handoff-app 2.0.0-1 → 2.0.0-3

package/dist/registry/auth/rate-limits.js

@@ -0,0 +1,75 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.purgeExpiredAuthRateLimits = exports.clearAuthRateLimit = exports.consumeAuthRateLimit = exports.hashRateLimitIdentifier = void 0;
+const drizzle_orm_1 = require("drizzle-orm");
+const schema_1 = require("../db/schema");
+const crypto_1 = require("./crypto");
+const hashRateLimitIdentifier = (bucket, identifier) => (0, crypto_1.hashSecret)(`${bucket}:${identifier.trim().toLowerCase()}`);
+exports.hashRateLimitIdentifier = hashRateLimitIdentifier;
+/** Atomic fixed-window counter shared by all registry instances. */
+const consumeAuthRateLimit = (db, input) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    if (!Number.isInteger(input.limit) || input.limit < 1)
+        throw new Error('Rate-limit limit must be a positive integer.');
+    if (!Number.isInteger(input.windowMs) || input.windowMs < 1) {
+        throw new Error('Rate-limit windowMs must be a positive integer.');
+    }
+    const now = (_a = input.now) !== null && _a !== void 0 ? _a : new Date();
+    const windowStartedAt = new Date(Math.floor(now.getTime() / input.windowMs) * input.windowMs);
+    const resetsAt = new Date(windowStartedAt.getTime() + input.windowMs);
+    const identifierHash = (0, exports.hashRateLimitIdentifier)(input.bucket, input.identifier);
+    const [counter] = yield db
+        .insert(schema_1.registryAuthRateLimits)
+        .values({
+        bucket: input.bucket,
+        identifierHash,
+        windowStartedAt,
+        attempts: 1,
+        expiresAt: resetsAt,
+        updatedAt: now,
+    })
+        .onConflictDoUpdate({
+        target: [schema_1.registryAuthRateLimits.bucket, schema_1.registryAuthRateLimits.identifierHash, schema_1.registryAuthRateLimits.windowStartedAt],
+        set: {
+            attempts: (0, drizzle_orm_1.sql) `${schema_1.registryAuthRateLimits.attempts} + 1`,
+            expiresAt: resetsAt,
+            updatedAt: now,
+        },
+    })
+        .returning({ attempts: schema_1.registryAuthRateLimits.attempts });
+    const attempts = counter.attempts;
+    return {
+        allowed: attempts <= input.limit,
+        attempts,
+        limit: input.limit,
+        remaining: Math.max(0, input.limit - attempts),
+        resetsAt,
+        retryAfterSeconds: attempts > input.limit ? Math.max(1, Math.ceil((resetsAt.getTime() - now.getTime()) / 1000)) : 0,
+    };
+});
+exports.consumeAuthRateLimit = consumeAuthRateLimit;
+const clearAuthRateLimit = (db, bucket, identifier) => __awaiter(void 0, void 0, void 0, function* () {
+    const rows = yield db
+        .delete(schema_1.registryAuthRateLimits)
+        .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryAuthRateLimits.bucket, bucket), (0, drizzle_orm_1.eq)(schema_1.registryAuthRateLimits.identifierHash, (0, exports.hashRateLimitIdentifier)(bucket, identifier))))
+        .returning({ identifierHash: schema_1.registryAuthRateLimits.identifierHash });
+    return rows.length;
+});
+exports.clearAuthRateLimit = clearAuthRateLimit;
+const purgeExpiredAuthRateLimits = (db_1, ...args_1) => __awaiter(void 0, [db_1, ...args_1], void 0, function* (db, now = new Date()) {
+    const rows = yield db
+        .delete(schema_1.registryAuthRateLimits)
+        .where((0, drizzle_orm_1.lt)(schema_1.registryAuthRateLimits.expiresAt, now))
+        .returning({ identifierHash: schema_1.registryAuthRateLimits.identifierHash });
+    return rows.length;
+});
+exports.purgeExpiredAuthRateLimits = purgeExpiredAuthRateLimits;

package/dist/registry/auth/types.d.ts

@@ -0,0 +1,26 @@
+import type { RegistryAccessScope, RegistryUserRole, RegistryUserStatus } from '../db/schema';
+export type { RegistryAccessScope, RegistryUserRole, RegistryUserStatus };
+export declare const REGISTRY_READ_SCOPE: "registry:read";
+export declare const REGISTRY_WRITE_SCOPE: "registry:write";
+export interface RegistryUser {
+    id: string;
+    email: string;
+    name: string | null;
+    image: string | null;
+    role: RegistryUserRole;
+    status: RegistryUserStatus;
+    emailVerifiedAt: Date | null;
+    authVersion: number;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface RegistryPrincipal {
+    tokenId: string;
+    userId: string;
+    email: string;
+    name: string | null;
+    role: RegistryUserRole;
+    scopes: RegistryAccessScope[];
+}
+export declare const scopesForRegistryRole: (role: RegistryUserRole) => RegistryAccessScope[];
+export declare const registryPrincipalHasScope: (principal: RegistryPrincipal, scope: RegistryAccessScope) => boolean;

package/dist/registry/auth/types.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registryPrincipalHasScope = exports.scopesForRegistryRole = exports.REGISTRY_WRITE_SCOPE = exports.REGISTRY_READ_SCOPE = void 0;
+exports.REGISTRY_READ_SCOPE = 'registry:read';
+exports.REGISTRY_WRITE_SCOPE = 'registry:write';
+const scopesForRegistryRole = (role) => role === 'admin' ? [exports.REGISTRY_READ_SCOPE, exports.REGISTRY_WRITE_SCOPE] : [exports.REGISTRY_READ_SCOPE];
+exports.scopesForRegistryRole = scopesForRegistryRole;
+const registryPrincipalHasScope = (principal, scope) => principal.scopes.includes(scope);
+exports.registryPrincipalHasScope = registryPrincipalHasScope;

package/dist/registry/auth/user-record.d.ts

@@ -0,0 +1,13 @@
+import type { RegistryUser } from './types';
+export declare const toRegistryUser: (row: {
+    id: string;
+    email: string;
+    name: string | null;
+    image: string | null;
+    role: RegistryUser["role"];
+    status: RegistryUser["status"];
+    emailVerifiedAt: Date | null;
+    authVersion: number;
+    createdAt: Date;
+    updatedAt: Date;
+}) => RegistryUser;

package/dist/registry/auth/user-record.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toRegistryUser = void 0;
+const toRegistryUser = (row) => ({
+    id: row.id,
+    email: row.email,
+    name: row.name,
+    image: row.image,
+    role: row.role,
+    status: row.status,
+    emailVerifiedAt: row.emailVerifiedAt,
+    authVersion: row.authVersion,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+});
+exports.toRegistryUser = toRegistryUser;

package/dist/registry/auth/users.d.ts

@@ -0,0 +1,31 @@
+import type { RegistryDatabase } from '../db/client';
+import { type RegistryUserRole } from '../db/schema';
+import type { RegistryUser, RegistryUserStatus } from './types';
+export type RegistryUserMutationResult = {
+    ok: true;
+    user: RegistryUser;
+} | {
+    ok: false;
+    reason: 'not_found' | 'invalid_name' | 'invalid_image' | 'invalid_role' | 'last_admin' | 'self_deactivation' | 'invalid_status';
+};
+export declare const getRegistryUserById: (db: RegistryDatabase, userId: string) => Promise<RegistryUser | null>;
+export declare const listRegistryUsers: (db: RegistryDatabase) => Promise<RegistryUser[]>;
+/** Credentials authentication is intentionally enumeration-safe: all failures return null. */
+export declare const authenticateRegistryCredentials: (db: RegistryDatabase, email: string, password: string) => Promise<RegistryUser | null>;
+export declare const updateRegistryUserProfile: (db: RegistryDatabase, input: {
+    userId: string;
+    name: string;
+    image?: string | null;
+    now?: Date;
+}) => Promise<RegistryUserMutationResult>;
+export declare const updateRegistryUserRole: (db: RegistryDatabase, input: {
+    userId: string;
+    role: RegistryUserRole;
+    now?: Date;
+}) => Promise<RegistryUserMutationResult>;
+export declare const setRegistryUserStatus: (db: RegistryDatabase, input: {
+    userId: string;
+    status: Extract<RegistryUserStatus, "active" | "deactivated">;
+    actorUserId?: string;
+    now?: Date;
+}) => Promise<RegistryUserMutationResult>;

package/dist/registry/auth/users.js

@@ -0,0 +1,135 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setRegistryUserStatus = exports.updateRegistryUserRole = exports.updateRegistryUserProfile = exports.authenticateRegistryCredentials = exports.listRegistryUsers = exports.getRegistryUserById = void 0;
+const drizzle_orm_1 = require("drizzle-orm");
+const schema_1 = require("../db/schema");
+const access_tokens_1 = require("./access-tokens");
+const database_1 = require("./database");
+const crypto_1 = require("./crypto");
+const password_1 = require("./password");
+const user_record_1 = require("./user-record");
+const validation_1 = require("./validation");
+const DUMMY_PASSWORD_HASH = 'scrypt-v1:AAAAAAAAAAAAAAAAAAAAAA:yK99vlYIaV57oeErq8gHqx18DxRfiUoHwETrTFUjt5JasWeMsu62stPgY-fO0TUeUc6uAu1hge_vuSQY15vvuQ';
+const getRegistryUserById = (db, userId) => __awaiter(void 0, void 0, void 0, function* () {
+    const [row] = yield db.select().from(schema_1.registryUsers).where((0, drizzle_orm_1.eq)(schema_1.registryUsers.id, userId)).limit(1);
+    return row ? (0, user_record_1.toRegistryUser)(row) : null;
+});
+exports.getRegistryUserById = getRegistryUserById;
+const listRegistryUsers = (db) => __awaiter(void 0, void 0, void 0, function* () {
+    const rows = yield db.select().from(schema_1.registryUsers).orderBy(schema_1.registryUsers.createdAt);
+    return rows.map(user_record_1.toRegistryUser);
+});
+exports.listRegistryUsers = listRegistryUsers;
+/** Credentials authentication is intentionally enumeration-safe: all failures return null. */
+const authenticateRegistryCredentials = (db, email, password) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    const normalizedEmail = (0, crypto_1.normalizeEmail)(email);
+    const [row] = yield db.select().from(schema_1.registryUsers).where((0, drizzle_orm_1.eq)(schema_1.registryUsers.email, normalizedEmail)).limit(1);
+    const passwordMatches = yield (0, password_1.verifyPassword)(password, (_a = row === null || row === void 0 ? void 0 : row.passwordHash) !== null && _a !== void 0 ? _a : DUMMY_PASSWORD_HASH);
+    return row && row.status === 'active' && row.passwordHash && passwordMatches ? (0, user_record_1.toRegistryUser)(row) : null;
+});
+exports.authenticateRegistryCredentials = authenticateRegistryCredentials;
+const updateRegistryUserProfile = (db, input) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    const name = (0, validation_1.validateRegistryDisplayName)(input.name);
+    if (!name)
+        return { ok: false, reason: 'invalid_name' };
+    const image = (0, validation_1.validateRegistryImageUrl)(input.image);
+    if (image === false)
+        return { ok: false, reason: 'invalid_image' };
+    const [row] = yield db
+        .update(schema_1.registryUsers)
+        .set({ name, image, updatedAt: (_a = input.now) !== null && _a !== void 0 ? _a : new Date() })
+        .where((0, drizzle_orm_1.eq)(schema_1.registryUsers.id, input.userId))
+        .returning();
+    return row ? { ok: true, user: (0, user_record_1.toRegistryUser)(row) } : { ok: false, reason: 'not_found' };
+});
+exports.updateRegistryUserProfile = updateRegistryUserProfile;
+const updateRegistryUserRole = (db, input) => __awaiter(void 0, void 0, void 0, function* () {
+    if (input.role !== 'admin' && input.role !== 'member')
+        return { ok: false, reason: 'invalid_role' };
+    return (0, database_1.withRegistryTransaction)(db, (tx) => __awaiter(void 0, void 0, void 0, function* () {
+        var _a;
+        yield (0, database_1.acquireRegistryAdvisoryLock)(tx, database_1.REGISTRY_ADMIN_LOCK_ID);
+        const [target] = yield tx.select().from(schema_1.registryUsers).where((0, drizzle_orm_1.eq)(schema_1.registryUsers.id, input.userId)).limit(1);
+        if (!target)
+            return { ok: false, reason: 'not_found' };
+        if (target.role === input.role)
+            return { ok: true, user: (0, user_record_1.toRegistryUser)(target) };
+        if (target.role === 'admin' && target.status === 'active' && input.role === 'member') {
+            const [{ value }] = yield tx
+                .select({ value: (0, drizzle_orm_1.count)() })
+                .from(schema_1.registryUsers)
+                .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryUsers.role, 'admin'), (0, drizzle_orm_1.eq)(schema_1.registryUsers.status, 'active')));
+            if (Number(value) <= 1)
+                return { ok: false, reason: 'last_admin' };
+        }
+        const now = (_a = input.now) !== null && _a !== void 0 ? _a : new Date();
+        const [row] = yield tx
+            .update(schema_1.registryUsers)
+            .set({
+            role: input.role,
+            authVersion: (0, drizzle_orm_1.sql) `${schema_1.registryUsers.authVersion} + 1`,
+            updatedAt: now,
+        })
+            .where((0, drizzle_orm_1.eq)(schema_1.registryUsers.id, input.userId))
+            .returning();
+        if (target.role === 'admin' && input.role === 'member') {
+            yield (0, access_tokens_1.revokeAllRegistryAccessTokens)(tx, input.userId, now);
+        }
+        return { ok: true, user: (0, user_record_1.toRegistryUser)(row) };
+    }));
+});
+exports.updateRegistryUserRole = updateRegistryUserRole;
+const setRegistryUserStatus = (db, input) => __awaiter(void 0, void 0, void 0, function* () {
+    if (input.status !== 'active' && input.status !== 'deactivated') {
+        return { ok: false, reason: 'invalid_status' };
+    }
+    if (input.status === 'deactivated' && input.actorUserId === input.userId) {
+        return { ok: false, reason: 'self_deactivation' };
+    }
+    return (0, database_1.withRegistryTransaction)(db, (tx) => __awaiter(void 0, void 0, void 0, function* () {
+        var _a;
+        yield (0, database_1.acquireRegistryAdvisoryLock)(tx, database_1.REGISTRY_ADMIN_LOCK_ID);
+        const [target] = yield tx.select().from(schema_1.registryUsers).where((0, drizzle_orm_1.eq)(schema_1.registryUsers.id, input.userId)).limit(1);
+        if (!target)
+            return { ok: false, reason: 'not_found' };
+        if (target.status === input.status)
+            return { ok: true, user: (0, user_record_1.toRegistryUser)(target) };
+        if (input.status === 'active' && target.status === 'invited') {
+            return { ok: false, reason: 'invalid_status' };
+        }
+        if (target.role === 'admin' && target.status === 'active' && input.status === 'deactivated') {
+            const [{ value }] = yield tx
+                .select({ value: (0, drizzle_orm_1.count)() })
+                .from(schema_1.registryUsers)
+                .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryUsers.role, 'admin'), (0, drizzle_orm_1.eq)(schema_1.registryUsers.status, 'active')));
+            if (Number(value) <= 1)
+                return { ok: false, reason: 'last_admin' };
+        }
+        const now = (_a = input.now) !== null && _a !== void 0 ? _a : new Date();
+        const [row] = yield tx
+            .update(schema_1.registryUsers)
+            .set({
+            status: input.status,
+            authVersion: (0, drizzle_orm_1.sql) `${schema_1.registryUsers.authVersion} + 1`,
+            updatedAt: now,
+        })
+            .where((0, drizzle_orm_1.eq)(schema_1.registryUsers.id, input.userId))
+            .returning();
+        if (input.status === 'deactivated') {
+            yield (0, access_tokens_1.revokeAllRegistryAccessTokens)(tx, input.userId, now);
+        }
+        return { ok: true, user: (0, user_record_1.toRegistryUser)(row) };
+    }));
+});
+exports.setRegistryUserStatus = setRegistryUserStatus;

package/dist/registry/auth/validation.d.ts

@@ -0,0 +1,3 @@
+export declare const validateRegistryEmail: (email: string) => string | null;
+export declare const validateRegistryDisplayName: (name: string) => string | null;
+export declare const validateRegistryImageUrl: (image: string | null | undefined) => string | null | false;

package/dist/registry/auth/validation.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateRegistryImageUrl = exports.validateRegistryDisplayName = exports.validateRegistryEmail = void 0;
+const crypto_1 = require("./crypto");
+const SIMPLE_EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const validateRegistryEmail = (email) => {
+    const normalized = (0, crypto_1.normalizeEmail)(email);
+    return normalized.length <= 320 && SIMPLE_EMAIL_PATTERN.test(normalized) ? normalized : null;
+};
+exports.validateRegistryEmail = validateRegistryEmail;
+const validateRegistryDisplayName = (name) => {
+    const normalized = name.trim();
+    return normalized && normalized.length <= 120 ? normalized : null;
+};
+exports.validateRegistryDisplayName = validateRegistryDisplayName;
+const validateRegistryImageUrl = (image) => {
+    const normalized = image === null || image === void 0 ? void 0 : image.trim();
+    if (!normalized)
+        return null;
+    try {
+        const parsed = new URL(normalized);
+        return parsed.protocol === 'https:' && normalized.length <= 2048 ? normalized : false;
+    }
+    catch (_a) {
+        return false;
+    }
+};
+exports.validateRegistryImageUrl = validateRegistryImageUrl;

package/dist/registry/checkout/assets.js

@@ -62,7 +62,9 @@ const describeFetchFailure = (error, target, registryUrl) => {
         case 'runtime_mode_conflict':
             return `The registry at ${registryUrl} is not running in registry mode, so it cannot serve a checkout: ${error.message}`;
         case 'unauthorized':
-            return `The registry rejected the access token (401). Check the configured access token matches the registry's token.`;
+            return `The registry rejected the access token (401). Run \`handoff-app login --url ${registryUrl}\` again, or replace the user-issued CI token.`;
+        case 'forbidden':
+            return `The registry token does not have permission to checkout assets (403). Authorize a token with registry:read access.`;
         default:
             return error.message;
     }
@@ -83,7 +85,7 @@ const wouldChange = (absolutePath, bytes) => {
  * Recreates workspace asset files; prompts before overwriting changed local files unless `--force`.
  */
 const checkoutAssets = (handoff, collection) => __awaiter(void 0, void 0, void 0, function* () {
-    const connection = (0, index_1.resolveConnectionOrThrow)(handoff);
+    const connection = yield (0, index_1.resolveConnectionOrThrow)(handoff);
     if (collection && !(0, sets_1.isAssetCollection)(collection)) {
         throw new index_1.CheckoutError(`Unknown asset collection "${collection}". Supported collections: ${sets_1.ASSET_COLLECTIONS.join(', ')}.`);
     }

package/dist/registry/checkout/index.d.ts

@@ -1,7 +1,7 @@
 /**
  * Connected-workspace checkout orchestration.
  *
- * `checkout <component|pattern> <id>` reads a normalized registry record and its registry-safe
+ * `checkout <components|patterns> <id>` reads a normalized registry record and its registry-safe
  * source files from the connected registry through the shared registry client, then writes them
  * into the local workspace in standard authoring form. The local **declaration is synthesized
  * locally** in the configured `runtime.workspace.declarationFormat` — declarations are never read
@@ -23,11 +23,16 @@ export declare class CheckoutError extends Error {
  * host has no local workspace to write into) and a resolved registry URL + access token. Throws an
  * actionable {@link CheckoutError} naming the exact misconfiguration.
  */
-export declare const resolveConnectionOrThrow: (handoff: Handoff) => import("../connection").ResolvedRegistryConnection;
+export declare const resolveConnectionOrThrow: (handoff: Handoff) => Promise<import("../connection").ResolvedRegistryConnection>;
 /**
- * Checkout a single component or pattern from a connected workspace: precondition checks → fetch the
- * normalized record + source files → resolve the local target → explicit-overwrite guard → write
- * source files and synthesize the local declaration. Throws {@link CheckoutError} with actionable
- * messaging on any precondition or fetch failure.
+ * Checkout a single component, pattern, or page from the connected registry into this workspace.
+ * Overwriting existing local files requires `--force` or an interactive confirmation.
  */
 export declare const checkoutEntity: (handoff: Handoff, kind: TransferEntityKind, id: string) => Promise<void>;
+/**
+ * Checkout every published component, pattern, or page of the kind into this workspace. Enumerates
+ * the registry's published ids, then checks each out through the shared client. A per-entity failure
+ * is collected and never aborts the rest; the run throws at the end if any entity failed. Overwrite
+ * prompting is per entity (skipped under `--force`).
+ */
+export declare const checkoutEntities: (handoff: Handoff, kind: TransferEntityKind) => Promise<void>;