openmausbot 0.1.90 → 0.1.92

package/dist-server/server/cloud-move.js

@@ -0,0 +1,418 @@
+// Move to Cloud (docs/cloud-pro.md): a person's one-time copy of their local
+// workspace onto their OMB Cloud home. The desktop exports the ordinary
+// encrypted workspace backup (workspace-backup.ts) and uploads it here in
+// parts; this machine then previews and restores it like any other backup,
+// so everything that backup policy keeps out (credentials, sign-ins, pairing
+// and sessions, runtime state) stays where it is on both sides.
+//
+// What this file adds: the workspace's size and contents, a resumable upload
+// slot, the space check for the machine's fixed-size volume, a backup of the
+// Cloud's own workspace taken before it is replaced ("Restore previous Cloud"
+// swaps it back), and the tidying that keeps that backup the only copy left
+// behind. Everything lives under `.backups`, which no snapshot includes and
+// no restore replaces.
+import { createHash, randomBytes } from "node:crypto";
+import { createReadStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statfsSync, writeFileSync } from "node:fs";
+import { open } from "node:fs/promises";
+import { join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { writeFileAtomic } from "./atomic.js";
+import { MAX_WORKSPACE_BACKUP_FILES, MAX_WORKSPACE_BACKUP_UPLOAD_BYTES, omittedFromWorkspaceBackup, removeWorkspaceBackupJob, stageWorkspaceBackup, } from "./workspace-backup.js";
+/** The part size the desktop sends; a part may be at most CLOUD_MOVE_MAX_PART_BYTES. */
+export const CLOUD_MOVE_PART_BYTES = 16 * 1024 ** 2;
+export const CLOUD_MOVE_MAX_PART_BYTES = 64 * 1024 ** 2;
+export const CLOUD_MOVE_MAX_BYTES = MAX_WORKSPACE_BACKUP_UPLOAD_BYTES;
+export const CLOUD_MOVE_MAX_FILES = MAX_WORKSPACE_BACKUP_FILES;
+/** Headroom kept free on the volume after a move's own files. */
+export const CLOUD_MOVE_SPACE_MARGIN = 256 * 1024 ** 2;
+// Encrypted header plus tag: anything smaller cannot be a backup.
+const MIN_BYTES = 60;
+const SHA256 = /^[a-f0-9]{64}$/;
+// An upload nobody has touched for a day is abandoned, not resumable.
+const UPLOAD_STALE_MS = 24 * 3600_000;
+const fail = (message, status, extra = {}) => Object.assign(new Error(message), { status, ...extra });
+const record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+function rosterLength(path) {
+    try {
+        const value = JSON.parse(readFileSync(path, "utf8"));
+        return Array.isArray(value) ? value.length : 0;
+    }
+    catch {
+        return 0;
+    }
+}
+/** What the person would call their work: bots, rooms, and the conversations
+ * they took part in (a starter bot's greeting is not a chat). */
+export function workspaceContents(dataDir) {
+    let chats = 0;
+    const database = join(dataDir, "messages.db");
+    if (existsSync(database)) {
+        const db = new DatabaseSync(database, { timeout: 5_000 });
+        try {
+            const columns = db.prepare("SELECT name FROM pragma_table_info('messages')").all().map((row) => String(row.name));
+            if (columns.length) {
+                const who = columns.includes("role") ? "role" : "json_extract(json, '$.role')";
+                chats = Number(db.prepare(`SELECT COUNT(DISTINCT thread_id) AS chats FROM messages WHERE ${who} = 'user'`).get()?.chats ?? 0);
+            }
+        }
+        finally {
+            db.close();
+        }
+    }
+    return { bots: rosterLength(join(dataDir, "bots.json")), rooms: rosterLength(join(dataDir, "groups.json")), chats };
+}
+/** A fresh machine: its one starter bot at most, no rooms, nobody has chatted. */
+export function isEmptyWorkspace(contents) {
+    return contents.bots <= 1 && contents.rooms === 0 && contents.chats === 0;
+}
+/** Bytes and files a backup of this workspace would carry, by the export's
+ * own rules. An estimate: live files can change before the export. */
+export function workspaceMoveSize(dataDir) {
+    let bytes = 0, files = 0;
+    const walk = (directory, prefix) => {
+        for (const name of readdirSync(directory)) {
+            const path = prefix ? `${prefix}/${name}` : name;
+            if (omittedFromWorkspaceBackup(path))
+                continue;
+            const stat = lstatSync(join(directory, name));
+            if (stat.isSymbolicLink())
+                continue;
+            if (stat.isDirectory())
+                walk(join(directory, name), path);
+            else if (stat.isFile()) {
+                bytes += stat.size;
+                files++;
+            }
+            if (files > CLOUD_MOVE_MAX_FILES)
+                return;
+        }
+    };
+    if (existsSync(dataDir))
+        walk(dataDir, "");
+    return { bytes, files };
+}
+export function freeVolumeBytes(path) {
+    const disk = statfsSync(path, { bigint: true });
+    const free = disk.bavail * disk.bsize;
+    return free > BigInt(Number.MAX_SAFE_INTEGER) ? Number.MAX_SAFE_INTEGER : Number(free);
+}
+/** Peak extra space a move of `upload` bytes needs: the upload, its decrypted
+ * copy and its staged files exist together while it is checked; the restore
+ * then installs from the staged copy. Replacing a workspace first backs it up
+ * (a snapshot and its archive, briefly both). */
+export function moveSpaceNeeded(upload, current, replacing) {
+    return 3 * upload + (replacing ? 2 * current : 0) + CLOUD_MOVE_SPACE_MARGIN;
+}
+function privateFolder(path) {
+    mkdirSync(path, { recursive: true, mode: 0o700 });
+    const stat = lstatSync(path);
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+        throw fail("Backup storage must be a real folder, not a link.", 500);
+    return path;
+}
+const backupsRoot = (dataDir) => privateFolder(join(dataDir, ".backups"));
+// Reads never create the folder; beginUpload does.
+const uploadFolder = (dataDir) => join(dataDir, ".backups", "cloud-move");
+const uploadMetaPath = (dataDir) => join(uploadFolder(dataDir), "upload.json");
+const uploadPartPath = (dataDir) => join(uploadFolder(dataDir), "upload.part");
+function readUploadMeta(dataDir) {
+    try {
+        const value = JSON.parse(readFileSync(uploadMetaPath(dataDir), "utf8"));
+        if (record(value) && typeof value.sha256 === "string" && SHA256.test(value.sha256) && Number.isSafeInteger(value.bytes) && Number.isSafeInteger(value.updatedAt)) {
+            return value;
+        }
+    }
+    catch { /* none, or unreadable: a fresh upload replaces it */ }
+    return null;
+}
+function receivedBytes(dataDir) {
+    try {
+        const stat = lstatSync(uploadPartPath(dataDir));
+        return stat.isFile() ? stat.size : 0;
+    }
+    catch {
+        return 0;
+    }
+}
+export function uploadStatus(dataDir) {
+    const meta = readUploadMeta(dataDir);
+    return meta ? { sha256: meta.sha256, bytes: meta.bytes, received: Math.min(receivedBytes(dataDir), meta.bytes) } : null;
+}
+export function discardUpload(dataDir) {
+    rmSync(uploadPartPath(dataDir), { force: true });
+    rmSync(uploadMetaPath(dataDir), { force: true });
+}
+/** Check a declared upload: its size, file count and SHA-256. */
+export function validUploadDeclaration(input) {
+    if (typeof input.sha256 !== "string" || !SHA256.test(input.sha256))
+        throw fail("This is not a workspace backup.", 400);
+    if (!Number.isSafeInteger(input.bytes) || input.bytes < MIN_BYTES)
+        throw fail("This is not a workspace backup.", 400);
+    if (input.bytes > CLOUD_MOVE_MAX_BYTES)
+        throw fail("This workspace is larger than the 10 GB a move can carry.", 413);
+    if (input.files !== undefined && (!Number.isSafeInteger(input.files) || input.files < 0 || input.files > CLOUD_MOVE_MAX_FILES)) {
+        throw fail("This workspace has more than the 100,000 files a move can carry.", 413);
+    }
+    return { sha256: input.sha256, bytes: input.bytes };
+}
+/** Start an upload, or continue the same file's upload where it stopped. */
+export function beginUpload(dataDir, declared, now = Date.now()) {
+    const existing = readUploadMeta(dataDir);
+    if (existing && existing.sha256 === declared.sha256 && existing.bytes === declared.bytes && existing.updatedAt + UPLOAD_STALE_MS > now && receivedBytes(dataDir) <= declared.bytes) {
+        writeFileAtomic(uploadMetaPath(dataDir), JSON.stringify({ ...existing, updatedAt: now }), { mode: 0o600 });
+        return { ...declared, received: receivedBytes(dataDir) };
+    }
+    discardUpload(dataDir);
+    backupsRoot(dataDir);
+    privateFolder(uploadFolder(dataDir));
+    writeFileSync(uploadPartPath(dataDir), "", { mode: 0o600, flag: "wx" });
+    writeFileAtomic(uploadMetaPath(dataDir), JSON.stringify({ ...declared, updatedAt: now }), { mode: 0o600 });
+    return { ...declared, received: 0 };
+}
+/** Store one part at `offset`. A part already stored is accepted again
+ * without writing; any other offset than the next one answers where the
+ * upload stands (409, `received`). A failed part is cut back off. */
+export async function writeUploadPart(dataDir, sha256, offset, length, body, now = Date.now()) {
+    const meta = readUploadMeta(dataDir);
+    if (!meta || meta.sha256 !== sha256)
+        throw fail("This upload is not in progress on your Cloud. Start the move again.", 404);
+    if (!Number.isSafeInteger(offset) || offset < 0 || !Number.isSafeInteger(length) || length <= 0 || length > CLOUD_MOVE_MAX_PART_BYTES) {
+        throw fail("Invalid upload part.", 400);
+    }
+    if (offset + length > meta.bytes)
+        throw fail("The upload is larger than the file it declared.", 413);
+    const received = receivedBytes(dataDir);
+    const drain = async () => { for await (const _chunk of body) { /* already stored */ } };
+    if (offset + length <= received) {
+        await drain();
+        return received;
+    }
+    if (offset !== received) {
+        await drain();
+        throw fail("The upload continues from another point.", 409, { received });
+    }
+    const handle = await open(uploadPartPath(dataDir), "r+");
+    let written = 0;
+    try {
+        for await (const chunk of body) {
+            if (written + chunk.length > length)
+                throw fail("The upload part is larger than it declared.", 413);
+            let done = 0;
+            while (done < chunk.length)
+                done += (await handle.write(chunk, done, chunk.length - done, offset + written + done)).bytesWritten;
+            written += chunk.length;
+        }
+        if (written !== length)
+            throw fail("The upload part was incomplete.", 400);
+        await handle.sync();
+    }
+    catch (error) {
+        await handle.truncate(received).catch(() => { });
+        throw error;
+    }
+    finally {
+        await handle.close();
+    }
+    writeFileAtomic(uploadMetaPath(dataDir), JSON.stringify({ ...meta, updatedAt: now }), { mode: 0o600 });
+    return received + length;
+}
+/** The complete upload's path, once its size and SHA-256 match what was declared. */
+export async function completedUpload(dataDir, sha256) {
+    const status = uploadStatus(dataDir);
+    if (!status || status.sha256 !== sha256)
+        throw fail("This upload is not in progress on your Cloud. Start the move again.", 404);
+    if (status.received !== status.bytes)
+        throw fail("The upload is not complete yet.", 409, { received: status.received });
+    const hash = createHash("sha256");
+    for await (const chunk of createReadStream(uploadPartPath(dataDir), { highWaterMark: 1024 * 1024 }))
+        hash.update(chunk);
+    if (hash.digest("hex") !== sha256) {
+        discardUpload(dataDir);
+        throw fail("The uploaded file was damaged on the way. Start the move again.", 400);
+    }
+    return uploadPartPath(dataDir);
+}
+const previousFolder = (dataDir) => join(dataDir, ".backups", "cloud-previous");
+const nextPreviousFolder = (dataDir) => join(dataDir, ".backups", "cloud-previous.next");
+const moveRestoresPath = (dataDir) => join(dataDir, ".backups", "cloud-move-restores.json");
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+function readPrevious(folder) {
+    try {
+        const value = JSON.parse(readFileSync(join(folder, "previous.json"), "utf8"));
+        if (!record(value) || typeof value.password !== "string" || typeof value.createdAt !== "string" || !record(value.contents))
+            return null;
+        if (!lstatSync(join(folder, "workspace.ombbackup")).isFile())
+            return null;
+        return value;
+    }
+    catch {
+        return null;
+    }
+}
+/** The previous Cloud that can be put back, never its password. A fresh
+ * Cloud's (its starter bot, nothing else) is kept but not offered. */
+export function previousCloud(dataDir) {
+    const previous = readPrevious(previousFolder(dataDir));
+    if (!previous || isEmptyWorkspace(previous.contents))
+        return null;
+    return { createdAt: previous.createdAt, ...previous.contents, bytes: lstatSync(join(previousFolder(dataDir), "workspace.ombbackup")).size };
+}
+/** Back up this workspace as the next previous Cloud, for the restore
+ * `restoreId`. `create` is createWorkspaceBackup, run by the caller inside
+ * the maintenance gate. It becomes the previous Cloud only once startup has
+ * installed that restore. */
+export async function prepareNextPreviousCloud(dataDir, restoreId, create) {
+    const password = randomBytes(32).toString("base64url");
+    const contents = workspaceContents(dataDir);
+    const created = await create(password);
+    const next = nextPreviousFolder(dataDir);
+    try {
+        backupsRoot(dataDir);
+        rmSync(next, { recursive: true, force: true });
+        privateFolder(next);
+        renameSync(created.path, join(next, "workspace.ombbackup"));
+        const meta = { password, createdAt: new Date().toISOString(), contents, forRestore: restoreId };
+        writeFileAtomic(join(next, "previous.json"), JSON.stringify(meta), { mode: 0o600 });
+        return { createdAt: meta.createdAt, ...contents };
+    }
+    catch (error) {
+        rmSync(next, { recursive: true, force: true });
+        throw error;
+    }
+    finally {
+        try {
+            removeWorkspaceBackupJob(dataDir, created.id);
+        }
+        catch { /* The export job expires with the others. */ }
+    }
+}
+/** Drop a next previous Cloud whose restore did not commit. */
+export function discardNextPreviousCloud(dataDir) {
+    rmSync(nextPreviousFolder(dataDir), { recursive: true, force: true });
+}
+/** Stage the previous Cloud for an ordinary restore; its archive stays. */
+export async function stagePreviousCloud(dataDir, appVersion) {
+    const previous = readPrevious(previousFolder(dataDir));
+    if (!previous || isEmptyWorkspace(previous.contents))
+        throw fail("There is no previous Cloud to restore.", 404);
+    const archive = join(previousFolder(dataDir), "workspace.ombbackup");
+    const staged = await stageWorkspaceBackup(dataDir, archive, { password: previous.password, currentAppVersion: appVersion });
+    return { ...staged, bytes: lstatSync(archive).size };
+}
+/** The archive size of the previous Cloud (0 without one), for space checks. */
+export function previousCloudArchiveBytes(dataDir) {
+    try {
+        return lstatSync(join(previousFolder(dataDir), "workspace.ombbackup")).size;
+    }
+    catch {
+        return 0;
+    }
+}
+function readMoveRestores(dataDir) {
+    try {
+        const value = JSON.parse(readFileSync(moveRestoresPath(dataDir), "utf8"));
+        return Array.isArray(value) ? value.filter((id) => typeof id === "string" && UUID.test(id)) : [];
+    }
+    catch {
+        return [];
+    }
+}
+function writeMoveRestores(dataDir, ids) {
+    backupsRoot(dataDir);
+    if (ids.length)
+        writeFileAtomic(moveRestoresPath(dataDir), JSON.stringify([...new Set(ids)]), { mode: 0o600 });
+    else
+        rmSync(moveRestoresPath(dataDir), { force: true });
+}
+/** Remember a restore made by a move or a swap back, before it commits, so
+ * its safety copy and staged files are tidied once it is installed. */
+export function noteMoveRestore(dataDir, restoreId) {
+    writeMoveRestores(dataDir, [...readMoveRestores(dataDir), restoreId]);
+}
+export function forgetMoveRestore(dataDir, restoreId) {
+    writeMoveRestores(dataDir, readMoveRestores(dataDir).filter((id) => id !== restoreId));
+}
+/** Delete a staged job, and its safety copy, by id: guarded paths only. */
+export function removeMoveFiles(dataDir, id) {
+    if (!UUID.test(id))
+        return;
+    for (const name of [id, `safety-${id}`]) {
+        const path = join(dataDir, ".backups", name);
+        try {
+            const stat = lstatSync(path);
+            if (stat.isDirectory() && !stat.isSymbolicLink())
+                rmSync(path, { recursive: true, force: true });
+        }
+        catch { /* already gone */ }
+    }
+}
+function pendingRestoreId(dataDir) {
+    try {
+        const value = JSON.parse(readFileSync(join(dataDir, ".backups", "pending-restore.json"), "utf8"));
+        return record(value) && typeof value.id === "string" ? value.id : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** At a Cloud home's startup, after any pending restore was applied:
+ * - a next previous Cloud becomes the previous Cloud once its restore is
+ *   installed, and is dropped otherwise;
+ * - moves' and swaps' restores, once settled, keep no safety copy or staged
+ *   files (the previous Cloud is the one undo point);
+ * - an upload nobody has touched for a day is deleted.
+ * Never touches a restore still waiting to be applied. */
+export function tidyCloudMoveStorage(dataDir, restored, now = Date.now()) {
+    if (!existsSync(join(dataDir, ".backups")))
+        return;
+    const pending = pendingRestoreId(dataDir);
+    const next = readPrevious(nextPreviousFolder(dataDir));
+    if (next && next.forRestore !== pending) {
+        if (restored.restored && restored.id === next.forRestore) {
+            rmSync(previousFolder(dataDir), { recursive: true, force: true });
+            renameSync(nextPreviousFolder(dataDir), previousFolder(dataDir));
+        }
+        else
+            discardNextPreviousCloud(dataDir);
+    }
+    else if (!next && existsSync(nextPreviousFolder(dataDir)) && !pending)
+        discardNextPreviousCloud(dataDir);
+    const settled = readMoveRestores(dataDir).filter((id) => id !== pending);
+    for (const id of settled)
+        removeMoveFiles(dataDir, id);
+    writeMoveRestores(dataDir, readMoveRestores(dataDir).filter((id) => id === pending));
+    if (restored.id && settled.includes(restored.id)) {
+        // The receipt must not point at a safety copy that is gone.
+        delete restored.safetyCopyPath;
+        try {
+            const receipt = join(dataDir, ".backups", "last-restore.json");
+            const value = JSON.parse(readFileSync(receipt, "utf8"));
+            if (record(value) && value.id === restored.id && "safetyCopyPath" in value) {
+                delete value.safetyCopyPath;
+                writeFileAtomic(receipt, JSON.stringify(value), { mode: 0o600 });
+            }
+        }
+        catch { /* no receipt */ }
+    }
+    const upload = readUploadMeta(dataDir);
+    if ((upload && upload.updatedAt + UPLOAD_STALE_MS <= now) || (!upload && existsSync(uploadPartPath(dataDir))))
+        discardUpload(dataDir);
+}
+/** Bytes under `.backups`: what backups, safety copies and moves hold on the volume. */
+export function backupsBytes(dataDir) {
+    let bytes = 0;
+    const walk = (directory) => {
+        for (const name of readdirSync(directory)) {
+            const stat = lstatSync(join(directory, name));
+            if (stat.isDirectory() && !stat.isSymbolicLink())
+                walk(join(directory, name));
+            else if (stat.isFile())
+                bytes += stat.size;
+        }
+    };
+    try {
+        walk(join(dataDir, ".backups"));
+    }
+    catch { /* none yet */ }
+    return bytes;
+}

package/dist-server/server/cloud-owner.js

@@ -0,0 +1,196 @@
+// An OMB Cloud home is personal (docs/cloud-pro.md): only the owner's own
+// devices connect, each with an admin session the Admin's signed pairing
+// gave it. No pairing, sign-in or session without admin scope is minted or
+// redeemed there (server/sessions.ts requireAdmin), and at every boot any
+// that is stored is revoked: what it opened or wrote is nobody's from then
+// on, and its key is recorded first, so no crash can ever make it the
+// owner's.
+//
+// Before, every device carried its own key (v0.1.91), so a device the owner
+// unpaired made the owner's conversations read as someone else's. Once, at
+// the first boot of a personal Cloud home, and again after a restore, the
+// keys named until then are settled, in two tiers:
+// - adopted: every key that opened a conversation, wrote a line or answered
+//   a card, except a revoked one. Its conversations are the owner's for who
+//   opened them, their approval level and their folder (so the owner's rooms
+//   and conversations keep Auto or Full, and their project folder);
+// - proven: only a key with proof it was the owner's, an admin session
+//   still paired, or one that answered a card (only the owner's devices
+//   could, on a Cloud home). Only those feed lending, memory, recall and the
+//   recent-work brief (cloud-lending.ts ownerOnlyConversation): a guest the
+//   owner unpaired before is indistinguishable from an owner's old device,
+//   so its lines never count as the owner's there.
+// Routines fail closed: a routine's writer is the owner only with proof (the
+// owner's key as its writer, the owner's fingerprint, #2023, a proposal the
+// owner approved on its card, or a restore the owner started whose results
+// conversation is theirs); every other routine is nobody's, and runs
+// confined. What a revoked session opened loses its working folder (its next
+// turn gets a private one), and its routines are paused.
+import { lstatSync, readFileSync } from "node:fs";
+import { z } from "zod";
+import { writeFileAtomic } from "./atomic.js";
+export const CLOUD_PERSONAL_REFUSAL = "Cloud Pro is personal: only your own devices can connect.";
+const KEY = /^p_[\w-]{22}$/;
+const keys = z.array(z.string().regex(KEY)).max(100_000);
+const recordFile = z.object({
+    version: z.literal(2),
+    machineId: z.string().max(128),
+    /** Revoked here, ever: never anyone's but nobody's. */
+    revokedKeys: keys,
+    adoptedKeys: keys,
+    provenKeys: keys,
+    /** The earlier keys are settled (and routines named). */
+    settled: z.boolean(),
+    /** A restore applied here whose data is not settled yet. */
+    pendingRestore: z.string().max(128).optional(),
+    /** The last restore whose data is settled (a restore applied at a start
+     * that ended before recording it is found this way at the next). */
+    settledRestore: z.string().max(128).optional(),
+}).strict();
+function readRecord(options) {
+    const fresh = { version: 2, machineId: options.machineId, revokedKeys: [], adoptedKeys: [], provenKeys: [], settled: false, fresh: true };
+    let stat;
+    try {
+        stat = lstatSync(options.file, { throwIfNoEntry: false });
+    }
+    catch {
+        stat = null;
+    }
+    if (stat === undefined)
+        return fresh;
+    try {
+        if (!stat || !stat.isFile() || stat.size > 16_000_000)
+            throw new Error("not a file");
+        const record = recordFile.parse(JSON.parse(readFileSync(options.file, "utf8")));
+        // Another machine's (never carried by a backup): nothing in it is ours.
+        if (record.machineId !== options.machineId) {
+            options.log(`cloud home: ${options.file} is another machine's; settling this one's own`);
+            return fresh;
+        }
+        return record;
+    }
+    catch {
+        // Settled before, and unreadable now: nothing earlier is the owner's, and
+        // running the settlement again could make a revoked key theirs.
+        options.log(`cloud home: ${options.file} is unreadable, so nothing from before is treated as the owner's`);
+        return { ...fresh, settled: true };
+    }
+}
+function save(options, record) {
+    try {
+        writeFileAtomic(options.file, JSON.stringify(record), { mode: 0o600 });
+        return true;
+    }
+    catch (error) {
+        options.log(`cloud home: could not record who is the owner (${error instanceof Error ? error.message : String(error)}); trying again at the next start`);
+        return false;
+    }
+}
+/** A step that never stops the server from starting: logged when it fails
+ * (`failed` is then called), and done again at the next start (every step
+ * can be). */
+function attempt(options, what, step, fallback, failed) {
+    try {
+        return step();
+    }
+    catch (error) {
+        options.log(`cloud home: could not ${what} (${error instanceof Error ? error.message : String(error)})`);
+        failed?.();
+        return fallback;
+    }
+}
+/** The settled keys, never one revoked since. */
+function settledSets(record) {
+    const revoked = new Set(record.revokedKeys);
+    return { adopted: new Set(record.adoptedKeys.filter((key) => !revoked.has(key))), proven: new Set(record.provenKeys.filter((key) => !revoked.has(key))) };
+}
+/** Revoke every session that is not one of the owner's devices, and settle
+ * the earlier keys (once, and after a restore). Every step is recorded
+ * before it is taken, so a crash anywhere, or a failed save, only ever
+ * leaves a key less trusted, and the next start carries on. */
+export function settleCloudOwnership(options) {
+    const { fresh, ...read } = readRecord(options);
+    let record = read;
+    const others = options.sessions.list().filter((session) => !session.scopes.includes("admin"));
+    const revoked = new Set([...record.revokedKeys, ...others.map((session) => options.personKey(session))]);
+    // A restore to settle: one applied at this start, or a later one than the
+    // last settled (its start ended before it was recorded). At the very first
+    // start, only one applied now: what came before settles the strict way.
+    const restore = options.restoredNow ??
+        (!fresh && options.lastRestore && options.lastRestore !== record.settledRestore && options.lastRestore !== record.pendingRestore ? options.lastRestore : undefined);
+    record = { ...record, revokedKeys: [...revoked], ...(restore ? { pendingRestore: restore } : {}),
+        ...(fresh && !options.restoredNow && options.lastRestore ? { settledRestore: options.lastRestore } : {}) };
+    // 1. The keys about to be revoked are recorded first.
+    if (!save(options, record))
+        return settledSets(record);
+    // 2. Their sessions go.
+    let count = 0;
+    for (const session of others)
+        if (attempt(options, "revoke a session", () => options.sessions.revoke(session.id), false))
+            count += 1;
+    options.log(`cloud home: revoked ${count} session${count === 1 ? "" : "s"} that ${count === 1 ? "was" : "were"} not the owner's own device${count === 1 ? "" : "s"}`);
+    // 3. What any revoked key opened or wrote is nobody's: its conversations
+    // lose their working folder (the owner's project, often), its routines stop.
+    const orphans = attempt(options, "mark conversations as nobody's", () => options.starters.reassign((person) => revoked.has(person), options.nobodyKey), []);
+    if (orphans.length)
+        attempt(options, "unpin their folders", () => options.unpin(orphans), undefined);
+    const stopped = attempt(options, "mark routines as nobody's", () => options.writers.reassign((person) => revoked.has(person), options.nobodyKey), []);
+    if (stopped.length)
+        attempt(options, "pause their routines", () => options.routines.pause(stopped), undefined);
+    if (fresh) {
+        options.log("cloud home: only your own devices can connect now. Review Settings → Remote access → Paired devices, and sign out any device that isn't yours.");
+    }
+    const restoring = record.pendingRestore !== undefined;
+    if (record.settled && !restoring)
+        return settledSets(record);
+    // 4. The earlier keys, recorded before anything is rewritten.
+    const eligible = (person) => KEY.test(person) && person !== options.ownerKey && person !== options.nobodyKey && !revoked.has(person);
+    // Settled only once every step below is done; else the next start does it again.
+    let complete = true;
+    const incomplete = () => { complete = false; };
+    const lines = attempt(options, "read who wrote in each conversation", () => options.lines(), { senders: [], answerers: [], approvals: [] }, incomplete);
+    const admins = options.sessions.list().filter((session) => session.scopes.includes("admin")).map((session) => options.personKey(session));
+    const proven = new Set([...record.provenKeys, ...admins, ...lines.answerers].filter(eligible));
+    const adopted = new Set([...record.adoptedKeys, ...proven, ...options.starters.people(), ...lines.senders].filter(eligible));
+    record = { ...record, adoptedKeys: [...adopted], provenKeys: [...proven] };
+    if (!save(options, record))
+        return settledSets(record);
+    // 5. Conversations the owner provably opened name the owner; routines are
+    // the owner's only with proof, else nobody's.
+    const moved = attempt(options, "name the owner on their conversations", () => options.starters.reassign((person) => proven.has(person), options.ownerKey), [], incomplete).length;
+    const ownersKey = (person) => person !== undefined && (person === options.ownerKey || proven.has(person));
+    // A card the owner allowed is proof of what it showed them: only while the
+    // routine still runs exactly that (its instructions, bot, schedule, where
+    // it runs and no attachment: anyone could change a routine on v0.1.91
+    // without being recorded).
+    const approved = new Set();
+    for (const [id, person, shape] of lines.approvals) {
+        if (ownersKey(person) && options.routines.shape(id) === shape)
+            approved.add(id);
+    }
+    let owners = 0, nobodys = 0;
+    attempt(options, "name each routine's writer", () => {
+        for (const id of options.routines.ids()) {
+            const writer = options.routines.writer(id);
+            // A restore is proof only for a routine reporting into a conversation
+            // that names nobody yet, or the owner (a backup from before can hold a
+            // guest's routine and its conversation).
+            const opener = options.routines.resultsOpener(id);
+            const owner = writer === options.ownerKey || options.routines.fingerprinted(id) || approved.has(id) ||
+                (restoring && writer !== options.nobodyKey && !(writer !== undefined && revoked.has(writer)) && (opener === undefined || ownersKey(opener)));
+            if (writer !== (owner ? options.ownerKey : options.nobodyKey))
+                options.routines.name(id, owner ? options.ownerKey : options.nobodyKey);
+            if (owner)
+                owners += 1;
+            else
+                nobodys += 1;
+        }
+    }, undefined, incomplete);
+    if (!complete)
+        return settledSets(record);
+    const { pendingRestore: done, ...rest } = record;
+    record = { ...rest, settled: true, ...(done ? { settledRestore: done } : {}) };
+    save(options, record);
+    options.log(`cloud home: settled what came before${restoring ? " (a restore)" : ""}: ${adopted.size} earlier device key${adopted.size === 1 ? "" : "s"} (${proven.size} proven), ${moved} conversation${moved === 1 ? "" : "s"} named the owner's, ${owners} routine${owners === 1 ? "" : "s"} the owner's and ${nobodys} nobody's`);
+    return settledSets(record);
+}

package/dist-server/server/cloud-secrets-boot.js

@@ -0,0 +1,6 @@
+// The server's first import (server/index.ts): on an OMB Cloud home, the
+// secrets the launcher hands over its pipe are read, and the pipe closed,
+// before any other module is loaded, so no process the server starts can
+// inherit it (cloud-secrets.ts, cloud-home-start.ts).
+import { takeCloudSecrets } from "./cloud-secrets.js";
+export const BOOT_CLOUD_SECRETS = takeCloudSecrets();