handoff-app 2.0.0-2 → 2.0.0-3

package/dist/commands/logout/index.js

@@ -0,0 +1,54 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const __1 = __importDefault(require("../../"));
+const device_1 = require("../../cli/auth/device");
+const store_1 = require("../../cli/auth/store");
+const logger_1 = require("../../utils/logger");
+const utils_1 = require("../utils");
+const command = {
+    command: 'logout',
+    describe: 'Revoke and remove saved registry credentials',
+    builder: (yargs) => (0, utils_1.getSharedOptions)(yargs).option('url', {
+        type: 'string',
+        describe: 'Revoke credentials only when they belong to this exact registry URL',
+    }),
+    handler: (args) => __awaiter(void 0, void 0, void 0, function* () {
+        const handoff = new __1.default(args.debug, args.force);
+        const auth = yield (0, store_1.readCliAuth)(handoff.workingPath);
+        if (args.url && auth && !(0, store_1.cliAuthMatchesRegistry)(auth, args.url)) {
+            logger_1.Logger.error(`The saved login belongs to ${auth.remoteUrl}, not ${(0, store_1.normalizeRegistryUrl)(args.url)}. No credentials were changed.`);
+            process.exitCode = 1;
+            return;
+        }
+        if (auth) {
+            try {
+                yield (0, device_1.revokeAccessToken)(auth);
+            }
+            catch (error) {
+                logger_1.Logger.warn(`Could not revoke the registry token remotely (${error instanceof Error ? error.message : String(error)}). ` +
+                    'It will still be removed from this workspace.');
+            }
+        }
+        try {
+            yield (0, store_1.clearCliAuth)(handoff.workingPath);
+            logger_1.Logger.success(`Logged out. Removed ${(0, store_1.cliAuthFilePath)(handoff.workingPath)}.`);
+        }
+        catch (error) {
+            logger_1.Logger.error(`Could not remove saved credentials: ${error instanceof Error ? error.message : String(error)}`);
+            process.exitCode = 1;
+        }
+    }),
+};
+exports.default = command;

package/dist/config/entries.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Registering directory-list entries (`entries.components` / `entries.patterns`) in the handoff
+ * config. Both scaffolding new component stubs and checking entities out of a registry need a
+ * freshly-written entity to be discoverable by the workspace build, so both have to handle every
+ * way a path can be declared:
+ *
+ * - a collection directory (e.g. `"components"`) whose subdirectories are entities: a new sibling
+ *   is auto-discovered at runtime, so nothing needs writing to the config;
+ * - an individual entity directory (e.g. `"components/button"`): the entity stays invisible until
+ *   its own path is added to the list.
+ *
+ * {@link isEntryCovered} answers "does this already load?" by reusing the runtime expansion
+ * ({@link getComponentsForPath}); {@link writeEntries} appends the paths that don't, across the
+ * `.json`, `.ts`, `.js`, and `.cjs` config formats.
+ */
+import { Config } from '../types/config';
+/** The `entries` keys whose values are declared as a list of directory paths. */
+export type EntryKind = 'components' | 'patterns';
+/** Minimal handoff shape needed here; avoids importing the full Handoff class (circular dep). */
+interface ConfigContext {
+    config?: Config;
+    workingPath: string;
+}
+/** Outcome of {@link writeEntries}: `added` on success, `unsupported` when the config couldn't be edited. */
+export interface WriteEntriesResult {
+    status: 'added' | 'unsupported';
+    /** The config file written (or that would need editing); null only when none exists and creation failed. */
+    configPath: string | null;
+    /** Workspace-relative POSIX paths written into the config. */
+    added: string[];
+    /** Workspace-relative POSIX paths the caller must add manually (`status: 'unsupported'`). */
+    pending: string[];
+}
+/**
+ * True when `targetDir` already loads through an existing `entries[kind]` declaration: listed
+ * directly, or sitting under a declared collection directory that runtime discovery expands.
+ * Reuses the same expansion the runtime uses, so every declaration style is covered.
+ */
+export declare const isEntryCovered: (handoff: ConfigContext, kind: EntryKind, targetDir: string) => boolean;
+/**
+ * Add `targetDirs` to `entries[kind]` in the workspace config so the build discovers them. Callers
+ * should first drop already-loading dirs via {@link isEntryCovered}. Paths are stored workspace-
+ * relative; a `.json` config is edited losslessly, a code config best-effort. When no config file
+ * exists a minimal `handoff.config.json` is created.
+ */
+export declare const writeEntries: (handoff: ConfigContext, kind: EntryKind, targetDirs: string[]) => Promise<WriteEntriesResult>;
+export {};

package/dist/config/entries.js

@@ -0,0 +1,162 @@
+"use strict";
+/**
+ * Registering directory-list entries (`entries.components` / `entries.patterns`) in the handoff
+ * config. Both scaffolding new component stubs and checking entities out of a registry need a
+ * freshly-written entity to be discoverable by the workspace build, so both have to handle every
+ * way a path can be declared:
+ *
+ * - a collection directory (e.g. `"components"`) whose subdirectories are entities: a new sibling
+ *   is auto-discovered at runtime, so nothing needs writing to the config;
+ * - an individual entity directory (e.g. `"components/button"`): the entity stays invisible until
+ *   its own path is added to the list.
+ *
+ * {@link isEntryCovered} answers "does this already load?" by reusing the runtime expansion
+ * ({@link getComponentsForPath}); {@link writeEntries} appends the paths that don't, across the
+ * `.json`, `.ts`, `.js`, and `.cjs` config formats.
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeEntries = exports.isEntryCovered = void 0;
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const path_1 = __importDefault(require("path"));
+const path_2 = require("../utils/path");
+const runtime_1 = require("./runtime");
+/** Config files in precedence order; the first that exists is the one we mutate. */
+const CONFIG_FILES = ['handoff.config.ts', 'handoff.config.js', 'handoff.config.cjs', 'handoff.config.json'];
+/** Workspace-relative, POSIX-separated path used as a config entry value. */
+const toEntryPath = (handoff, targetDir) => path_1.default.relative(handoff.workingPath, targetDir).split(path_1.default.sep).join('/');
+/**
+ * True when `targetDir` already loads through an existing `entries[kind]` declaration: listed
+ * directly, or sitting under a declared collection directory that runtime discovery expands.
+ * Reuses the same expansion the runtime uses, so every declaration style is covered.
+ */
+const isEntryCovered = (handoff, kind, targetDir) => {
+    var _a, _b;
+    const configured = (_b = (_a = handoff.config) === null || _a === void 0 ? void 0 : _a.entries) === null || _b === void 0 ? void 0 : _b[kind];
+    if (!(configured === null || configured === void 0 ? void 0 : configured.length)) {
+        return false;
+    }
+    return configured
+        .flatMap((entry) => (0, runtime_1.getComponentsForPath)(path_1.default.resolve(handoff.workingPath, entry)))
+        .some((dir) => (0, path_2.arePathsEqual)(dir, targetDir));
+};
+exports.isEntryCovered = isEntryCovered;
+/** Format an entry array as source, matching the surrounding indentation of a code config. */
+const formatEntryArray = (paths, indent) => {
+    if (paths.length === 0)
+        return '[]';
+    if (paths.length === 1)
+        return `['${paths[0]}']`;
+    return `[\n${paths.map((entry) => `${indent}'${entry}',`).join('\n')}\n${indent.slice(2)}]`;
+};
+/** Append entry paths to a structured `.json` config (lossless read/modify/write). */
+const addToJsonConfig = (configPath, kind, relPaths) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    try {
+        const config = yield fs_extra_1.default.readJSON(configPath);
+        config.entries = (_a = config.entries) !== null && _a !== void 0 ? _a : {};
+        const existing = Array.isArray(config.entries[kind]) ? config.entries[kind] : [];
+        const existingSet = new Set(existing);
+        for (const relPath of relPaths) {
+            if (!existingSet.has(relPath))
+                existing.push(relPath);
+        }
+        config.entries[kind] = existing;
+        yield fs_extra_1.default.writeJSON(configPath, config, { spaces: 2 });
+        return true;
+    }
+    catch (_b) {
+        return false;
+    }
+});
+/**
+ * Best-effort splice of entry paths into an executable `.ts` / `.js` / `.cjs` config. These are
+ * modules, not data, so there's no lossless structured write; if a computed or spread `entries`
+ * array can't be edited textually, the caller falls back to printing the paths for the user to add.
+ */
+const addToCodeConfig = (configPath, kind, relPaths) => __awaiter(void 0, void 0, void 0, function* () {
+    try {
+        let content = yield fs_extra_1.default.readFile(configPath, 'utf8');
+        const arrayBlock = formatEntryArray(relPaths, '      ');
+        // 1) An `entries: { ... <kind>: [ ... ] }` array already exists, so merge into it.
+        const hasKeyArray = new RegExp(`entries\\s*:\\s*\\{[\\s\\S]*?${kind}\\s*:`).test(content);
+        const arrayRegex = new RegExp(`(${kind}\\s*:\\s*\\[)([^\\]]*)(\\])`);
+        const match = hasKeyArray ? content.match(arrayRegex) : null;
+        if (match) {
+            const existing = match[2]
+                .split(',')
+                .map((s) => s.trim().replace(/['"]/g, ''))
+                .filter(Boolean);
+            const existingSet = new Set(existing);
+            const toAdd = relPaths.filter((relPath) => !existingSet.has(relPath));
+            if (toAdd.length > 0) {
+                const indentMatch = content.match(new RegExp(`${kind}\\s*:\\s*\\[\\s*\\n(\\s*)`));
+                const indent = indentMatch ? indentMatch[1] : '      ';
+                content = content.replace(arrayRegex, `${kind}: ${formatEntryArray([...existing, ...toAdd], indent)}`);
+                yield fs_extra_1.default.writeFile(configPath, content, 'utf8');
+            }
+            return true;
+        }
+        // 2) An `entries` object exists but not this key, so add the key.
+        if (/entries\s*:\s*\{/.test(content)) {
+            content = content.replace(/(entries\s*:\s*\{)/, `$1\n    ${kind}: ${arrayBlock},`);
+            yield fs_extra_1.default.writeFile(configPath, content, 'utf8');
+            return true;
+        }
+        // 3) No `entries` object, so insert one into the exported config object.
+        const entriesBlock = `  entries: {\n    ${kind}: ${arrayBlock},\n  },\n`;
+        for (const anchor of [/module\.exports\s*=\s*\{/, /export\s+default\s+\{/, /defineConfig\s*\(\s*\{/]) {
+            if (anchor.test(content)) {
+                content = content.replace(anchor, (matched) => `${matched}\n${entriesBlock}`);
+                yield fs_extra_1.default.writeFile(configPath, content, 'utf8');
+                return true;
+            }
+        }
+        return false;
+    }
+    catch (_a) {
+        return false;
+    }
+});
+/**
+ * Add `targetDirs` to `entries[kind]` in the workspace config so the build discovers them. Callers
+ * should first drop already-loading dirs via {@link isEntryCovered}. Paths are stored workspace-
+ * relative; a `.json` config is edited losslessly, a code config best-effort. When no config file
+ * exists a minimal `handoff.config.json` is created.
+ */
+const writeEntries = (handoff, kind, targetDirs) => __awaiter(void 0, void 0, void 0, function* () {
+    const relPaths = [...new Set(targetDirs.map((dir) => toEntryPath(handoff, dir)))];
+    const configFile = CONFIG_FILES.find((file) => fs_extra_1.default.existsSync(path_1.default.resolve(handoff.workingPath, file)));
+    const configPath = configFile ? path_1.default.resolve(handoff.workingPath, configFile) : null;
+    if (relPaths.length === 0) {
+        return { status: 'added', configPath, added: [], pending: [] };
+    }
+    if (!configPath) {
+        const newConfigPath = path_1.default.resolve(handoff.workingPath, 'handoff.config.json');
+        try {
+            yield fs_extra_1.default.writeJSON(newConfigPath, { entries: { [kind]: relPaths } }, { spaces: 2 });
+            return { status: 'added', configPath: newConfigPath, added: relPaths, pending: [] };
+        }
+        catch (_a) {
+            return { status: 'unsupported', configPath: null, added: [], pending: relPaths };
+        }
+    }
+    const ok = configPath.endsWith('.json')
+        ? yield addToJsonConfig(configPath, kind, relPaths)
+        : yield addToCodeConfig(configPath, kind, relPaths);
+    return ok
+        ? { status: 'added', configPath, added: relPaths, pending: [] }
+        : { status: 'unsupported', configPath, added: [], pending: relPaths };
+});
+exports.writeEntries = writeEntries;

package/dist/config/index.d.ts

@@ -4,3 +4,5 @@ export { initConfig, initConfigWithMetadata } from './loader';
 export { defineConfig } from './helpers';
 export { initRuntimeConfig } from './runtime';
 export { validateConfig } from './validator';
+export { isEntryCovered, writeEntries } from './entries';
+export type { EntryKind, WriteEntriesResult } from './entries';

package/dist/config/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateConfig = exports.initRuntimeConfig = exports.defineConfig = exports.initConfigWithMetadata = exports.initConfig = exports.getClientConfig = exports.defaultConfig = void 0;
+exports.writeEntries = exports.isEntryCovered = exports.validateConfig = exports.initRuntimeConfig = exports.defineConfig = exports.initConfigWithMetadata = exports.initConfig = exports.getClientConfig = exports.defaultConfig = void 0;
 // Config defaults and client config
 var defaults_1 = require("./defaults");
 Object.defineProperty(exports, "defaultConfig", { enumerable: true, get: function () { return defaults_1.defaultConfig; } });
@@ -18,3 +18,7 @@ Object.defineProperty(exports, "initRuntimeConfig", { enumerable: true, get: fun
 // Config validation
 var validator_1 = require("./validator");
 Object.defineProperty(exports, "validateConfig", { enumerable: true, get: function () { return validator_1.validateConfig; } });
+// Registering directory-list entries (components/patterns)
+var entries_1 = require("./entries");
+Object.defineProperty(exports, "isEntryCovered", { enumerable: true, get: function () { return entries_1.isEntryCovered; } });
+Object.defineProperty(exports, "writeEntries", { enumerable: true, get: function () { return entries_1.writeEntries; } });

package/dist/config/runtime.d.ts

@@ -21,17 +21,17 @@ export declare const resolveComponentDeclaration: (componentDir: string, compone
  */
 export declare const initRuntimeConfig: (handoff: HandoffContext) => [runtimeConfig: RuntimeConfig, configs: string[], configFileIndex: Map<string, ConfigFileEntry>];
 /**
- * Returns a list of component directories for a given path.
- *
- * This function determines whether the provided `searchPath` is:
- * 1. A single component directory (contains a config file named after the directory)
- * 2. A collection of component directories (subdirectories are components)
- *
- * A directory is considered a component if it contains a config file matching
- * `{dirname}.json`, `{dirname}.js`, or `{dirname}.cjs`.
+ * True when `searchPath` is itself a single component directory: it holds a declaration file named
+ * after the directory (`{dirname}.handoff.*`, or a legacy `{dirname}.{json,js,cjs}`). This is what
+ * separates a declared component from a collection directory.
+ */
+export declare const isComponentDirectory: (searchPath: string) => boolean;
+/**
+ * Returns the component directories for a given path. If `searchPath` is itself a component
+ * directory it's returned as-is; otherwise each subdirectory is treated as a potential component.
  *
  * @param searchPath - The absolute path to check for components.
- * @returns An array of string paths to component directories.
+ * @returns Paths to the component directories.
  */
 export declare const getComponentsForPath: (searchPath: string) => string[];
 /**

package/dist/config/runtime.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.toLowerCaseKeysAndValues = exports.getItemsForPath = exports.getComponentsForPath = exports.initRuntimeConfig = exports.resolveComponentDeclaration = void 0;
+exports.toLowerCaseKeysAndValues = exports.getItemsForPath = exports.getComponentsForPath = exports.isComponentDirectory = exports.initRuntimeConfig = exports.resolveComponentDeclaration = void 0;
 const esbuild_1 = __importDefault(require("esbuild"));
 const fs_extra_1 = __importDefault(require("fs-extra"));
 const gray_matter_1 = __importDefault(require("gray-matter"));
@@ -283,24 +283,24 @@ const collectPageMarkdownPaths = (rootDir, relativeParts = []) => {
     return results;
 };
 /**
- * Returns a list of component directories for a given path.
- *
- * This function determines whether the provided `searchPath` is:
- * 1. A single component directory (contains a config file named after the directory)
- * 2. A collection of component directories (subdirectories are components)
- *
- * A directory is considered a component if it contains a config file matching
- * `{dirname}.json`, `{dirname}.js`, or `{dirname}.cjs`.
+ * True when `searchPath` is itself a single component directory: it holds a declaration file named
+ * after the directory (`{dirname}.handoff.*`, or a legacy `{dirname}.{json,js,cjs}`). This is what
+ * separates a declared component from a collection directory.
+ */
+const isComponentDirectory = (searchPath) => !!(0, exports.resolveComponentDeclaration)(searchPath, path_1.default.basename(searchPath));
+exports.isComponentDirectory = isComponentDirectory;
+/**
+ * Returns the component directories for a given path. If `searchPath` is itself a component
+ * directory it's returned as-is; otherwise each subdirectory is treated as a potential component.
  *
  * @param searchPath - The absolute path to check for components.
- * @returns An array of string paths to component directories.
+ * @returns Paths to the component directories.
  */
 const getComponentsForPath = (searchPath) => {
-    const dirName = path_1.default.basename(searchPath);
-    const hasOwnConfig = !!(0, exports.resolveComponentDeclaration)(searchPath, dirName);
-    // Check if searchPath itself is a component directory (has a config file named after the directory)
-    if (hasOwnConfig) {
-        // This directory is a single component
+    if ((0, exports.isComponentDirectory)(searchPath)) {
+        return [searchPath];
+    }
+    if (!fs_extra_1.default.existsSync(searchPath)) {
         return [searchPath];
     }
     // Otherwise, treat each subdirectory as a potential component

package/dist/registry/auth/access-tokens.d.ts

@@ -0,0 +1,46 @@
+import type { RegistryDatabase } from '../db/client';
+import { type RegistryAccessScope } from '../db/schema';
+import { type RegistryPrincipal, type RegistryUserRole } from './types';
+export interface RegistryAccessTokenSummary {
+    id: string;
+    name: string;
+    scopes: RegistryAccessScope[];
+    expiresAt: Date;
+    lastUsedAt: Date | null;
+    revokedAt: Date | null;
+    createdAt: Date;
+}
+export type CreateRegistryAccessTokenResult = {
+    ok: true;
+    token: string;
+    record: RegistryAccessTokenSummary;
+} | {
+    ok: false;
+    reason: 'user_not_found' | 'user_inactive' | 'scope_forbidden' | 'invalid_name' | 'invalid_expiry';
+};
+export declare const normalizeRegistryScopes: (scopes: readonly RegistryAccessScope[]) => RegistryAccessScope[];
+export declare const registryRoleAllowsScopes: (role: RegistryUserRole, scopes: readonly RegistryAccessScope[]) => boolean;
+export declare const formatRegistryAccessToken: (id: string, secret: string) => string;
+export declare const parseRegistryAccessToken: (token: string) => {
+    id: string;
+    secret: string;
+} | null;
+export declare const createRegistryAccessToken: (db: RegistryDatabase, input: {
+    userId: string;
+    name: string;
+    scopes: RegistryAccessScope[];
+    expiresAt?: Date;
+    now?: Date;
+}) => Promise<CreateRegistryAccessTokenResult>;
+export declare const listRegistryAccessTokens: (db: RegistryDatabase, userId: string) => Promise<RegistryAccessTokenSummary[]>;
+export declare const revokeRegistryAccessToken: (db: RegistryDatabase, input: {
+    tokenId: string;
+    userId: string;
+    now?: Date;
+}) => Promise<boolean>;
+export declare const revokeAllRegistryAccessTokens: (db: RegistryDatabase, userId: string, now?: Date) => Promise<number>;
+/**
+ * Resolve an opaque bearer credential into a live principal. User state is joined on every call,
+ * making deactivation effective even if a defensive token-revocation write was interrupted.
+ */
+export declare const authenticateRegistryAccessToken: (db: RegistryDatabase, token: string, now?: Date) => Promise<RegistryPrincipal | null>;

package/dist/registry/auth/access-tokens.js

@@ -0,0 +1,165 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authenticateRegistryAccessToken = exports.revokeAllRegistryAccessTokens = exports.revokeRegistryAccessToken = exports.listRegistryAccessTokens = exports.createRegistryAccessToken = exports.parseRegistryAccessToken = exports.formatRegistryAccessToken = exports.registryRoleAllowsScopes = exports.normalizeRegistryScopes = void 0;
+const drizzle_orm_1 = require("drizzle-orm");
+const schema_1 = require("../db/schema");
+const crypto_1 = require("./crypto");
+const database_1 = require("./database");
+const types_1 = require("./types");
+const ACCESS_TOKEN_PREFIX = 'hnd';
+const DEFAULT_ACCESS_TOKEN_LIFETIME_MS = 365 * 24 * 60 * 60 * 1000;
+const isRegistryScope = (value) => value === types_1.REGISTRY_READ_SCOPE || value === types_1.REGISTRY_WRITE_SCOPE;
+const normalizeRegistryScopes = (scopes) => {
+    const unique = new Set(scopes.filter(isRegistryScope));
+    return [types_1.REGISTRY_READ_SCOPE, types_1.REGISTRY_WRITE_SCOPE].filter((scope) => unique.has(scope));
+};
+exports.normalizeRegistryScopes = normalizeRegistryScopes;
+const registryRoleAllowsScopes = (role, scopes) => role === 'admin' || !scopes.includes(types_1.REGISTRY_WRITE_SCOPE);
+exports.registryRoleAllowsScopes = registryRoleAllowsScopes;
+const formatRegistryAccessToken = (id, secret) => `${ACCESS_TOKEN_PREFIX}_${id}_${secret}`;
+exports.formatRegistryAccessToken = formatRegistryAccessToken;
+const parseRegistryAccessToken = (token) => {
+    const match = /^hnd_([A-Za-z0-9_-]{16})_([A-Za-z0-9_-]{43})$/.exec(token.trim());
+    return match ? { id: match[1], secret: match[2] } : null;
+};
+exports.parseRegistryAccessToken = parseRegistryAccessToken;
+const createRegistryAccessTokenInTransaction = (db, input) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a, _b;
+    const name = input.name.trim();
+    if (!name || name.length > 120)
+        return { ok: false, reason: 'invalid_name' };
+    const now = (_a = input.now) !== null && _a !== void 0 ? _a : new Date();
+    const expiresAt = (_b = input.expiresAt) !== null && _b !== void 0 ? _b : new Date(now.getTime() + DEFAULT_ACCESS_TOKEN_LIFETIME_MS);
+    if (!(expiresAt instanceof Date) || !Number.isFinite(expiresAt.getTime()) || expiresAt <= now) {
+        return { ok: false, reason: 'invalid_expiry' };
+    }
+    const [user] = yield db
+        .select({ id: schema_1.registryUsers.id, role: schema_1.registryUsers.role, status: schema_1.registryUsers.status })
+        .from(schema_1.registryUsers)
+        .where((0, drizzle_orm_1.eq)(schema_1.registryUsers.id, input.userId))
+        .limit(1)
+        .for('update');
+    if (!user)
+        return { ok: false, reason: 'user_not_found' };
+    if (user.status !== 'active')
+        return { ok: false, reason: 'user_inactive' };
+    const scopes = (0, exports.normalizeRegistryScopes)(input.scopes);
+    if (!scopes.length)
+        scopes.push(types_1.REGISTRY_READ_SCOPE);
+    if (!(0, exports.registryRoleAllowsScopes)(user.role, scopes))
+        return { ok: false, reason: 'scope_forbidden' };
+    const id = (0, crypto_1.createOpaqueSecret)(12);
+    const secret = (0, crypto_1.createOpaqueSecret)(32);
+    const [record] = yield db
+        .insert(schema_1.registryAccessTokens)
+        .values({
+        id,
+        userId: user.id,
+        name,
+        secretHash: (0, crypto_1.hashSecret)(secret),
+        scopes,
+        expiresAt,
+    })
+        .returning({
+        id: schema_1.registryAccessTokens.id,
+        name: schema_1.registryAccessTokens.name,
+        scopes: schema_1.registryAccessTokens.scopes,
+        expiresAt: schema_1.registryAccessTokens.expiresAt,
+        lastUsedAt: schema_1.registryAccessTokens.lastUsedAt,
+        revokedAt: schema_1.registryAccessTokens.revokedAt,
+        createdAt: schema_1.registryAccessTokens.createdAt,
+    });
+    return { ok: true, token: (0, exports.formatRegistryAccessToken)(id, secret), record };
+});
+const createRegistryAccessToken = (db, input) => __awaiter(void 0, void 0, void 0, function* () { return (0, database_1.withRegistryTransaction)(db, (tx) => createRegistryAccessTokenInTransaction(tx, input)); });
+exports.createRegistryAccessToken = createRegistryAccessToken;
+const listRegistryAccessTokens = (db, userId) => __awaiter(void 0, void 0, void 0, function* () {
+    return db
+        .select({
+        id: schema_1.registryAccessTokens.id,
+        name: schema_1.registryAccessTokens.name,
+        scopes: schema_1.registryAccessTokens.scopes,
+        expiresAt: schema_1.registryAccessTokens.expiresAt,
+        lastUsedAt: schema_1.registryAccessTokens.lastUsedAt,
+        revokedAt: schema_1.registryAccessTokens.revokedAt,
+        createdAt: schema_1.registryAccessTokens.createdAt,
+    })
+        .from(schema_1.registryAccessTokens)
+        .where((0, drizzle_orm_1.eq)(schema_1.registryAccessTokens.userId, userId))
+        .orderBy(schema_1.registryAccessTokens.createdAt);
+});
+exports.listRegistryAccessTokens = listRegistryAccessTokens;
+const revokeRegistryAccessToken = (db, input) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    const rows = yield db
+        .update(schema_1.registryAccessTokens)
+        .set({ revokedAt: (_a = input.now) !== null && _a !== void 0 ? _a : new Date() })
+        .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryAccessTokens.id, input.tokenId), (0, drizzle_orm_1.eq)(schema_1.registryAccessTokens.userId, input.userId), (0, drizzle_orm_1.isNull)(schema_1.registryAccessTokens.revokedAt)))
+        .returning({ id: schema_1.registryAccessTokens.id });
+    return rows.length > 0;
+});
+exports.revokeRegistryAccessToken = revokeRegistryAccessToken;
+const revokeAllRegistryAccessTokens = (db_1, userId_1, ...args_1) => __awaiter(void 0, [db_1, userId_1, ...args_1], void 0, function* (db, userId, now = new Date()) {
+    const rows = yield db
+        .update(schema_1.registryAccessTokens)
+        .set({ revokedAt: now })
+        .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryAccessTokens.userId, userId), (0, drizzle_orm_1.isNull)(schema_1.registryAccessTokens.revokedAt)))
+        .returning({ id: schema_1.registryAccessTokens.id });
+    return rows.length;
+});
+exports.revokeAllRegistryAccessTokens = revokeAllRegistryAccessTokens;
+/**
+ * Resolve an opaque bearer credential into a live principal. User state is joined on every call,
+ * making deactivation effective even if a defensive token-revocation write was interrupted.
+ */
+const authenticateRegistryAccessToken = (db_1, token_1, ...args_1) => __awaiter(void 0, [db_1, token_1, ...args_1], void 0, function* (db, token, now = new Date()) {
+    const parsed = (0, exports.parseRegistryAccessToken)(token);
+    if (!parsed)
+        return null;
+    const [row] = yield db
+        .select({
+        tokenId: schema_1.registryAccessTokens.id,
+        secretHash: schema_1.registryAccessTokens.secretHash,
+        scopes: schema_1.registryAccessTokens.scopes,
+        expiresAt: schema_1.registryAccessTokens.expiresAt,
+        revokedAt: schema_1.registryAccessTokens.revokedAt,
+        userId: schema_1.registryUsers.id,
+        email: schema_1.registryUsers.email,
+        name: schema_1.registryUsers.name,
+        role: schema_1.registryUsers.role,
+        status: schema_1.registryUsers.status,
+    })
+        .from(schema_1.registryAccessTokens)
+        .innerJoin(schema_1.registryUsers, (0, drizzle_orm_1.eq)(schema_1.registryUsers.id, schema_1.registryAccessTokens.userId))
+        .where((0, drizzle_orm_1.eq)(schema_1.registryAccessTokens.id, parsed.id))
+        .limit(1);
+    if (!row || row.status !== 'active' || row.revokedAt || row.expiresAt <= now || !(0, crypto_1.secretHashMatches)(parsed.secret, row.secretHash)) {
+        return null;
+    }
+    const scopes = (0, exports.normalizeRegistryScopes)(Array.isArray(row.scopes) ? row.scopes : []);
+    const updated = yield db
+        .update(schema_1.registryAccessTokens)
+        .set({ lastUsedAt: now })
+        .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryAccessTokens.id, row.tokenId), (0, drizzle_orm_1.isNull)(schema_1.registryAccessTokens.revokedAt), (0, drizzle_orm_1.gt)(schema_1.registryAccessTokens.expiresAt, now)))
+        .returning({ id: schema_1.registryAccessTokens.id });
+    if (!updated.length)
+        return null;
+    return {
+        tokenId: row.tokenId,
+        userId: row.userId,
+        email: row.email,
+        name: row.name,
+        role: row.role,
+        scopes,
+    };
+});
+exports.authenticateRegistryAccessToken = authenticateRegistryAccessToken;

package/dist/registry/auth/action-tokens.d.ts

@@ -0,0 +1,66 @@
+import type { RegistryDatabase } from '../db/client';
+import { type RegistryUserRole } from '../db/schema';
+import type { RegistryUser } from './types';
+export declare const INVITATION_LIFETIME_MS: number;
+export declare const PASSWORD_RESET_LIFETIME_MS: number;
+export type CreateUserInvitationResult = {
+    ok: true;
+    user: RegistryUser;
+    token: string;
+    expiresAt: Date;
+} | {
+    ok: false;
+    reason: 'invalid_email' | 'invalid_name' | 'invalid_role' | 'email_exists';
+};
+export type ResendUserInvitationResult = {
+    ok: true;
+    user: RegistryUser;
+    token: string;
+    expiresAt: Date;
+} | {
+    ok: false;
+    reason: 'not_found' | 'already_accepted' | 'deactivated';
+};
+export type ConsumeAuthActionResult = {
+    ok: true;
+    user: RegistryUser;
+} | {
+    ok: false;
+    reason: 'invalid_or_expired_token' | 'invalid_password';
+    error?: string;
+};
+export declare const createUserInvitation: (db: RegistryDatabase, input: {
+    email: string;
+    name: string;
+    role: RegistryUserRole;
+    now?: Date;
+    expiresAt?: Date;
+}) => Promise<CreateUserInvitationResult>;
+export declare const resendUserInvitation: (db: RegistryDatabase, input: {
+    userId: string;
+    now?: Date;
+    expiresAt?: Date;
+}) => Promise<ResendUserInvitationResult>;
+export declare const acceptUserInvitation: (db: RegistryDatabase, input: {
+    token: string;
+    password: string;
+    now?: Date;
+}) => Promise<ConsumeAuthActionResult>;
+/**
+ * Enumeration-safe reset request. The token is returned only to the trusted mail-delivery caller;
+ * unknown/inactive emails return the same successful shape with a null token.
+ */
+export declare const createPasswordReset: (db: RegistryDatabase, email: string, options?: {
+    now?: Date;
+    expiresAt?: Date;
+}) => Promise<{
+    ok: true;
+    user: RegistryUser | null;
+    token: string | null;
+    expiresAt: Date | null;
+}>;
+export declare const resetPassword: (db: RegistryDatabase, input: {
+    token: string;
+    password: string;
+    now?: Date;
+}) => Promise<ConsumeAuthActionResult>;