cortad 0.3.11 → 0.4.0

package/lib/identities.mjs

@@ -1,689 +0,0 @@
-// The same file lives on the Cortad side. Keep the two in step: the recipes the
-// cloud sends are gated here again, on the machine that holds the secrets.
-// Signing in as the customer's own callers, from inside the box, through their own doors.
-//
-// A recipe (src/setup/road-identities.ts) names env variables, routes and body fields; never a
-// value. This program runs where the app's environment file is, opens the values itself, creates
-// an account through their admin door or exchanges their shared password for a token, and keeps
-// what their door issued in a header file only the box can read. What it prints is roles and
-// statuses: a token the run needs is fetched from the box when a turn first speaks as that role,
-// and a credential that IS a sealed value (an admin key) is marked sealed and never leaves. A
-// caller Firebase verifies is signed up at the Auth emulator the boot raised in place of their
-// project; without that emulator the role stays upstream, verified outside the box.
-
-export const IDENTITY_PATH = "/tmp/bl-identities.py";
-export const IDENTITY_OUT = "/tmp/bl-identities.json";
-const HEADER_FILE = "/tmp/bl-identity-%s.%s";
-
-const ROLE = /^[a-z][a-z0-9_-]{0,30}(?::[a-z][a-z0-9_-]{0,30})?$/;
-const HEADER = /^[a-z][a-z0-9-]{0,40}$/;
-const ENV_NAME = /^[A-Z_][A-Z0-9_]*$/;
-const ROUTE = /^\/[\w./-]{0,200}$/;
-const OPENS = /^\/[\w./{}-]{0,200}$/;
-const SOURCE = /^(?:env:[A-Z_][A-Z0-9_]*(?:\|[A-Z_][A-Z0-9_]*)*|gen:(?:username|email|password|name)|role)$/;
-// A Next.js route file is spelled with brackets and route groups with parentheses: `app/api/auth/
-// [...all]/route.ts (better-auth)` failed the old gate and every catch-all auth recipe was dropped
-// before the program saw it. Still no quote, angle bracket, `$`, backtick or semicolon.
-const WHERE = /^[\w./:@()[\] -]{1,300}$/;
-const BASE = /^http:\/\/(?:127\.0\.0\.1|\[::1\]|localhost):\d{2,5}$/;
-const KINDS = new Set(["header", "login", "jwt", "upstream", "firebase", "authjs", "supabase", "basic", "clerk", "supabase-admin"]);
-const STATUSES = new Set(["minted", "sealed", "absent", "refused", "unreachable", "upstream"]);
-
-// A credential the app's own environment names for its own account: a user-side name and a
-// password-side name that share a prefix. The prefix is the name with its trailing token removed,
-// so USER_USERNAME pairs with USER_PASSWORD and TUDUDI_USER_EMAIL with TUDUDI_USER_PASSWORD.
-const USER_TOKEN = /_(?:USERNAME|USER|EMAIL|LOGIN)$/;
-const SECRET_TOKEN = /_(?:PASSWORD|PASS|SECRET)$/;
-// A pair that opens a store or a mail server is never the app's own account: PG_DB_USER with
-// PG_DB_PASSWORD signs in to Postgres, and offered to a sign-in form it sent a database password
-// to the app's login route.
-const SERVICE_PREFIX = /(?:^|_)(?:DB|DATABASE|SQL|PG|PSQL|POSTGRES(?:QL)?|MYSQL|MARIADB|MSSQL|MONGO(?:DB)?|REDIS|VALKEY|ELASTIC(?:SEARCH)?|OPENSEARCH|ES|QDRANT|NEO4J|CLICKHOUSE|RABBIT(?:MQ)?|AMQP|KAFKA|SMTP|MAIL|EMAIL|S3|MINIO|FTP|SFTP|LDAP|PROXY)(?:_|$)/;
-const CRED_USER_FIELD = /^(?:e-?mail|user(?:_?name)?|login|account|identifier)$/i;
-const CRED_PASS_FIELD = /^(?:password|passcode|pass|pwd)$/i;
-const SIGN_IN_ROUTE = /(?:^|\/)(?:login|signin|sign-in|sign_in|session|token|authenticate)(?:\/|$)/i;
-
-const slug = (role) => role.replace(/[^a-z0-9-]/g, "-");
-export const identityHeaderFile = (role) => (ROLE.test(role) ? HEADER_FILE.replace("%s.%s", `${slug(role)}.header`) : null);
-// The curl argument a probe inside the box adds to speak as a role: the header line is read there,
-// so the value never rides in a command this process composes.
-export function identityCurlArg(as) {
-  if (as === "browser" || as === "bare" || !ROLE.test(as)) return "";
-  return `-H "$(cat ${HEADER_FILE.replace("%s.%s", `${slug(as)}.header`)} ${HEADER_FILE.replace("%s.%s", `${slug(as)}.sealed`)} 2>/dev/null)"`;
-}
-
-// Every string the recipes carry reaches the program as base64 JSON, never as source, and only
-// after the charset gate: a route or a role is read from a repository.
-export function identityScript(recipes, target, accounts = {}) {
-  const safe = recipes.filter(safeRecipe).slice(0, 12);
-  const headers = Object.fromEntries(Object.entries(target.headers ?? {}).filter(([k, v]) => HEADER.test(k) && typeof v === "string" && v.length <= 300 && !/[\r\n]/.test(v)));
-  const kept = Object.fromEntries(Object.entries(accounts).filter(([role, a]) => ROLE.test(role) && a
-    && ["username", "email", "password", "name"].every((f) => typeof a[f] === "string" && a[f].length <= 120 && !/[\r\n]/.test(a[f]))));
-  const plan = { envPath: /^[\w./-]+$/.test(target.envPath) ? target.envPath : "/workspace/repo/.env", base: BASE.test(target.base) ? target.base : "http://127.0.0.1:0", headers, recipes: safe, accounts: kept };
-  return PROGRAM
-    .replace("__PLAN__", Buffer.from(JSON.stringify(plan), "utf8").toString("base64"))
-    .replace("__OUT__", IDENTITY_OUT)
-    .replace("__FILE__", HEADER_FILE);
-}
-
-function safeRecipe(r) {
-  const step = (s) => s && ROUTE.test(s.route)
-    && Object.entries(s.headers ?? {}).every(([k, v]) => HEADER.test(k) && SOURCE.test(v))
-    && Object.entries(s.body ?? {}).every(([k, v]) => /^[A-Za-z_][\w]{0,40}$/.test(k) && SOURCE.test(v));
-  return r && KINDS.has(r.kind) && ROLE.test(r.role) && HEADER.test(r.header) && WHERE.test(r.where)
-    && (r.env ?? []).every((n) => ENV_NAME.test(n))
-    && (r.roles ?? []).every((v) => /^[a-z][a-z0-9_-]{0,30}$/.test(v))
-    && (r.opens ?? []).every((o) => OPENS.test(o))
-    && (r.steps ?? []).every(step) && (r.alt ?? []).every(step)
-    && (r.claim === undefined || /^[a-z_][a-z0-9_]{0,30}$/i.test(r.claim));
-}
-
-const PROGRAM = String.raw`import base64, hashlib, hmac, http.cookiejar, json, os, re, secrets, time, urllib.error, urllib.request
-
-PLAN = json.loads(base64.b64decode("__PLAN__").decode("utf-8"))
-OUT = "__OUT__"
-FILE = "__FILE__"
-TTL = 6 * 3600
-# Digits only: an account column is an integer in Strapi, Django and Rails, and a word here makes
-# the database itself raise. Nonerds crashed its whole process on "cortad-test-user". Digits are a
-# valid string id too, so this one value fits both kinds of account table.
-TEST = "9000001"
-# A dev server compiles its auth route on the first request: better-chatbot's sign-in timed out at 10s
-# and the caller was filed unreachable. The whole program stays inside the step's two minutes.
-DEADLINE = time.time() + 100
-SIGNUP = "/identitytoolkit.googleapis.com/v1/accounts:signUp?key=standin"
-
-
-def read_env(path):
-    out = {}
-    try:
-        with open(path, encoding="utf-8", errors="replace") as f:
-            for line in f:
-                m = re.match(r"^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$", line)
-                if not m:
-                    continue
-                v = m.group(2).strip()
-                if len(v) >= 2 and v[0] == v[-1] and v[0] in "\"'":
-                    v = v[1:-1]
-                out[m.group(1)] = v
-    except OSError:
-        pass
-    return out
-
-
-def slug(role):
-    return re.sub(r"[^a-z0-9-]", "-", role)
-
-
-# One account per role, made once and signed into on every later run: a fresh account per run left
-# 1,600 active test logins in one app's own account store.
-def gen(role):
-    if role in PLAN.get("accounts", {}):
-        return PLAN["accounts"][role]
-    tag = secrets.token_hex(4)
-    return {
-        "username": "cortad-%s-%s" % (slug(role), tag),
-        "email": "cortad-%s-%s@example.invalid" % (slug(role), tag),
-        "password": secrets.token_urlsafe(18) + "A1!",
-        "name": "Cortad test %s" % role,
-    }
-
-
-def source(spec, env, g, role):
-    if spec.startswith("env:"):
-        for name in spec[4:].split("|"):
-            if env.get(name):
-                return env[name]
-        return None
-    return {"gen:username": g["username"], "gen:email": g["email"], "gen:password": g["password"], "gen:name": g["name"], "role": role}.get(spec)
-
-
-def names(spec):
-    return spec[4:].replace("|", " or ") if spec.startswith("env:") else spec
-
-
-def call(path, headers, body, jar, base=None):
-    opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(jar))
-    req = urllib.request.Request((base or PLAN["base"]) + path, data=json.dumps(body).encode("utf-8"), method="POST")
-    for k, v in list(PLAN["headers"].items()) + list(headers.items()):
-        req.add_header(k, v)
-    req.add_header("content-type", "application/json")
-    try:
-        with opener.open(req, timeout=40) as r:
-            return r.status, r.read(200000).decode("utf-8", "replace")
-    except urllib.error.HTTPError as e:
-        # The door's own sentence rides the refusal: a 500 with no body told nobody what the
-        # sign-up died on.
-        try:
-            return e.code, e.read(4000).decode("utf-8", "replace")
-        except Exception:
-            return e.code, ""
-    except Exception as e:
-        return 0, type(e).__name__
-
-
-def token_in(value, depth=0):
-    if isinstance(value, dict):
-        for k, v in value.items():
-            if isinstance(v, str) and v and re.fullmatch(r"(?i)(access_?token|token|jwt|session_?token|id_?token|api_?key)", k):
-                return v
-        if depth < 2:
-            for v in value.values():
-                found = token_in(v, depth + 1)
-                if found:
-                    return found
-    return None
-
-
-def bearer(header, value):
-    if header == "authorization" and not value.lower().startswith("bearer "):
-        return "Bearer " + value
-    return value
-
-
-def minted(header, value, ttl=TTL):
-    return {"status": "minted", "header": header, "line": "%s: %s" % (header, bearer(header, value)), "expires": int(time.time()) + ttl}
-
-
-# The account is named after the identity, not the role slot: staff:sales and sales are two callers
-# at two doors, and their door reads the name back on every login.
-def login(recipe, role, role_value, env):
-    g = gen(role)
-    ways = [recipe["steps"]] + ([recipe["alt"]] if recipe.get("alt") else [])
-    for way in ways:
-        last = ways[-1] is way
-        got = walk(way, recipe, env, g, role_value)
-        if got.get("status") != "refused" or last:
-            return got
-    return got
-
-
-def walk(steps, recipe, env, g, role_value):
-    jar = http.cookiejar.CookieJar()
-    status, token = 0, None
-    for step in steps:
-        headers = {}
-        # A token the previous step minted signs this one: the key route wants the session that
-        # just logged in, and a cookie jar alone does not carry a bearer.
-        if token:
-            headers[recipe["header"]] = bearer(recipe["header"], token)
-        for h, spec in step.get("headers", {}).items():
-            v = source(spec, env, g, role_value)
-            if v is None:
-                return {"status": "absent", "note": names(spec)}
-            headers[h] = v
-        body = {}
-        unset = None
-        for field, spec in step["body"].items():
-            v = source(spec, env, g, role_value)
-            if v is None:
-                if not spec.startswith("env:"):
-                    return {"status": "absent", "note": names(spec)}
-                # A switch in their code may make this one optional: ask without it, and a refusal
-                # is then the variable they did not seal, not their door.
-                unset = names(spec)
-                continue
-            body[field] = v
-        status, text = call(step["route"], headers, body, jar)
-        if status == 0:
-            return {"status": "unreachable", "note": text}
-        if status >= 400 and unset:
-            return {"status": "absent", "note": unset}
-        # The account this role was given on an earlier run is still there: go on and sign in.
-        if status in (400, 409, 422) and step is not steps[-1] and re.search(r"exist|taken|already|duplicate|in use|registered", text or "", re.I):
-            continue
-        if status >= 400:
-            said = re.sub(r"\s+", " ", re.sub(r"<[^>]+>", "", text or "")).strip()[:160]
-            return {"status": "refused", "note": "HTTP %d at %s%s" % (status, step["route"], (": " + said) if said else "")}
-        try:
-            found = token_in(json.loads(text))
-        except ValueError:
-            found = None
-        # A step that mints nothing keeps what the step before it minted.
-        token = found or token
-    cookies = "; ".join("%s=%s" % (c.name, c.value) for c in jar)
-    # A cookie door reads its cookie by name. better-auth's sign-in answers a token AND sets
-    # better-auth.session_token; sending the bare token as the cookie header named nothing, so its
-    # proxy redirected every signed-in knock to the sign-in page.
-    if recipe["header"] == "cookie" and cookies:
-        return minted("cookie", cookies)
-    if token:
-        return minted(recipe["header"], token)
-    if cookies:
-        # ponytail: the cookie alone; a CSRF token their form also wants is the next thing to carry.
-        return minted("cookie", cookies)
-    return {"status": "refused", "note": "HTTP %d with no token in the reply" % status}
-
-
-def b64url(raw):
-    return base64.urlsafe_b64encode(raw).rstrip(b"=").decode("ascii")
-
-
-def hs256(secret, claims):
-    head = b64url(json.dumps({"alg": "HS256", "typ": "JWT"}, separators=(",", ":")).encode("utf-8"))
-    body = b64url(json.dumps(claims, separators=(",", ":")).encode("utf-8"))
-    sig = b64url(hmac.new(secret.encode("utf-8"), ("%s.%s" % (head, body)).encode("ascii"), hashlib.sha256).digest())
-    return "%s.%s.%s" % (head, body, sig)
-
-
-def jwt(recipe, env):
-    secret = source("env:" + "|".join(recipe["env"]), env, None, None)
-    if not secret:
-        return {"status": "absent", "note": " or ".join(recipe["env"])}
-    now = int(time.time())
-    # On their own machine the database is theirs and live: the token names a test id that belongs
-    # to nobody, never account 1, which is usually the person who built the app. (The sandbox copy
-    # of this program signs account 1 of a restored copy; this one differs on purpose.)
-    claims = {"sub": TEST, "id": TEST, "iat": now, "exp": now + TTL}
-    claim = recipe.get("claim") or "sub"
-    if claim not in claims:
-        claims[claim] = TEST
-    return minted("authorization", hs256(secret, claims))
-
-
-# GoTrue signs its access token HS256 with the project's JWT secret; RLS reads sub as auth.uid()
-# and role as auth.role(). The id is a well-formed uuid that belongs to nobody, never a real row.
-SUPA_UID = "00000000-0000-4000-8000-000000009001"
-
-
-def supabase(recipe, env):
-    secret = source("env:" + "|".join(recipe["env"]), env, None, None)
-    if not secret:
-        return {"status": "absent", "note": " or ".join(recipe["env"])}
-    now = int(time.time())
-    claims = {"sub": SUPA_UID, "aud": "authenticated", "role": "authenticated", "iat": now, "exp": now + TTL, "is_anonymous": False}
-    return minted("authorization", hs256(secret, claims))
-
-
-# Auth.js v5 (and next-auth v5) seals its session as a JWE, not a signed JWT: dir key management,
-# A256CBC-HS512 content encryption, the key derived from the secret with HKDF over the cookie name.
-# Verified against the @auth/core jwt.ts encode path. next-auth v4 (A256GCM) is not minted here.
-def hkdf_sha256(secret, salt, info, length):
-    salt = salt or bytes(hashlib.sha256().digest_size)
-    prk = hmac.new(salt, secret, hashlib.sha256).digest()
-    out, block, i = b"", b"", 1
-    while len(out) < length:
-        block = hmac.new(prk, block + info + bytes([i]), hashlib.sha256).digest()
-        out += block
-        i += 1
-    return out[:length]
-
-
-AES_SBOX = bytes.fromhex(
-    "637c777bf26b6fc53001672bfed7ab76ca82c97dfa5947f0add4a2af9ca472c0"
-    "b7fd9326363ff7cc34a5e5f171d8311504c723c31896059a071280e2eb27b275"
-    "09832c1a1b6e5aa0523bd6b329e32f8453d100ed20fcb15b6acbbe394a4c58cf"
-    "d0efaafb434d338545f9027f503c9fa851a3408f929d38f5bcb6da2110fff3d2"
-    "cd0c13ec5f974417c4a77e3d645d197360814fdc222a908846eeb814de5e0bdb"
-    "e0323a0a4906245cc2d3ac629195e479e7c8376d8dd54ea96c56f4ea657aae08"
-    "ba78252e1ca6b4c6e8dd741f4bbd8b8a703eb5664803f60e613557b986c11d9e"
-    "e1f8981169d98e949b1e87e9ce5528df8ca1890dbfe6426841992d0fb054bb16")
-AES_RCON = (0, 1, 2, 4, 8, 16, 32, 64)
-
-
-def _aes_mul(a, b):
-    r = 0
-    for _ in range(8):
-        if b & 1:
-            r ^= a
-        hi = a & 0x80
-        a = (a << 1) & 0xFF
-        if hi:
-            a ^= 0x1B
-        b >>= 1
-    return r
-
-
-def _aes_expand(key):
-    w = [list(key[i:i + 4]) for i in range(0, 32, 4)]
-    for i in range(8, 60):
-        t = list(w[i - 1])
-        if i % 8 == 0:
-            t = [AES_SBOX[b] for b in t[1:] + t[:1]]
-            t[0] ^= AES_RCON[i // 8]
-        elif i % 8 == 4:
-            t = [AES_SBOX[b] for b in t]
-        w.append([w[i - 8][j] ^ t[j] for j in range(4)])
-    return [b for word in w for b in word]
-
-
-def _aes_shift_rows(s):
-    o = list(s)
-    for r in range(1, 4):
-        vals = [s[c * 4 + r] for c in range(4)]
-        vals = vals[r:] + vals[:r]
-        for c in range(4):
-            o[c * 4 + r] = vals[c]
-    return o
-
-
-def _aes_encrypt_block(block, rk):
-    s = list(block)
-
-    def add(rnd):
-        for i in range(16):
-            s[i] ^= rk[rnd * 16 + i]
-
-    add(0)
-    for rnd in range(1, 14):
-        s = [AES_SBOX[b] for b in s]
-        s = _aes_shift_rows(s)
-        mixed = []
-        for c in range(4):
-            a, b, d, e = s[c * 4:c * 4 + 4]
-            mixed += [
-                _aes_mul(a, 2) ^ _aes_mul(b, 3) ^ d ^ e,
-                a ^ _aes_mul(b, 2) ^ _aes_mul(d, 3) ^ e,
-                a ^ b ^ _aes_mul(d, 2) ^ _aes_mul(e, 3),
-                _aes_mul(a, 3) ^ b ^ d ^ _aes_mul(e, 2),
-            ]
-        s = mixed
-        add(rnd)
-    s = _aes_shift_rows([AES_SBOX[b] for b in s])
-    add(14)
-    return bytes(s)
-
-
-def _aes_cbc(key, iv, data):
-    rk = _aes_expand(key)
-    out, prev = b"", iv
-    for i in range(0, len(data), 16):
-        block = bytes(x ^ y for x, y in zip(data[i:i + 16], prev))
-        prev = _aes_encrypt_block(block, rk)
-        out += prev
-    return out
-
-
-def _authjs_cookie(env_path):
-    root = os.path.dirname(os.path.abspath(env_path))
-    for _ in range(5):
-        nm = os.path.join(root, "node_modules")
-        if os.path.isdir(os.path.join(nm, "@auth", "core")):
-            return "authjs.session-token"
-        try:
-            with open(os.path.join(nm, "next-auth", "package.json"), encoding="utf-8") as f:
-                major = json.load(f).get("version", "").lstrip("^~").split(".")[0]
-            return "authjs.session-token" if major.isdigit() and int(major) >= 5 else None
-        except OSError:
-            pass
-        parent = os.path.dirname(root)
-        if parent == root:
-            break
-        root = parent
-    # The dependency was detected upstream but the tree is not on disk: v5 is the current default.
-    return "authjs.session-token"
-
-
-def authjs(recipe, env):
-    secret = source("env:" + "|".join(recipe["env"]), env, None, None)
-    if not secret:
-        return {"status": "absent", "note": " or ".join(recipe["env"])}
-    cookie = _authjs_cookie(PLAN["envPath"])
-    if not cookie:
-        return {"status": "upstream", "note": "Auth.js v4"}
-    key = hkdf_sha256(secret.encode("utf-8"), cookie.encode("utf-8"), ("Auth.js Generated Encryption Key (%s)" % cookie).encode("utf-8"), 64)
-    mac_key, enc_key = key[:32], key[32:]
-    now = int(time.time())
-    claims = {"sub": TEST, "name": "Cortad test", "email": "cortad@example.invalid", "iat": now, "exp": now + TTL, "jti": secrets.token_hex(16)}
-    header = b64url(json.dumps({"alg": "dir", "enc": "A256CBC-HS512"}, separators=(",", ":")).encode("utf-8"))
-    plaintext = json.dumps(claims, separators=(",", ":")).encode("utf-8")
-    pad = 16 - (len(plaintext) % 16)
-    iv = secrets.token_bytes(16)
-    ct = _aes_cbc(enc_key, iv, plaintext + bytes([pad]) * pad)
-    aad = header.encode("ascii")
-    al = (len(aad) * 8).to_bytes(8, "big")
-    tag = hmac.new(mac_key, aad + iv + ct + al, hashlib.sha512).digest()[:32]
-    jwe = "%s..%s.%s.%s" % (header, b64url(iv), b64url(ct), b64url(tag))
-    return minted("cookie", "%s=%s" % (cookie, jwe))
-
-
-# The Auth emulator the boot raised in place of their Firebase project: it signs any address up
-# under any key, and firebase-admin accepts its tokens while FIREBASE_AUTH_EMULATOR_HOST is set.
-def firebase(recipe, role, env):
-    host = env.get("FIREBASE_AUTH_EMULATOR_HOST", "")
-    if not re.fullmatch(r"[\w.-]+:\d{2,5}", host):
-        return {"status": "upstream", "note": "Firebase"}
-    g = gen(role)
-    status, text = call(SIGNUP, {}, {"email": g["email"], "password": g["password"], "returnSecureToken": True}, http.cookiejar.CookieJar(), "http://" + host)
-    if status == 0:
-        return {"status": "unreachable", "note": text}
-    try:
-        reply = json.loads(text)
-    except ValueError:
-        reply = {}
-    token = reply.get("idToken") if isinstance(reply, dict) else None
-    if not isinstance(token, str) or not token:
-        return {"status": "refused", "note": "HTTP %d at the Firebase emulator" % status}
-    return minted(recipe["header"], token, int(reply.get("expiresIn") or 3600))
-
-
-def sealed(recipe, env):
-    v = source("env:" + "|".join(recipe["env"]), env, None, None)
-    if not v:
-        return {"status": "absent", "note": " or ".join(recipe["env"])}
-    return {"status": "sealed", "header": recipe["header"], "line": "%s: %s" % (recipe["header"], bearer(recipe["header"], v)), "note": " or ".join(recipe["env"])}
-
-
-# HTTP Basic from the username and password the app's own environment names: env[0] is the user,
-# env[1] the password. The line carries the scheme verbatim, so it is not run through bearer().
-def basic(recipe, env):
-    names = recipe.get("env", [])
-    user = env.get(names[0]) if len(names) > 0 else None
-    pw = env.get(names[1]) if len(names) > 1 else None
-    if not user or not pw:
-        return {"status": "absent", "note": " and ".join(names)}
-    raw = base64.b64encode(("%s:%s" % (user, pw)).encode("utf-8")).decode("ascii")
-    return {"status": "minted", "header": recipe["header"], "line": "%s: Basic %s" % (recipe["header"], raw), "expires": int(time.time()) + TTL, "note": " and ".join(names)}
-
-
-def keep(path, line):
-    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
-    with os.fdopen(fd, "w", encoding="utf-8") as f:
-        f.write(line + "\n")
-
-
-# A token their door issued earlier and still honours is reused: sign-in doors are rate limited,
-# and a run re-minting on every boot would spend that budget on itself.
-def previous():
-    try:
-        with open(OUT, encoding="utf-8") as f:
-            rows = json.load(f)["identities"]
-    except Exception:
-        return {}
-    now = time.time()
-    out = {}
-    for r in rows:
-        if r.get("status") not in ("minted", "sealed"):
-            continue
-        if not os.path.exists(FILE % (slug(r["role"]), "header" if r["status"] == "minted" else "sealed")):
-            continue
-        if r.get("expires") is not None and r["expires"] < now + 60:
-            continue
-        out[r["role"]] = r
-    return out
-
-
-def main():
-    env = read_env(PLAN["envPath"])
-    kept = previous()
-    rows = []
-    for recipe in PLAN["recipes"]:
-        for role_value in recipe.get("roles") or [None]:
-            role = "%s:%s" % (recipe["role"], role_value) if role_value else recipe["role"]
-            steps = recipe.get("steps") or []
-            base = {
-                "role": role, "kind": recipe["kind"], "header": recipe["header"], "where": recipe["where"],
-                "opens": [o.replace("{role}", role_value or "") for o in recipe.get("opens", [])],
-                "door": steps[-1]["route"] if steps else SIGNUP if recipe["kind"] == "firebase" else recipe["header"],
-            }
-            if role in kept:
-                rows.append(dict(base, **{k: v for k, v in kept[role].items() if k in ("status", "header", "expires", "note")}))
-                continue
-            if time.time() > DEADLINE:
-                rows.append(dict(base, status="unreachable", note="out of time"))
-                continue
-            try:
-                if recipe["kind"] == "header":
-                    got = sealed(recipe, env)
-                elif recipe["kind"] == "jwt":
-                    got = jwt(recipe, env)
-                elif recipe["kind"] == "supabase":
-                    got = supabase(recipe, env)
-                elif recipe["kind"] == "authjs":
-                    got = authjs(recipe, env)
-                elif recipe["kind"] == "login":
-                    got = login(recipe, role, role_value, env)
-                elif recipe["kind"] == "firebase":
-                    got = firebase(recipe, role, env)
-                elif recipe["kind"] == "basic":
-                    got = basic(recipe, env)
-                else:
-                    got = {"status": "upstream", "note": " or ".join(recipe["env"]) or recipe["role"]}
-            except Exception as err:
-                got = {"status": "unreachable", "note": type(err).__name__}
-            # A sign-in the environment named its own credential for records which names it used.
-            if recipe.get("envCred") and got.get("status") == "minted" and not got.get("note"):
-                got["note"] = " and ".join(recipe.get("env", []))
-            line = got.pop("line", None)
-            if line:
-                keep(FILE % (slug(role), "header" if got["status"] == "minted" else "sealed"), line)
-            rows.append(dict(base, **got))
-    report = {"identities": rows}
-    with open(OUT, "w", encoding="utf-8") as f:
-        json.dump(report, f)
-    print("BL_IDENTITIES " + json.dumps(report))
-
-
-main()
-`;
-
-// The one line the program wrote, as typed rows. Anything malformed is dropped rather than read,
-// and nothing here is a value: a role, a header name, a status, a door.
-export function parseIdentityReport(text) {
-  const line = String(text ?? "").split("\n").find((l) => l.startsWith("BL_IDENTITIES {")) ?? (String(text ?? "").trim().startsWith("{") ? `BL_IDENTITIES ${String(text).trim()}` : null);
-  if (!line) return null;
-  let raw;
-  try {
-    raw = JSON.parse(line.slice("BL_IDENTITIES ".length));
-  } catch {
-    return null;
-  }
-  if (!Array.isArray(raw?.identities)) return null;
-  const identities = raw.identities.flatMap((r) => {
-    if (!r || !ROLE.test(String(r.role)) || !KINDS.has(r.kind) || !HEADER.test(String(r.header)) || !STATUSES.has(r.status)) return [];
-    if (typeof r.where !== "string" || !WHERE.test(r.where) || typeof r.door !== "string" || r.door.length > 200) return [];
-    const opens = (Array.isArray(r.opens) ? r.opens : []).filter((o) => typeof o === "string" && OPENS.test(o)).slice(0, 8);
-    return [{
-      role: r.role, kind: r.kind, header: r.header, status: r.status, opens, door: r.door, where: r.where,
-      ...(Number.isFinite(r.expires) ? { expires: Number(r.expires) } : {}),
-      ...(typeof r.note === "string" ? { note: r.note.slice(0, 200) } : {}),
-    }];
-  });
-  return { identities };
-}
-
-// The credential pairs an environment names, by shared prefix. Names only, never values.
-export function credentialPairs(names) {
-  const list = (Array.isArray(names) ? names : []).filter((n) => typeof n === "string" && ENV_NAME.test(n));
-  const users = list.filter((n) => USER_TOKEN.test(n)).map((n) => ({ name: n, prefix: n.replace(USER_TOKEN, "") }));
-  const secrets = list.filter((n) => SECRET_TOKEN.test(n)).map((n) => ({ name: n, prefix: n.replace(SECRET_TOKEN, "") }));
-  const pairs = [];
-  const seen = new Set();
-  for (const u of users) {
-    const s = secrets.find((x) => x.prefix === u.prefix);
-    if (s && !seen.has(u.prefix) && !SERVICE_PREFIX.test(u.prefix)) { seen.add(u.prefix); pairs.push({ user: u.name, secret: s.name, prefix: u.prefix }); }
-  }
-  return pairs;
-}
-
-const routeRole = (route) => {
-  const seg = route.split("/").filter((s) => s && !/^(?:api|v\d+|auth)$/i.test(s)).pop() ?? "user";
-  const r = seg.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/^-+|-+$/g, "").slice(0, 20);
-  return /^[a-z]/.test(r) ? r : "user";
-};
-const uniqueRole = (base, used) => {
-  const stem = /^[a-z]/.test(base) ? base : "account";
-  let role = stem;
-  for (let n = 2; used.has(role); n += 1) role = `${stem}-${n}`;
-  used.add(role);
-  return role;
-};
-
-// When the app's own environment names a credential pair, the box can sign in with it. Each login
-// recipe whose sign-in form takes a username or email and a password is filled from the pair
-// instead of a generated account; each discovered sign-in route with no recipe becomes one; and an
-// HTTP Basic identity is minted for a door that answers 401 with a Basic challenge. Values are
-// opened by the mint program on the machine, never here: this only rewrites which env name a field
-// reads. A register step (one of several, not a sign-in) keeps its fresh account.
-export function envCredentialRecipes(recipes, names, loginRoutes = []) {
-  const list = Array.isArray(recipes) ? recipes : [];
-  const pairs = credentialPairs(names);
-  if (!pairs.length) return list;
-  const pair = pairs[0];
-  const userSrc = `env:${pair.user}`;
-  const passSrc = `env:${pair.secret}`;
-  const used = new Set(list.map((r) => r?.role).filter(Boolean));
-  const covered = new Set();
-  const out = list.map((r) => {
-    if (r?.kind !== "login" || !Array.isArray(r.steps)) return r;
-    let touched = false;
-    const steps = r.steps.map((s) => {
-      if (r.steps.length !== 1 && !SIGN_IN_ROUTE.test(s.route)) return s;
-      const body = { ...(s.body ?? {}) };
-      let hit = false;
-      for (const [f, v] of Object.entries(body)) {
-        if (typeof v !== "string" || !v.startsWith("gen:")) continue;
-        if (CRED_USER_FIELD.test(f)) { body[f] = userSrc; hit = true; }
-        else if (CRED_PASS_FIELD.test(f)) { body[f] = passSrc; hit = true; }
-      }
-      if (!hit) return s;
-      covered.add(s.route);
-      touched = true;
-      return { ...s, body };
-    });
-    return touched ? { ...r, steps, env: [...new Set([...(r.env ?? []), pair.user, pair.secret])], envCred: true } : r;
-  });
-  const known = new Set(out.flatMap((r) => (r?.steps ?? []).map((s) => s.route)));
-  const userField = /_EMAIL$/.test(pair.user) ? "email" : "username";
-  for (const route of (Array.isArray(loginRoutes) ? loginRoutes : []).slice(0, 6)) {
-    if (typeof route !== "string" || !route.startsWith("/") || known.has(route) || covered.has(route)) continue;
-    out.push({
-      kind: "login", role: uniqueRole(routeRole(route), used), header: "authorization", env: [pair.user, pair.secret],
-      steps: [{ route, body: { [userField]: userSrc, password: passSrc } }], opens: [], envCred: true,
-      where: `your environment (${pair.user} and ${pair.secret})`,
-    });
-  }
-  // A Basic identity for each pair as well: a door that wants a sign-in form ignores it, and a door
-  // behind HTTP Basic (which declares no route to fill) is reached by nothing else.
-  for (const p of pairs) {
-    out.push({
-      kind: "basic", role: uniqueRole(slug(p.prefix.toLowerCase()) || "account", used), header: "authorization",
-      env: [p.user, p.secret], opens: [], envCred: true, where: `your environment (${p.user} and ${p.secret})`,
-    });
-  }
-  return out;
-}
-
-// What each row means to the person whose app this is.
-export function identitySentence(row) {
-  switch (row.status) {
-    case "minted": return row.kind === "firebase"
-      ? `signed in as ${row.role} through the Firebase emulator standing in for your project; the token stays inside the sandbox`
-      : row.kind === "basic"
-        ? `signed in as ${row.role} with the username and password your environment sets (${row.note ?? "two variables"}); the header stays inside the sandbox`
-        : `signed in as ${row.role} through your own door ${row.door}; the token stays inside the sandbox`;
-    case "sealed": return `${row.role} is the sealed ${row.note} value itself; it never leaves the sandbox, so only the compile's own probe can speak as it`;
-    case "absent": return `could not sign in as ${row.role}: ${row.note} is not in the environment you sealed`;
-    case "refused": return `your door refused the ${row.role} sign-in (${row.note}), so cases behind it are counted and not driven`;
-    case "unreachable": return `the ${row.role} sign-in at ${row.door} did not answer (${row.note}); that is ours to look at`;
-    default: return `${row.role} callers are verified by ${row.note}, outside this sandbox; their doors are counted and not driven`;
-  }
-}
-
-// Write the program, run it detached, read the report back, and leave only the header files and
-// the report the next mint reuses.
-export async function mintInBox(box, recipes, target) {
-  if (!(await box.write(IDENTITY_PATH, identityScript(recipes, target)))) return null;
-  await box.run("bl-identities", `python3 ${IDENTITY_PATH}`).catch(() => null);
-  const out = await box.exec(`cat ${IDENTITY_OUT} 2>/dev/null; rm -f ${IDENTITY_PATH}`).catch(() => "");
-  return parseIdentityReport(out);
-}