artifacty 0.8.0 → 0.9.0

package/src/lib/render.js

@@ -2,7 +2,7 @@ import { EDITOR_CLIENT_PATH, VIEWER_CLIENT_PATH, editorImportMapJson } from "./e
 import { createI18n, DEFAULT_LOCALE, editorMessages, localizedHref, switchLocaleHref } from "./i18n.js";
 import { ARTIFACT_FORMATS, ARTIFACT_TYPES } from "./storage.js";
 
-export function renderDashboard({ artifacts, baseUrl, filters = {}, pagination, locale = DEFAULT_LOCALE, currentPath = "/" }) {
+export function renderDashboard({ artifacts, baseUrl, filters = {}, pagination, locale = DEFAULT_LOCALE, currentPath = "/", user = null }) {
   const view = viewContext(locale, currentPath);
   const total = pagination?.total ?? artifacts.length;
   const start = artifacts.length ? (pagination?.offset ?? 0) + 1 : 0;
@@ -48,6 +48,7 @@ export function renderDashboard({ artifacts, baseUrl, filters = {}, pagination,
           <a href="${view.href("/new")}">${view.text("nav.new")}</a>
           <a href="${view.href("/import")}">${view.text("nav.import")}</a>
           <a href="/api/artifacts">${view.text("nav.api")}</a>
+          ${authNav(user)}
           ${languageSwitcher(view)}
         </nav>
       </header>
@@ -249,6 +250,170 @@ export function renderImportArtifactPage({ baseUrl, authToken = "", locale = DEF
   });
 }
 
+export function renderLoginPage({ baseUrl, setup = false, error = "", locale = DEFAULT_LOCALE, currentPath = "/login" }) {
+  const view = viewContext(locale, currentPath);
+  const title = setup ? "Create admin account" : "Sign in";
+  return pageShell({
+    title,
+    body: `
+      <header class="topbar">
+        <div>
+          <h1>${escapeHtml(title)}</h1>
+          <p>${escapeHtml(baseUrl)}</p>
+        </div>
+        <nav>
+          <a href="${view.href("/")}">${view.text("nav.index")}</a>
+          ${languageSwitcher(view)}
+        </nav>
+      </header>
+      <main class="artifact-editor auth-panel">
+        ${error ? `<p class="auth-error">${escapeHtml(error)}</p>` : ""}
+        ${setup ? `<p class="muted">No users exist yet. The first account becomes an administrator.</p>` : ""}
+        <form class="editor-form auth-form" method="post" action="/login">
+          <section class="editor-fields">
+            <label class="field">
+              <span>Email</span>
+              <input type="email" name="email" autocomplete="username" required>
+            </label>
+            ${setup ? `<label class="field">
+              <span>Name</span>
+              <input name="name" autocomplete="name">
+            </label>` : ""}
+            <label class="field">
+              <span>Password</span>
+              <input type="password" name="password" autocomplete="${setup ? "new-password" : "current-password"}" minlength="8" required>
+            </label>
+          </section>
+          <footer class="editor-actions">
+            <button type="submit">${setup ? "Create admin" : "Sign in"}</button>
+          </footer>
+        </form>
+      </main>
+    `,
+    locale: view.locale
+  });
+}
+
+export function renderAccountPage({ baseUrl, user, tokens = [], createdToken = "", locale = DEFAULT_LOCALE, currentPath = "/account" }) {
+  const view = viewContext(locale, currentPath);
+  const rows = tokens.map((token) => `
+    <tr>
+      <td>${escapeHtml(token.name)}</td>
+      <td>${escapeHtml(token.createdAt)}</td>
+      <td>${token.lastUsedAt ? escapeHtml(token.lastUsedAt) : "Never"}</td>
+      <td>${token.revokedAt ? escapeHtml(token.revokedAt) : "Active"}</td>
+      <td>
+        ${token.revokedAt ? "" : `<form method="post" action="/account/tokens/${encodeURIComponent(token.id)}/revoke">
+          <button type="submit">Revoke</button>
+        </form>`}
+      </td>
+    </tr>
+  `).join("");
+
+  return pageShell({
+    title: "Account",
+    body: `
+      <header class="topbar">
+        <div>
+          <h1>Account</h1>
+          <p>${escapeHtml(user.email)} · ${escapeHtml(user.role)} · ${escapeHtml(baseUrl)}</p>
+        </div>
+        <nav>
+          <a href="${view.href("/")}">${view.text("nav.index")}</a>
+          ${user.role === "admin" ? `<a href="/admin/users">Users</a>` : ""}
+          <form class="nav-form" method="post" action="/logout"><button type="submit">Sign out</button></form>
+          ${languageSwitcher(view)}
+        </nav>
+      </header>
+      <main class="artifact-view">
+        ${createdToken ? `<section class="token-once">
+          <h2>New API token</h2>
+          <p>Copy this token now. Artifacty stores only its hash and cannot show it again.</p>
+          <pre class="artifact-code"><code>${escapeHtml(createdToken)}</code></pre>
+        </section>` : ""}
+        <section class="meta-card">
+          <h2>Profile</h2>
+          <p><strong>${escapeHtml(user.name)}</strong></p>
+          <p>${escapeHtml(user.email)}</p>
+          <p>Role: ${escapeHtml(user.role)}</p>
+        </section>
+        <section class="meta-card">
+          <h2>Create API token</h2>
+          <form class="inline-action" method="post" action="/account/tokens">
+            <input name="name" placeholder="Token name" autocomplete="off" required>
+            <button type="submit">Create token</button>
+          </form>
+        </section>
+        <section class="meta-card">
+          <h2>API tokens</h2>
+          <table class="data-table">
+            <thead><tr><th>Name</th><th>Created</th><th>Last used</th><th>Status</th><th></th></tr></thead>
+            <tbody>${rows || `<tr><td colspan="5">No API tokens.</td></tr>`}</tbody>
+          </table>
+        </section>
+      </main>
+    `,
+    locale: view.locale
+  });
+}
+
+export function renderAdminUsersPage({ baseUrl, user, users = [], locale = DEFAULT_LOCALE, currentPath = "/admin/users" }) {
+  const view = viewContext(locale, currentPath);
+  const rows = users.map((item) => `
+    <tr>
+      <td>${escapeHtml(item.email)}</td>
+      <td>${escapeHtml(item.name)}</td>
+      <td>${escapeHtml(item.role)}</td>
+      <td>${item.active ? "Active" : "Disabled"}</td>
+      <td>${escapeHtml(item.createdAt)}</td>
+      <td>
+        ${item.id === user.id ? "" : `<form method="post" action="/admin/users/${encodeURIComponent(item.id)}/${item.active ? "disable" : "enable"}">
+          <button type="submit">${item.active ? "Disable" : "Enable"}</button>
+        </form>`}
+      </td>
+    </tr>
+  `).join("");
+
+  return pageShell({
+    title: "Users",
+    body: `
+      <header class="topbar">
+        <div>
+          <h1>Users</h1>
+          <p>${escapeHtml(baseUrl)}</p>
+        </div>
+        <nav>
+          <a href="${view.href("/")}">${view.text("nav.index")}</a>
+          <a href="/account">Account</a>
+          ${languageSwitcher(view)}
+        </nav>
+      </header>
+      <main class="artifact-view">
+        <section class="meta-card">
+          <h2>Create user</h2>
+          <form class="editor-form auth-form" method="post" action="/admin/users">
+            <section class="editor-fields">
+              <label class="field"><span>Email</span><input type="email" name="email" required></label>
+              <label class="field"><span>Name</span><input name="name"></label>
+              <label class="field"><span>Role</span><select name="role"><option value="user">user</option><option value="admin">admin</option></select></label>
+              <label class="field"><span>Password</span><input type="password" name="password" minlength="8" required></label>
+            </section>
+            <footer class="editor-actions"><button type="submit">Create user</button></footer>
+          </form>
+        </section>
+        <section class="meta-card">
+          <h2>Existing users</h2>
+          <table class="data-table">
+            <thead><tr><th>Email</th><th>Name</th><th>Role</th><th>Status</th><th>Created</th><th></th></tr></thead>
+            <tbody>${rows}</tbody>
+          </table>
+        </section>
+      </main>
+    `,
+    locale: view.locale
+  });
+}
+
 export function renderArtifactPage({ artifact, version, content, baseUrl, authToken = "", locale = DEFAULT_LOCALE, currentPath = "/" }) {
   const view = viewContext(locale, currentPath);
   const versionLinks = artifact.versions
@@ -726,6 +891,25 @@ export function pageShell({ title, body, head = "", afterBody = "", locale = DEF
     .inline-action {
       margin-bottom: 12px;
     }
+    .nav-form {
+      display: inline-flex;
+      margin: 0;
+    }
+    .nav-form button {
+      min-height: 0;
+      padding: 0;
+      border: 0;
+      background: transparent;
+      color: inherit;
+      font: inherit;
+      font-weight: inherit;
+    }
+    .nav-form button:hover {
+      background: transparent;
+      border: 0;
+      color: var(--text);
+      text-decoration: underline;
+    }
     .diff-form {
       grid-template-columns: 160px 160px auto;
       width: fit-content;
@@ -788,6 +972,64 @@ export function pageShell({ title, body, head = "", afterBody = "", locale = DEF
       display: grid;
       gap: 16px;
     }
+    .auth-panel {
+      max-width: 720px;
+      margin: 0 auto;
+    }
+    .auth-form .editor-fields {
+      grid-template-columns: minmax(220px, 1fr);
+    }
+    .auth-error,
+    .token-once {
+      border: 1px solid var(--line);
+      border-radius: 8px;
+      padding: 12px 14px;
+      background: var(--panel);
+    }
+    .auth-error {
+      color: #991b1b;
+      background: #fef2f2;
+      border-color: #fecaca;
+    }
+    .muted {
+      color: var(--muted);
+    }
+    .meta-card {
+      display: grid;
+      gap: 10px;
+      margin-bottom: 16px;
+      border: 1px solid var(--line);
+      border-radius: 8px;
+      padding: 16px;
+      background: var(--panel);
+    }
+    .meta-card h2,
+    .token-once h2 {
+      margin: 0;
+      font-size: 18px;
+    }
+    .data-table {
+      width: 100%;
+      border-collapse: collapse;
+      font-size: 13px;
+    }
+    .data-table th,
+    .data-table td {
+      padding: 9px 10px;
+      border-bottom: 1px solid var(--line);
+      text-align: left;
+      vertical-align: middle;
+    }
+    .data-table th {
+      color: var(--faint);
+      font-family: var(--mono);
+      font-size: 11.5px;
+      letter-spacing: 0.06em;
+      text-transform: uppercase;
+    }
+    .data-table form {
+      margin: 0;
+    }
     .editor-fields {
       display: grid;
       grid-template-columns: minmax(220px, 1fr) 180px 180px minmax(160px, 240px);
@@ -1573,6 +1815,13 @@ function languageSwitcher(view) {
   return `<span class="language-switcher">${english}${korean}</span>`;
 }
 
+function authNav(user) {
+  if (!user) {
+    return `<a href="/login">Sign in</a>`;
+  }
+  return `${user.role === "admin" ? `<a href="/admin/users">Users</a>` : ""}<a href="/account">Account</a>`;
+}
+
 export function escapeHtml(value) {
   return String(value)
     .replaceAll("&", "&amp;")

package/src/lib/security.js

@@ -57,6 +57,10 @@ export function requireToken({ request, url, body = {}, config = securityConfig(
   }
 }
 
+export function requestToken({ request, url, body = {} }) {
+  return extractToken({ request, url, body });
+}
+
 export function scanForSecrets(content) {
   const text = String(content ?? "");
   const findings = [];

package/src/lib/service.js

@@ -230,6 +230,7 @@ function serviceConfig(options = {}) {
     apiToken: options.apiToken || "",
     shareMode: options.shareMode || "",
     allowSecrets: Boolean(options.allowSecrets),
+    mcpHttp: Boolean(options.mcpHttp),
     taskName: options.taskName || DEFAULT_TASK_NAME
   };
 }
@@ -251,6 +252,9 @@ function serverArgs(config, options = {}) {
   if (config.allowSecrets) {
     args.push("--allow-secrets");
   }
+  if (config.mcpHttp) {
+    args.push("--mcp-http");
+  }
   if (options.includeApiTokenArg && config.apiToken) {
     args.push("--api-token", config.apiToken);
   }

package/src/lib/storage.js

@@ -1,4 +1,4 @@
-import { createHash, randomUUID } from "node:crypto";
+import { createHash, randomBytes, randomUUID, scryptSync, timingSafeEqual } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { homedir } from "node:os";
@@ -9,6 +9,7 @@ import { assertNoSecrets, securityConfig } from "./security.js";
 export const STORE_VERSION = 3;
 export const ARTIFACT_SCHEMA_VERSION = 1;
 export const MAX_ARTIFACT_BYTES = 16 * 1024 * 1024;
+export const USER_ROLES = ["admin", "user"];
 export const ARTIFACT_FORMATS = [
   "html",
   "markdown",
@@ -653,6 +654,239 @@ export async function listAuditEvents(store = createStore(), filters = {}) {
   }
 }
 
+export async function countUsers(store = createStore()) {
+  const db = openDatabase(store);
+  try {
+    return db.prepare("SELECT COUNT(*) AS count FROM users").get().count;
+  } finally {
+    db.close();
+  }
+}
+
+export async function createUser(store = createStore(), input = {}) {
+  const email = normalizeEmail(input.email);
+  const password = String(input.password || "");
+  if (!email) {
+    throw Object.assign(new Error("User email is required"), { statusCode: 400, code: "USER_EMAIL_REQUIRED" });
+  }
+  if (password.length < 8) {
+    throw Object.assign(new Error("User password must be at least 8 characters"), { statusCode: 400, code: "USER_PASSWORD_WEAK" });
+  }
+  const role = normalizeUserRole(input.role || "user");
+  const name = normalizeOptionalString(input.name) || email;
+  const now = new Date().toISOString();
+  const user = {
+    id: randomUUID(),
+    email,
+    name,
+    role,
+    active: true,
+    createdAt: now,
+    updatedAt: now
+  };
+  const db = openDatabase(store);
+  try {
+    db.prepare(`
+      INSERT INTO users (id, email, name, role, password_hash, active, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, 1, ?, ?)
+    `).run(user.id, user.email, user.name, user.role, hashPassword(password), now, now);
+    return user;
+  } catch (error) {
+    if (/UNIQUE/i.test(error.message)) {
+      throw Object.assign(new Error(`User already exists: ${email}`), { statusCode: 409, code: "USER_EXISTS" });
+    }
+    throw error;
+  } finally {
+    db.close();
+  }
+}
+
+export async function listUsers(store = createStore()) {
+  const db = openDatabase(store);
+  try {
+    return db.prepare(`
+      SELECT id, email, name, role, active, created_at, updated_at
+      FROM users
+      ORDER BY created_at ASC
+    `).all().map(userFromRow);
+  } finally {
+    db.close();
+  }
+}
+
+export async function setUserActive(store = createStore(), id, active) {
+  const db = openDatabase(store);
+  try {
+    const now = new Date().toISOString();
+    const result = db.prepare("UPDATE users SET active = ?, updated_at = ? WHERE id = ?").run(active ? 1 : 0, now, id);
+    if (result.changes === 0) {
+      throw Object.assign(new Error(`User not found: ${id}`), { statusCode: 404, code: "USER_NOT_FOUND" });
+    }
+    return userFromRow(db.prepare(`
+      SELECT id, email, name, role, active, created_at, updated_at FROM users WHERE id = ?
+    `).get(id));
+  } finally {
+    db.close();
+  }
+}
+
+export async function verifyUserPassword(store = createStore(), email, password) {
+  const db = openDatabase(store);
+  try {
+    const row = db.prepare(`
+      SELECT id, email, name, role, password_hash, active, created_at, updated_at
+      FROM users
+      WHERE email = ?
+    `).get(normalizeEmail(email));
+    if (!row || !row.active || !verifyPassword(password, row.password_hash)) {
+      return null;
+    }
+    return userFromRow(row);
+  } finally {
+    db.close();
+  }
+}
+
+export async function createSession(store = createStore(), userId, options = {}) {
+  const token = generateOpaqueToken("arts");
+  const now = new Date();
+  const expiresAt = new Date(now.getTime() + Number(options.ttlMs || 7 * 24 * 60 * 60 * 1000)).toISOString();
+  const session = {
+    id: randomUUID(),
+    userId,
+    createdAt: now.toISOString(),
+    expiresAt
+  };
+  const db = openDatabase(store);
+  try {
+    db.prepare(`
+      INSERT INTO sessions (id, user_id, token_hash, created_at, expires_at)
+      VALUES (?, ?, ?, ?, ?)
+    `).run(session.id, userId, hashToken(token), session.createdAt, expiresAt);
+    return { token, session };
+  } finally {
+    db.close();
+  }
+}
+
+export async function getSessionUser(store = createStore(), token) {
+  if (!token) {
+    return null;
+  }
+  const db = openDatabase(store);
+  try {
+    const row = db.prepare(`
+      SELECT s.id AS session_id, s.expires_at, u.id, u.email, u.name, u.role, u.active, u.created_at, u.updated_at
+      FROM sessions s
+      JOIN users u ON u.id = s.user_id
+      WHERE s.token_hash = ? AND s.revoked_at IS NULL
+    `).get(hashToken(token));
+    if (!row || !row.active || Date.parse(row.expires_at) <= Date.now()) {
+      return null;
+    }
+    return {
+      ...userFromRow(row),
+      sessionId: row.session_id
+    };
+  } finally {
+    db.close();
+  }
+}
+
+export async function revokeSession(store = createStore(), token) {
+  if (!token) {
+    return false;
+  }
+  const db = openDatabase(store);
+  try {
+    const result = db.prepare("UPDATE sessions SET revoked_at = ? WHERE token_hash = ? AND revoked_at IS NULL")
+      .run(new Date().toISOString(), hashToken(token));
+    return result.changes > 0;
+  } finally {
+    db.close();
+  }
+}
+
+export async function createApiToken(store = createStore(), userId, input = {}) {
+  const token = generateOpaqueToken("arty");
+  const now = new Date().toISOString();
+  const record = {
+    id: randomUUID(),
+    userId,
+    name: normalizeOptionalString(input.name) || "Artifacty token",
+    createdAt: now,
+    lastUsedAt: null,
+    revokedAt: null
+  };
+  const db = openDatabase(store);
+  try {
+    db.prepare(`
+      INSERT INTO api_tokens (id, user_id, name, token_hash, created_at)
+      VALUES (?, ?, ?, ?, ?)
+    `).run(record.id, userId, record.name, hashToken(token), now);
+    return { token, record };
+  } finally {
+    db.close();
+  }
+}
+
+export async function listApiTokens(store = createStore(), userId) {
+  const db = openDatabase(store);
+  try {
+    return db.prepare(`
+      SELECT id, user_id, name, created_at, last_used_at, revoked_at
+      FROM api_tokens
+      WHERE user_id = ?
+      ORDER BY created_at DESC
+    `).all(userId).map(apiTokenFromRow);
+  } finally {
+    db.close();
+  }
+}
+
+export async function revokeApiToken(store = createStore(), tokenId, userId) {
+  const db = openDatabase(store);
+  try {
+    const result = db.prepare(`
+      UPDATE api_tokens
+      SET revoked_at = ?
+      WHERE id = ? AND user_id = ? AND revoked_at IS NULL
+    `).run(new Date().toISOString(), tokenId, userId);
+    return result.changes > 0;
+  } finally {
+    db.close();
+  }
+}
+
+export async function authenticateApiToken(store = createStore(), token) {
+  if (!token) {
+    return null;
+  }
+  const db = openDatabase(store);
+  try {
+    const tokenHash = hashToken(token);
+    const row = db.prepare(`
+      SELECT t.id AS token_id, t.name AS token_name, u.id, u.email, u.name, u.role, u.active, u.created_at, u.updated_at
+      FROM api_tokens t
+      JOIN users u ON u.id = t.user_id
+      WHERE t.token_hash = ? AND t.revoked_at IS NULL
+    `).get(tokenHash);
+    if (!row || !row.active) {
+      return null;
+    }
+    db.prepare("UPDATE api_tokens SET last_used_at = ? WHERE id = ?").run(new Date().toISOString(), row.token_id);
+    return {
+      type: "api-token",
+      actor: row.email,
+      tokenId: row.token_id,
+      tokenName: row.token_name,
+      user: userFromRow(row)
+    };
+  } finally {
+    db.close();
+  }
+}
+
 export async function readArtifactVersion(store, artifact, versionNumber) {
   const version = artifact.versions.find((item) => item.version === versionNumber);
   if (!version) {
@@ -798,10 +1032,45 @@ function initializeSchema(db) {
       metadata_json TEXT NOT NULL
     );
 
+    CREATE TABLE IF NOT EXISTS users (
+      id TEXT PRIMARY KEY,
+      email TEXT NOT NULL UNIQUE,
+      name TEXT NOT NULL,
+      role TEXT NOT NULL DEFAULT 'user',
+      password_hash TEXT NOT NULL,
+      active INTEGER NOT NULL DEFAULT 1,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS sessions (
+      id TEXT PRIMARY KEY,
+      user_id TEXT NOT NULL,
+      token_hash TEXT NOT NULL UNIQUE,
+      created_at TEXT NOT NULL,
+      expires_at TEXT NOT NULL,
+      revoked_at TEXT,
+      FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+    );
+
+    CREATE TABLE IF NOT EXISTS api_tokens (
+      id TEXT PRIMARY KEY,
+      user_id TEXT NOT NULL,
+      name TEXT NOT NULL,
+      token_hash TEXT NOT NULL UNIQUE,
+      created_at TEXT NOT NULL,
+      last_used_at TEXT,
+      revoked_at TEXT,
+      FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+    );
+
     CREATE INDEX IF NOT EXISTS idx_artifacts_updated_at ON artifacts(updated_at DESC);
     CREATE INDEX IF NOT EXISTS idx_artifacts_source_agent ON artifacts(source_agent);
     CREATE INDEX IF NOT EXISTS idx_audit_log_created_at ON audit_log(created_at DESC);
     CREATE INDEX IF NOT EXISTS idx_audit_log_artifact_id ON audit_log(artifact_id);
+    CREATE INDEX IF NOT EXISTS idx_users_email ON users(email);
+    CREATE INDEX IF NOT EXISTS idx_sessions_token_hash ON sessions(token_hash);
+    CREATE INDEX IF NOT EXISTS idx_api_tokens_token_hash ON api_tokens(token_hash);
   `);
   ensureColumn(db, "artifacts", "artifact_type", "TEXT NOT NULL DEFAULT 'document'");
   ensureColumn(db, "artifacts", "schema_version", "INTEGER NOT NULL DEFAULT 1");
@@ -1104,6 +1373,29 @@ function auditFromRow(row) {
   };
 }
 
+function userFromRow(row) {
+  return {
+    id: row.id,
+    email: row.email,
+    name: row.name,
+    role: row.role,
+    active: Boolean(row.active),
+    createdAt: row.created_at,
+    updatedAt: row.updated_at
+  };
+}
+
+function apiTokenFromRow(row) {
+  return {
+    id: row.id,
+    userId: row.user_id,
+    name: row.name,
+    createdAt: row.created_at,
+    lastUsedAt: row.last_used_at,
+    revokedAt: row.revoked_at
+  };
+}
+
 function versionFromRow(row) {
   return {
     version: row.version,
@@ -1280,6 +1572,21 @@ function normalizeMetadata(metadata) {
   return metadata;
 }
 
+function normalizeEmail(value) {
+  return normalizeOptionalString(value).toLowerCase();
+}
+
+function normalizeUserRole(value) {
+  const role = normalizeOptionalString(value) || "user";
+  if (!USER_ROLES.includes(role)) {
+    throw Object.assign(new Error(`Unsupported user role: ${value}`), {
+      statusCode: 400,
+      code: "INVALID_USER_ROLE"
+    });
+  }
+  return role;
+}
+
 function normalizeOptionalString(value) {
   if (value === undefined || value === null) {
     return "";
@@ -1287,6 +1594,30 @@ function normalizeOptionalString(value) {
   return String(value).trim();
 }
 
+function generateOpaqueToken(prefix) {
+  return `${prefix}_${randomBytes(32).toString("base64url")}`;
+}
+
+function hashToken(token) {
+  return createHash("sha256").update(String(token || "")).digest("hex");
+}
+
+function hashPassword(password) {
+  const salt = randomBytes(16).toString("base64url");
+  const hash = scryptSync(String(password), salt, 64).toString("base64url");
+  return `scrypt:${salt}:${hash}`;
+}
+
+function verifyPassword(password, stored) {
+  const [scheme, salt, expected] = String(stored || "").split(":");
+  if (scheme !== "scrypt" || !salt || !expected) {
+    return false;
+  }
+  const actualBuffer = scryptSync(String(password), salt, 64);
+  const expectedBuffer = Buffer.from(expected, "base64url");
+  return actualBuffer.length === expectedBuffer.length && timingSafeEqual(actualBuffer, expectedBuffer);
+}
+
 function inferFormat(contentType) {
   const value = normalizeOptionalString(contentType).toLowerCase();
   if (value.includes("vnd.ant.code") || value.includes("source-code")) {