {
+            const row = prepare(sql, values).get(...values);
+            return row === undefined ? undefined : { ...row };
+        }),
+        all: (sql, ...values) => sqliteCall(() => prepare(sql, values)
+            .all(...values)
+            .map((row) => ({ ...row }))),
+        run: (sql, ...values) => sqliteCall(() => {
+            const { changes } = prepare(sql, values).run(...values);
+            const count = Number(changes);
+            if (!Number.isSafeInteger(count))
+                throw new RangeError('SQL change count exceeds the safe integer range');
+            return { changes: count };
+        }),
+        exec: (sql) => sqliteCall(() => database.exec(sql)),
+        close: () => sqliteCall(() => database.close()),
+    };
+};

package/dist/db.d.ts

@@ -1,6 +1,6 @@
-import sqlite3 from 'sqlite3';
-import type { Database } from 'sqlite';
-export type Db = Database<sqlite3.Database, sqlite3.Statement>;
+import type { ConnectDb, Db } from './db-driver.ts';
+export type { Db } from './db-driver.ts';
+export declare const openDb: (filename: string) => Promise<Db>, openAgentDb: (filename: string) => Promise<Db>, openSnapshotDb: (filename: string) => Db;
 export interface ProjectRow {
     id: string;
     name: string;
@@ -19,7 +19,6 @@ export interface NodeRow {
     status: string;
     labels_json: string | null;
     agent_token_hash: string | null;
-    registry_token_hash: string | null;
     last_seen_at: string | null;
     created_at: string;
     updated_at: string;
@@ -120,5 +119,9 @@ export interface AppliedStateRow {
     service_states_json: string;
     secret_versions_json: string;
 }
-export declare function openDb(filename: string): Promise<Db>;
-export declare function openAgentDb(filename: string): Promise<Db>;
+/** Shared policy for every driver, including read-only restore validation. */
+export declare function databaseAccess(connect: ConnectDb): {
+    openDb: (filename: string) => Promise<Db>;
+    openAgentDb: (filename: string) => Promise<Db>;
+    openSnapshotDb: (filename: string) => Db;
+};

package/dist/db.js

@@ -1,19 +1,38 @@
-import sqlite3 from 'sqlite3';
-import { open } from 'sqlite';
+import { connectNodeDb } from "./db-node.js";
 import path from 'node:path';
 import { ensureDir, now } from "./util.js";
-export async function openDb(filename) {
-    await ensureDir(path.dirname(filename));
-    const db = await open({ filename, driver: sqlite3.Database });
-    await db.exec('PRAGMA journal_mode = WAL; PRAGMA foreign_keys = ON;');
-    await migrate(db);
-    return db;
+// One composition point for all writable and snapshot connections.
+export const { openDb, openAgentDb, openSnapshotDb } = databaseAccess(connectNodeDb);
+function configure(db, writable, initialize) {
+    try {
+        db.exec('PRAGMA foreign_keys = ON; PRAGMA busy_timeout = 1000;');
+        if (writable)
+            db.exec('PRAGMA journal_mode = WAL;');
+        initialize?.(db);
+        return db;
+    }
+    catch (error) {
+        try {
+            db.close();
+        }
+        catch {
+            /* Preserve the initialization failure. */
+        }
+        throw error;
+    }
 }
-export async function openAgentDb(filename) {
-    await ensureDir(path.dirname(filename));
-    const db = await open({ filename, driver: sqlite3.Database });
-    await db.exec('PRAGMA journal_mode = WAL; PRAGMA foreign_keys = ON;');
-    await db.exec(`
+/** Shared policy for every driver, including read-only restore validation. */
+export function databaseAccess(connect) {
+    function openSnapshotDb(filename) {
+        return configure(connect(filename, { readOnly: true }), false);
+    }
+    async function openDb(filename) {
+        await ensureDir(path.dirname(filename));
+        return configure(connect(filename, { readOnly: false }), true, initializeControl);
+    }
+    async function openAgentDb(filename) {
+        await ensureDir(path.dirname(filename));
+        return configure(connect(filename, { readOnly: false }), true, (db) => db.exec(`
 CREATE TABLE IF NOT EXISTS applied_state(
   project TEXT PRIMARY KEY,
   version TEXT,
@@ -27,14 +46,15 @@ CREATE TABLE IF NOT EXISTS event_state(
   fingerprint TEXT NOT NULL,
   phase TEXT NOT NULL
 );
-`);
-    return db;
+`));
+    }
+    return { openDb, openAgentDb, openSnapshotDb };
 }
-async function migrate(db) {
-    await db.exec(`
+function initializeControl(db) {
+    db.exec(`
 CREATE TABLE IF NOT EXISTS meta(key TEXT PRIMARY KEY, value TEXT NOT NULL);
 CREATE TABLE IF NOT EXISTS projects(id TEXT PRIMARY KEY, name TEXT UNIQUE NOT NULL, current_deployment_id TEXT, created_at TEXT, updated_at TEXT);
-CREATE TABLE IF NOT EXISTS nodes(id TEXT PRIMARY KEY, name TEXT UNIQUE NOT NULL, address TEXT, public_address TEXT, overlay_ip TEXT UNIQUE, ingress INTEGER NOT NULL DEFAULT 0, ingress_status_json TEXT, status TEXT, labels_json TEXT, agent_token_hash TEXT, registry_token_hash TEXT, last_seen_at TEXT, created_at TEXT, updated_at TEXT);
+CREATE TABLE IF NOT EXISTS nodes(id TEXT PRIMARY KEY, name TEXT UNIQUE NOT NULL, address TEXT, public_address TEXT, overlay_ip TEXT UNIQUE, ingress INTEGER NOT NULL DEFAULT 0, ingress_status_json TEXT, status TEXT, labels_json TEXT, agent_token_hash TEXT, last_seen_at TEXT, created_at TEXT, updated_at TEXT);
 CREATE TABLE IF NOT EXISTS wg_peers(node_id TEXT PRIMARY KEY, public_key TEXT NOT NULL UNIQUE, overlay_ip TEXT NOT NULL, endpoint TEXT, allowed_ips TEXT NOT NULL, updated_at TEXT);
 CREATE TABLE IF NOT EXISTS enroll_tokens(token_hash TEXT PRIMARY KEY, name TEXT, uses_remaining INTEGER, expires_at TEXT, created_at TEXT);
 CREATE TABLE IF NOT EXISTS deployments(id TEXT PRIMARY KEY, project_id TEXT, version TEXT, state TEXT, created_at TEXT, updated_at TEXT, error_message TEXT, actor TEXT);
@@ -51,13 +71,7 @@ CREATE TABLE IF NOT EXISTS api_tokens(id TEXT PRIMARY KEY, name TEXT UNIQUE NOT
 CREATE INDEX IF NOT EXISTS events_by_time ON events(created_at);
 CREATE TABLE IF NOT EXISTS locks(name TEXT PRIMARY KEY, owner TEXT, expires_at TEXT, created_at TEXT);
 `);
-    try {
-        await db.exec('ALTER TABLE nodes ADD COLUMN labels_json TEXT');
-    }
-    catch {
-        /* column already exists */
-    }
-    const row = await db.get('SELECT value FROM meta WHERE key = ?', 'schema_created_at');
+    const row = db.get('SELECT value FROM meta WHERE key = ?', 'schema_created_at');
     if (!row)
-        await db.run('INSERT INTO meta(key,value) VALUES(?,?)', 'schema_created_at', now());
+        db.run('INSERT INTO meta(key,value) VALUES(?,?)', 'schema_created_at', now());
 }

package/dist/docker-api.js

@@ -19,8 +19,14 @@ export const isNotFound = (error) => error instanceof DockerError && error.statu
 /** Splits a reference into `fromImage` and `tag` for `POST /images/create`. */
 export function splitImageRef(ref) {
     const digest = ref.indexOf('@');
-    if (digest >= 0)
-        return { fromImage: ref.slice(0, digest), tag: ref.slice(digest + 1) };
+    if (digest >= 0) {
+        const name = ref.slice(0, digest);
+        const colon = name.lastIndexOf(':');
+        return {
+            fromImage: colon > name.lastIndexOf('/') ? name.slice(0, colon) : name,
+            tag: ref.slice(digest + 1),
+        };
+    }
     const colon = ref.lastIndexOf(':');
     if (colon > ref.lastIndexOf('/'))
         return { fromImage: ref.slice(0, colon), tag: ref.slice(colon + 1) };
@@ -396,8 +402,14 @@ export class DockerEngine {
         const { fromImage, tag } = splitImageRef(ref);
         const res = await this.request('POST', '/images/create', {
             query: { fromImage, tag },
+            // Docker uses Go's padded base64.URLEncoding; Node's base64url encoding omits required '='.
             headers: auth
-                ? { 'x-registry-auth': Buffer.from(JSON.stringify(auth)).toString('base64url') }
+                ? {
+                    'x-registry-auth': Buffer.from(JSON.stringify(auth))
+                        .toString('base64')
+                        .replaceAll('+', '-')
+                        .replaceAll('/', '_'),
+                }
                 : {},
         });
         await this.progress(res, `pull ${ref}`);

package/dist/protocol.d.ts

@@ -421,6 +421,10 @@ export interface StatusReport {
     ingress?: IngressStatus;
 }
 export interface SecretsResponse {
+    registryAuth?: Record<string, {
+        username: string;
+        password: string;
+    }>;
     secrets: Record<string, string>;
     versions: Record<string, number>;
 }
@@ -447,7 +451,6 @@ export interface NodeInfo {
 export interface RegisterResponse {
     node: NodeInfo;
     agentToken: string;
-    registryToken: string;
 }
 /** Body of `POST /agent/v1/enroll`. */
 export interface EnrollRequest {
@@ -461,16 +464,13 @@ export interface EnrollRequest {
     labels?: string[];
 }
 /** Response of `POST /agent/v1/enroll`. */
-export interface EnrollResponse extends RegisterResponse {
-    registry: string;
-}
+export type EnrollResponse = RegisterResponse;
 /** Response of `POST /api/v1/nodes/enroll-token`. */
 export interface EnrollTokenResponse {
     enrollToken: string;
     name: string | null;
     usesRemaining: number;
     expiresAt: string;
-    registry: string;
 }
 /** The base64url-encoded JSON payload of TUG_JOIN_KEY. */
 export interface JoinKey {

package/dist/registry.d.ts

@@ -0,0 +1,17 @@
+export declare const REGISTRY_AUTH_SECRET = "TUG_REGISTRY_AUTH";
+export interface RegistryCredential {
+    username: string;
+    password: string;
+}
+export type RegistryCredentials = Record<string, RegistryCredential>;
+/** A project secret containing registry-host -> username/password entries; never a desired-state field. */
+export declare function parseRegistryCredentials(value?: string): RegistryCredentials;
+export declare function imageLocation(image: string): {
+    host: string;
+    repository: string;
+    tag: string;
+    digest: string;
+    name: string;
+};
+/** Pin the complete index, so amd64 and arm64 agents select from the same immutable manifest. */
+export declare function resolveImage(image: string, credentials?: RegistryCredentials, request?: typeof fetch): Promise<string>;

package/dist/registry.js

@@ -0,0 +1,133 @@
+import { createHash } from 'node:crypto';
+export const REGISTRY_AUTH_SECRET = 'TUG_REGISTRY_AUTH';
+/** A project secret containing registry-host -> username/password entries; never a desired-state field. */
+export function parseRegistryCredentials(value) {
+    if (!value)
+        return {};
+    try {
+        const entries = JSON.parse(value);
+        if (!entries || typeof entries !== 'object' || Array.isArray(entries))
+            throw new Error();
+        const credentials = {};
+        for (const [host, auth] of Object.entries(entries)) {
+            if (!/^[a-zA-Z0-9.:[\]-]+$/.test(host) ||
+                !auth ||
+                typeof auth !== 'object' ||
+                typeof auth.username !== 'string' ||
+                typeof auth.password !== 'string')
+                throw new Error();
+            credentials[host] = { username: auth.username, password: auth.password };
+        }
+        return credentials;
+    }
+    catch {
+        throw new Error(`${REGISTRY_AUTH_SECRET} must be a JSON object mapping registry hosts to username/password objects`);
+    }
+}
+export function imageLocation(image) {
+    const match = /^(?<name>[^@\s]+?)(?:@(?<digest>sha256:[a-f0-9]{64}))?$/.exec(image);
+    if (!match?.groups)
+        throw new Error('invalid image reference');
+    const { name, digest } = match.groups;
+    const slash = name.indexOf('/');
+    const qualified = slash >= 0 && /[.:]|^localhost$/.test(name.slice(0, slash));
+    let host = qualified ? name.slice(0, slash) : 'docker.io';
+    if (host === 'index.docker.io')
+        host = 'docker.io';
+    let repository = qualified ? name.slice(slash + 1) : name;
+    const colon = repository.lastIndexOf(':');
+    const tag = colon >= 0 ? repository.slice(colon + 1) : 'latest';
+    if (colon >= 0)
+        repository = repository.slice(0, colon);
+    if (host === 'docker.io' && !repository.includes('/'))
+        repository = `library/${repository}`;
+    if (!/^[a-z0-9]+(?:[._-]+[a-z0-9]+)*(?:\/[a-z0-9]+(?:[._-]+[a-z0-9]+)*)*$/.test(repository) ||
+        !/^[\w][\w.-]{0,127}$/.test(tag) ||
+        !/^[a-zA-Z0-9.:[\]-]+$/.test(host))
+        throw new Error('invalid image reference');
+    return { host, repository, tag, digest, name };
+}
+const accept = [
+    'application/vnd.oci.image.index.v1+json',
+    'application/vnd.docker.distribution.manifest.list.v2+json',
+    'application/vnd.oci.image.manifest.v1+json',
+    'application/vnd.docker.distribution.manifest.v2+json',
+].join(', ');
+/** Pin the complete index, so amd64 and arm64 agents select from the same immutable manifest. */
+export async function resolveImage(image, credentials = {}, request = fetch) {
+    const location = imageLocation(image);
+    if (location.digest)
+        return image;
+    const { host, repository, tag, name } = location;
+    const endpoint = host === 'docker.io' ? 'registry-1.docker.io' : host;
+    const url = `https://${endpoint}/v2/${repository}/manifests/${tag}`;
+    const auth = credentials[host];
+    const basic = auth
+        ? `Basic ${Buffer.from(`${auth.username}:${auth.password}`).toString('base64')}`
+        : undefined;
+    const get = (authorization) => request(url, {
+        headers: { Accept: accept, ...(authorization ? { Authorization: authorization } : {}) },
+        redirect: 'error',
+        signal: AbortSignal.timeout(30_000),
+    });
+    try {
+        let response = await get();
+        if (response.status === 401) {
+            const challenge = response.headers.get('www-authenticate') || '';
+            await response.body?.cancel();
+            if (/^Basic\s/i.test(challenge) && basic)
+                response = await get(basic);
+            else if (/^Bearer\s/i.test(challenge)) {
+                const params = Object.fromEntries([...challenge.matchAll(/(\w+)="([^"]*)"/g)].map((m) => [m[1], m[2]]));
+                const tokenUrl = new URL(params.realm);
+                if (tokenUrl.protocol !== 'https:' || tokenUrl.username || tokenUrl.password)
+                    throw new Error();
+                if (params.service)
+                    tokenUrl.searchParams.set('service', params.service);
+                tokenUrl.searchParams.set('scope', `repository:${repository}:pull`);
+                const tokenResponse = await request(tokenUrl, {
+                    headers: basic ? { Authorization: basic } : {},
+                    redirect: 'error',
+                    signal: AbortSignal.timeout(30_000),
+                });
+                if (!tokenResponse.ok) {
+                    await tokenResponse.body?.cancel();
+                    throw new Error();
+                }
+                const body = (await tokenResponse.json());
+                const token = body.token || body.access_token;
+                if (!token || typeof token !== 'string')
+                    throw new Error();
+                response = await get(`Bearer ${token}`);
+            }
+            else
+                throw new Error();
+        }
+        if (!response.ok) {
+            await response.body?.cancel();
+            throw new Error();
+        }
+        // Hash the exact bytes instead of trusting a registry's digest header. Bound manifest memory use.
+        const chunks = [];
+        let size = 0;
+        for await (const chunk of response.body) {
+            size += chunk.length;
+            if (size > 8 * 1024 * 1024)
+                throw new Error();
+            chunks.push(chunk);
+        }
+        const bytes = Buffer.concat(chunks);
+        const manifest = JSON.parse(bytes.toString());
+        if (manifest.schemaVersion !== 2 ||
+            !(Array.isArray(manifest.manifests) || (manifest.config && Array.isArray(manifest.layers))))
+            throw new Error();
+        const digest = `sha256:${createHash('sha256').update(bytes).digest('hex')}`;
+        const reported = response.headers.get('docker-content-digest');
+        if (reported && reported !== digest)
+            throw new Error();
+        return `${name}@${digest}`;
+    }
+    catch {
+        throw new Error(`cannot resolve image ${image}; check registry availability and project ${REGISTRY_AUTH_SECRET} credentials`);
+    }
+}

package/dist/templates/control-compose.yml

@@ -8,12 +8,8 @@ services:
       TUG_DATA_DIR: /data
       TUG_OPERATOR_TOKEN: {{OPERATOR_TOKEN}}
       TUG_MESH: {{MESH}}
-      TUG_REGISTRY: {{REGISTRY_HOST}}
-      TUG_REGISTRY_AUTH_PATH: {{REGISTRY_AUTH_PATH}}
-      TUG_REGISTRY_CONTAINER: {{REGISTRY_CONTAINER}}
     ports:
       - "{{PORT}}:8080"
     volumes:
       - /var/lib/tug-control:/data
-      - /var/lib/tug-registry-auth:/registry-auth
       - /var/run/docker.sock:/var/run/docker.sock

package/dist/templates/node-install.sh

@@ -3,6 +3,5 @@ mkdir -p /etc/tug /var/lib/tug
 cat > /etc/tug/agent.env <<'ENV'
 {{ENV}}ENV
 chmod 0600 /etc/tug/agent.env
-{{DOCKER_LOGIN}}
 docker rm -f tug-agent >/dev/null 2>&1 || true
 docker run -d --name tug-agent --restart unless-stopped --env-file /etc/tug/agent.env {{RUN_FLAGS}}-v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/tug:/var/lib/tug {{IMAGE_SH}} agent

package/dist/tokens.d.ts

@@ -14,7 +14,7 @@ export declare const PROJECT_NAME_PATTERN: RegExp;
 /**
  * The single source of truth for who may call what. Every `/api/v1` route must appear here: createApp refuses to
  * register an unlisted route, and a test compares this table with the live router. `public` routes do their own
- * credential check (the registry hook) and are not behind the token guard. docs/access-control.md mirrors this table.
+ * credential check and are not behind the token guard. docs/access-control.md mirrors this table.
  */
 export declare const ROUTE_ROLES: Record<string, RouteRole>;
 /** The authenticated caller of an API request. `projects` is null when the credential is not project-scoped. */
@@ -60,14 +60,14 @@ export declare function parseTokenRequest(body: unknown): {
     expiresAt: string | null;
 };
 /** Creates a token. The plaintext is returned once; only its hash is stored. */
-export declare function createToken(db: Db, request: ReturnType<typeof parseTokenRequest>, createdBy: string): Promise<TokenInfo & {
+export declare function createToken(db: Db, request: ReturnType<typeof parseTokenRequest>, createdBy: string): TokenInfo & {
     token: string;
-}>;
-export declare function listTokens(db: Db): Promise<TokenInfo[]>;
+};
+export declare function listTokens(db: Db): TokenInfo[];
 /** Revokes a token immediately. Returns false if no such token exists; revoking twice keeps the first revocation time. */
-export declare function revokeToken(db: Db, name: string): Promise<boolean>;
+export declare function revokeToken(db: Db, name: string): boolean;
 /** Resolves a bearer value to an actor by hash lookup: the root operator token first, then named tokens. */
-export declare function authenticate(db: Db, raw: string): Promise<Actor | null>;
+export declare function authenticate(db: Db, raw: string): Actor | null;
 /**
  * Which project a request targets: a name, `null` for control-wide data (admin only), or `undefined` when it cannot be
  * resolved (for example an unknown ID). Unresolvable targets are denied to scoped tokens without saying why, so they
@@ -88,4 +88,4 @@ export declare function recordEvent(db: Db, event: {
     project?: string | null;
     deploymentId?: string | null;
     metadata?: Record<string, unknown>;
-}): Promise<void>;
+}): void;

package/dist/tokens.js

@@ -1,3 +1,4 @@
+import { isUniqueViolation } from "./db-driver.js";
 import { hashToken, id, now, token } from "./util.js";
 /** Roles are cumulative: `deploy` includes `read`, and `admin` includes both. */
 export const ROLES = ['read', 'deploy', 'admin'];
@@ -14,7 +15,7 @@ const LAST_USED_INTERVAL_MS = 60_000;
 /**
  * The single source of truth for who may call what. Every `/api/v1` route must appear here: createApp refuses to
  * register an unlisted route, and a test compares this table with the live router. `public` routes do their own
- * credential check (the registry hook) and are not behind the token guard. docs/access-control.md mirrors this table.
+ * credential check and are not behind the token guard. docs/access-control.md mirrors this table.
  */
 export const ROUTE_ROLES = {
     'GET /api/v1/live': 'deploy',
@@ -38,8 +39,6 @@ export const ROUTE_ROLES = {
     'GET /api/v1/nodes': 'admin',
     'POST /api/v1/nodes/register': 'admin',
     'POST /api/v1/nodes/enroll-token': 'admin',
-    'POST /api/v1/nodes/:name/rotate-registry-token': 'admin',
-    'POST /api/v1/nodes/:name/revoke-registry-token': 'admin',
     'POST /api/v1/nodes/:name/rotate-wg-key': 'admin',
     'POST /api/v1/nodes/:name/ingress': 'admin',
     'DELETE /api/v1/nodes/:name': 'admin',
@@ -50,7 +49,6 @@ export const ROUTE_ROLES = {
     'POST /api/v1/tokens': 'admin',
     'GET /api/v1/tokens': 'admin',
     'DELETE /api/v1/tokens/:name': 'admin',
-    'POST /api/v1/registry/auth': 'public',
 };
 const statusError = (status, message) => Object.assign(new Error(message), { status });
 export const isRole = (value) => typeof value === 'string' && ROLES.includes(value);
@@ -98,46 +96,51 @@ const info = (row) => ({
     revokedAt: row.revoked_at,
 });
 /** Creates a token. The plaintext is returned once; only its hash is stored. */
-export async function createToken(db, request, createdBy) {
+export function createToken(db, request, createdBy) {
     const value = token(TOKEN_PREFIX);
     try {
-        await db.run('INSERT INTO api_tokens(id,name,token_hash,role,projects_json,created_at,created_by,expires_at) VALUES(?,?,?,?,?,?,?,?)', id('tok'), request.name, hashToken(value), request.role, request.projects ? JSON.stringify(request.projects) : null, now(), createdBy, request.expiresAt);
+        db.run('INSERT INTO api_tokens(id,name,token_hash,role,projects_json,created_at,created_by,expires_at) VALUES(?,?,?,?,?,?,?,?)', id('tok'), request.name, hashToken(value), request.role, request.projects ? JSON.stringify(request.projects) : null, now(), createdBy, request.expiresAt);
     }
     catch (e) {
-        if (/UNIQUE constraint/.test(e.message))
+        if (isUniqueViolation(e))
             throw statusError(409, `token name ${request.name} is already used (revoked tokens keep their names for the audit trail)`);
         throw e;
     }
     return {
-        ...info((await db.get('SELECT * FROM api_tokens WHERE name=?', request.name))),
+        ...info(db.get('SELECT * FROM api_tokens WHERE name=?', request.name)),
         token: value,
     };
 }
-export async function listTokens(db) {
-    return (await db.all('SELECT * FROM api_tokens ORDER BY created_at, name')).map(info);
+export function listTokens(db) {
+    return db.all('SELECT * FROM api_tokens ORDER BY created_at, name').map(info);
 }
 /** Revokes a token immediately. Returns false if no such token exists; revoking twice keeps the first revocation time. */
-export async function revokeToken(db, name) {
-    const row = await db.get('SELECT * FROM api_tokens WHERE name=?', name);
+export function revokeToken(db, name) {
+    const row = db.get('SELECT * FROM api_tokens WHERE name=?', name);
     if (!row)
         return false;
-    await db.run('UPDATE api_tokens SET revoked_at=? WHERE id=? AND revoked_at IS NULL', now(), row.id);
+    db.run('UPDATE api_tokens SET revoked_at=? WHERE id=? AND revoked_at IS NULL', now(), row.id);
     return true;
 }
 /** Resolves a bearer value to an actor by hash lookup: the root operator token first, then named tokens. */
-export async function authenticate(db, raw) {
+export function authenticate(db, raw) {
     if (!raw)
         return null;
     const hash = hashToken(raw);
-    const operator = await db.get('SELECT value FROM meta WHERE key=?', 'operator_token_hash');
+    const operator = db.get('SELECT value FROM meta WHERE key=?', 'operator_token_hash');
     if (operator && hash === operator.value)
         return { name: OPERATOR_ACTOR, role: 'admin', projects: null };
-    const row = await db.get('SELECT * FROM api_tokens WHERE token_hash=?', hash);
+    const row = db.get('SELECT * FROM api_tokens WHERE token_hash=?', hash);
     if (!row || row.revoked_at || (row.expires_at && row.expires_at <= now()))
         return null;
-    // Best effort and throttled: a slow or failing bookkeeping write must never fail or delay the request.
+    // Best effort and throttled: bookkeeping failures must never fail authentication.
     if (!row.last_used_at || Date.parse(row.last_used_at) < Date.now() - LAST_USED_INTERVAL_MS)
-        void db.run('UPDATE api_tokens SET last_used_at=? WHERE id=?', now(), row.id).catch(() => { });
+        try {
+            db.run('UPDATE api_tokens SET last_used_at=? WHERE id=?', now(), row.id);
+        }
+        catch {
+            /* Best-effort bookkeeping. */
+        }
     return {
         name: row.name,
         role: row.role,
@@ -156,7 +159,7 @@ export function assertProject(actor, project) {
 export function createGuard(db) {
     return (required, resolve) => async (req, res, next) => {
         try {
-            const actor = await authenticate(db, (req.headers.authorization || '').replace(/^Bearer /, ''));
+            const actor = authenticate(db, (req.headers.authorization || '').replace(/^Bearer /, ''));
             if (!actor) {
                 res.status(401).json({ error: 'unauthorized' });
                 return;
@@ -186,6 +189,6 @@ export function createGuard(db) {
     };
 }
 /** Appends a control-originated audit event naming the acting token. */
-export async function recordEvent(db, event) {
-    await db.run('INSERT INTO events(id,project_id,deployment_id,node_id,level,type,message,metadata_json,created_at,actor) VALUES(?,?,?,?,?,?,?,?,?,?)', id('evt'), event.project ?? null, event.deploymentId ?? null, null, 'info', event.type, event.message, JSON.stringify(event.metadata ?? {}), now(), event.actor);
+export function recordEvent(db, event) {
+    db.run('INSERT INTO events(id,project_id,deployment_id,node_id,level,type,message,metadata_json,created_at,actor) VALUES(?,?,?,?,?,?,?,?,?,?)', id('evt'), event.project ?? null, event.deploymentId ?? null, null, 'info', event.type, event.message, JSON.stringify(event.metadata ?? {}), now(), event.actor);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wpelevator/tug",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Portable VPS deployments with Docker Compose",
   "repository": {
     "type": "git",
@@ -43,8 +43,6 @@
     "express": "^4.21.2",
     "js-yaml": "^4.1.0",
     "multer": "^2.2.0",
-    "sqlite": "^5.1.1",
-    "sqlite3": "^5.1.7",
     "tar": "^7.4.3",
     "ws": "^8.22.1"
   },