golem-kit 0.1.0 → 0.2.0

package/docs/local-cli.md

@@ -3,15 +3,17 @@
 Use Node.js >=22.18.0 (native TypeScript execution) and pnpm 10.28.2.
 Run `pnpm install`, then `./golem help`. The executable wrapper resolves the
 project-local CLI relative to itself, including when invoked from another directory.
-The browser shell uses the local Vite build and the published `golem-ui` package.
+The browser shell uses the local Vite build and the published `golem-ui` package. Before every
+command, the wrapper optionally loads the app-local `.env.local` using Node's standard dotenv-file
+support. Values already exported in the shell win; a missing file is ignored.
 
 ## Source resolution seam
 
-The root wrapper explicitly selects `src/cli.ts` relative to the wrapper's own
+The root wrapper explicitly selects `src/entry.mjs` relative to the wrapper's own
 directory. This is the sole CLI entrypoint resolution point today; there is no
-package-name lookup or resolution configuration. Generated app wrappers add an
-explicit `GOLEM_SOURCE=/path/to/golem` opt-in for running a framework checkout
-while keeping the app cwd. Unset it to use the installed pinned package.
+package-name lookup or resolution configuration. Generated app wrappers load `.env.local` before
+selecting `GOLEM_SOURCE`, so a local checkout can be selected while keeping the app cwd. An invalid
+source path fails clearly; unset it to use the installed pinned package.
 
 The CLI imports `./dev-server.ts` relative to the wrapper. The server serves built `dist/`
 files and does not resolve packages or depend on
@@ -23,19 +25,29 @@ boundary so a hot-source workflow can select the CLI without changing HTTP start
 | Command | Behavior | Exit status |
 | --- | --- | --- |
 | `./golem help` (or `./golem`) | List all commands | 0 |
-| `./golem dev` | Refresh the browser build, then serve it at `http://127.0.0.1:3000/` until SIGINT/SIGTERM | 0 on clean shutdown; 1 on startup failure |
+| `./golem dev` | Refresh the browser build, then serve it at the `golem.config.ts` address (default `http://127.0.0.1:3000/`) until SIGINT/SIGTERM | 0 on clean shutdown; 1 on startup failure |
 | `./golem build` | Build the browser shell into `dist/` | 0 |
+| `./golem lint` | Check the app's architecture rules with ESLint and `eslint.config.mjs` ([architecture guide](architecture.md)) | 0 clean; 1 violations or missing config |
 | `./golem doctor` | Report local shell and backend readiness | 0 |
 
 Unknown commands and extra arguments exit 2. Built assets are served directly; extensionless browser
 routes fall back to `index.html`, while missing assets return 404. Malformed URLs return 400. The
-server binds to loopback only. Port 3000 must be free.
+default server binds to loopback on port 3000. To use another local port or a
+specific tailnet address, export optional root settings from `golem.config.ts`:
+
+```ts
+export default { title: 'Golem', host: '100.64.0.10', port: 3000 }
+```
+
+`host` must be a nonempty string and `port` an integer from 1 through 65535.
+Configuration, build, and bind failures are printed by `./golem dev`. Restart
+the server after changing these settings.
 `doctor` succeeding means its report ran, not that the full product is ready.
 
-`src/dev-server.ts` exports `startDevServer(port = 3000)`, resolving to a listening
+`src/dev-server.ts` exports `startDevServer(port = 3000, backend, stateDirectory, host = '127.0.0.1')`, resolving to a listening
 Node HTTP server. It refreshes the browser build before listening; the CLI owns signal handling and output. `src/browser/app.tsx` is the
 composition boundary: anonymous identity and browser navigation are explicit host adapters, while
-the chat adapter connects explicit browser build-mode sessions to the local Codex runtime.
+the chat adapter connects explicit browser build-mode sessions to the chosen local Claude Code or Codex runtime.
 
 Check types with `pnpm exec tsc --noEmit`; run the CLI/HTTP smoke check with
 `node --test --test-concurrency=1 test/*.mjs` (serial because the CLI test intentionally removes
@@ -43,18 +55,22 @@ and rebuilds the shared `dist/` directory; requires port 3000).
 
 ## Generated projects
 
-`golem-kit init` creates `package.json`, `golem.config.ts`, `src/app.tsx`,
-`docs/domain.md`, and an executable `./golem`. Normal initialization writes the
-pinned npm dependency `golem-kit@<framework version>` and installs it with pnpm.
+`golem-kit init` creates `package.json`, `golem.config.ts`, `eslint.config.mjs`, `src/app.tsx`,
+`docs/domain.md` (the app's DNA template), small `AGENTS.md` and `CLAUDE.md` pointers to the
+installed framework guide, and an executable `./golem`. Normal initialization writes the
+pinned npm dependency `golem-kit@<framework version>` and installs it with pnpm, along with
+the exact `golem-ui` version golem-kit uses so app code can import its components directly.
 For local packed-tarball acceptance only, set `GOLEM_KIT_TARBALL=/path/to/golem-kit.tgz`.
 An existing package is supported only when it already declares `golem-kit`; its
-metadata is preserved. Other nonempty destinations are refused.
+metadata is preserved. It adds `.golem/` and `.env.local` to an existing `.gitignore` without
+removing its content. Other nonempty destinations are refused.
 
 Two-checkout development:
 
 ```sh
-GOLEM_SOURCE=/path/to/golem /path/to/app/golem build
-GOLEM_SOURCE=/path/to/golem /path/to/app/golem dev
+printf '%s\n' 'GOLEM_SOURCE=/path/to/golem' > /path/to/app/.env.local
+/path/to/app/golem build
+/path/to/app/golem dev
 ```
 
 The wrapper changes into the app first, so `src/` and `dist/` remain app-owned.

package/docs/source-development.md

@@ -7,6 +7,16 @@ deduplicating React with the Golem checkout. It also loads the UI checkout's ins
 `@tailwindcss/vite` plugin and adds the checkout as a Tailwind `@source`, so utility classes in
 edited UI components are compiled and scanned.
 
+## Pinned golem-ui
+
+The published `golem-ui@0.1.1` predates the `Brain` component and `ChatMessage.sources`. This
+checkout is developed against golem-ui commit `e26476d` (MNC-187 Shell chrome: the menu row, the
+settings dropdown, the chat toggle; `initialTab` is gone); until that ships as a package version, run
+with `GOLEM_UI_SOURCE` pointing at a checkout of it to get the Brain reader, the source chips, the
+slash-command picker, a chat-less normal mode, and the Brain, Admin and Builder controls. With 0.1.1
+installed the shell still builds with the old chrome and none of those controls, and the Brain panel
+says what is missing.
+
 ## Clean checkout
 
 ```sh
@@ -58,8 +68,29 @@ editing the isolated UI checkout. Ordinary source mode expects the normal Messag
 No package scripts or lockfiles need to change when switching modes. `golem-ui` itself uses Vite
 and its package build is `pnpm build`; source mode consumes its TypeScript entry point directly.
 
+## An app against the checkouts
+
 For generated apps, `GOLEM_SOURCE=/path/to/golem /path/to/app/golem dev` opts into
 the framework checkout while preserving the app cwd and lockfile. Omit
 `GOLEM_SOURCE` to use the installed pinned `golem-kit`; combine it with
 `GOLEM_UI_SOURCE=/path/to/golem-ui` when developing both checkouts. Source-mode
 builds print each source path and short git revision.
+
+Source mode covers the app's own code too, not only the shell's. An app that imports
+`golem-kit/server` in `src/server/index.ts`, `golem-kit/client` or `golem-ui` in `src/app.tsx`
+resolves those imports from the checkouts, in all three places the app's code is read:
+
+- the **app typecheck** (`tsc` over `src/app.tsx`, `golem.config.ts` and `src/server/index.ts`),
+  through a generated tsconfig whose `paths` point at the checkouts;
+- the **browser bundle**, through Vite aliases;
+- the **app server bundle**, where `golem-kit/server` resolves to the checkout's file and stays
+  external, so the app and the running server share one module instance.
+
+Nothing is written into the app folder and `node_modules` is never edited: the app keeps the
+published `golem-kit` and `golem-ui` it installed, and drops back to them the moment the
+variables are absent. `golem-ui` is read from its `src/`, so its checkout needs no `pnpm build`.
+
+An exported `GOLEM_SOURCE` also decides which `entry.mjs` the app's `./golem` script launches, so
+source mode works even when the installed `golem-kit` is older than the checkout. `GOLEM_SOURCE`
+set in `.env.local` is read by node instead, which needs the installed `golem-kit` to be recent
+enough to have `src/entry.mjs`.

package/index.html

@@ -4,6 +4,15 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>Golem</title>
+    <!-- Theme before first paint: the Shell sets it again in an effect, too late to stop a white frame on reload.
+         Same key and default as the Shell: the saved choice, else the OS. -->
+    <script>
+      try { document.documentElement.dataset.golemTheme = localStorage.getItem('golem-shell-theme') ?? (matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light') } catch { document.documentElement.dataset.golemTheme = 'light' }
+    </script>
+    <style>
+      html { background: #f4f6f9; color-scheme: light; }
+      html[data-golem-theme='dark'] { background: #0e131a; color-scheme: dark; } /* golem-ui Shell: --chat-bg */
+    </style>
   </head>
   <body>
     <div id="root"></div>

package/package.json

@@ -1,12 +1,25 @@
 {
   "name": "golem-kit",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Starter kit and local CLI for Golem applications.",
   "type": "module",
+  "exports": {
+    "./client": "./src/client.ts",
+    "./eslint": "./src/eslint.mjs",
+    "./operations": "./src/operations.ts",
+    "./server": "./src/backend/index.ts",
+    "./*": "./*"
+  },
   "files": [
+    "CHANGELOG.md",
     "README.md",
     "assets/golem-mascot.png",
     "docs/local-cli.md",
+    "docs/architecture.md",
+    "docs/builder.md",
+    "docs/app-backend.md",
+    "docs/knowledge.md",
+    "docs/agents.md",
     "docs/source-development.md",
     "golem.config.ts",
     "index.html",
@@ -34,15 +47,21 @@
     "test": "node --test --test-concurrency=1 test/*.test.mjs"
   },
   "dependencies": {
+    "@anthropic-ai/sdk": "0.127.0",
+    "@babel/core": "8.0.6",
+    "@babel/eslint-parser": "8.0.6",
     "@types/node": "22.20.3",
     "@types/react": "19.2.2",
     "@types/react-dom": "19.2.1",
     "@vitejs/plugin-react": "5.0.4",
+    "croner": "10.0.1",
+    "eslint": "10.11.0",
+    "golem-ui": "0.2.0",
+    "react": "19.2.0",
+    "react-dom": "19.2.0",
+    "tsx": "4.23.13",
     "typescript": "7.0.2",
     "vite": "7.1.9",
-    "tsx": "4.23.13",
-    "golem-ui": "0.1.1",
-    "react": "19.2.0",
-    "react-dom": "19.2.0"
+    "zod": "4.6.5"
   }
 }

package/src/backend/accounts.ts

@@ -0,0 +1,287 @@
+import { createHash, randomBytes, scrypt, timingSafeEqual } from 'node:crypto'
+import { EventEmitter } from 'node:events'
+import { isPlain, type AccountsConfig } from '../config.ts'
+import {
+  AppError, ForbiddenError, InvalidError, NotFoundError, RecordRefusedError, UnauthorizedError, validId, z,
+  type Principal, type RecordStore, type Row,
+} from '../operations.ts'
+
+/** Reserved collections: the builtin records operations refuse `_` names, and nothing here reaches the change stream. */
+export const ACCOUNTS = '_accounts'
+export const SESSIONS = '_sessions'
+export const INVITES = '_invites'
+
+const day = 86_400_000
+const sessionLifetime = 14 * day
+const inviteLifetime = 7 * day
+const maxFailures = 5
+const lockout = 15 * 60_000
+
+export type Member = { id: string; name: string; email: string; roles: string[]; groups: string[] }
+type Account = Row & Member & { password: string }
+type User = Extract<Principal, { kind: 'user' }>
+
+export class RateLimitedError extends AppError {
+  override name = 'RateLimitedError'
+  override status = 429
+}
+
+const email = z.string().trim().toLowerCase().min(3).max(254).refine((value) => value.includes('@'), 'must be an email address')
+const password = z.string().min(8, 'Use at least 8 characters.').max(256)
+const group = z.string().regex(/^[A-Za-z0-9_.-]{1,64}$/)
+export const inputs = {
+  signIn: z.object({ email, password: z.string().max(256) }),
+  signUp: z.object({ name: z.string().trim().min(1).max(120), email, password, invite: z.string().max(128).optional() }),
+  invite: z.object({ role: z.string() }),
+  role: z.object({ role: z.string() }),
+  groups: z.object({ groups: z.array(group).max(64) }),
+}
+
+function parse<T>(schema: z.ZodType<T>, input: unknown): T {
+  const parsed = schema.safeParse(input)
+  if (!parsed.success) throw new InvalidError(z.prettifyError(parsed.error))
+  return parsed.data
+}
+
+/**
+ * Local accounts: scrypt password hashes, server-side sessions named by the SHA-256 of a random
+ * cookie token, single-use invites, and the principal every request and agent call acts as.
+ */
+export function createAccounts(records: RecordStore, config: AccountsConfig) {
+  /** Emits `change` with an account id whenever its sessions, roles, groups or existence change. */
+  const changes = new EventEmitter().setMaxListeners(0)
+  const failures = new Map<string, { count: number; until: number }>()
+  // Sign-up checks the email, claims the invite and creates the account as one step, one at a time.
+  let signingUp: Promise<unknown> = Promise.resolve()
+  const managing = new Set(config.roles.filter((role) => role.manages).map((role) => role.id))
+  const roleIds = new Set(config.roles.map((role) => role.id))
+  const digest = (token: string) => createHash('sha256').update(token).digest('base64url')
+  const manages = (principal: Principal) => principal.kind === 'user' && principal.roles.some((role) => managing.has(role))
+  const member = ({ id, name, email, roles, groups }: Account): Member => ({ id, name, email, roles, groups })
+  const user = (account: Account, session?: string): User => ({ kind: 'user', id: account.id, name: account.name, roles: account.roles, groups: account.groups, ...(session ? { session } : {}) })
+
+  async function all(): Promise<Account[]> {
+    const found: Account[] = []
+    let cursor: string | null = null
+    do {
+      const page: Awaited<ReturnType<RecordStore['list']>> = await records.list(ACCOUNTS, { cursor, limit: 500 })
+      found.push(...page.rows as Account[])
+      cursor = page.nextCursor
+    } while (cursor)
+    return found
+  }
+
+  /** The live session with this id and its account, or nothing once it is signed out, expired or its account removed. */
+  async function live(sessionId: string): Promise<{ session: Row; account: Account } | undefined> {
+    if (!/^[A-Za-z0-9_-]{43}$/.test(sessionId)) return undefined
+    const session = await records.get(SESSIONS, sessionId)
+    if (!session) return undefined
+    if (Date.parse(String(session.expiresAt)) <= Date.now()) {
+      await records.remove(SESSIONS, session.id).catch(() => {})
+      return undefined
+    }
+    const account = await records.get(ACCOUNTS, String(session.userId)) as Account | null
+    return account ? { session, account } : undefined
+  }
+
+  async function startSession(account: Account): Promise<{ user: Member; token: string }> {
+    const token = randomBytes(32).toString('base64url')
+    await records.create(SESSIONS, { id: digest(token), userId: account.id, expiresAt: new Date(Date.now() + sessionLifetime).toISOString() })
+    return { user: member(account), token }
+  }
+
+  function requireManager(actor: Principal): void {
+    if (actor.kind !== 'user') throw new UnauthorizedError('Sign in first.')
+    if (!manages(actor)) throw new ForbiddenError('Only an admin can manage members.')
+  }
+
+  async function target(id: string): Promise<Account> {
+    const account = await records.get(ACCOUNTS, validId(id)) as Account | null
+    if (!account) throw new NotFoundError('That member no longer exists.')
+    return account
+  }
+
+  async function keepsAManager(changed: Account, roles: string[] | null): Promise<void> {
+    if (!changed.roles.some((role) => managing.has(role)) || roles?.some((role) => managing.has(role))) return
+    const managers = (await all()).filter((account) => account.roles.some((role) => managing.has(role)))
+    if (managers.length <= 1) throw new RecordRefusedError('Keep at least one member who manages accounts.')
+  }
+
+  function throttle(keys: string[]): void {
+    const now = Date.now()
+    for (const [key, entry] of failures) if (entry.until <= now) failures.delete(key)
+    if (keys.some((key) => (failures.get(key)?.count ?? 0) >= maxFailures)) throw new RateLimitedError('Too many attempts. Try again in 15 minutes.')
+  }
+
+  function fail(keys: string[]): void {
+    for (const key of keys) {
+      const entry = failures.get(key) ?? { count: 0, until: 0 }
+      failures.set(key, { count: entry.count + 1, until: Date.now() + lockout })
+    }
+  }
+
+  /** For server-owned work that acts for an account (a scheduled job): its current roles and groups, no session. */
+  async function resolveAccount(id: string): Promise<User> {
+    const account = await records.get(ACCOUNTS, validId(id)) as Account | null
+    if (!account) throw new ForbiddenError(`Account ${id} no longer exists`)
+    return user(account)
+  }
+
+  async function createAccount(name: string, email: string, hashed: string, invite: string | undefined): Promise<Account> {
+    if ((await records.list(ACCOUNTS, { filter: { email }, limit: 1 })).rows.length) throw new InvalidError('That email already has an account. Sign in instead.')
+    // Without an invite, only a role that neither manages nor builds, whatever the role order.
+    let role = config.roles.find(isPlain)?.id
+    if (invite) {
+      const found = /^[A-Za-z0-9_-]{43}$/.test(invite) ? await records.get(INVITES, digest(invite)) : null
+      if (!found || Date.parse(String(found.expiresAt)) <= Date.now()) throw new InvalidError('That invite link has expired or was already used.')
+      // Removing first claims the invite: a second sign-up on the same link finds it gone.
+      await records.remove(INVITES, found.id).catch(() => { throw new InvalidError('That invite link has expired or was already used.') })
+      role = String(found.role)
+    } else if (!config.allowSignUp || !role) {
+      throw new ForbiddenError('This app is invite-only. Ask an admin for an invite link.')
+    }
+    return await records.create(ACCOUNTS, { email, name, password: hashed, roles: [role], groups: [] }) as Account
+  }
+
+  async function mintInvite(role: string, origin: string, lifetime: number): Promise<string> {
+    if (!roleIds.has(role)) throw new InvalidError(`Unknown role: ${role}`)
+    const token = randomBytes(32).toString('base64url')
+    await records.create(INVITES, { id: digest(token), role, expiresAt: new Date(Date.now() + lifetime).toISOString() })
+    return `${origin}/?invite=${token}`
+  }
+
+  return {
+    config,
+    changes,
+    manages,
+    /** Build access is its own permission: a managing role or the `builder` role. */
+    canBuild: (principal: Principal) => manages(principal) || (principal.kind === 'user' && principal.roles.includes('builder')),
+
+    /** The principal behind a session cookie token; anonymous when there is none or it is no longer live. */
+    async fromToken(token: string | undefined): Promise<Principal> {
+      const found = token ? await live(digest(token)) : undefined
+      return found ? user(found.account, found.session.id) : { kind: 'anonymous' }
+    },
+
+    /**
+     * Re-reads a principal from stored accounts before trusted work runs. A session-bound principal
+     * stays valid only while that session is live; a signed-in identity never degrades to anonymous.
+     */
+    async refresh(principal: Principal): Promise<Principal> {
+      if (principal.kind !== 'user') return principal
+      if (!principal.session) return resolveAccount(principal.id)
+      const found = await live(principal.session)
+      if (!found || found.account.id !== principal.id) throw new UnauthorizedError('This session has ended. Sign in again.')
+      return user(found.account, found.session.id)
+    },
+
+    resolveAccount,
+
+    /** True while any live session of this account exists. */
+    async signedIn(id: string): Promise<boolean> {
+      const sessions = await records.list(SESSIONS, { filter: { userId: id }, limit: 500 })
+      return sessions.rows.some((session) => Date.parse(String(session.expiresAt)) > Date.now())
+    },
+
+    async me(principal: Principal): Promise<Member | null> {
+      if (principal.kind !== 'user') return null
+      const account = await records.get(ACCOUNTS, principal.id) as Account | null
+      return account ? member(account) : null
+    },
+
+    async signIn(input: unknown, client: string): Promise<{ user: Member; token: string }> {
+      const { email, password } = parse(inputs.signIn, input)
+      const keys = [`email:${email}`, `client:${client}`]
+      throttle(keys)
+      const account = (await records.list(ACCOUNTS, { filter: { email }, limit: 1 })).rows[0] as Account | undefined
+      // Hash even for an unknown address so timing does not reveal which addresses have accounts.
+      if (!(await verify(password, account?.password ?? unknownAccount))) {
+        fail(keys)
+        throw new InvalidError('That email or password is not right.')
+      }
+      failures.delete(keys[0])
+      return startSession(account!)
+    },
+
+    async signUp(input: unknown): Promise<{ user: Member; token: string }> {
+      const { name, email, password, invite } = parse(inputs.signUp, input)
+      const hashed = await hash(password)
+      const step = signingUp.then(() => createAccount(name, email, hashed, invite))
+      signingUp = step.catch(() => {})
+      return startSession(await step)
+    },
+
+    async signOut(principal: Principal): Promise<void> {
+      if (principal.kind !== 'user' || !principal.session) return
+      await records.remove(SESSIONS, principal.session).catch(() => {})
+      changes.emit('change', principal.id)
+    },
+
+    async members(actor: Principal): Promise<Member[]> {
+      requireManager(actor)
+      return (await all()).map(member)
+    },
+
+    async invite(actor: Principal, input: unknown, origin: string): Promise<string> {
+      requireManager(actor)
+      return mintInvite(parse(inputs.invite, input).role, origin, inviteLifetime)
+    },
+
+    async setRole(actor: Principal, id: string, input: unknown): Promise<void> {
+      requireManager(actor)
+      const { role } = parse(inputs.role, input)
+      if (!roleIds.has(role)) throw new InvalidError(`Unknown role: ${role}`)
+      const account = await target(id)
+      await keepsAManager(account, [role])
+      await records.update(ACCOUNTS, account.id, { roles: [role] })
+      changes.emit('change', account.id)
+    },
+
+    async setGroups(actor: Principal, id: string, input: unknown): Promise<void> {
+      requireManager(actor)
+      const account = await target(id)
+      await records.update(ACCOUNTS, account.id, { groups: [...new Set(parse(inputs.groups, input).groups)] })
+      changes.emit('change', account.id)
+    },
+
+    async remove(actor: Principal, id: string): Promise<void> {
+      requireManager(actor)
+      const account = await target(id)
+      await keepsAManager(account, null)
+      const sessions = await records.list(SESSIONS, { filter: { userId: account.id }, limit: 500 })
+      for (const session of sessions.rows) await records.remove(SESSIONS, session.id).catch(() => {})
+      await records.remove(ACCOUNTS, account.id)
+      changes.emit('change', account.id)
+    },
+
+    /**
+     * A one-use invite for the first managing role, for the terminal that starts the server:
+     * only while no account exists at all, or when the operator explicitly asks for recovery.
+     */
+    async managerInvite(origin: string, recover: boolean): Promise<string | undefined> {
+      if (!recover && (await records.list(ACCOUNTS, { limit: 1 })).rows.length) return undefined
+      return mintInvite(config.roles.find((role) => role.manages)!.id, origin, day)
+    },
+  }
+}
+
+export type Accounts = ReturnType<typeof createAccounts>
+
+const keyLength = 64
+const derive = (secret: string, salt: Buffer) => new Promise<Buffer>((resolve, reject) => scrypt(secret, salt, keyLength, (error, key) => error ? reject(error) : resolve(key)))
+
+async function hash(secret: string): Promise<string> {
+  const salt = randomBytes(16)
+  return `scrypt$${salt.toString('base64')}$${(await derive(secret, salt)).toString('base64')}`
+}
+
+async function verify(secret: string, stored: string): Promise<boolean> {
+  const [scheme, salt, expected] = stored.split('$')
+  if (scheme !== 'scrypt' || !salt || !expected) return false
+  const actual = await derive(secret, Buffer.from(salt, 'base64'))
+  const wanted = Buffer.from(expected, 'base64')
+  return actual.length === wanted.length && timingSafeEqual(actual, wanted) && stored !== unknownAccount
+}
+
+// A well-formed hash no password matches; the last check in verify() refuses it outright.
+const unknownAccount = `scrypt$${randomBytes(16).toString('base64')}$${randomBytes(keyLength).toString('base64')}`