happy2 0.0.5

package/packages/happy2-server/dist/modules/config/loader.js

@@ -0,0 +1,251 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { parse } from "smol-toml";
+import { bundledRigCommand } from "../agents/command.js";
+import { localRuntimePaths } from "./paths.js";
+function table(value, path) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error(`${path} must be a TOML table`);
+    return value;
+}
+function string(value, path, optional = false) {
+    if (value === undefined && optional)
+        return undefined;
+    if (typeof value !== "string" || value.length === 0)
+        throw new Error(`${path} must be a non-empty string`);
+    return value;
+}
+function boolean(value, path, fallback = false) {
+    if (value === undefined)
+        return fallback;
+    if (typeof value !== "boolean")
+        throw new Error(`${path} must be true or false`);
+    return value;
+}
+function integer(value, path, fallback) {
+    if (value === undefined && fallback !== undefined)
+        return fallback;
+    if (typeof value !== "number" || !Number.isInteger(value))
+        throw new Error(`${path} must be an integer`);
+    return value;
+}
+function strings(value, path, fallback = []) {
+    if (value === undefined)
+        return fallback;
+    if (!Array.isArray(value) || !value.every((item) => typeof item === "string"))
+        throw new Error(`${path} must be a string array`);
+    return [...value];
+}
+export function parseConfig(input) {
+    const paths = localRuntimePaths();
+    const root = table(parse(input), "config");
+    const server = table(root.server, "server");
+    const role = string(server.role, "server.role");
+    if (!["all", "auth", "api"].includes(role))
+        throw new Error("server.role must be all, auth, or api");
+    const publicUrl = string(server.public_url, "server.public_url");
+    new URL(publicUrl);
+    const trustedProxyHops = integer(server.trusted_proxy_hops, "server.trusted_proxy_hops", 0);
+    if (trustedProxyHops < 0)
+        throw new Error("server.trusted_proxy_hops cannot be negative");
+    const database = table(root.database, "database");
+    const agents = table(root.agents ?? {}, "agents");
+    const files = table(root.files ?? {}, "files");
+    const fileProvider = string(files.provider, "files.provider", true) ?? "local";
+    if (fileProvider !== "local")
+        throw new Error("files.provider must be local in this server build");
+    const signedUrlExpirySeconds = integer(files.signed_url_expiry_seconds, "files.signed_url_expiry_seconds", 300);
+    if (signedUrlExpirySeconds < 1 || signedUrlExpirySeconds > 3600)
+        throw new Error("files.signed_url_expiry_seconds must be between 1 and 3600");
+    const maxUploadBytes = integer(files.max_upload_bytes, "files.max_upload_bytes", 512 * 1024 * 1024);
+    if (maxUploadBytes < 1024 || maxUploadBytes > 2 * 1024 * 1024 * 1024)
+        throw new Error("files.max_upload_bytes must be between 1 KiB and 2 GiB");
+    const resumableChunkBytes = integer(files.resumable_chunk_bytes, "files.resumable_chunk_bytes", 8 * 1024 * 1024);
+    if (resumableChunkBytes < 64 * 1024 || resumableChunkBytes > 64 * 1024 * 1024)
+        throw new Error("files.resumable_chunk_bytes must be between 64 KiB and 64 MiB");
+    const perUserQuotaBytes = quota(files.per_user_quota_bytes, "files.per_user_quota_bytes");
+    const serverQuotaBytes = quota(files.server_quota_bytes, "files.server_quota_bytes");
+    const incompleteUploadExpirySeconds = integer(files.incomplete_upload_expiry_seconds, "files.incomplete_upload_expiry_seconds", 24 * 60 * 60);
+    if (incompleteUploadExpirySeconds < 60 || incompleteUploadExpirySeconds > 30 * 24 * 60 * 60)
+        throw new Error("files.incomplete_upload_expiry_seconds must be between 60 and 2592000");
+    const quarantineRetentionSeconds = integer(files.quarantine_retention_seconds, "files.quarantine_retention_seconds", 30 * 24 * 60 * 60);
+    if (quarantineRetentionSeconds < 0 || quarantineRetentionSeconds > 365 * 24 * 60 * 60)
+        throw new Error("files.quarantine_retention_seconds must be between 0 and 31536000");
+    const malwareScanTimeoutSeconds = integer(files.malware_scan_timeout_seconds, "files.malware_scan_timeout_seconds", 120);
+    if (malwareScanTimeoutSeconds < 1 || malwareScanTimeoutSeconds > 3600)
+        throw new Error("files.malware_scan_timeout_seconds must be between 1 and 3600");
+    const malwareScanFailureMode = string(files.malware_scan_failure_mode, "files.malware_scan_failure_mode", true) ?? "deny";
+    if (malwareScanFailureMode !== "allow" && malwareScanFailureMode !== "deny")
+        throw new Error("files.malware_scan_failure_mode must be allow or deny");
+    const security = table(root.security ?? {}, "security");
+    const rateLimit = table(security.rate_limit ?? {}, "security.rate_limit");
+    const idempotency = table(security.idempotency ?? {}, "security.idempotency");
+    const readsPerMinute = boundedPositiveInteger(rateLimit.reads_per_minute, "security.rate_limit.reads_per_minute", 1_200, 1_000_000);
+    const writesPerMinute = boundedPositiveInteger(rateLimit.writes_per_minute, "security.rate_limit.writes_per_minute", 300, 1_000_000);
+    const authPerMinute = boundedPositiveInteger(rateLimit.auth_per_minute, "security.rate_limit.auth_per_minute", 30, 1_000_000);
+    const idempotencyLeaseSeconds = boundedPositiveInteger(idempotency.lease_seconds, "security.idempotency.lease_seconds", 30, 3_600);
+    const idempotencyRetentionSeconds = boundedPositiveInteger(idempotency.retention_seconds, "security.idempotency.retention_seconds", 86_400, 31_536_000);
+    if (idempotencyRetentionSeconds < idempotencyLeaseSeconds)
+        throw new Error("security.idempotency.retention_seconds must be at least lease_seconds");
+    const jwt = table(root.jwt, "jwt");
+    const expiryDays = integer(jwt.expiry_days, "jwt.expiry_days", 30);
+    if (expiryDays < 1 || expiryDays > 90)
+        throw new Error("jwt.expiry_days must be between 1 and 90");
+    const privateKeyPath = string(jwt.private_key_path, "jwt.private_key_path", true);
+    const publicKeyPath = string(jwt.public_key_path, "jwt.public_key_path", true);
+    const auth = table(root.auth ?? {}, "auth");
+    const password = table(auth.password ?? {}, "auth.password");
+    const magicLink = table(auth.magic_link ?? {}, "auth.magic_link");
+    const cloudflareAccess = table(auth.cloudflare_access ?? {}, "auth.cloudflare_access");
+    const oidc = new Map();
+    for (const [id, value] of Object.entries(table(auth.oidc ?? {}, "auth.oidc"))) {
+        const provider = table(value, `auth.oidc.${id}`);
+        if (!boolean(provider.enabled, `auth.oidc.${id}.enabled`))
+            continue;
+        const scopes = provider.scopes ?? ["openid", "email", "profile"];
+        if (!Array.isArray(scopes) || !scopes.every((scope) => typeof scope === "string"))
+            throw new Error(`auth.oidc.${id}.scopes must be string array`);
+        const redirectPath = string(provider.redirect_path, `auth.oidc.${id}.redirect_path`);
+        if (!redirectPath.startsWith("/v0/auth/oidc/"))
+            throw new Error(`auth.oidc.${id}.redirect_path must be a /v0 auth route`);
+        oidc.set(id, {
+            id,
+            discoveryUrl: string(provider.discovery_url, `auth.oidc.${id}.discovery_url`),
+            clientId: string(provider.client_id, `auth.oidc.${id}.client_id`),
+            clientSecretEnv: string(provider.client_secret_env, `auth.oidc.${id}.client_secret_env`),
+            scopes: [...scopes],
+            redirectPath,
+        });
+    }
+    if (oidc.size > 1) {
+        throw new Error("only one OIDC provider can be enabled at a time");
+    }
+    const magicEnabled = boolean(magicLink.enabled, "auth.magic_link.enabled");
+    const magicRedirectUrl = string(magicLink.redirect_url, "auth.magic_link.redirect_url", true);
+    if (magicEnabled && !magicRedirectUrl)
+        throw new Error("auth.magic_link.redirect_url is required when magic links are enabled");
+    const cloudflareAccessEnabled = boolean(cloudflareAccess.enabled, "auth.cloudflare_access.enabled");
+    const cloudflareAccessTeamDomain = string(cloudflareAccess.team_domain, "auth.cloudflare_access.team_domain", !cloudflareAccessEnabled);
+    const cloudflareAccessAudience = string(cloudflareAccess.audience, "auth.cloudflare_access.audience", !cloudflareAccessEnabled);
+    let normalizedCloudflareAccessTeamDomain = cloudflareAccessTeamDomain;
+    if (cloudflareAccessEnabled) {
+        const teamDomain = new URL(cloudflareAccessTeamDomain);
+        if (teamDomain.protocol !== "https:" ||
+            !teamDomain.hostname.endsWith(".cloudflareaccess.com") ||
+            teamDomain.username ||
+            teamDomain.password ||
+            teamDomain.port ||
+            teamDomain.pathname !== "/" ||
+            teamDomain.search ||
+            teamDomain.hash)
+            throw new Error("auth.cloudflare_access.team_domain must be an https Cloudflare Access team domain");
+        normalizedCloudflareAccessTeamDomain = teamDomain.origin;
+    }
+    const enabledMethods = [
+        boolean(password.enabled, "auth.password.enabled"),
+        magicEnabled,
+        oidc.size > 0,
+        cloudflareAccessEnabled,
+    ].filter(Boolean).length;
+    if (enabledMethods > 1) {
+        throw new Error("only one authentication method can be enabled at a time");
+    }
+    return {
+        server: {
+            role,
+            host: string(server.host, "server.host"),
+            port: integer(server.port, "server.port"),
+            publicUrl: publicUrl.replace(/\/$/, ""),
+            trustedProxyHops,
+        },
+        database: {
+            url: string(database.url, "database.url"),
+            authTokenEnv: string(database.auth_token_env, "database.auth_token_env", true),
+        },
+        agents: {
+            enabled: boolean(agents.enabled, "agents.enabled", true),
+            directory: paths.rigDirectory,
+            socketPath: string(agents.socket_path, "agents.socket_path", true) ??
+                process.env.RIG_SERVER_SOCKET_PATH ??
+                join(paths.rigDirectory, "server.sock"),
+            tokenPath: string(agents.token_path, "agents.token_path", true) ??
+                process.env.RIG_SERVER_TOKEN_PATH ??
+                join(paths.rigDirectory, "token"),
+            command: string(agents.command, "agents.command", true) ??
+                process.env.RIG_COMMAND ??
+                bundledRigCommand(),
+            defaultCwd: string(agents.default_cwd, "agents.default_cwd", true) ?? paths.workspacesDirectory,
+        },
+        files: {
+            provider: fileProvider,
+            directory: string(files.directory, "files.directory", true) ?? paths.filesDirectory,
+            signedUrlExpirySeconds,
+            maxUploadBytes,
+            resumableChunkBytes,
+            perUserQuotaBytes,
+            serverQuotaBytes,
+            incompleteUploadExpirySeconds,
+            quarantineRetentionSeconds,
+            malwareScannerCommand: string(files.malware_scanner_command, "files.malware_scanner_command", true),
+            malwareScannerArguments: strings(files.malware_scanner_arguments, "files.malware_scanner_arguments"),
+            malwareScanTimeoutSeconds,
+            malwareScanFailureMode,
+        },
+        security: {
+            integrationSecretEnv: string(security.integration_secret_env, "security.integration_secret_env", true) ??
+                "HAPPY2_INTEGRATION_SECRET",
+            rateLimit: {
+                enabled: boolean(rateLimit.enabled, "security.rate_limit.enabled", true),
+                readsPerMinute,
+                writesPerMinute,
+                authPerMinute,
+            },
+            idempotency: {
+                enabled: boolean(idempotency.enabled, "security.idempotency.enabled", true),
+                leaseSeconds: idempotencyLeaseSeconds,
+                retentionSeconds: idempotencyRetentionSeconds,
+            },
+        },
+        jwt: {
+            issuer: string(jwt.issuer, "jwt.issuer"),
+            audience: string(jwt.audience, "jwt.audience"),
+            keyId: string(jwt.key_id, "jwt.key_id"),
+            privateKeyPath,
+            publicKeyPath,
+            expiryDays,
+        },
+        auth: {
+            password: {
+                enabled: boolean(password.enabled, "auth.password.enabled"),
+                signupEnabled: boolean(password.signup_enabled, "auth.password.signup_enabled"),
+            },
+            magicLink: {
+                enabled: magicEnabled,
+                from: string(magicLink.from, "auth.magic_link.from", true),
+                redirectUrl: magicRedirectUrl,
+            },
+            oidc,
+            cloudflareAccess: {
+                enabled: cloudflareAccessEnabled,
+                teamDomain: normalizedCloudflareAccessTeamDomain,
+                audience: cloudflareAccessAudience,
+            },
+        },
+    };
+}
+function quota(value, path) {
+    const result = integer(value, path, 0);
+    if (!Number.isSafeInteger(result) || result < 0)
+        throw new Error(`${path} must be zero or a positive safe integer`);
+    return result;
+}
+function boundedPositiveInteger(value, path, fallback, maximum) {
+    const result = integer(value, path, fallback);
+    if (result < 1 || result > maximum)
+        throw new Error(`${path} must be between 1 and ${maximum}`);
+    return result;
+}
+export async function loadConfig(path) {
+    return parseConfig(await readFile(path, "utf8"));
+}
+//# sourceMappingURL=loader.js.map

package/packages/happy2-server/dist/modules/config/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../../sources/modules/config/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAO/C,SAAS,KAAK,CAAC,KAAc,EAAE,IAAY;IACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAC;IACpD,OAAO,KAAc,CAAC;AAC1B,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,IAAY,EAAE,QAAQ,GAAG,KAAK;IAC1D,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,IAAY,EAAE,QAAQ,GAAG,KAAK;IAC3D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACzC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wBAAwB,CAAC,CAAC;IACjF,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,IAAY,EAAE,QAAiB;IAC5D,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACnE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qBAAqB,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,IAAY,EAAE,QAAQ,GAAa,EAAE;IAClE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,yBAAyB,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAe,CAAC;IAC9D,IAAI,CAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,mBAAmB,CAAE,CAAC;IAClE,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IACnB,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,2BAA2B,EAAE,CAAC,CAAC,CAAC;IAC5F,IAAI,gBAAgB,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAE1F,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,CAAC,IAAI,OAAO,CAAC;IAC/E,IAAI,YAAY,KAAK,OAAO;QACxB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACzE,MAAM,sBAAsB,GAAG,OAAO,CAClC,KAAK,CAAC,yBAAyB,EAC/B,iCAAiC,EACjC,GAAG,CACN,CAAC;IACF,IAAI,sBAAsB,GAAG,CAAC,IAAI,sBAAsB,GAAG,IAAI;QAC3D,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAClF,MAAM,cAAc,GAAG,OAAO,CAC1B,KAAK,CAAC,gBAAgB,EACtB,wBAAwB,EACxB,GAAG,GAAG,IAAI,GAAG,IAAI,CACpB,CAAC;IACF,IAAI,cAAc,GAAG,IAAI,IAAI,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI;QAChE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC9E,MAAM,mBAAmB,GAAG,OAAO,CAC/B,KAAK,CAAC,qBAAqB,EAC3B,6BAA6B,EAC7B,CAAC,GAAG,IAAI,GAAG,IAAI,CAClB,CAAC;IACF,IAAI,mBAAmB,GAAG,EAAE,GAAG,IAAI,IAAI,mBAAmB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;QACzE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACrF,MAAM,iBAAiB,GAAG,KAAK,CAAC,KAAK,CAAC,oBAAoB,EAAE,4BAA4B,CAAC,CAAC;IAC1F,MAAM,gBAAgB,GAAG,KAAK,CAAC,KAAK,CAAC,kBAAkB,EAAE,0BAA0B,CAAC,CAAC;IACrF,MAAM,6BAA6B,GAAG,OAAO,CACzC,KAAK,CAAC,gCAAgC,EACtC,wCAAwC,EACxC,EAAE,GAAG,EAAE,GAAG,EAAE,CACf,CAAC;IACF,IAAI,6BAA6B,GAAG,EAAE,IAAI,6BAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;QACvF,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC7F,MAAM,0BAA0B,GAAG,OAAO,CACtC,KAAK,CAAC,4BAA4B,EAClC,oCAAoC,EACpC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CACpB,CAAC;IACF,IAAI,0BAA0B,GAAG,CAAC,IAAI,0BAA0B,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;QACjF,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACzF,MAAM,yBAAyB,GAAG,OAAO,CACrC,KAAK,CAAC,4BAA4B,EAClC,oCAAoC,EACpC,GAAG,CACN,CAAC;IACF,IAAI,yBAAyB,GAAG,CAAC,IAAI,yBAAyB,GAAG,IAAI;QACjE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACrF,MAAM,sBAAsB,GACxB,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,iCAAiC,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC;IAC/F,IAAI,sBAAsB,KAAK,OAAO,IAAI,sBAAsB,KAAK,MAAM;QACvE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,EAAE,qBAAqB,CAAC,CAAC;IAC1E,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,EAAE,sBAAsB,CAAC,CAAC;IAC9E,MAAM,cAAc,GAAG,sBAAsB,CACzC,SAAS,CAAC,gBAAgB,EAC1B,sCAAsC,EACtC,KAAK,EACL,SAAS,CACZ,CAAC;IACF,MAAM,eAAe,GAAG,sBAAsB,CAC1C,SAAS,CAAC,iBAAiB,EAC3B,uCAAuC,EACvC,GAAG,EACH,SAAS,CACZ,CAAC;IACF,MAAM,aAAa,GAAG,sBAAsB,CACxC,SAAS,CAAC,eAAe,EACzB,qCAAqC,EACrC,EAAE,EACF,SAAS,CACZ,CAAC;IACF,MAAM,uBAAuB,GAAG,sBAAsB,CAClD,WAAW,CAAC,aAAa,EACzB,oCAAoC,EACpC,EAAE,EACF,KAAK,CACR,CAAC;IACF,MAAM,2BAA2B,GAAG,sBAAsB,CACtD,WAAW,CAAC,iBAAiB,EAC7B,wCAAwC,EACxC,MAAM,EACN,UAAU,CACb,CAAC;IACF,IAAI,2BAA2B,GAAG,uBAAuB;QACrD,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC7F,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;IACnE,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,EAAE;QACjC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAChE,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,sBAAsB,EAAE,IAAI,CAAC,CAAC;IAClF,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,qBAAqB,EAAE,IAAI,CAAC,CAAC;IAE/E,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,eAAe,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,iBAAiB,CAAC,CAAC;IAClE,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,EAAE,wBAAwB,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,IAAI,GAAG,EAA8B,CAAC;IACnD,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC;YAAE,SAAS;QACpE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;YAC7E,MAAM,IAAI,KAAK,CAAC,aAAa,EAAE,8BAA8B,CAAC,CAAC;QACnE,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,aAAa,EAAE,gBAAgB,CAAE,CAAC;QACtF,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,gBAAgB,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,aAAa,EAAE,yCAAyC,CAAC,CAAC;QAC9E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE;YACT,EAAE;YACF,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,aAAa,EAAE,gBAAgB,CAAE;YAC9E,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,aAAa,EAAE,YAAY,CAAE;YAClE,eAAe,EAAE,MAAM,CACnB,QAAQ,CAAC,iBAAiB,EAC1B,aAAa,EAAE,oBAAoB,CACrC;YACF,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC;YACnB,YAAY;SACf,CAAC,CAAC;IACP,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;IAC3E,MAAM,gBAAgB,GAAG,MAAM,CAAC,SAAS,CAAC,YAAY,EAAE,8BAA8B,EAAE,IAAI,CAAC,CAAC;IAC9F,IAAI,YAAY,IAAI,CAAC,gBAAgB;QACjC,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC7F,MAAM,uBAAuB,GAAG,OAAO,CACnC,gBAAgB,CAAC,OAAO,EACxB,gCAAgC,CACnC,CAAC;IACF,MAAM,0BAA0B,GAAG,MAAM,CACrC,gBAAgB,CAAC,WAAW,EAC5B,oCAAoC,EACpC,CAAC,uBAAuB,CAC3B,CAAC;IACF,MAAM,wBAAwB,GAAG,MAAM,CACnC,gBAAgB,CAAC,QAAQ,EACzB,iCAAiC,EACjC,CAAC,uBAAuB,CAC3B,CAAC;IACF,IAAI,oCAAoC,GAAG,0BAA0B,CAAC;IACtE,IAAI,uBAAuB,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,0BAA2B,CAAC,CAAC;QACxD,IACI,UAAU,CAAC,QAAQ,KAAK,QAAQ;YAChC,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YACtD,UAAU,CAAC,QAAQ;YACnB,UAAU,CAAC,QAAQ;YACnB,UAAU,CAAC,IAAI;YACf,UAAU,CAAC,QAAQ,KAAK,GAAG;YAC3B,UAAU,CAAC,MAAM;YACjB,UAAU,CAAC,IAAI;YAEf,MAAM,IAAI,KAAK,CACX,mFAAmF,CACtF,CAAC;QACN,oCAAoC,GAAG,UAAU,CAAC,MAAM,CAAC;IAC7D,CAAC;IACD,MAAM,cAAc,GAAG;QACnB,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;QAClD,YAAY;QACZ,IAAI,CAAC,IAAI,GAAG,CAAC;QACb,uBAAuB;KAC1B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IACzB,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO;QACH,MAAM,EAAE;YACJ,IAAI;YACJ,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAE;YACzC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC;YACzC,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YACvC,gBAAgB;SACnB;QACD,QAAQ,EAAE;YACN,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAE;YAC1C,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,yBAAyB,EAAE,IAAI,CAAC;SACjF;QACD,MAAM,EAAE;YACJ,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC;YACxD,SAAS,EAAE,KAAK,CAAC,YAAY;YAC7B,UAAU,EACN,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,oBAAoB,EAAE,IAAI,CAAC;gBACtD,OAAO,CAAC,GAAG,CAAC,sBAAsB;gBAClC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,aAAa,CAAC;YAC3C,SAAS,EACL,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,mBAAmB,EAAE,IAAI,CAAC;gBACpD,OAAO,CAAC,GAAG,CAAC,qBAAqB;gBACjC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC;YACrC,OAAO,EACH,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC;gBAC9C,OAAO,CAAC,GAAG,CAAC,WAAW;gBACvB,iBAAiB,EAAE;YACvB,UAAU,EACN,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,oBAAoB,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,mBAAmB;SAC1F;QACD,KAAK,EAAE;YACH,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,iBAAiB,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,cAAc;YACnF,sBAAsB;YACtB,cAAc;YACd,mBAAmB;YACnB,iBAAiB;YACjB,gBAAgB;YAChB,6BAA6B;YAC7B,0BAA0B;YAC1B,qBAAqB,EAAE,MAAM,CACzB,KAAK,CAAC,uBAAuB,EAC7B,+BAA+B,EAC/B,IAAI,CACP;YACD,uBAAuB,EAAE,OAAO,CAC5B,KAAK,CAAC,yBAAyB,EAC/B,iCAAiC,CACpC;YACD,yBAAyB;YACzB,sBAAsB;SACzB;QACD,QAAQ,EAAE;YACN,oBAAoB,EAChB,MAAM,CAAC,QAAQ,CAAC,sBAAsB,EAAE,iCAAiC,EAAE,IAAI,CAAC;gBAChF,2BAA2B;YAC/B,SAAS,EAAE;gBACP,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,6BAA6B,EAAE,IAAI,CAAC;gBACxE,cAAc;gBACd,eAAe;gBACf,aAAa;aAChB;YACD,WAAW,EAAE;gBACT,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,8BAA8B,EAAE,IAAI,CAAC;gBAC3E,YAAY,EAAE,uBAAuB;gBACrC,gBAAgB,EAAE,2BAA2B;aAChD;SACJ;QACD,GAAG,EAAE;YACD,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAE;YACzC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAE;YAC/C,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAE;YACxC,cAAc;YACd,aAAa;YACb,UAAU;SACb;QACD,IAAI,EAAE;YACF,QAAQ,EAAE;gBACN,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;gBAC3D,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,8BAA8B,CAAC;aAClF;YACD,SAAS,EAAE;gBACP,OAAO,EAAE,YAAY;gBACrB,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,sBAAsB,EAAE,IAAI,CAAC;gBAC1D,WAAW,EAAE,gBAAgB;aAChC;YACD,IAAI;YACJ,gBAAgB,EAAE;gBACd,OAAO,EAAE,uBAAuB;gBAChC,UAAU,EAAE,oCAAoC;gBAChD,QAAQ,EAAE,wBAAwB;aACrC;SACJ;KACJ,CAAC;AACN,CAAC;AAED,SAAS,KAAK,CAAC,KAAc,EAAE,IAAY;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,0CAA0C,CAAC,CAAC;IACvE,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,SAAS,sBAAsB,CAC3B,KAAc,EACd,IAAY,EACZ,QAAgB,EAChB,OAAe;IAEf,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC9C,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,0BAA0B,OAAO,EAAE,CAAC,CAAC;IAChG,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY;IACzC,OAAO,WAAW,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AACrD,CAAC"}

package/packages/happy2-server/dist/modules/config/loader.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=loader.test.d.ts.map

package/packages/happy2-server/dist/modules/config/loader.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.test.d.ts","sourceRoot":"","sources":["../../../sources/modules/config/loader.test.ts"],"names":[],"mappings":""}

package/packages/happy2-server/dist/modules/config/loader.test.js

@@ -0,0 +1,108 @@
+import { describe, expect, it } from "vitest";
+import { join } from "node:path";
+import { parseConfig } from "./loader.js";
+const base = `[server]
+role = "all"
+host = "127.0.0.1"
+port = 3000
+public_url = "https://happy2.example"
+
+[database]
+url = "file:/tmp/happy2.db"
+
+[jwt]
+issuer = "https://happy2.example"
+audience = "happy2"
+key_id = "test"
+`;
+describe("TOML config", () => {
+    it("loads one selected authentication mechanism", () => {
+        const config = parseConfig(`${base}
+[auth.oidc.example]
+enabled = true
+discovery_url = "https://id.example/.well-known/openid-configuration"
+client_id = "client"
+client_secret_env = "OIDC_SECRET"
+redirect_path = "/v0/auth/oidc/example/callback"
+`);
+        expect(config.auth.password.enabled).toBe(false);
+        expect(config.auth.oidc.get("example")?.clientSecretEnv).toBe("OIDC_SECRET");
+        expect(config.agents).toMatchObject({
+            directory: join(process.cwd(), ".happy2", "rig"),
+            defaultCwd: join(process.cwd(), ".happy2", "workspaces"),
+        });
+        expect(config.files.directory).toBe(join(process.cwd(), ".happy2", "files"));
+    });
+    it("rejects more than one enabled authentication mechanism", () => {
+        expect(() => parseConfig(`${base}
+[auth.password]
+enabled = true
+
+[auth.magic_link]
+enabled = true
+redirect_url = "happy2://auth/magic-link"
+`)).toThrow("only one authentication method");
+        expect(() => parseConfig(`${base}
+[auth.password]
+enabled = true
+
+[auth.cloudflare_access]
+enabled = true
+team_domain = "https://happy.cloudflareaccess.com"
+audience = "cloudflare-access-audience"
+`)).toThrow("only one authentication method");
+    });
+    it("loads a Cloudflare Access application and rejects unsafe team domains", () => {
+        const config = parseConfig(`${base}
+[auth.cloudflare_access]
+enabled = true
+team_domain = "https://happy.cloudflareaccess.com"
+audience = "cloudflare-access-audience"
+`);
+        expect(config.auth.cloudflareAccess).toEqual({
+            enabled: true,
+            teamDomain: "https://happy.cloudflareaccess.com",
+            audience: "cloudflare-access-audience",
+        });
+        expect(() => parseConfig(`${base}
+[auth.cloudflare_access]
+enabled = true
+team_domain = "https://cloudflareaccess.com.evil.example"
+audience = "cloudflare-access-audience"
+`)).toThrow("team_domain");
+    });
+    it("requires a desktop callback when magic links are enabled", () => {
+        expect(() => parseConfig(`${base}
+[auth.magic_link]
+enabled = true
+`)).toThrow("redirect_url");
+    });
+    it("loads file pipeline limits and scanner policy", () => {
+        const config = parseConfig(`${base}
+[files]
+provider = "local"
+resumable_chunk_bytes = 1048576
+per_user_quota_bytes = 5368709120
+server_quota_bytes = 107374182400
+malware_scanner_command = "/usr/bin/scanner"
+malware_scanner_arguments = ["--quiet", "{path}"]
+malware_scan_failure_mode = "allow"
+`);
+        expect(config.files).toMatchObject({
+            provider: "local",
+            resumableChunkBytes: 1048576,
+            perUserQuotaBytes: 5368709120,
+            serverQuotaBytes: 107374182400,
+            malwareScannerCommand: "/usr/bin/scanner",
+            malwareScannerArguments: ["--quiet", "{path}"],
+            malwareScanFailureMode: "allow",
+        });
+    });
+    it("rejects unsafe file pipeline limits", () => {
+        expect(() => parseConfig(`${base}
+[files]
+resumable_chunk_bytes = 1
+`)).toThrow("resumable_chunk_bytes");
+    });
+});
+//# sourceMappingURL=loader.test.js.map

package/packages/happy2-server/dist/modules/config/loader.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.test.js","sourceRoot":"","sources":["../../../sources/modules/config/loader.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,IAAI,GAAG;;;;;;;;;;;;;CAaZ,CAAC;AAEF,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACnD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,IAAI;;;;;;;CAOzC,CAAC,CAAC;QACK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC;YAChC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC;YAChD,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC;SAC3D,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,GAAG,EAAE,CACR,WAAW,CAAC,GAAG,IAAI;;;;;;;CAO9B,CAAC,CACO,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,EAAE,CACR,WAAW,CAAC,GAAG,IAAI;;;;;;;;CAQ9B,CAAC,CACO,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC7E,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,IAAI;;;;;CAKzC,CAAC,CAAC;QACK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC;YACzC,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,oCAAoC;YAChD,QAAQ,EAAE,4BAA4B;SACzC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,EAAE,CACR,WAAW,CAAC,GAAG,IAAI;;;;;CAK9B,CAAC,CACO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,GAAG,EAAE,CACR,WAAW,CAAC,GAAG,IAAI;;;CAG9B,CAAC,CACO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACrD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,IAAI;;;;;;;;;CASzC,CAAC,CAAC;QACK,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC;YAC/B,QAAQ,EAAE,OAAO;YACjB,mBAAmB,EAAE,OAAO;YAC5B,iBAAiB,EAAE,UAAU;YAC7B,gBAAgB,EAAE,YAAY;YAC9B,qBAAqB,EAAE,kBAAkB;YACzC,uBAAuB,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC;YAC9C,sBAAsB,EAAE,OAAO;SAClC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,GAAG,EAAE,CACR,WAAW,CAAC,GAAG,IAAI;;;CAG9B,CAAC,CACO,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/packages/happy2-server/dist/modules/config/paths.d.ts

@@ -0,0 +1,7 @@
+export declare function localRuntimePaths(cwd?: string, environment?: NodeJS.ProcessEnv): {
+    filesDirectory: string;
+    rigDirectory: string;
+    runtimeDirectory: string;
+    workspacesDirectory: string;
+};
+//# sourceMappingURL=paths.d.ts.map

package/packages/happy2-server/dist/modules/config/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../sources/modules/config/paths.ts"],"names":[],"mappings":"AAEA,wBAAgB,iBAAiB,CAC7B,GAAG,SAAgB,EACnB,WAAW,GAAE,MAAM,CAAC,UAAwB,GAC7C;IACC,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;CAC/B,CAYA"}

package/packages/happy2-server/dist/modules/config/paths.js

@@ -0,0 +1,15 @@
+import { isAbsolute, join } from "node:path";
+export function localRuntimePaths(cwd = process.cwd(), environment = process.env) {
+    const runtimeDirectory = join(cwd, ".happy2");
+    const configuredRigHome = environment.RIG_HOME?.trim();
+    if (configuredRigHome && !isAbsolute(configuredRigHome)) {
+        throw new Error("RIG_HOME must be an absolute path.");
+    }
+    return {
+        filesDirectory: join(runtimeDirectory, "files"),
+        rigDirectory: configuredRigHome || join(runtimeDirectory, "rig"),
+        runtimeDirectory,
+        workspacesDirectory: join(runtimeDirectory, "workspaces"),
+    };
+}
+//# sourceMappingURL=paths.js.map

package/packages/happy2-server/dist/modules/config/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../../sources/modules/config/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE7C,MAAM,UAAU,iBAAiB,CAC7B,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EACnB,WAAW,GAAsB,OAAO,CAAC,GAAG;IAO5C,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC9C,MAAM,iBAAiB,GAAG,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IACvD,IAAI,iBAAiB,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO;QACH,cAAc,EAAE,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC;QAC/C,YAAY,EAAE,iBAAiB,IAAI,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC;QAChE,gBAAgB;QAChB,mBAAmB,EAAE,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC;KAC5D,CAAC;AACN,CAAC"}

package/packages/happy2-server/dist/modules/config/paths.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=paths.test.d.ts.map

package/packages/happy2-server/dist/modules/config/paths.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.test.d.ts","sourceRoot":"","sources":["../../../sources/modules/config/paths.test.ts"],"names":[],"mappings":""}

package/packages/happy2-server/dist/modules/config/paths.test.js

@@ -0,0 +1,22 @@
+import { describe, expect, it } from "vitest";
+import { join } from "node:path";
+import { localRuntimePaths } from "./paths.js";
+describe("local runtime paths", () => {
+    it("keeps the private Rig home with the local Happy runtime by default", () => {
+        expect(localRuntimePaths("/workspace/happy", {})).toMatchObject({
+            rigDirectory: "/workspace/happy/.happy2/rig",
+            runtimeDirectory: "/workspace/happy/.happy2",
+        });
+    });
+    it("uses an absolute RIG_HOME for private Rig configuration and state", () => {
+        expect(localRuntimePaths("/workspace/happy", { RIG_HOME: "/private/rig" })).toMatchObject({
+            filesDirectory: join("/workspace/happy", ".happy2", "files"),
+            rigDirectory: "/private/rig",
+            workspacesDirectory: join("/workspace/happy", ".happy2", "workspaces"),
+        });
+    });
+    it("rejects a relative RIG_HOME before starting Rig", () => {
+        expect(() => localRuntimePaths("/workspace/happy", { RIG_HOME: "relative/rig" })).toThrow("RIG_HOME must be an absolute path.");
+    });
+});
+//# sourceMappingURL=paths.test.js.map

package/packages/happy2-server/dist/modules/config/paths.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.test.js","sourceRoot":"","sources":["../../../sources/modules/config/paths.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,iBAAiB,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;YAC5D,YAAY,EAAE,8BAA8B;YAC5C,gBAAgB,EAAE,0BAA0B;SAC/C,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,iBAAiB,CAAC,kBAAkB,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;YACtF,cAAc,EAAE,IAAI,CAAC,kBAAkB,EAAE,SAAS,EAAE,OAAO,CAAC;YAC5D,YAAY,EAAE,cAAc;YAC5B,mBAAmB,EAAE,IAAI,CAAC,kBAAkB,EAAE,SAAS,EAAE,YAAY,CAAC;SACzE,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,kBAAkB,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,OAAO,CACrF,oCAAoC,CACvC,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/packages/happy2-server/dist/modules/config/runtime.d.ts

@@ -0,0 +1,6 @@
+import type { ServerConfig } from "./type.js";
+export declare function loadRuntimeConfig(configPath?: string): Promise<{
+    config: ServerConfig;
+    managedConfigPath: string;
+}>;
+//# sourceMappingURL=runtime.d.ts.map

package/packages/happy2-server/dist/modules/config/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../sources/modules/config/runtime.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAE9C,wBAAsB,iBAAiB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAClE,MAAM,EAAE,YAAY,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;CAC7B,CAAC,CAMD"}

package/packages/happy2-server/dist/modules/config/runtime.js

@@ -0,0 +1,14 @@
+import { mkdir } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { defaultConfig } from "./defaults.js";
+import { initializeManagedEnvironment } from "./environment.js";
+import { loadConfig } from "./loader.js";
+export async function loadRuntimeConfig(configPath) {
+    const managedConfigPath = configPath ?? join(process.cwd(), ".happy2", "happy2.toml");
+    if (!configPath)
+        await mkdir(dirname(managedConfigPath), { recursive: true, mode: 0o700 });
+    const config = configPath ? await loadConfig(configPath) : defaultConfig();
+    await initializeManagedEnvironment(managedConfigPath, config);
+    return { config, managedConfigPath };
+}
+//# sourceMappingURL=runtime.js.map

package/packages/happy2-server/dist/modules/config/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../sources/modules/config/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,UAAmB;IAIvD,MAAM,iBAAiB,GAAG,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;IACtF,IAAI,CAAC,UAAU;QAAE,MAAM,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3F,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC3E,MAAM,4BAA4B,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IAC9D,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;AACzC,CAAC"}

package/packages/happy2-server/dist/modules/config/type.d.ts

@@ -0,0 +1,88 @@
+export type ServerRole = "all" | "auth" | "api";
+export interface OidcProviderConfig {
+    id: string;
+    discoveryUrl: string;
+    clientId: string;
+    clientSecretEnv: string;
+    scopes: string[];
+    redirectPath: string;
+}
+export interface CloudflareAccessConfig {
+    enabled: boolean;
+    /** Cloudflare Zero Trust team domain, for example https://team.cloudflareaccess.com. */
+    teamDomain?: string;
+    /** The immutable Application Audience (AUD) tag assigned by Cloudflare Access. */
+    audience?: string;
+}
+export interface ServerConfig {
+    server: {
+        role: ServerRole;
+        host: string;
+        port: number;
+        publicUrl: string;
+        trustedProxyHops: number;
+    };
+    database: {
+        url: string;
+        authTokenEnv?: string;
+    };
+    agents: {
+        enabled: boolean;
+        directory: string;
+        socketPath: string;
+        tokenPath: string;
+        command: string;
+        defaultCwd: string;
+    };
+    files: {
+        provider: "local";
+        directory: string;
+        signedUrlExpirySeconds: number;
+        maxUploadBytes: number;
+        resumableChunkBytes: number;
+        perUserQuotaBytes: number;
+        serverQuotaBytes: number;
+        incompleteUploadExpirySeconds: number;
+        quarantineRetentionSeconds: number;
+        malwareScannerCommand?: string;
+        malwareScannerArguments: string[];
+        malwareScanTimeoutSeconds: number;
+        malwareScanFailureMode: "allow" | "deny";
+    };
+    security: {
+        integrationSecretEnv: string;
+        rateLimit: {
+            enabled: boolean;
+            readsPerMinute: number;
+            writesPerMinute: number;
+            authPerMinute: number;
+        };
+        idempotency: {
+            enabled: boolean;
+            leaseSeconds: number;
+            retentionSeconds: number;
+        };
+    };
+    jwt: {
+        issuer: string;
+        audience: string;
+        keyId: string;
+        privateKeyPath?: string;
+        publicKeyPath?: string;
+        expiryDays: number;
+    };
+    auth: {
+        password: {
+            enabled: boolean;
+            signupEnabled: boolean;
+        };
+        magicLink: {
+            enabled: boolean;
+            from?: string;
+            redirectUrl?: string;
+        };
+        oidc: Map<string, OidcProviderConfig>;
+        cloudflareAccess: CloudflareAccessConfig;
+    };
+}
+//# sourceMappingURL=type.d.ts.map

package/packages/happy2-server/dist/modules/config/type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"type.d.ts","sourceRoot":"","sources":["../../../sources/modules/config/type.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;AAEhD,MAAM,WAAW,kBAAkB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,wFAAwF;IACxF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IACzB,MAAM,EAAE;QACJ,IAAI,EAAE,UAAU,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,gBAAgB,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD,MAAM,EAAE;QACJ,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,KAAK,EAAE;QACH,QAAQ,EAAE,OAAO,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,sBAAsB,EAAE,MAAM,CAAC;QAC/B,cAAc,EAAE,MAAM,CAAC;QACvB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,iBAAiB,EAAE,MAAM,CAAC;QAC1B,gBAAgB,EAAE,MAAM,CAAC;QACzB,6BAA6B,EAAE,MAAM,CAAC;QACtC,0BAA0B,EAAE,MAAM,CAAC;QACnC,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAC/B,uBAAuB,EAAE,MAAM,EAAE,CAAC;QAClC,yBAAyB,EAAE,MAAM,CAAC;QAClC,sBAAsB,EAAE,OAAO,GAAG,MAAM,CAAC;KAC5C,CAAC;IACF,QAAQ,EAAE;QACN,oBAAoB,EAAE,MAAM,CAAC;QAC7B,SAAS,EAAE;YACP,OAAO,EAAE,OAAO,CAAC;YACjB,cAAc,EAAE,MAAM,CAAC;YACvB,eAAe,EAAE,MAAM,CAAC;YACxB,aAAa,EAAE,MAAM,CAAC;SACzB,CAAC;QACF,WAAW,EAAE;YACT,OAAO,EAAE,OAAO,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,gBAAgB,EAAE,MAAM,CAAC;SAC5B,CAAC;KACL,CAAC;IACF,GAAG,EAAE;QACD,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,IAAI,EAAE;QACF,QAAQ,EAAE;YAAE,OAAO,EAAE,OAAO,CAAC;YAAC,aAAa,EAAE,OAAO,CAAA;SAAE,CAAC;QACvD,SAAS,EAAE;YAAE,OAAO,EAAE,OAAO,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,WAAW,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACrE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;QACtC,gBAAgB,EAAE,sBAAsB,CAAC;KAC5C,CAAC;CACL"}

package/packages/happy2-server/dist/modules/config/type.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=type.js.map

package/packages/happy2-server/dist/modules/config/type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"type.js","sourceRoot":"","sources":["../../../sources/modules/config/type.ts"],"names":[],"mappings":""}