@zerwiz/ymir 0.1.33 → 0.1.35

package/apps/hlidskjalf/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "@zerwiz/hlidskjalf",
+  "private": false,
+  "version": "0.1.0",
+  "type": "module",
+  "description": "Hlidskjalf \u2014 Odin's high seat. The Ymir master control dashboard.",
+  "scripts": {
+    "dev": "vite",
+    "api": "bun run server/index.ts",
+    "dev:all": "bun run server/index.ts & vite",
+    "build": "tsc --noEmit && vite build",
+    "preview": "vite preview",
+    "typecheck": "tsc --noEmit",
+    "desktop": "electron .",
+    "prepack": "npm run build"
+  },
+  "dependencies": {
+    "@capacitor/android": "^6.2.2",
+    "@capacitor/core": "^6.2.2",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0",
+    "react-markdown": "^10.1.0",
+    "remark-gfm": "^4.0.1",
+    "zustand": "^5.0.2"
+  },
+  "devDependencies": {
+    "@capacitor/cli": "^6.2.2",
+    "@types/react": "^19.0.0",
+    "@types/react-dom": "^19.0.0",
+    "@vitejs/plugin-react": "^4.3.4",
+    "electron": "^33.0.0",
+    "typescript": "^5.7.2",
+    "vite": "^6.0.5"
+  },
+  "main": "electron/main.cjs",
+  "allowScripts": {
+    "electron@33.4.11": true,
+    "esbuild@0.25.12": true
+  },
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/zerwiz/hlidskjalf.git"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "!dist/*.apk",
+    "server",
+    "README.md",
+    "electron"
+  ]
+}

package/apps/hlidskjalf/public/icon.svg

@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32" width="32" height="32" role="img" aria-label="the seat — Hlidskjalf, the high seat of the control plane">
+  <title>the seat — Hlidskjalf, the high seat of the control plane</title>
+  <rect width="32" height="32" rx="7" fill="#0e0c09"/>
+  <g transform="translate(4 4) scale(1.0)" fill="none" stroke="#c9973f" stroke-width="1.8" stroke-linecap="square" stroke-linejoin="miter">
+    <path d="M4 20V8L12 14L20 8V20"/>
+  </g>
+</svg>

package/apps/hlidskjalf/public/manifest.webmanifest

@@ -0,0 +1,31 @@
+{
+  "name": "Ymir \u00b7 Hlidskjalf",
+  "short_name": "Ymir",
+  "description": "The sovereign's seat of Ymir OS \u2014 fleet, tasks, the well, runes, reviews.",
+  "start_url": "/",
+  "scope": "/",
+  "display": "standalone",
+  "orientation": "any",
+  "background_color": "#080c14",
+  "theme_color": "#080c14",
+  "icons": [
+    {
+      "src": "/ymir-icon.png",
+      "sizes": "512x512",
+      "type": "image/png",
+      "purpose": "any"
+    },
+    {
+      "src": "/ymir-icon.png",
+      "sizes": "512x512",
+      "type": "image/png",
+      "purpose": "maskable"
+    },
+    {
+      "src": "/ymir-mark.svg",
+      "sizes": "any",
+      "type": "image/svg+xml",
+      "purpose": "any"
+    }
+  ]
+}

package/apps/hlidskjalf/public/og.svg

@@ -0,0 +1,64 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="630" viewBox="0 0 1200 630" fill="none">
+  <defs>
+    <linearGradient id="og-bg" x1="0" y1="0" x2="1200" y2="630" gradientUnits="userSpaceOnUse">
+      <stop offset="0" stop-color="#0b101c" />
+      <stop offset="0.55" stop-color="#0a0f1a" />
+      <stop offset="1" stop-color="#020617" />
+    </linearGradient>
+    <radialGradient id="og-glow" cx="0.28" cy="0.42" r="0.7">
+      <stop offset="0" stop-color="#38bdf8" stop-opacity="0.28" />
+      <stop offset="0.5" stop-color="#0ea5e9" stop-opacity="0.08" />
+      <stop offset="1" stop-color="#0ea5e9" stop-opacity="0" />
+    </radialGradient>
+    <linearGradient id="og-metal" x1="0" y1="0" x2="0" y2="1">
+      <stop offset="0" stop-color="#7dd3fc" />
+      <stop offset="0.5" stop-color="#475569" />
+      <stop offset="1" stop-color="#1e293b" />
+    </linearGradient>
+    <pattern id="og-grid" width="48" height="48" patternUnits="userSpaceOnUse">
+      <path d="M48 0H0V48" fill="none" stroke="#1e293b" stroke-width="1" stroke-opacity="0.5" />
+    </pattern>
+  </defs>
+
+  <rect width="1200" height="630" fill="url(#og-bg)" />
+  <rect width="1200" height="630" fill="url(#og-grid)" />
+  <rect width="1200" height="630" fill="url(#og-glow)" />
+
+  <rect x="0" y="0" width="1200" height="6" fill="url(#og-metal)" />
+  <rect x="0" y="624" width="1200" height="6" fill="#1e293b" />
+
+  <!-- Ymir mark -->
+  <g transform="translate(96 150) scale(0.62)">
+    <g fill="url(#og-metal)" stroke="#7dd3fc" stroke-width="3" stroke-opacity="0.5">
+      <polygon points="120,100 168,100 256,188 344,100 392,100 276,216 276,340 236,340 236,216" />
+      <polygon points="100,340 412,340 400,388 112,388" />
+      <polygon points="132,408 380,408 368,440 144,440" />
+    </g>
+  </g>
+
+  <!-- Wordmark block -->
+  <g font-family="'Cinzel', Georgia, 'Times New Roman', serif">
+    <text x="612" y="208" fill="#e8edf6" font-size="104" font-weight="700" letter-spacing="14">YMIR</text>
+    <text x="616" y="258" fill="#38bdf8" font-size="30" font-weight="500" letter-spacing="16">HLIDSKJALF</text>
+  </g>
+
+  <text x="616" y="330" fill="#b3c0d4" font-family="'JetBrains Mono', ui-monospace, monospace" font-size="22">
+    One operator. Every realm.
+  </text>
+
+  <text x="616" y="392" fill="#7b8aa3" font-family="'JetBrains Mono', ui-monospace, monospace" font-size="17">
+    The sovereign's seat — the fleet, the A2A task stream,
+  </text>
+  <text x="616" y="420" fill="#7b8aa3" font-family="'JetBrains Mono', ui-monospace, monospace" font-size="17">
+    the well, the runes, the reviews.
+  </text>
+
+  <rect x="616" y="470" width="72" height="3" fill="#38bdf8" />
+
+  <text x="616" y="530" fill="#4b5a73" font-family="'JetBrains Mono', ui-monospace, monospace" font-size="15" letter-spacing="2">
+    AGENTIC OPERATING SYSTEM · LOCAL-FIRST · OSS-FIRST
+  </text>
+
+  <!-- rune ticks bottom-right -->
+  <text x="1036" y="566" fill="#334155" font-family="'Cinzel', Georgia, serif" font-size="34">ᛉ ᛗ ᛒ</text>
+</svg>

package/apps/hlidskjalf/public/sw.js

@@ -0,0 +1,39 @@
+/* Ymir — app-shell service worker. Network-first for navigations, cache-first
+   for hashed assets; the gate API is always network-only. */
+const CACHE = 'ymir-shell-v1';
+const SHELL = ['/', '/index.html', '/manifest.webmanifest', '/ymir-mark.svg', '/ymir-icon.png', '/og.jpg'];
+
+self.addEventListener('install', (e) => {
+  e.waitUntil(caches.open(CACHE).then((c) => c.addAll(SHELL)).then(() => self.skipWaiting()));
+});
+self.addEventListener('activate', (e) => {
+  e.waitUntil(self.clients.claim());
+});
+self.addEventListener('fetch', (e) => {
+  const req = e.request;
+  if (req.method !== 'GET') return;
+  const url = new URL(req.url);
+  if (url.origin !== location.origin) return;
+  if (url.pathname.startsWith('/api/')) return; // gate API: network only
+  if (req.mode === 'navigate') {
+    e.respondWith(
+      fetch(req)
+        .then((res) => {
+          caches.open(CACHE).then((c) => c.put('/index.html', res.clone()));
+          return res;
+        })
+        .catch(() => caches.match('/index.html')),
+    );
+    return;
+  }
+  e.respondWith(
+    caches.match(req).then(
+      (r) =>
+        r ||
+        fetch(req).then((res) => {
+          if (res.ok) caches.open(CACHE).then((c) => c.put(req, res.clone()));
+          return res;
+        }),
+    ),
+  );
+});

package/apps/hlidskjalf/public/ymir-mark.svg

@@ -0,0 +1,62 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512" width="100%" height="100%">
+  <defs>
+    <!-- Background Dark Steel Gradient -->
+    <linearGradient id="bg-grad" x1="0%" y1="0%" x2="100%" y2="100%">
+      <stop offset="0%" stop-color="#0e0c09" />
+      <stop offset="100%" stop-color="#0e0c09" />
+    </linearGradient>
+
+    <!-- Base Metal Color for the Rune -->
+    <linearGradient id="metal-base" x1="0%" y1="0%" x2="0%" y2="100%">
+      <stop offset="0%" stop-color="#c9973f" />
+      <stop offset="50%" stop-color="#7d5f2a" />
+      <stop offset="100%" stop-color="#2b241a" />
+    </linearGradient>
+
+    <!-- Advanced 3D Forge Filter -->
+    <filter id="heavy-metal-3d" x="-20%" y="-20%" width="140%" height="140%">
+      <!-- 1. Generate Hammered Iron Texture -->
+      <feTurbulence type="fractalNoise" baseFrequency="0.04" numOctaves="4" result="noise" />
+      <feColorMatrix type="matrix" values="1 0 0 0 0  0 1 0 0 0  0 0 1 0 0  0 0 0 0.15 0" in="noise" result="coloredNoise" />
+
+      <!-- 2. Blend Texture with Base Color -->
+      <feComposite operator="in" in="coloredNoise" in2="SourceGraphic" result="textured" />
+      <feBlend mode="multiply" in="textured" in2="SourceGraphic" result="baseTex" />
+
+      <!-- 3. Create 3D Bevel / Depth Map -->
+      <feGaussianBlur in="SourceAlpha" stdDeviation="4" result="blur" />
+
+      <!-- 4. Apply 3D Lighting (Cyan/Blue Specular Highlight) -->
+      <feSpecularLighting in="blur" surfaceScale="6" specularConstant="1.2" specularExponent="25" lighting-color="#cfc3a9" result="specOut">
+        <!-- Light Source Positioned Top-Left -->
+        <fePointLight x="-100" y="-100" z="300" />
+      </feSpecularLighting>
+
+      <!-- 5. Mask Lighting to the Shape -->
+      <feComposite operator="in" in="specOut" in2="SourceAlpha" result="specularMasked" />
+
+      <!-- 6. Combine Lighting and Textured Base -->
+      <feComposite operator="arithmetic" k1="0" k2="1" k3="1" k4="0" in="specularMasked" in2="baseTex" result="litModel" />
+
+      <!-- 7. Heavy Drop Shadow for Canvas Depth -->
+      <feDropShadow in="litModel" dx="0" dy="16" stdDeviation="12" flood-opacity="0.85" flood-color="#0e0c09" result="finalShadow" />
+    </filter>
+  </defs>
+
+  <!-- Canvas -->
+  <rect width="512" height="512" rx="40" fill="url(#bg-grad)" stroke="#2b241a" stroke-width="4"/>
+
+  <!-- Master Group with 3D Rendering Filter Applied -->
+  <g filter="url(#heavy-metal-3d)" fill="url(#metal-base)">
+
+    <!-- Algiz Y-Stem (Solid Geometric Polygon) -->
+    <polygon points="120,100 168,100 256,188 344,100 392,100 276,216 276,340 236,340 236,216" />
+
+    <!-- Top Anvil Bar -->
+    <polygon points="100,340 412,340 400,388 112,388" />
+
+    <!-- Bottom Anvil Bar (Slightly narrower base) -->
+    <polygon points="132,408 380,408 368,440 144,440" />
+
+  </g>
+</svg>

package/apps/hlidskjalf/server/accounts.ts

@@ -0,0 +1,159 @@
+/**
+ * Accounts and invites for the gate.
+ *
+ * One operator owns the instance. The invite code is how someone *else* is let
+ * in to try it: registration is closed unless a live code is presented, and a
+ * code carries its own ceiling, so a shared link cannot quietly become an open
+ * door.
+ *
+ * Two rules hold here:
+ *  - the store is machine state, so it lives in the user's config dir and never
+ *    inside the repo (nothing personal is ever tracked);
+ *  - passwords are hashed with Bun's argon2id; the plaintext never lands.
+ */
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+export type Account = { login: string; hash: string; created: string };
+export type Invite = { code: string; created: string; used: number; limit: number };
+type Store = { version: 1; accounts: Account[]; invites: Invite[] };
+
+/** Where the machine keeps its accounts (`YMIR_CONFIG_DIR` overrides, for tests). */
+export const CONFIG_DIR = process.env.YMIR_CONFIG_DIR ?? join(homedir(), '.config', 'ymir');
+export const STORE = join(CONFIG_DIR, 'accounts.json');
+
+/** Default ceiling on how many accounts one invite may create. */
+export const DEFAULT_INVITE_LIMIT = Number(process.env.YMIR_INVITE_LIMIT ?? 5);
+
+/** The shortest password the gate will accept. */
+const MIN_PASSWORD = 8;
+const LOGIN_RE = /^[a-z0-9][a-z0-9._-]{1,31}$/;
+
+function empty(): Store {
+  return { version: 1, accounts: [], invites: [] };
+}
+
+export function load(): Store {
+  if (!existsSync(STORE)) return empty();
+  try {
+    const s = JSON.parse(readFileSync(STORE, 'utf8')) as Store;
+    return { version: 1, accounts: s.accounts ?? [], invites: s.invites ?? [] };
+  } catch {
+    return empty();
+  }
+}
+
+function save(s: Store): void {
+  mkdirSync(CONFIG_DIR, { recursive: true });
+  writeFileSync(STORE, `${JSON.stringify(s, null, 2)}\n`, { mode: 0o600 });
+  try {
+    chmodSync(STORE, 0o600);
+  } catch {
+    /* best effort — the mode above is the real guard */
+  }
+}
+
+/* ---- invites -------------------------------------------------------------- */
+
+/** A code that is readable aloud but not guessable. */
+export function mintCode(): string {
+  const alphabet = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789'; // no I/O/0/1 — said aloud, not mistyped
+  const block = () =>
+    Array.from({ length: 4 }, () => alphabet[Math.floor(Math.random() * alphabet.length)]).join('');
+  return `YMIR-${block()}-${block()}`;
+}
+
+export type InviteCheck = { ok: true; invite: Invite } | { ok: false; reason: string };
+
+/** Is this code live, and may it still admit another account? */
+export function inviteCheck(code: string): InviteCheck {
+  const wanted = code.trim().toUpperCase();
+  if (!wanted) return { ok: false, reason: 'an invite code is required' };
+  const invite = load().invites.find((i) => i.code === wanted);
+  if (!invite) return { ok: false, reason: 'that invite code is not valid' };
+  if (invite.used >= invite.limit) return { ok: false, reason: 'that invite code has been used up' };
+  return { ok: true, invite };
+}
+
+/** Mint a code and record it. `limit` is how many accounts it may create. */
+export function addInvite(limit = DEFAULT_INVITE_LIMIT): Invite {
+  const s = load();
+  const invite: Invite = { code: mintCode(), created: new Date().toISOString(), used: 0, limit };
+  s.invites.push(invite);
+  save(s);
+  return invite;
+}
+
+export function listInvites(): Invite[] {
+  return load().invites;
+}
+
+/** Remove a code. Returns whether anything was removed. */
+export function revokeInvite(code: string): boolean {
+  const s = load();
+  const wanted = code.trim().toUpperCase();
+  const before = s.invites.length;
+  s.invites = s.invites.filter((i) => i.code !== wanted);
+  if (s.invites.length !== before) {
+    save(s);
+    return true;
+  }
+  return false;
+}
+
+/** Is registration open at all? False when no live code exists. */
+export function invitesOpen(): boolean {
+  return load().invites.some((i) => i.used < i.limit);
+}
+
+/* ---- accounts ------------------------------------------------------------- */
+
+export function findAccount(login: string): Account | undefined {
+  const wanted = login.trim().toLowerCase();
+  return load().accounts.find((a) => a.login === wanted);
+}
+
+export function listAccounts(): { login: string; created: string }[] {
+  return load().accounts.map(({ login, created }) => ({ login, created }));
+}
+
+export type RegisterResult = { ok: true; login: string } | { ok: false; reason: string };
+
+/**
+ * Create an account, spending one use of the invite.
+ *
+ * The invite is checked *again* here, so a caller cannot skip it, and the store
+ * is re-read so two simultaneous registrations cannot both spend the last use.
+ */
+export async function register(login: string, password: string, code: string): Promise<RegisterResult> {
+  const name = login.trim().toLowerCase();
+  if (!LOGIN_RE.test(name)) {
+    return { ok: false, reason: 'a username is 2–32 characters: letters, digits, dot, dash, underscore' };
+  }
+  if (password.length < MIN_PASSWORD) {
+    return { ok: false, reason: `a password of at least ${MIN_PASSWORD} characters is required` };
+  }
+  const check = inviteCheck(code);
+  if (!check.ok) return { ok: false, reason: check.reason };
+
+  const s = load();
+  if (s.accounts.some((a) => a.login === name)) return { ok: false, reason: 'that username is taken' };
+  const live = s.invites.find((i) => i.code === check.invite.code);
+  if (!live) return { ok: false, reason: 'that invite code is not valid' };
+  if (live.used >= live.limit) return { ok: false, reason: 'that invite code has been used up' };
+
+  const hash = await Bun.password.hash(password, { algorithm: 'argon2id' });
+  s.accounts.push({ login: name, hash, created: new Date().toISOString() });
+  live.used += 1;
+  save(s);
+  return { ok: true, login: name };
+}
+
+/** Check a stored account's password. Returns the login on success. */
+export async function verify(login: string, password: string): Promise<string | null> {
+  const account = findAccount(login);
+  if (!account) return null;
+  const ok = await Bun.password.verify(password, account.hash).catch(() => false);
+  return ok ? account.login : null;
+}