@yadsh/dsh-qa-surface 0.7.4 → 0.8.0

package/lib/accounts/database.js

@@ -0,0 +1,447 @@
+import { randomBytes } from "node:crypto";
+import { readFileSync, renameSync } from "node:fs";
+import { SqliteDatabase, } from "@yadsh/dsh-plugin-kit/sqlite";
+import { snapshotDigest, } from "./file.js";
+/** The token secret lives beside the schema version in the meta table. */
+const SECRET_KEY = "token_secret";
+/**
+ * One step per released layout. Versions are dense: a database records the
+ * highest one it has applied, and a build refuses to open a file from above it.
+ */
+const MIGRATIONS = [
+    {
+        version: 1,
+        up: `
+      CREATE TABLE qa_accounts (
+        id TEXT PRIMARY KEY,
+        seq INTEGER NOT NULL,
+        email TEXT NOT NULL,
+        display_name TEXT NOT NULL,
+        role TEXT NOT NULL,
+        disabled INTEGER NOT NULL DEFAULT 0,
+        token_version INTEGER NOT NULL DEFAULT 0,
+        created_at TEXT NOT NULL,
+        last_login_at TEXT,
+        password_salt TEXT NOT NULL,
+        password_hash TEXT NOT NULL,
+        profile_json TEXT,
+        starters_json TEXT,
+        qa_access_json TEXT
+      );
+      CREATE UNIQUE INDEX qa_accounts_email ON qa_accounts (email);
+
+      -- Every admitted chat freezes the capabilities it was admitted with, and
+      -- on a real deployment those policies are almost always the same list: 25
+      -- snapshots on the live stand were two distinct ones, and restating them
+      -- per chat was 45% of the file. One row per distinct policy, referenced.
+      CREATE TABLE qa_snapshots (
+        hash TEXT PRIMARY KEY,
+        json TEXT NOT NULL,
+        first_seen_at TEXT NOT NULL
+      );
+
+      CREATE TABLE qa_ownership (
+        session_id TEXT PRIMARY KEY,
+        user_id TEXT NOT NULL,
+        claimed_at TEXT NOT NULL,
+        subrole_id TEXT,
+        admin_preview INTEGER NOT NULL DEFAULT 0,
+        snapshot_hash TEXT REFERENCES qa_snapshots (hash)
+      );
+      CREATE INDEX qa_ownership_user ON qa_ownership (user_id, claimed_at DESC);
+
+      CREATE TABLE qa_skill_activations (
+        session_id TEXT NOT NULL,
+        seq INTEGER NOT NULL,
+        json TEXT NOT NULL,
+        PRIMARY KEY (session_id, seq)
+      );
+    `,
+    },
+];
+/** SQLite hands back null-prototype records; the row shapes describe them. */
+function asRows(value) {
+    return value;
+}
+function parseJsonColumn(raw) {
+    if (raw === null || raw === "")
+        return undefined;
+    return JSON.parse(raw);
+}
+function toUser(row) {
+    const profile = parseJsonColumn(row.profile_json);
+    const starters = parseJsonColumn(row.starters_json);
+    const qaAccess = parseJsonColumn(row.qa_access_json);
+    return {
+        id: row.id,
+        email: row.email,
+        displayName: row.display_name,
+        role: row.role,
+        passwordHash: { salt: row.password_salt, hash: row.password_hash },
+        createdAt: row.created_at,
+        lastLoginAt: row.last_login_at,
+        ...(row.disabled === 1 ? { disabled: true } : {}),
+        ...(row.token_version === 0 ? {} : { tokenVersion: row.token_version }),
+        ...(profile === undefined ? {} : { profile }),
+        ...(starters === undefined ? {} : { starters }),
+        ...(qaAccess === undefined ? {} : { qaAccess }),
+    };
+}
+/**
+ * The deployment's accounts, as tables.
+ *
+ * The stores this replaces were one JSON document read, parsed and rewritten
+ * whole on every mutation — so a chat being opened rewrote every account and
+ * every chat the deployment had ever seen, and the cost of that write grew with
+ * the deployment's age. Here a mutation touches the row it changes: opening a
+ * chat inserts one ownership row, and the file's size stops being a per-turn
+ * cost.
+ *
+ * Cross-process freshness survives the change. The `qa-accounts` CLI writes the
+ * same database from a second process, so the in-memory model is invalidated by
+ * `PRAGMA data_version`, which SQLite bumps exactly when *another* connection
+ * commits — the same guarantee the previous mtime-and-size stamp provided, with
+ * no file read to notice it.
+ */
+export class QaAccountsDatabase {
+    filePath;
+    storage;
+    observedDataVersion;
+    constructor(filePath) {
+        this.filePath = filePath;
+        this.storage = new SqliteDatabase(filePath, MIGRATIONS);
+        this.observedDataVersion = this.readDataVersion();
+        this.ensureSecret();
+    }
+    /** The token secret, creating one for a database that has none yet. */
+    get secret() {
+        const existing = this.storage.meta(SECRET_KEY);
+        if (existing !== undefined && existing !== "")
+            return existing;
+        throw new Error(`qa-accounts: ${this.filePath} has no token secret; refusing to mint tokens`);
+    }
+    /** True while the in-memory model a caller holds is still current. */
+    get unchangedSinceLoad() {
+        return this.readDataVersion() === this.observedDataVersion;
+    }
+    /** Take the current data version as the baseline a caller's model reflects. */
+    markLoaded() {
+        this.observedDataVersion = this.readDataVersion();
+    }
+    /** Every account, ownership record and skill activation, in one read. */
+    loadAll() {
+        const users = asRows(this.storage.db.prepare("SELECT * FROM qa_accounts ORDER BY seq").all());
+        const ownershipRows = asRows(this.storage.db
+            .prepare(`SELECT o.session_id, o.user_id, o.claimed_at, o.subrole_id,
+                  o.admin_preview, s.json AS snapshot_json
+             FROM qa_ownership o
+             LEFT JOIN qa_snapshots s ON s.hash = o.snapshot_hash`)
+            .all());
+        const ownership = {};
+        for (const row of ownershipRows) {
+            const snapshot = parseJsonColumn(row.snapshot_json);
+            const skillActivations = asRows(this.storage.db
+                .prepare("SELECT json FROM qa_skill_activations WHERE session_id = ? ORDER BY seq")
+                .all(row.session_id));
+            ownership[row.session_id] = {
+                userId: row.user_id,
+                claimedAt: row.claimed_at,
+                ...(row.subrole_id === null ? {} : { subroleId: row.subrole_id }),
+                ...(row.admin_preview === 1 ? { adminPreview: true } : {}),
+                ...(snapshot === undefined ? {} : { capabilitySnapshot: snapshot }),
+                ...(skillActivations.length === 0
+                    ? {}
+                    : {
+                        skillActivations: skillActivations.map((entry) => JSON.parse(entry.json)),
+                    }),
+            };
+        }
+        this.markLoaded();
+        return {
+            version: 1,
+            secret: this.secret,
+            users: users.map(toUser),
+            ownership,
+        };
+    }
+    /** Append one account, preserving the order accounts are listed in. */
+    insertUser(user) {
+        this.storage.transaction(() => {
+            this.writeUser(user);
+        });
+    }
+    /** Replace one account's row in place. */
+    updateUser(user) {
+        this.storage.transaction(() => {
+            this.writeUser(user, { replace: true });
+        });
+    }
+    /** Record a successful sign-in without rewriting the account. */
+    touchLogin(userId, at) {
+        this.storage.transaction(() => {
+            this.storage.db
+                .prepare("UPDATE qa_accounts SET last_login_at = ? WHERE id = ?")
+                .run(at, userId);
+        });
+    }
+    /** Claim one chat for an account. */
+    insertOwnership(sessionId, owner) {
+        this.storage.transaction(() => {
+            this.writeOwnership(sessionId, owner);
+        });
+    }
+    /** Claim many chats at once, which is how a browser's index migrates. */
+    insertOwnershipMany(rows) {
+        if (rows.length === 0)
+            return;
+        this.storage.transaction(() => {
+            for (const row of rows)
+                this.writeOwnership(row.sessionId, row.owner);
+        });
+    }
+    /** Rewrite an existing chat's pinned role, preview flag or snapshot. */
+    updateOwnership(sessionId, owner) {
+        this.storage.transaction(() => {
+            this.writeOwnership(sessionId, owner);
+        });
+    }
+    /** Forget chats: a rolled-back reservation, or a chat the Harness lost. */
+    deleteOwnership(sessionIds) {
+        if (sessionIds.length === 0)
+            return;
+        this.storage.transaction(() => {
+            const remove = this.storage.db.prepare("DELETE FROM qa_ownership WHERE session_id = ?");
+            for (const sessionId of sessionIds) {
+                remove.run(sessionId);
+                this.storage.db
+                    .prepare("DELETE FROM qa_skill_activations WHERE session_id = ?")
+                    .run(sessionId);
+            }
+            this.gcSnapshots();
+        });
+    }
+    /**
+     * Append one skill activation and keep the newest `limit` of them. The list
+     * is bounded because a long session may activate skills many times, and the
+     * oldest entries stop being interesting long before the store does.
+     */
+    appendSkillActivation(sessionId, entry, limit) {
+        return this.storage.transaction(() => {
+            const next = this.storage.db
+                .prepare("SELECT COALESCE(MAX(seq), 0) + 1 AS next FROM qa_skill_activations WHERE session_id = ?")
+                .get(sessionId);
+            this.storage.db
+                .prepare("INSERT INTO qa_skill_activations (session_id, seq, json) VALUES (?, ?, ?)")
+                .run(sessionId, next.next, JSON.stringify(entry));
+            if (limit > 0) {
+                this.storage.db
+                    .prepare(`DELETE FROM qa_skill_activations
+              WHERE session_id = ?
+                AND seq <= ? - ?`)
+                    .run(sessionId, next.next, limit);
+            }
+            const kept = asRows(this.storage.db
+                .prepare("SELECT json FROM qa_skill_activations WHERE session_id = ? ORDER BY seq")
+                .all(sessionId));
+            return kept.map((row) => JSON.parse(row.json));
+        });
+    }
+    /**
+     * Import a pre-SQLite `qa-accounts.json` exactly once, then rename it away.
+     *
+     * The import is verified *inside* the transaction and before the file is
+     * retired — every account and every ownership record must have arrived, and
+     * the token secret must be the one the file carried — because a silent
+     * partial import would either lock accounts out or hand a chat to the wrong
+     * owner. A database that already holds accounts is never overwritten by a
+     * leftover file.
+     */
+    importLegacyFile(legacyFilePath) {
+        if (legacyFilePath === undefined)
+            return undefined;
+        let raw;
+        try {
+            raw = readFileSync(legacyFilePath, "utf8");
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return undefined;
+            throw error;
+        }
+        const legacy = this.parseLegacyFile(legacyFilePath, raw);
+        if (this.hasAccounts())
+            return undefined;
+        const imported = this.storage.transaction(() => {
+            this.storage.setMeta(SECRET_KEY, legacy.secret);
+            for (const user of legacy.users)
+                this.writeUser(user);
+            for (const [sessionId, owner] of Object.entries(legacy.ownership)) {
+                this.writeOwnership(sessionId, owner);
+            }
+            const arrived = this.loadAll();
+            this.assertImportArrived(legacyFilePath, legacy, arrived);
+            return arrived;
+        });
+        renameSync(legacyFilePath, `${legacyFilePath}.migrated-${new Date().toISOString().replace(/[:.]/gu, "-")}`);
+        return imported;
+    }
+    assertImportArrived(legacyFilePath, legacy, imported) {
+        const problems = [];
+        if (imported.secret !== legacy.secret) {
+            problems.push("the token secret did not arrive");
+        }
+        if (imported.users.length !== legacy.users.length) {
+            problems.push(`expected ${legacy.users.length} accounts, imported ${imported.users.length}`);
+        }
+        const expectedSessions = Object.keys(legacy.ownership).length;
+        const importedSessions = Object.keys(imported.ownership).length;
+        if (importedSessions !== expectedSessions) {
+            problems.push(`expected ${expectedSessions} chat records, imported ${importedSessions}`);
+        }
+        if (problems.length > 0) {
+            throw new Error(`qa-accounts: importing ${legacyFilePath} failed verification (${problems.join("; ")}); the file is left in place and the import was rolled back`);
+        }
+    }
+    close() {
+        this.storage.close();
+    }
+    hasAccounts() {
+        const row = this.storage.db
+            .prepare("SELECT COUNT(*) AS count FROM qa_accounts")
+            .get();
+        return row.count > 0;
+    }
+    readDataVersion() {
+        const row = this.storage.db.prepare("PRAGMA data_version").get();
+        return row.data_version;
+    }
+    ensureSecret() {
+        const existing = this.storage.meta(SECRET_KEY);
+        if (existing !== undefined && existing !== "")
+            return;
+        this.storage.transaction(() => {
+            // 32 random bytes, base64url — the shape the tokens already assume.
+            this.storage.setMeta(SECRET_KEY, randomBytes(32).toString("base64url"));
+        });
+    }
+    /** The account columns, in the order both write statements bind them. */
+    accountColumns(user) {
+        return [
+            user.email,
+            user.displayName,
+            user.role,
+            user.disabled === true ? 1 : 0,
+            user.tokenVersion ?? 0,
+            user.createdAt,
+            user.lastLoginAt,
+            user.passwordHash.salt,
+            user.passwordHash.hash,
+            user.profile === undefined ? null : JSON.stringify(user.profile),
+            user.starters === undefined ? null : JSON.stringify(user.starters),
+            user.qaAccess === undefined ? null : JSON.stringify(user.qaAccess),
+        ];
+    }
+    writeUser(user, options = {}) {
+        const columns = this.accountColumns(user);
+        if (options.replace === true) {
+            this.storage.db
+                .prepare(`UPDATE qa_accounts
+              SET email = ?, display_name = ?, role = ?, disabled = ?,
+                  token_version = ?, created_at = ?, last_login_at = ?,
+                  password_salt = ?, password_hash = ?, profile_json = ?,
+                  starters_json = ?, qa_access_json = ?
+            WHERE id = ?`)
+                .run(...columns, user.id);
+            return;
+        }
+        // A new account lands after every account already stored, which is the
+        // order the operator CLI and the console list them in.
+        const next = this.storage.db
+            .prepare("SELECT COALESCE(MAX(seq), 0) + 1 AS next FROM qa_accounts")
+            .get();
+        this.storage.db
+            .prepare(`INSERT INTO qa_accounts
+           (id, seq, email, display_name, role, disabled, token_version,
+            created_at, last_login_at, password_salt, password_hash,
+            profile_json, starters_json, qa_access_json)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(user.id, next.next, ...columns);
+    }
+    writeOwnership(sessionId, owner) {
+        const snapshotHash = owner.capabilitySnapshot === undefined
+            ? null
+            : this.writeSnapshot(owner.capabilitySnapshot);
+        this.storage.db
+            .prepare(`INSERT INTO qa_ownership
+           (session_id, user_id, claimed_at, subrole_id, admin_preview, snapshot_hash)
+         VALUES (?, ?, ?, ?, ?, ?)
+         ON CONFLICT(session_id) DO UPDATE SET
+           user_id = excluded.user_id,
+           claimed_at = excluded.claimed_at,
+           subrole_id = excluded.subrole_id,
+           admin_preview = excluded.admin_preview,
+           snapshot_hash = excluded.snapshot_hash`)
+            .run(sessionId, owner.userId, owner.claimedAt, owner.subroleId ?? null, owner.adminPreview === true ? 1 : 0, snapshotHash);
+        const activations = owner.skillActivations ?? [];
+        this.storage.db
+            .prepare("DELETE FROM qa_skill_activations WHERE session_id = ?")
+            .run(sessionId);
+        const insert = this.storage.db.prepare("INSERT INTO qa_skill_activations (session_id, seq, json) VALUES (?, ?, ?)");
+        activations.forEach((entry, index) => {
+            insert.run(sessionId, index + 1, JSON.stringify(entry));
+        });
+        this.gcSnapshots();
+    }
+    /** One row per distinct policy; the digest is the policy's content. */
+    writeSnapshot(policy) {
+        const hash = snapshotDigest(policy);
+        this.storage.db
+            .prepare(`INSERT INTO qa_snapshots (hash, json, first_seen_at) VALUES (?, ?, ?)
+         ON CONFLICT(hash) DO NOTHING`)
+            .run(hash, JSON.stringify(policy), new Date().toISOString());
+        return hash;
+    }
+    /** Drop snapshots no chat refers to any more, so the table cannot drift up. */
+    gcSnapshots() {
+        this.storage.db
+            .prepare(`DELETE FROM qa_snapshots
+          WHERE hash NOT IN (
+            SELECT snapshot_hash FROM qa_ownership
+             WHERE snapshot_hash IS NOT NULL
+          )`)
+            .run();
+    }
+    parseLegacyFile(filePath, raw) {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== "object" ||
+            parsed === null ||
+            parsed.version !== 1 ||
+            typeof parsed.secret !== "string" ||
+            !Array.isArray(parsed.users)) {
+            throw new Error(`qa-accounts: ${filePath} is not a recognizable accounts file; refusing to import it`);
+        }
+        const file = parsed;
+        const snapshots = file.snapshots ?? {};
+        const ownership = {};
+        for (const [sessionId, entry] of Object.entries(file.ownership ?? {})) {
+            const stored = entry;
+            const { snapshotRef, ...rest } = stored;
+            if (snapshotRef === undefined) {
+                ownership[sessionId] = rest;
+                continue;
+            }
+            const snapshot = snapshots[snapshotRef];
+            if (snapshot === undefined) {
+                throw new Error(`qa-accounts: session ${sessionId} refers to missing capability snapshot ${snapshotRef}; refusing to import a corrupt accounts file`);
+            }
+            ownership[sessionId] = { ...rest, capabilitySnapshot: snapshot };
+        }
+        return {
+            version: 1,
+            secret: file.secret,
+            users: file.users,
+            ownership,
+        };
+    }
+}
+//# sourceMappingURL=database.js.map

package/lib/accounts/database.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.js","sourceRoot":"","sources":["../../src/accounts/database.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EACL,cAAc,GAEf,MAAM,8BAA8B,CAAC;AAMtC,OAAO,EACL,cAAc,GAMf,MAAM,WAAW,CAAC;AAEnB,0EAA0E;AAC1E,MAAM,UAAU,GAAG,cAAc,CAAC;AAElC;;;GAGG;AACH,MAAM,UAAU,GAA+B;IAC7C;QACE,OAAO,EAAE,CAAC;QACV,EAAE,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA6CH;KACF;CACF,CAAC;AAiCF,8EAA8E;AAC9E,SAAS,MAAM,CAAI,KAAc;IAC/B,OAAO,KAAY,CAAC;AACtB,CAAC;AAED,SAAS,eAAe,CAAI,GAAkB;IAC5C,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACjD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,CAAC;AAC9B,CAAC;AAED,SAAS,MAAM,CAAC,GAAe;IAC7B,MAAM,OAAO,GAAG,eAAe,CAAgB,GAAG,CAAC,YAAY,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,eAAe,CAAiB,GAAG,CAAC,aAAa,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,eAAe,CAAe,GAAG,CAAC,cAAc,CAAC,CAAC;IACnE,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,IAAI,EAAE,GAAG,CAAC,IAA0B;QACpC,YAAY,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,GAAG,CAAC,aAAa,EAAE;QAClE,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,WAAW,EAAE,GAAG,CAAC,aAAa;QAC9B,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;QACvE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;KAChD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,kBAAkB;IAIR,QAAQ;IAHpB,OAAO,CAAiB;IACzB,mBAAmB,CAAS;IAEpC,YAAqB,QAAgB;wBAAhB,QAAQ;QAC3B,IAAI,CAAC,OAAO,GAAG,IAAI,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACxD,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAClD,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAED,uEAAuE;IACvE,IAAI,MAAM;QACR,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE;YAAE,OAAO,QAAQ,CAAC;QAC/D,MAAM,IAAI,KAAK,CACb,gBAAgB,IAAI,CAAC,QAAQ,+CAA+C,CAC7E,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,eAAe,EAAE,KAAK,IAAI,CAAC,mBAAmB,CAAC;IAC7D,CAAC;IAED,+EAA+E;IAC/E,UAAU;QACR,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;IACpD,CAAC;IAED,yEAAyE;IACzE,OAAO;QACL,MAAM,KAAK,GAAG,MAAM,CAClB,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,EAAE,CACxE,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,CAC1B,IAAI,CAAC,OAAO,CAAC,EAAE;aACZ,OAAO,CACN;;;kEAGwD,CACzD;aACA,GAAG,EAAE,CACT,CAAC;QACF,MAAM,SAAS,GAAoC,EAAE,CAAC;QACtD,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,eAAe,CAC9B,GAAG,CAAC,aAAa,CAClB,CAAC;YACF,MAAM,gBAAgB,GAAG,MAAM,CAC7B,IAAI,CAAC,OAAO,CAAC,EAAE;iBACZ,OAAO,CACN,yEAAyE,CAC1E;iBACA,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CACvB,CAAC;YACF,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG;gBAC1B,MAAM,EAAE,GAAG,CAAC,OAAO;gBACnB,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;gBACjE,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC;gBACnE,GAAG,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC;oBAC/B,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC;wBACE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CACpC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAA4B,CAC7D;qBACF,CAAC;aACP,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,OAAO;YACL,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;YACxB,SAAS;SACV,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,UAAU,CAAC,IAAgB;QACzB,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,0CAA0C;IAC1C,UAAU,CAAC,IAAgB;QACzB,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iEAAiE;IACjE,UAAU,CAAC,MAAc,EAAE,EAAU;QACnC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,OAAO,CAAC,EAAE;iBACZ,OAAO,CAAC,uDAAuD,CAAC;iBAChE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,qCAAqC;IACrC,eAAe,CAAC,SAAiB,EAAE,KAAsB;QACvD,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,mBAAmB,CAAC,IAA+B;QACjD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC9B,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC5B,KAAK,MAAM,GAAG,IAAI,IAAI;gBAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,eAAe,CAAC,SAAiB,EAAE,KAAsB;QACvD,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,eAAe,CAAC,UAA6B;QAC3C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACpC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CACpC,+CAA+C,CAChD,CAAC;YACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACtB,IAAI,CAAC,OAAO,CAAC,EAAE;qBACZ,OAAO,CAAC,uDAAuD,CAAC;qBAChE,GAAG,CAAC,SAAS,CAAC,CAAC;YACpB,CAAC;YACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,qBAAqB,CACnB,SAAiB,EACjB,KAA8B,EAC9B,KAAa;QAEb,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YACnC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE;iBACzB,OAAO,CACN,yFAAyF,CAC1F;iBACA,GAAG,CAAC,SAAS,CAAqB,CAAC;YACtC,IAAI,CAAC,OAAO,CAAC,EAAE;iBACZ,OAAO,CACN,2EAA2E,CAC5E;iBACA,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YACpD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACd,IAAI,CAAC,OAAO,CAAC,EAAE;qBACZ,OAAO,CACN;;iCAEqB,CACtB;qBACA,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACtC,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CACjB,IAAI,CAAC,OAAO,CAAC,EAAE;iBACZ,OAAO,CACN,yEAAyE,CAC1E;iBACA,GAAG,CAAC,SAAS,CAAC,CAClB,CAAC;YACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAA4B,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACH,gBAAgB,CACd,cAAkC;QAElC,IAAI,cAAc,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACnD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YACzE,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,SAAS,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC7C,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAChD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK;gBAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACtD,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClE,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACxC,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC/B,IAAI,CAAC,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC1D,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,UAAU,CACR,cAAc,EACd,GAAG,cAAc,aAAa,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAChF,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,mBAAmB,CACzB,cAAsB,EACtB,MAAoB,EACpB,QAAsB;QAEtB,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClD,QAAQ,CAAC,IAAI,CACX,YAAY,MAAM,CAAC,KAAK,CAAC,MAAM,uBAAuB,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAC9E,CAAC;QACJ,CAAC;QACD,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;QAC9D,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;QAChE,IAAI,gBAAgB,KAAK,gBAAgB,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CACX,YAAY,gBAAgB,2BAA2B,gBAAgB,EAAE,CAC1E,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,0BAA0B,cAAc,yBAAyB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,6DAA6D,CAClJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAEO,WAAW;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE;aACxB,OAAO,CAAC,2CAA2C,CAAC;aACpD,GAAG,EAAuB,CAAC;QAC9B,OAAO,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC;IACvB,CAAC;IAEO,eAAe;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,GAAG,EAE7D,CAAC;QACF,OAAO,GAAG,CAAC,YAAY,CAAC;IAC1B,CAAC;IAEO,YAAY;QAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE;YAAE,OAAO;QACtD,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC5B,oEAAoE;YACpE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACjE,cAAc,CACpB,IAAgB;QAEhB,OAAO;YACL,IAAI,CAAC,KAAK;YACV,IAAI,CAAC,WAAW;YAChB,IAAI,CAAC,IAAI;YACT,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,YAAY,IAAI,CAAC;YACtB,IAAI,CAAC,SAAS;YACd,IAAI,CAAC,WAAW;YAChB,IAAI,CAAC,YAAY,CAAC,IAAI;YACtB,IAAI,CAAC,YAAY,CAAC,IAAI;YACtB,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;YAChE,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;YAClE,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;SACnE,CAAC;IACJ,CAAC;IAEO,SAAS,CACf,IAAgB,EAChB,OAAO,GAA0B,EAAE;QAEnC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC7B,IAAI,CAAC,OAAO,CAAC,EAAE;iBACZ,OAAO,CACN;;;;;yBAKe,CAChB;iBACA,GAAG,CAAC,GAAG,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,uEAAuE;QACvE,uDAAuD;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE;aACzB,OAAO,CAAC,2DAA2D,CAAC;aACpE,GAAG,EAAsB,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,EAAE;aACZ,OAAO,CACN;;;;2DAImD,CACpD;aACA,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,CAAC;IACzC,CAAC;IAEO,cAAc,CAAC,SAAiB,EAAE,KAAsB;QAC9D,MAAM,YAAY,GAChB,KAAK,CAAC,kBAAkB,KAAK,SAAS;YACpC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,EAAE;aACZ,OAAO,CACN;;;;;;;;kDAQ0C,CAC3C;aACA,GAAG,CACF,SAAS,EACT,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,SAAS,IAAI,IAAI,EACvB,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACnC,YAAY,CACb,CAAC;QACJ,MAAM,WAAW,GAAG,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,EAAE;aACZ,OAAO,CAAC,uDAAuD,CAAC;aAChE,GAAG,CAAC,SAAS,CAAC,CAAC;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CACpC,2EAA2E,CAC5E,CAAC;QACF,WAAW,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACnC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC;IAED,uEAAuE;IAC/D,aAAa,CAAC,MAAmC;QACvD,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO,CAAC,EAAE;aACZ,OAAO,CACN;sCAC8B,CAC/B;aACA,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+EAA+E;IACvE,WAAW;QACjB,IAAI,CAAC,OAAO,CAAC,EAAE;aACZ,OAAO,CACN;;;;YAII,CACL;aACA,GAAG,EAAE,CAAC;IACX,CAAC;IAEO,eAAe,CAAC,QAAgB,EAAE,GAAW;QACnD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IACE,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACd,MAAuB,CAAC,OAAO,KAAK,CAAC;YACtC,OAAQ,MAAuB,CAAC,MAAM,KAAK,QAAQ;YACnD,CAAC,KAAK,CAAC,OAAO,CAAE,MAAuB,CAAC,KAAK,CAAC,EAC9C,CAAC;YACD,MAAM,IAAI,KAAK,CACb,gBAAgB,QAAQ,6DAA6D,CACtF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAEZ,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;QACvC,MAAM,SAAS,GAAoC,EAAE,CAAC;QACtD,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YACtE,MAAM,MAAM,GAAG,KAAmD,CAAC;YACnE,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;YACxC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,SAAS,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;gBAC5B,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;YACxC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,wBAAwB,SAAS,0CAA0C,WAAW,8CAA8C,CACrI,CAAC;YACJ,CAAC;YACD,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC;QACnE,CAAC;QACD,OAAO;YACL,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS;SACV,CAAC;IACJ,CAAC;CACF"}

package/lib/accounts/file.js

@@ -1,101 +1,38 @@
-import { randomBytes } from "node:crypto";
-import { mkdirSync, readFileSync, renameSync, statSync, writeFileSync, } from "node:fs";
+import { createHash } from "node:crypto";
 import path from "node:path";
-import { base64Url } from "./token.js";
-/** A stamp no real file can match, so the first load always reads the disk. */
-export function createFileStampRef() {
-    return { current: { mtimeMs: Number.NEGATIVE_INFINITY, size: -1 } };
-}
-export function stampOf(stat) {
-    return { mtimeMs: stat.mtimeMs, size: stat.size };
-}
-const SECRET_BYTES = 32;
-/** The accounts file lives next to the DSH home the launcher exports. */
+/** The accounts database lives next to the DSH home the launcher exports. */
 export function defaultAccountsFilePath() {
     const home = process.env.DSH_HOME?.trim();
-    return path.join(home !== undefined && home !== "" ? home : process.cwd(), "qa-accounts.json");
-}
-/**
- * Read the accounts file, or create it on first run with a fresh token
- * secret. The stamp ref is left pointing at the version just read.
- */
-export function loadAccountsFile(filePath, stamp) {
-    let raw;
-    let stat;
-    try {
-        raw = readFileSync(filePath, "utf8");
-        stat = statSync(filePath);
-    }
-    catch (error) {
-        // Only a missing file means "first run": anything else (permissions,
-        // a directory in the way, I/O failure) must surface, or the store
-        // would silently reset every account it cannot read.
-        if (error.code !== "ENOENT")
-            throw error;
-        const created = {
-            version: 1,
-            secret: base64Url(randomBytes(SECRET_BYTES)),
-            users: [],
-            ownership: {},
-        };
-        persistAccountsFile(filePath, created, stamp);
-        return created;
-    }
-    const parsed = JSON.parse(raw);
-    if (typeof parsed !== "object" ||
-        parsed === null ||
-        parsed.version !== 1 ||
-        typeof parsed.secret !== "string" ||
-        !Array.isArray(parsed.users)) {
-        throw new Error(`qa-accounts: ${filePath} is not a recognizable accounts file; refusing to overwrite it`);
-    }
-    const file = parsed;
-    if (stat !== undefined)
-        stamp.current = stampOf(stat);
-    return {
-        version: 1,
-        secret: file.secret,
-        users: file.users,
-        ownership: file.ownership ?? {},
-    };
+    return path.join(home !== undefined && home !== "" ? home : process.cwd(), "qa-accounts.db");
 }
 /**
- * Persist the accounts file atomically (temp file + rename) and leave the
- * stamp ref pointing at the freshly written version.
+ * Where the pre-SQLite accounts file lived. It is imported on first use and
+ * then renamed aside, so a deployment upgrades without re-registering anyone.
  */
-export function persistAccountsFile(filePath, file, stamp) {
-    mkdirSync(path.dirname(filePath), { recursive: true });
-    // A per-process temp name: the Host and the CLI never race on one file.
-    const temp = `${filePath}.${process.pid}.tmp`;
-    writeFileSync(temp, `${JSON.stringify(file, null, 2)}\n`, "utf8");
-    renameSync(temp, filePath);
-    stamp.current = stampOf(statSync(filePath));
+export function defaultLegacyAccountsFilePath() {
+    const home = process.env.DSH_HOME?.trim();
+    return path.join(home !== undefined && home !== "" ? home : process.cwd(), "qa-accounts.json");
 }
 /**
- * The qa-accounts CLI runs in its own process against the same file. Re-read
- * it whenever it changed on disk, before every read or read-modify-write:
- * without this a running Host would keep honoring tokens the CLI revoked
- * and its next save would resurrect the CLI's change from a stale snapshot.
- * One file, one writer at a time remains the deployment's discipline; LAN
- * scale keeps the stat per operation trivial.
- *
- * Returns the freshly loaded file, or undefined when the caller should keep
- * serving its in-memory state.
+ * A stable digest of one capability policy, so two chats admitted under the
+ * same policy share a stored snapshot. Keys are sorted because object key order
+ * is an artefact of construction, not part of the policy.
  */
-export function reloadAccountsFileIfChanged(filePath, stamp) {
-    let stat;
-    try {
-        stat = statSync(filePath);
-    }
-    catch {
-        // The file vanished between operations (never by our hand): keep
-        // serving the in-memory state instead of resetting every account.
-        return undefined;
-    }
-    if (stat.mtimeMs === stamp.current.mtimeMs &&
-        stat.size === stamp.current.size) {
-        return undefined;
-    }
-    return loadAccountsFile(filePath, stamp);
+export function snapshotDigest(value) {
+    const canonical = (input) => {
+        if (input === null || typeof input !== "object") {
+            return JSON.stringify(input) ?? "null";
+        }
+        if (Array.isArray(input)) {
+            return `[${input.map(canonical).join(",")}]`;
+        }
+        const entries = Object.entries(input)
+            .filter(([, entry]) => entry !== undefined)
+            .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0));
+        return `{${entries
+            .map(([key, entry]) => `${JSON.stringify(key)}:${canonical(entry)}`)
+            .join(",")}}`;
+    };
+    return createHash("sha256").update(canonical(value)).digest("hex");
 }
 //# sourceMappingURL=file.js.map

package/lib/accounts/file.js.map

@@ -1 +1 @@
-{"version":3,"file":"file.js","sourceRoot":"","sources":["../../src/accounts/file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,SAAS,EACT,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AAEjB,OAAO,IAAI,MAAM,WAAW,CAAC;AAO7B,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AA4EvC,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB;IAChC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAW;IACjC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB,yEAAyE;AACzE,MAAM,UAAU,uBAAuB;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1C,OAAO,IAAI,CAAC,IAAI,CACd,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EACxD,kBAAkB,CACnB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,KAAmB;IAEnB,IAAI,GAAW,CAAC;IAChB,IAAI,IAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACrC,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,qEAAqE;QACrE,kEAAkE;QAClE,qDAAqD;QACrD,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;QACpE,MAAM,OAAO,GAAiB;YAC5B,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,SAAS,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;YAC5C,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,EAAE;SACd,CAAC;QACF,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9C,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,KAAK,IAAI;QACd,MAAuB,CAAC,OAAO,KAAK,CAAC;QACtC,OAAQ,MAAuB,CAAC,MAAM,KAAK,QAAQ;QACnD,CAAC,KAAK,CAAC,OAAO,CAAE,MAAuB,CAAC,KAAK,CAAC,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,gBAAgB,QAAQ,gEAAgE,CACzF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAsB,CAAC;IACpC,IAAI,IAAI,KAAK,SAAS;QAAE,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO;QACL,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE;KAChC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,IAAkB,EAClB,KAAmB;IAEnB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,wEAAwE;IACxE,MAAM,IAAI,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClE,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3B,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAAgB,EAChB,KAAmB;IAEnB,IAAI,IAAW,CAAC;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,kEAAkE;QAClE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IACE,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,OAAO;QACtC,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,CAAC,IAAI,EAChC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"file.js","sourceRoot":"","sources":["../../src/accounts/file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAyE7B,6EAA6E;AAC7E,MAAM,UAAU,uBAAuB;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1C,OAAO,IAAI,CAAC,IAAI,CACd,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EACxD,gBAAgB,CACjB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,6BAA6B;IAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1C,OAAO,IAAI,CAAC,IAAI,CACd,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EACxD,kBAAkB,CACnB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,SAAS,GAAG,CAAC,KAAc,EAAU,EAAE;QAC3C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;QACzC,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAC/C,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;aAC1C,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,OAAO,IAAI,OAAO;aACf,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;aACnE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC"}