cortad 0.3.11 → 0.4.0

package/lib/keeping.mjs

@@ -1,181 +0,0 @@
-// What one session keeps out of the run's way and brings up for it: the app's database files and
-// servers, copied before it starts (lib/data.mjs, lib/stores.mjs), and the stores and services it
-// reaches, started when nothing answers there (lib/backing.mjs). Every sentence goes to the terminal
-// and to the run: the copies made through lines(), and each store with none through blocked().
-import { createHash } from "node:crypto";
-import { localAddresses, makeBacking, tcpOpen } from "./backing.mjs";
-import { keepData } from "./data.mjs";
-import { bypassedOf, isStorePort, onThisMachine, storeId, storeKeeper, storesOf, unnamedHeld } from "./stores.mjs";
-
-// A line that opens with a setting's name keeps its case: "nEXT_PUBLIC_SUPABASE_URL" was printed.
-const lower = (line) => (/^[A-Z][A-Z0-9_]/.test(line) ? line : line.charAt(0).toLowerCase() + line.slice(1));
-// A store at a network address; a socket path, or no host at all, is Postgres's own socket.
-const addressed = (s) => Boolean(s.host) && !s.host.startsWith("/") && Boolean(s.port);
-// One nothing answers at is left for later: trials cannot write into it.
-const isDown = async (s) => addressed(s) && !(await tcpOpen(s.host, s.port));
-// The stores the settings name on this machine, as ports to bring up; a compose image may serve them.
-const localStores = (k) => k.named.filter((s) => addressed(s) && onThisMachine(s.host)).map((s) => ({ port: s.port, names: s.names, store: true }));
-// The API keeps eight stores that hold Run. Past that, the rest travel as one row, and a yes to that
-// row is a yes to each of them; a row more changes its id, so an old yes no longer covers it.
-const BLOCKED_MAX = 8;
-const overflow = (blocked) => blocked.slice(BLOCKED_MAX - 1);
-// How a service on this machine that answers nothing is named to the API: by its port, never an address.
-const downId = (port) => createHash("sha256").update(`down:${port}`).digest("hex").slice(0, 16);
-const overflowId = (rest) => createHash("sha256").update(rest.map((b) => b.id).join()).digest("hex").slice(0, 16);
-function blockedRows(blocked) {
-  const rows = blocked.map(({ port: _port, ...b }) => ({ ...b, why: b.why.slice(0, 400) }));
-  if (rows.length <= BLOCKED_MAX) return rows;
-  const rest = overflow(rows);
-  const names = [...new Set(rest.flatMap((b) => b.names))].slice(0, 8);
-  return [...rows.slice(0, BLOCKED_MAX - 1), { id: overflowId(rest), names, why: `These ${rest.length} stores hold Run too. ${rest[0].why}`.slice(0, 400) }];
-}
-
-// settings(): the environment the app starts with, the env file each name came from, the app's
-// folder and its source files. launch(plan): a service of the repository started the way the app
-// is. connections(): what the hook saw the app reach. hold(): the run's requests wait from here until
-// the caller has the app on the copies made, since until then it still writes into the originals.
-// `typed`: the person gave the start command. It is run as it is, with the settings and the stores
-// that command gives the app: a legal research API typed ENV=staging and was started on copies of
-// the test databases its default settings file names, where its library is empty.
-// `chosen`: the store settings of the file the person chose for the run (--data). Those stores are
-// the ones copied, and the app is handed all of those settings, so it reaches the server they name.
-const AS_TYPED = "Your app is started with your own command as it is, on the databases that command gives it. Nothing is copied: a run writes into them once you say yes to each on the card.";
-export function makeKeeping({ root, work, ledgerFile, onPath, say, settings, launch, connections, copies = () => [], hold = () => {}, typed = false, chosen = {} }) {
-  let pending = null;
-  let now = null;
-  let backing = null;
-  let backedUp = false;
-  let seen = 0;
-  const tell = (lines) => { for (const line of lines) say(lower(line)); };
-  const held = (blocked) => tell(blocked.map((b) => `One question for the person on the card in the browser: ${lower(b.why)}`));
-
-  async function keepAll(started) {
-    const { values, from, appDir, sources } = settings();
-    // Which stores a typed command gives the app is its own: only those chosen for the run are copied,
-    // and each other store it reaches holds Run once the hook sees it (watch). A store it reaches for
-    // and finds nothing at is still brought up: a session that ended stopped the ones it had started,
-    // and the app started next with its own command met "connection refused".
-    const disk = typed ? { env: {}, said: Object.keys(chosen).length ? [] : [AS_TYPED], held: [], values: chosen } : keepData({ values, from, appDir, root, work, sources, started });
-    const stores = storesOf(disk.values);
-    const keeper = storeKeeper({ ledgerFile, values: disk.values, dirs: [...new Set([appDir, root])] });
-    const got = await keeper.keep(stores, { started, down: isDown });
-    backing ??= makeBacking({ root, appDir, values: typed ? values : disk.values, onPath, ledgerFile, launch, adopt: started });
-    now = { env: { ...chosen, ...disk.env, ...got.env }, notes: [...disk.said, ...got.copies], blocked: [...disk.held, ...got.blocked], pass: got.pass, stores, named: stores, keeper, values: disk.values, started };
-    tell(now.notes);
-    held(now.blocked);
-    return now;
-  }
-  // A read that failed is tried again on the next ask, never handed back as the same failure.
-  const once = (started) => (pending ??= keepAll(started).catch((e) => { pending = null; throw e; }));
-  // The store ids the person's yes covers: a yes to the row the rest travel as is a yes to each.
-  const yesOf = (stores) => {
-    const yes = new Set(stores);
-    const rest = now && now.blocked.length > BLOCKED_MAX ? overflow(now.blocked) : [];
-    if (rest.length && yes.has(overflowId(rest))) for (const b of rest) yes.add(b.id);
-    return yes;
-  };
-
-  // Brings up what is wanted, copies each store that now answers, and says both.
-  async function bringUp(wants) {
-    const k = await once(true);
-    hold();
-    const up = await backing.up(wants);
-    const got = await k.keeper.keep(k.stores, { started: k.started, down: isDown });
-    Object.assign(k.env, got.env);
-    // Said once: every look brings the same lines back, and status printed one hold four times.
-    k.notes.push(...[...up.lines, ...got.copies].filter((l) => !k.notes.includes(l)));
-    // A service a setting names that answers nothing holds Run until it does; one that answers now
-    // lets go. ai-appointment-setter's only free run played with its knowledge base down.
-    const checked = new Set(wants.map((w) => w.port));
-    const stillDown = new Set(up.down.map((d) => d.port));
-    for (let i = k.blocked.length - 1; i >= 0; i--) if (k.blocked[i].down && checked.has(k.blocked[i].port) && !stillDown.has(k.blocked[i].port)) k.blocked.splice(i, 1);
-    for (const d of up.down) if (!k.blocked.some((b) => b.down && b.port === d.port)) k.blocked.push({ id: downId(d.port), names: d.names, why: d.why, down: true, port: d.port });
-    k.blocked.push(...got.blocked.filter((b) => !k.blocked.some((x) => x.id === b.id)));
-    k.pass.push(...got.pass);
-    const said = [...up.lines, ...got.copies];
-    tell(said);
-    held(got.blocked);
-    return { changed: said.length > 0 || got.blocked.length > 0, came: up.ports.length > 0, copied: Object.keys(got.env).length > 0 };
-  }
-  // Ports on this machine the hook saw the app reach. A compose image serves only a store's port: a
-  // model server behind a compose file is gigabytes nobody asked for.
-  const reached = (appPort) => connections().filter((c) => onThisMachine(c.host) && c.port !== appPort).map((c) => ({ port: c.port, store: isStorePort(c.port) }));
-
-  return {
-    // The settings the app starts with: the copies it runs against.
-    env: async (started) => (await once(started)).env,
-    // The copies so far, for a service of the repository started beside the app.
-    envNow: () => now?.env ?? {},
-    // The copies trials write into; the API keeps eight sentences of 400 characters.
-    lines: async (started) => (await once(started)).notes.map((l) => l.slice(0, 400)).slice(0, 8),
-    // The stores no copy could be made of: each holds Run until the person says yes.
-    blocked: async (started) => blockedRows((await once(started)).blocked),
-    // The hosts a trial's writes may reach: the copies made off this machine, and the hosts and
-    // stores the person said yes to (setup.consent). Before the copies are made, or after the app
-    // was attached to instead, only the hosts.
-    outbound: ({ hosts = [], stores = [] } = {}) => {
-      if (!now) return [...new Set(hosts)];
-      const yes = yesOf(stores);
-      return [...new Set([...hosts, ...now.pass, ...now.stores.filter((s) => yes.has(storeId(s)) && !onThisMachine(s.host)).map((s) => String(s.host).toLowerCase())])];
-    },
-    // The stores with no copy the person has not said yes to writing into. A service that is down
-    // holds Run too, but nothing can be written into it.
-    holding: ({ stores = [] } = {}) => {
-      const yes = yesOf(stores);
-      return now?.blocked.filter((b) => !b.down && !yes.has(b.id)) ?? [];
-    },
-    // The app stopped before it answered: each store its settings name and each port it reached that
-    // is down is brought up, once. True when the app is worth starting again.
-    async backUp(appPort) {
-      if (backedUp) return false;
-      backedUp = true;
-      const k = await once(true);
-      const got = await bringUp([...localStores(k), ...reached(appPort)]);
-      return got.came || got.copied;
-    },
-    // The app answers: each store and service its settings name on this machine that nothing
-    // answers at is brought up, since an app that connects on first use starts without them.
-    // `copied` says the app has copies it was not started on.
-    async services(appPort) {
-      const k = await once(true);
-      return bringUp([...localStores(k), ...localAddresses(k.values)].filter((a) => a.port !== appPort));
-    },
-    // What the app reached since the last look. A live store no setting names is said, what is down
-    // is brought up, and `copied` says the app has copies it was not started on.
-    async watch(appPort) {
-      const conns = connections();
-      // A service that held Run and answers now lets go without a reconnect: the person started
-      // Supabase, and the hold stood until they disconnected and connected again.
-      const heldDown = now?.blocked.filter((b) => b.down) ?? [];
-      const cameUp = [];
-      for (const b of heldDown) if (await tcpOpen("127.0.0.1", b.port)) cameUp.push({ port: b.port, names: b.names });
-      if (cameUp.length) { const got = await bringUp(cameUp); if (!pending || conns.length === seen) return { changed: true, copied: got.copied }; }
-      if (!pending || conns.length === seen) return { changed: false, copied: false };
-      seen = conns.length;
-      const k = await pending;
-      const live = [];
-      for (const c of conns) if (!onThisMachine(c.host) || (await tcpOpen(c.host, c.port))) live.push(c);
-      const bypassed = [...bypassedOf(live, k.stores, k.blocked), ...unnamedHeld(live, k.stores, k.blocked)];
-      k.blocked.push(...bypassed);
-      held(bypassed);
-      const got = await bringUp(reached(appPort));
-      return { changed: bypassed.length > 0 || got.changed, copied: got.copied };
-    },
-    // An app attached to instead of started keeps its own connections: its copies are of no use.
-    async forget() {
-      const k = await pending;
-      pending = null;
-      now = null;
-      await k?.keeper.dropCopies(copies(), k.stores).catch(() => {});
-      await k?.keeper.drop();
-    },
-    // Once the app has stopped: a copy is dropped when nothing holds it open, and a store is stopped
-    // only after its copy is gone.
-    async close() {
-      const k = await pending?.catch(() => null);
-      await k?.keeper.dropCopies(copies(), k.stores).catch(() => {});
-      await k?.keeper.drop().catch(() => {});
-      await backing?.stop().catch(() => {});
-    },
-  };
-}

package/lib/ledger.mjs

@@ -1,20 +0,0 @@
-// What this command made on the person's machine and has not yet undone: a database copied, a
-// service started. Kept in the project's folder under ~/.cortad, so a session that died (a killed
-// terminal, a closed lid) is undone by the next one. Rows name what was made, never an address or
-// a password.
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname } from "node:path";
-
-const alive = (pid) => { try { process.kill(pid, 0); return true; } catch (e) { return e.code !== "ESRCH"; } };
-
-export function ledger(file) {
-  const read = () => { try { const rows = JSON.parse(readFileSync(file, "utf8")); return Array.isArray(rows) ? rows : []; } catch { return []; } };
-  const write = (rows) => { try { mkdirSync(dirname(file), { recursive: true, mode: 0o700 }); writeFileSync(file, JSON.stringify(rows), { mode: 0o600 }); } catch { /* undone by hand then */ } };
-  const same = (a, b) => a.kind === b.kind && a.key === b.key && a.made === b.made;
-  return {
-    add: (row) => write([...read().filter((r) => !same(r, row)), { ...row, pid: process.pid }]),
-    remove: (row) => write(read().filter((r) => !same(r, row))),
-    // Rows of `kind` whose session has ended.
-    orphans: (kind) => read().filter((r) => r.kind === kind && !alive(r.pid)),
-  };
-}

package/lib/listing.mjs

@@ -1,12 +0,0 @@
-// Where a provider key is asked for its model listing: the base URL their app is pointed at, when
-// their env sets one beside the key (OPENAI_BASE_URL beside OPENAI_API_KEY), else the provider's own
-// host. A Fireworks key under OPENAI_API_KEY is refused by api.openai.com and works where it is sent.
-export function listingUrl(name, canonical, values) {
-  const prefix = name.replace(/_API_KEY$/, "");
-  const base = values[`${prefix}_BASE_URL`] || values[`${prefix}_API_BASE`];
-  if (!base) return canonical;
-  try {
-    const u = new URL(base);
-    return /^https?:$/.test(u.protocol) ? `${base.replace(/\/+$/, "")}/models` : canonical;
-  } catch { return canonical; }
-}

package/lib/mint.mjs

@@ -1,350 +0,0 @@
-// Signing in as the app's own callers, on the machine that holds its secrets. The cloud sends
-// recipes: names of env variables, routes and body fields, never a value and never code. They are
-// gated again here, the values are opened here, and what the app's own door issues is kept in a
-// folder only this user can read and wiped when the command exits. A request that should speak as
-// a role arrives carrying a marker; the real header is put in its place here, so neither a secret
-// nor a token ever leaves this machine.
-import { execFile } from "node:child_process";
-import { createHmac, createSign, randomBytes } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { basename, dirname, join } from "node:path";
-import { promisify } from "node:util";
-import { envCredentialRecipes, identityScript, parseIdentityReport } from "./identities.mjs";
-
-const exec = promisify(execFile);
-export const AS_HEADER = "x-cortad-as";
-const ROLE = /^[a-z][a-z0-9_-]{0,30}(?::[a-z][a-z0-9_-]{0,30})?$/;
-const slug = (role) => role.replace(/[^a-z0-9-]/g, "-");
-const TEST_UID = "brainsless-test-user";
-
-// The account each role signs in as, the same on every run from this folder: derived from a key that
-// never leaves this machine, so no server holds a password to any of their accounts.
-export function accountsFor(root, roles, keyFile = join(homedir(), ".cortad", "identity.key")) {
-  if (!existsSync(keyFile)) { mkdirSync(dirname(keyFile), { recursive: true, mode: 0o700 }); writeFileSync(keyFile, randomBytes(32), { mode: 0o600 }); }
-  const key = readFileSync(keyFile);
-  const mac = (what) => createHmac("sha256", key).update(`${what}\0${root}`).digest("base64url");
-  return Object.fromEntries(roles.filter((role) => ROLE.test(role)).map((role) => {
-    const username = `cortad-${slug(role)}-${mac(`name\0${role}`).replace(/[^a-z0-9]/gi, "").slice(0, 8).toLowerCase()}`;
-    return [role, { username, email: `${username}@example.invalid`, password: `${mac(`pw\0${role}`).slice(0, 24)}A1!`, name: `Cortad test ${role}` }];
-  }));
-}
-
-// Who this machine signs in as, whatever a recipe asks: an account made for the session, or a test
-// id that belongs to nobody. Never a person who already has an account, never an admin, and never a
-// key the app does not already hand to every browser. The recipes come from the cloud; these rules
-// are here, beside the secrets, so a recipe cannot talk its way past them.
-const ELEVATED = /admin|owner|super|root/i;
-const PUBLIC_NAME = /^(NEXT_PUBLIC_|VITE_|REACT_APP_|EXPO_PUBLIC_|NUXT_PUBLIC_|PUBLIC_|GATSBY_)/;
-const ACCOUNT_FIELD = /^(e-?mail|user(_?name)?|login|phone|account|identifier)$/i;
-const ID_CLAIM = /^(sub|id|uid|user_?id|userid)$/i;
-
-// Whether a value is already in the code the app ships: then every browser holds it, and sending it
-// as the caller's key tells the app nothing a visitor could not.
-function inSource(root, files, value) {
-  for (const rel of files) {
-    try { if (readFileSync(join(root, rel), "utf8").includes(value)) return true; } catch { /* gone */ }
-  }
-  return false;
-}
-
-export function refusal(recipe, env, shipped) {
-  if ([recipe?.role, ...(recipe?.roles ?? [])].some((r) => ELEVATED.test(String(r ?? "")))) return "an admin role; only an ordinary test account is signed in";
-  if (recipe?.kind === "jwt" && recipe.claim && !ID_CLAIM.test(recipe.claim)) return `a token field (${recipe.claim}) other than the user's id`;
-  if (recipe?.kind === "header") {
-    const names = recipe.env ?? [];
-    const value = names.map((n) => env[n]).find(Boolean);
-    if (value && !names.some((n) => PUBLIC_NAME.test(n)) && !shipped(value)) return `${names.join(" or ")} is a private key, never sent as a caller's own`;
-  }
-  for (const step of [...(recipe?.steps ?? []), ...(recipe?.alt ?? [])])
-    for (const [field, spec] of Object.entries(step?.body ?? {}))
-      if (ACCOUNT_FIELD.test(field) && String(spec).startsWith("env:")) return "an existing account from your environment; only a new test account is signed in";
-  return null;
-}
-
-export function readEnv(file) {
-  const out = {};
-  let text = "";
-  try { text = readFileSync(file, "utf8"); } catch { return out; }
-  for (const line of text.split("\n")) {
-    const m = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(line);
-    if (m) out[m[1]] = m[2].trim().replace(/^(['"])([\s\S]*)\1$/, "$2");
-  }
-  return out;
-}
-
-// The admin credential the app itself runs with, under the names projects really use.
-function serviceAccountOf(env) {
-  const parse = (s) => { try { const j = JSON.parse(s); return j?.private_key && j?.client_email ? j : null; } catch { return null; } };
-  for (const [name, value] of Object.entries(env)) {
-    if (!/SERVICE_ACCOUNT|FIREBASE_ADMIN|GOOGLE_CREDENTIALS/.test(name) || !value) continue;
-    const found = parse(value) ?? parse(Buffer.from(value, "base64").toString("utf8"));
-    if (found) return found;
-  }
-  if (env.GOOGLE_APPLICATION_CREDENTIALS) { try { const found = parse(readFileSync(env.GOOGLE_APPLICATION_CREDENTIALS, "utf8")); if (found) return found; } catch { /* not a file here */ } }
-  return env.FIREBASE_PRIVATE_KEY && env.FIREBASE_CLIENT_EMAIL ? { private_key: env.FIREBASE_PRIVATE_KEY.replace(/\\n/g, "\n"), client_email: env.FIREBASE_CLIENT_EMAIL } : null;
-}
-const webApiKeyOf = (envs) => envs.flatMap((env) => Object.entries(env)).find(([name, value]) => /FIREBASE\w*API_KEY$/.test(name) && /^AIza[\w-]{20,}$/.test(value))?.[1] ?? null;
-
-// A custom token signed with their own admin credential, exchanged at their own project for the ID
-// token their app verifies. The first exchange creates the test user in that project, by that uid.
-async function firebaseIdToken(account, apiKey) {
-  const now = Math.floor(Date.now() / 1000);
-  const part = (o) => Buffer.from(JSON.stringify(o)).toString("base64url");
-  const unsigned = `${part({ alg: "RS256", typ: "JWT" })}.${part({ iss: account.client_email, sub: account.client_email, aud: "https://identitytoolkit.googleapis.com/google.identity.identitytoolkit.v1.IdentityToolkit", iat: now, exp: now + 3600, uid: TEST_UID })}`;
-  const token = `${unsigned}.${createSign("RSA-SHA256").update(unsigned).sign(account.private_key).toString("base64url")}`;
-  const res = await fetch(`https://identitytoolkit.googleapis.com/v1/accounts:signInWithCustomToken?key=${apiKey}`, {
-    method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ token, returnSecureToken: true }), signal: AbortSignal.timeout(20_000),
-  });
-  const out = await res.json().catch(() => null);
-  return res.ok && out?.idToken ? { idToken: out.idToken } : { error: String(out?.error?.message ?? `status ${res.status}`).slice(0, 120) };
-}
-
-const LOOPBACK = new Set(["127.0.0.1", "localhost", "[::1]"]);
-// A server key goes only over TLS, or to a service on this machine (a local Supabase).
-function serviceOrigin(value) {
-  try { const u = new URL(value); return u.protocol === "https:" || (u.protocol === "http:" && LOOPBACK.has(u.hostname)) ? u.origin : null; } catch { return null; }
-}
-async function send(url, { method = "POST", headers = {}, body } = {}) {
-  const res = await fetch(url, { method, headers: { "content-type": "application/json", ...headers }, ...(body === undefined ? {} : { body: JSON.stringify(body) }), signal: AbortSignal.timeout(20_000) });
-  return { ok: res.ok, status: res.status, json: await res.json().catch(() => null) };
-}
-const saidBy = (r) => String(r.json?.errors?.[0]?.long_message ?? r.json?.msg ?? r.json?.error_description ?? r.json?.message ?? r.json?.error?.message ?? `status ${r.status}`).slice(0, 120);
-const refusedBy = (who, r) => ({ status: "refused", note: `${who} refused the test account: ${saidBy(r)}` });
-// An account the service already held may have been given a role since this machine made it.
-const ELEVATED_ACCOUNT = { status: "refused", note: "the test account carries an admin role; only an ordinary account is signed in" };
-const elevated = (...claims) => claims.some((c) => c && ELEVATED.test(JSON.stringify(c)));
-
-// Clerk's Backend API, in their development instance only: the account, a session for it, and the
-// session's token, which lives a minute and is minted again from the same session before it lapses.
-export async function clerkToken(env, account, session) {
-  const key = env.CLERK_SECRET_KEY;
-  if (!key) return { status: "absent", note: "no CLERK_SECRET_KEY in your environment" };
-  if (!key.startsWith("sk_test_")) return { status: "refused", note: "your CLERK_SECRET_KEY is a production key; test accounts are made only in a development instance" };
-  const origin = serviceOrigin(env.CLERK_API_URL || "https://api.clerk.com");
-  if (!origin) return { status: "refused", note: "CLERK_API_URL is not an https address" };
-  const api = `${origin}/v1`;
-  const auth = { authorization: `Bearer ${key}` };
-  const tokenOf = async (id) => (await send(`${api}/sessions/${encodeURIComponent(id)}/tokens`, { headers: auth })).json?.jwt;
-  const again = session && await tokenOf(session);
-  if (again) return { token: again, session };
-  // Clerk sends nothing to a +clerk_test address; it exists for exactly this.
-  const email = `${account.username}+clerk_test@example.com`;
-  const found = await send(`${api}/users?email_address=${encodeURIComponent(email)}`, { method: "GET", headers: auth });
-  let user = Array.isArray(found.json) ? found.json[0] : null;
-  if (!user) {
-    // No password: a session is made through this API, and an instance that signs in only by email
-    // code or OAuth refuses a user created with one.
-    const made = await send(`${api}/users`, { headers: auth, body: { email_address: [email], skip_password_requirement: true } });
-    if (!made.ok || !made.json?.id) return refusedBy("your Clerk instance", made);
-    user = made.json;
-  }
-  if (elevated(user.public_metadata, user.private_metadata)) return ELEVATED_ACCOUNT;
-  const opened = await send(`${api}/sessions`, { headers: auth, body: { user_id: user.id } });
-  if (!opened.ok || !opened.json?.id) return refusedBy("your Clerk instance", opened);
-  const token = await tokenOf(opened.json.id);
-  return token ? { token, session: opened.json.id } : { status: "refused", note: "your Clerk instance issued no session token" };
-}
-
-const SUPABASE_URL = /^(?:NEXT_PUBLIC_|VITE_|EXPO_PUBLIC_|PUBLIC_)?SUPABASE_URL$/;
-const SUPABASE_SERVICE = /^SUPABASE_(?:SERVICE_ROLE|SERVICE|SECRET)_KEY$/;
-const SUPABASE_PUBLIC = /^(?:NEXT_PUBLIC_|VITE_|EXPO_PUBLIC_|PUBLIC_)?SUPABASE_(?:ANON|PUBLISHABLE)(?:_DEFAULT)?_KEY$/;
-const named = (env, pattern) => Object.entries(env).find(([name, value]) => pattern.test(name) && value)?.[1] ?? null;
-
-// Supabase Auth's admin API makes the account already confirmed, with the service key their server
-// holds; a password sign-in then issues the session their own client would hold.
-export async function supabaseSession(env, account) {
-  const url = named(env, SUPABASE_URL);
-  const service = named(env, SUPABASE_SERVICE);
-  if (!url || !service) return { status: "absent", note: `no ${url ? "SUPABASE_SERVICE_ROLE_KEY" : "SUPABASE_URL"} in your environment` };
-  const origin = serviceOrigin(url);
-  if (!origin) return { status: "refused", note: "SUPABASE_URL is not an https address" };
-  const made = await send(`${origin}/auth/v1/admin/users`, { headers: { apikey: service, authorization: `Bearer ${service}` }, body: { email: account.email, password: account.password, email_confirm: true } });
-  if (!made.ok && !/already|exists|registered/i.test(saidBy(made))) return refusedBy("your Supabase project", made);
-  const got = await send(`${origin}/auth/v1/token?grant_type=password`, { headers: { apikey: named(env, SUPABASE_PUBLIC) ?? service }, body: { email: account.email, password: account.password } });
-  if (!got.ok || typeof got.json?.access_token !== "string") return refusedBy("your Supabase project", got);
-  if (elevated(got.json.user?.app_metadata, got.json.user?.role)) return ELEVATED_ACCOUNT;
-  return { session: got.json, origin };
-}
-
-// @supabase/ssr's own cookie: the session as base64url JSON under sb-<ref>-auth-token, cut into
-// numbered chunks past 3180 characters the way the library cuts it.
-export function supabaseCookie(origin, session) {
-  const name = `sb-${new URL(origin).hostname.split(".")[0]}-auth-token`;
-  const value = `base64-${Buffer.from(JSON.stringify(session)).toString("base64url")}`;
-  if (value.length <= 3180) return `${name}=${value}`;
-  return value.match(/.{1,3180}/g).map((part, i) => `${name}.${i}=${part}`).join("; ");
-}
-
-// The Auth emulator their app verifies against while FIREBASE_AUTH_EMULATOR_HOST is set: it signs up any
-// address under any key. The account is this machine's own test account, made once and signed in after.
-export async function emulatorToken(host, account) {
-  // An emulator runs beside the app on this machine, and the test account's password goes to it in
-  // plain http: never to another host.
-  if (!/^(?:localhost|127\.0\.0\.1|\[::1\]):\d{2,5}$/.test(host)) return { status: "refused", note: "FIREBASE_AUTH_EMULATOR_HOST does not name an emulator on this machine" };
-  const at = (verb) => `http://${host}/identitytoolkit.googleapis.com/v1/accounts:${verb}?key=cortad-test`;
-  const body = { email: account.email, password: account.password, returnSecureToken: true };
-  let got = await send(at("signUp"), { body });
-  if (!got.ok && /EMAIL_EXISTS/.test(saidBy(got))) got = await send(at("signInWithPassword"), { body });
-  if (!got.ok || typeof got.json?.idToken !== "string") return refusedBy("your Firebase Auth emulator", got);
-  return { idToken: got.json.idToken, ttl: Number(got.json.expiresIn) || 3600 };
-}
-
-// Each hosted service's sign-in, as the value the role's header carries and how long it holds.
-const SIGN_IN = new Map([
-  ["firebase", async ({ env, all, account }) => {
-    if (env.FIREBASE_AUTH_EMULATOR_HOST) {
-      const got = await emulatorToken(env.FIREBASE_AUTH_EMULATOR_HOST, account);
-      return got.idToken ? { value: `Bearer ${got.idToken}`, ttl: got.ttl, door: "your Firebase Auth emulator", said: "made a test account in your Firebase Auth emulator for the run to sign in with" } : got;
-    }
-    const admin = serviceAccountOf(env);
-    const apiKey = webApiKeyOf(all);
-    if (!admin || !apiKey) return { status: "absent", note: !admin ? "no Firebase admin credential in your environment" : "no Firebase web API key in your environment" };
-    const got = await firebaseIdToken(admin, apiKey);
-    if (!got.idToken) return { status: "refused", note: `your Firebase project refused the sign-in: ${got.error}` };
-    return { value: `Bearer ${got.idToken}`, ttl: 3600, door: "your Firebase project", said: `signed in to your app as a test user it can tell apart (${TEST_UID}, in your own Firebase project)` };
-  }],
-  ["clerk", async ({ env, account, session }) => {
-    const got = await clerkToken(env, account, session);
-    return got.token ? { value: `Bearer ${got.token}`, ttl: 60, session: got.session, door: "your Clerk development instance", said: "made a test account in your Clerk development instance for the run to sign in with" } : got;
-  }],
-  ["supabase-admin", async ({ env, account, header }) => {
-    const got = await supabaseSession(env, account);
-    if (!got.session) return got;
-    const s = got.session;
-    return {
-      value: header === "cookie" ? supabaseCookie(got.origin, s) : `Bearer ${s.access_token}`, secrets: [s.access_token, s.refresh_token],
-      ttl: Number(s.expires_in) || 3600, door: "your Supabase project", said: "made a test account in your Supabase project for the run to sign in with",
-    };
-  }],
-]);
-// Renewed this long after a sign-in: Clerk's token lives 60 s, Supabase's and Firebase's an hour.
-const RENEW_MS = { firebase: 50 * 60_000, clerk: 50_000, "supabase-admin": 55 * 60_000 };
-const PER_PERSON = new Set(["clerk", "supabase-admin"]);
-// A simulated person's own caller: the run sends `clerk:p1a2b3c4` for the person behind a trial.
-const PERSONA = /^([a-z][a-z0-9_-]{0,30}):p[0-9a-f]{8}$/;
-
-export function makeIdentities({ root, work, envFiles, sourceFiles = () => [], say, keepSecret, appDir = () => root }) {
-  const dir = join(work, "identities");
-  const headerFile = (role) => join(dir, `bl-identity-${slug(role)}.header`);
-  const hosted = new Map();
-  // The roles signed in on this machine so far, in the order they were: the connect command's own
-  // test requests ask as the first when an endpoint refuses a visitor.
-  const minted = new Set();
-  const envs = () => {
-    // The app's own folder first: in a monorepo the root's env file is not the backend's.
-    const homes = [appDir(), root];
-    const own = homes.flatMap((h) => [envFiles.find((f) => dirname(f) === h && basename(f) === ".env"), envFiles.find((f) => dirname(f) === h)]).find(Boolean) ?? envFiles[0];
-    return { path: own ?? join(root, ".env"), all: [process.env, ...envFiles.map(readEnv)] };
-  };
-  const merged = () => Object.assign({}, ...[...envs().all].reverse());
-  const keep = (role, header, value, secrets = []) => {
-    mkdirSync(dir, { recursive: true, mode: 0o700 });
-    writeFileSync(headerFile(role), `${header}: ${value}\n`, { mode: 0o600 });
-    for (const secret of [value.replace(/^Bearer\s+/i, ""), ...secrets]) keepSecret(secret);
-  };
-
-  // A hosted service's sign-in, kept on this machine and renewed through headerFor. Only the
-  // bearer or the cookie is ever filled, whatever header a recipe names.
-  async function signIn(row) {
-    const header = row.header === "cookie" ? "cookie" : "authorization";
-    const { all } = envs();
-    const got = await SIGN_IN.get(row.kind)({ env: merged(), all, header, account: accountsFor(root, [row.role])[row.role], session: hosted.get(row.role)?.session })
-      .catch((e) => ({ status: "unreachable", note: String(e?.message ?? e).slice(0, 120) }));
-    if (!got.value) return { ...row, status: got.status, note: got.note };
-    keep(row.role, header, got.value, got.secrets);
-    if (!hosted.has(row.role) && !PERSONA.test(row.role)) say(got.said);
-    hosted.set(row.role, { row: { ...row, header }, at: Date.now(), session: got.session });
-    return { ...row, header, status: "minted", door: got.door, expires: Math.floor(Date.now() / 1000) + got.ttl };
-  }
-
-  async function mint(body, port) {
-    let recipes = Array.isArray(body?.recipes) ? body.recipes.slice(0, 12) : [];
-    // On a refused first pass the raise asks again with this flag: sign in with the credential the
-    // app's own environment names, filling its sign-in form or a Basic header from that pair.
-    if (body?.envCreds) recipes = envCredentialRecipes(recipes, Object.keys(merged()), body.loginRoutes).slice(0, 12);
-    if (!recipes.length || !port) return { identities: [] };
-    mkdirSync(dir, { recursive: true, mode: 0o700 });
-    const out = join(dir, "bl-identities.json");
-    rmSync(out, { force: true });
-    // ponytail: the program is Python, as it is in the sandbox. A machine without python3 mints
-    // nothing and says so; port the program to this file if that turns out to be common.
-    // A caller a hosted service verifies is signed in at that service, below, a Firebase one at the
-    // Auth emulator when the app's settings name one: the program reads one env file and never saw an
-    // emulator named anywhere else, so a Python app verified by the emulator was knocked unsigned.
-    const env = merged();
-    const signsHere = (r) => SIGN_IN.has(r?.kind);
-    const refused = new Map();
-    // A pair the environment names for the app's own account is the one credential the raise is
-    // allowed to reuse: the elevation and existing-account guards do not apply to it.
-    for (const r of recipes) { const why = r?.envCred ? null : refusal(r, env, (value) => inSource(root, sourceFiles(), value)); if (why && typeof r?.role === "string") refused.set(r.role, why); }
-    const forProgram = recipes.filter((r) => !refused.has(r?.role) && !signsHere(r));
-    // The program signs in once per role value ("staff" as sales, support, marketing), each named
-    // role:value; an account made for "staff" alone was never the one it asked for.
-    const accounts = accountsFor(root, forProgram.flatMap((r) => (Array.isArray(r.roles) && r.roles.length ? r.roles.map((v) => `${r.role}:${v}`) : [r.role])));
-    const script = identityScript(forProgram, { envPath: envs().path, base: `http://127.0.0.1:${port}`, headers: body?.headers ?? {} }, accounts).split("/tmp/bl-identit").join(join(dir, "bl-identit"));
-    const file = join(dir, "mint.py");
-    writeFileSync(file, script, { mode: 0o600 });
-    const ran = forProgram.length ? await exec("python3", [file], { cwd: root, timeout: 115_000, maxBuffer: 1 << 20 }).then(() => true, (e) => e?.code !== "ENOENT") : true;
-    rmSync(file, { force: true });
-    const report = parseIdentityReport(existsSync(out) ? readFileSync(out, "utf8") : "");
-    const known = new Map((report?.identities ?? []).map((r) => [r.role, r]));
-    const rows = [];
-    for (const recipe of recipes) {
-      if (typeof recipe?.role !== "string" || !ROLE.test(recipe.role)) continue;
-      const blank = { role: recipe.role, kind: recipe.kind, header: recipe.header, opens: [], door: recipe.header, where: recipe.where };
-      if (refused.has(recipe.role)) { rows.push({ ...blank, status: "refused", note: refused.get(recipe.role) }); continue; }
-      if (signsHere(recipe)) { rows.push(await signIn({ ...blank, status: "upstream" })); continue; }
-      rows.push(known.get(recipe.role) ?? { ...blank, status: ran ? "unreachable" : "absent", ...(ran ? {} : { note: "python3 is not installed on this machine" }) });
-    }
-    for (const row of rows.filter((r) => r.status === "minted")) {
-      minted.add(row.role);
-      if (existsSync(headerFile(row.role))) keepSecret(readFileSync(headerFile(row.role), "utf8").split(": ").slice(1).join(": ").trim().replace(/^Bearer\s+/i, ""));
-    }
-    return { identities: rows };
-  }
-
-  // A hosted token renewed before it lapses, and a simulated person's own account signed in the
-  // first time that person speaks. One sign-in per role at a time: lanes asking together share it.
-  const renewing = new Map();
-  const tried = new Set();
-  const shared = new Set();
-  async function due(role) {
-    const held = hosted.get(role);
-    if (held) { if (Date.now() - held.at > RENEW_MS[held.row.kind]) await signIn(held.row); return; }
-    const owner = hosted.get(PERSONA.exec(role)?.[1]);
-    if (!owner || !PER_PERSON.has(owner.row.kind) || tried.has(role)) return;
-    tried.add(role);
-    const got = await signIn({ ...owner.row, role });
-    if (got.status !== "minted" && !shared.has(owner.row.role)) {
-      shared.add(owner.row.role);
-      say(`a simulated person's own test account could not be made (${got.note ?? got.status}), so that person signs in as the shared test account`);
-    }
-  }
-  const renewed = (role) => {
-    if (!renewing.has(role)) renewing.set(role, due(role).catch(() => null).finally(() => renewing.delete(role)));
-    return renewing.get(role);
-  };
-
-  // A token the app's door issued, or a credential that is itself one of their secrets (an admin
-  // key). In the sandbox the second never leaves the box; here it never leaves this machine, which
-  // is the same promise, because this is where the request is sent from.
-  function held(role) {
-    const file = [headerFile(role), headerFile(role).replace(/\.header$/, ".sealed")].find((f) => { try { return statSync(f).isFile(); } catch { return false; } });
-    if (!file) return null;
-    const line = readFileSync(file, "utf8").split("\n")[0] ?? "";
-    const at = line.indexOf(": ");
-    return at > 0 ? { name: line.slice(0, at).trim().toLowerCase(), value: line.slice(at + 2).trim() } : null;
-  }
-
-  // The header a role speaks with, or nothing. A person whose own account could not be made speaks
-  // as the role that person belongs to, the one account every trial used before.
-  async function headerFor(role) {
-    if (!ROLE.test(role)) return null;
-    await renewed(role);
-    const base = PERSONA.exec(role)?.[1];
-    return held(role) ?? (base ? held(base) : null);
-  }
-
-  return { mint, headerFor, roles: () => [...minted] };
-}