self-bench 0.3.5 → 0.3.8

package/dist/artifacts.js

@@ -1,308 +1,11 @@
-import { createHash, randomUUID } from "node:crypto";
-import { createReadStream, createWriteStream } from "node:fs";
-import { link, mkdir, mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { dirname, join, resolve, sep } from "node:path";
-import { Readable, Transform } from "node:stream";
-import { pipeline } from "node:stream/promises";
-import { Storage } from "@google-cloud/storage";
-import { sha256 } from "./hash.js";
+import { GcsArtifactStore } from "./artifacts/gcs.js";
+import { LocalArtifactStore } from "./artifacts/local.js";
 export function createArtifactStore(config) {
     return config.kind === "gcs"
         ? new GcsArtifactStore(config.bucket, config.prefix)
         : new LocalArtifactStore(config.directory);
 }
-export class LocalArtifactStore {
-    #root;
-    constructor(root) {
-        this.#root = resolve(root);
-    }
-    async put(key, value, contentType) {
-        const path = this.#pathFor(key);
-        await mkdir(dirname(path), { recursive: true });
-        const digest = sha256(value);
-        try {
-            await writeFile(path, value, { flag: "wx" });
-        }
-        catch (error) {
-            const existing = await fileDigest(path).catch(() => undefined);
-            if (!existing || existing.sha256 !== digest || existing.sizeBytes !== value.byteLength) {
-                throw error;
-            }
-        }
-        return {
-            uri: `file://${path}`,
-            sha256: digest,
-            sizeBytes: value.byteLength,
-            contentType,
-        };
-    }
-    async putFile(key, sourcePath, contentType) {
-        const path = this.#pathFor(key);
-        await mkdir(dirname(path), { recursive: true });
-        const temporaryPath = `${path}.${randomUUID()}.tmp`;
-        try {
-            const digest = await copyWithDigest(sourcePath, temporaryPath);
-            try {
-                await link(temporaryPath, path);
-            }
-            catch (error) {
-                if (!hasCode(error, "EEXIST")) {
-                    throw error;
-                }
-                const existing = await fileDigest(path).catch(() => undefined);
-                if (!existing ||
-                    existing.sha256 !== digest.sha256 ||
-                    existing.sizeBytes !== digest.sizeBytes) {
-                    throw new Error(`artifact already exists with different contents: file://${path}`);
-                }
-            }
-            return {
-                uri: `file://${path}`,
-                ...digest,
-                contentType,
-            };
-        }
-        finally {
-            await rm(temporaryPath, { force: true });
-        }
-    }
-    async get(reference) {
-        const url = new URL(reference.uri);
-        if (url.protocol !== "file:") {
-            throw new Error(`local artifact store cannot read ${reference.uri}`);
-        }
-        const path = resolve(decodeURIComponent(url.pathname));
-        this.#assertInsideRoot(path);
-        const value = await readFile(path);
-        verifyArtifact(reference, value);
-        return value;
-    }
-    async openRead(reference) {
-        const path = this.#pathForReference(reference);
-        if ((await stat(path)).size !== reference.sizeBytes) {
-            throw new Error(`artifact integrity check failed: ${reference.uri}`);
-        }
-        return verifiedArtifactReadStream(reference, createReadStream(path));
-    }
-    async getByKey(key) {
-        try {
-            return await readFile(this.#pathFor(key));
-        }
-        catch (error) {
-            if (isNotFound(error)) {
-                return undefined;
-            }
-            throw error;
-        }
-    }
-    #pathForReference(reference) {
-        const url = new URL(reference.uri);
-        if (url.protocol !== "file:") {
-            throw new Error(`local artifact store cannot read ${reference.uri}`);
-        }
-        const path = resolve(decodeURIComponent(url.pathname));
-        this.#assertInsideRoot(path);
-        return path;
-    }
-    #pathFor(key) {
-        if (!key || key.startsWith("/") || key.split("/").some((part) => part === "..")) {
-            throw new Error(`unsafe artifact key: ${key}`);
-        }
-        const path = resolve(this.#root, key);
-        this.#assertInsideRoot(path);
-        return path;
-    }
-    #assertInsideRoot(path) {
-        if (path !== this.#root && !path.startsWith(`${this.#root}${sep}`)) {
-            throw new Error(`artifact path escapes root: ${path}`);
-        }
-    }
-}
-export class GcsArtifactStore {
-    #storage = new Storage();
-    #bucket;
-    #prefix;
-    constructor(bucket, prefix) {
-        this.#bucket = bucket;
-        this.#prefix = prefix.replace(/^\/+|\/+$/g, "");
-    }
-    async put(key, value, contentType) {
-        const object = this.#objectFor(key);
-        const digest = sha256(value);
-        const file = this.#storage.bucket(this.#bucket).file(object);
-        try {
-            await file.save(value, {
-                resumable: false,
-                preconditionOpts: { ifGenerationMatch: 0 },
-                metadata: {
-                    contentType,
-                    metadata: { sha256: digest },
-                },
-            });
-        }
-        catch (error) {
-            const [exists] = await file.exists();
-            if (!exists) {
-                throw error;
-            }
-            const [metadata] = await file.getMetadata();
-            if (metadata.metadata?.sha256 !== digest) {
-                throw new Error(`artifact already exists with different contents: gs://${this.#bucket}/${object}`);
-            }
-        }
-        return {
-            uri: `gs://${this.#bucket}/${object}`,
-            sha256: digest,
-            sizeBytes: value.byteLength,
-            contentType,
-        };
-    }
-    async putFile(key, sourcePath, contentType) {
-        const object = this.#objectFor(key);
-        const bucket = this.#storage.bucket(this.#bucket);
-        const file = bucket.file(object);
-        const snapshotDirectory = await mkdtemp(join(tmpdir(), "selfbench-artifact-"));
-        const snapshotPath = join(snapshotDirectory, "upload");
-        try {
-            const digest = await copyWithDigest(sourcePath, snapshotPath);
-            try {
-                await bucket.upload(snapshotPath, {
-                    destination: object,
-                    resumable: true,
-                    preconditionOpts: { ifGenerationMatch: 0 },
-                    metadata: {
-                        contentType,
-                        metadata: { sha256: digest.sha256 },
-                    },
-                });
-            }
-            catch (error) {
-                const [exists] = await file.exists();
-                if (!exists) {
-                    throw error;
-                }
-                const [metadata] = await file.getMetadata();
-                if (metadata.metadata?.sha256 !== digest.sha256 ||
-                    Number(metadata.size) !== digest.sizeBytes) {
-                    throw new Error(`artifact already exists with different contents: gs://${this.#bucket}/${object}`);
-                }
-            }
-            return {
-                uri: `gs://${this.#bucket}/${object}`,
-                ...digest,
-                contentType,
-            };
-        }
-        finally {
-            await rm(snapshotDirectory, { recursive: true, force: true });
-        }
-    }
-    async get(reference) {
-        const match = /^gs:\/\/([^/]+)\/(.+)$/.exec(reference.uri);
-        if (!match) {
-            throw new Error(`GCS artifact store cannot read ${reference.uri}`);
-        }
-        const [, bucket, object] = match;
-        if (bucket !== this.#bucket || !object) {
-            throw new Error(`artifact is outside configured bucket: ${reference.uri}`);
-        }
-        if (this.#prefix && object !== this.#prefix && !object.startsWith(`${this.#prefix}/`)) {
-            throw new Error(`artifact is outside configured bucket: ${reference.uri}`);
-        }
-        const [value] = await this.#storage.bucket(bucket).file(object).download();
-        verifyArtifact(reference, value);
-        return value;
-    }
-    async openRead(reference) {
-        const file = this.#fileForReference(reference);
-        const [metadata] = await file.getMetadata();
-        if (Number(metadata.size) !== reference.sizeBytes ||
-            metadata.metadata?.sha256 !== reference.sha256) {
-            throw new Error(`artifact integrity check failed: ${reference.uri}`);
-        }
-        return verifiedArtifactReadStream(reference, file.createReadStream());
-    }
-    async getByKey(key) {
-        const file = this.#storage.bucket(this.#bucket).file(this.#objectFor(key));
-        const [exists] = await file.exists();
-        if (!exists) {
-            return undefined;
-        }
-        const [value] = await file.download();
-        return value;
-    }
-    #fileForReference(reference) {
-        const match = /^gs:\/\/([^/]+)\/(.+)$/.exec(reference.uri);
-        if (!match) {
-            throw new Error(`GCS artifact store cannot read ${reference.uri}`);
-        }
-        const [, bucket, object] = match;
-        if (bucket !== this.#bucket || !object) {
-            throw new Error(`artifact is outside configured bucket: ${reference.uri}`);
-        }
-        if (this.#prefix && object !== this.#prefix && !object.startsWith(`${this.#prefix}/`)) {
-            throw new Error(`artifact is outside configured bucket: ${reference.uri}`);
-        }
-        return this.#storage.bucket(bucket).file(object);
-    }
-    #objectFor(key) {
-        if (!key || key.startsWith("/") || key.split("/").some((part) => part === "..")) {
-            throw new Error(`unsafe artifact key: ${key}`);
-        }
-        return this.#prefix ? `${this.#prefix}/${key}` : key;
-    }
-}
-export function verifiedArtifactReadStream(reference, input) {
-    return Readable.from((async function* () {
-        const hash = createHash("sha256");
-        let sizeBytes = 0;
-        for await (const chunk of input) {
-            const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-            hash.update(bytes);
-            sizeBytes += bytes.byteLength;
-            yield bytes;
-        }
-        if (sizeBytes !== reference.sizeBytes || hash.digest("hex") !== reference.sha256) {
-            throw new Error(`artifact integrity check failed: ${reference.uri}`);
-        }
-    })());
-}
-async function copyWithDigest(sourcePath, destinationPath) {
-    const hash = createHash("sha256");
-    let sizeBytes = 0;
-    const hasher = new Transform({
-        transform(chunk, _encoding, callback) {
-            hash.update(chunk);
-            sizeBytes += chunk.byteLength;
-            callback(undefined, chunk);
-        },
-    });
-    await pipeline(createReadStream(sourcePath), hasher, createWriteStream(destinationPath, { flags: "wx" }));
-    return { sha256: hash.digest("hex"), sizeBytes };
-}
-async function fileDigest(path) {
-    const hash = createHash("sha256");
-    let sizeBytes = 0;
-    for await (const chunk of createReadStream(path)) {
-        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        hash.update(bytes);
-        sizeBytes += bytes.byteLength;
-    }
-    return { sha256: hash.digest("hex"), sizeBytes };
-}
-function hasCode(error, code) {
-    return (typeof error === "object" &&
-        error !== null &&
-        "code" in error &&
-        error.code === code);
-}
-function isNotFound(error) {
-    return hasCode(error, "ENOENT");
-}
-function verifyArtifact(reference, value) {
-    if (value.byteLength !== reference.sizeBytes || sha256(value) !== reference.sha256) {
-        throw new Error(`artifact integrity check failed: ${reference.uri}`);
-    }
-}
+export { verifiedArtifactReadStream } from "./artifacts/common.js";
+export { GcsArtifactStore } from "./artifacts/gcs.js";
+export { LocalArtifactStore } from "./artifacts/local.js";
 //# sourceMappingURL=artifacts.js.map

package/dist/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","sourceRoot":"","sources":["../src/artifacts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAGhD,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAUnC,MAAM,UAAU,mBAAmB,CAAC,MAAmC;IACrE,OAAO,MAAM,CAAC,IAAI,KAAK,KAAK;QAC1B,CAAC,CAAC,IAAI,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;QACpD,CAAC,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,OAAO,kBAAkB;IACpB,KAAK,CAAS;IAEvB,YAAY,IAAY;QACtB,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAiB,EAAE,WAAmB;QAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC/D,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;gBACvF,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO;YACL,GAAG,EAAE,UAAU,IAAI,EAAE;YACrB,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,KAAK,CAAC,UAAU;YAC3B,WAAW;SACZ,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,UAAkB,EAAE,WAAmB;QAChE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,aAAa,GAAG,GAAG,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAC/D,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;oBAC9B,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC/D,IACE,CAAC,QAAQ;oBACT,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;oBACjC,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EACvC,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,2DAA2D,IAAI,EAAE,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;YACD,OAAO;gBACL,GAAG,EAAE,UAAU,IAAI,EAAE;gBACrB,GAAG,MAAM;gBACT,WAAW;aACZ,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAsB;QAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,oCAAoC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnC,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,SAAsB;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,SAAS,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,oCAAoC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,0BAA0B,CAAC,SAAS,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAW;QACxB,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,iBAAiB,CAAC,SAAsB;QACtC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,oCAAoC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iBAAiB,CAAC,IAAY;QAC5B,IAAI,IAAI,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,gBAAgB;IAClB,QAAQ,GAAG,IAAI,OAAO,EAAE,CAAC;IACzB,OAAO,CAAS;IAChB,OAAO,CAAS;IAEzB,YAAY,MAAc,EAAE,MAAc;QACxC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAiB,EAAE,WAAmB;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE;gBACrB,SAAS,EAAE,KAAK;gBAChB,gBAAgB,EAAE,EAAE,iBAAiB,EAAE,CAAC,EAAE;gBAC1C,QAAQ,EAAE;oBACR,WAAW;oBACX,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;iBAC7B;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YACrC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5C,IAAI,QAAQ,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CACb,yDAAyD,IAAI,CAAC,OAAO,IAAI,MAAM,EAAE,CAClF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO;YACL,GAAG,EAAE,QAAQ,IAAI,CAAC,OAAO,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,KAAK,CAAC,UAAU;YAC3B,WAAW;SACZ,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,UAAkB,EAAE,WAAmB;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,iBAAiB,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAC/E,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YAC9D,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE;oBAChC,WAAW,EAAE,MAAM;oBACnB,SAAS,EAAE,IAAI;oBACf,gBAAgB,EAAE,EAAE,iBAAiB,EAAE,CAAC,EAAE;oBAC1C,QAAQ,EAAE;wBACR,WAAW;wBACX,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;qBACpC;iBACF,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;gBACrC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC5C,IACE,QAAQ,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM;oBAC3C,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,SAAS,EAC1C,CAAC;oBACD,MAAM,IAAI,KAAK,CACb,yDAAyD,IAAI,CAAC,OAAO,IAAI,MAAM,EAAE,CAClF,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO;gBACL,GAAG,EAAE,QAAQ,IAAI,CAAC,OAAO,IAAI,MAAM,EAAE;gBACrC,GAAG,MAAM;gBACT,WAAW;aACZ,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAsB;QAC9B,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,kCAAkC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;QACjC,IAAI,MAAM,KAAK,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,0CAA0C,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,IAAI,MAAM,KAAK,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,KAAK,CAAC,0CAA0C,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3E,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,SAAsB;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5C,IACE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,SAAS;YAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,CAAC,MAAM,EAC9C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,0BAA0B,CAAC,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAW;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3E,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,iBAAiB,CAAC,SAAsB;QACtC,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,kCAAkC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;QACjC,IAAI,MAAM,KAAK,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,0CAA0C,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,IAAI,MAAM,KAAK,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,KAAK,CAAC,0CAA0C,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnD,CAAC;IAED,UAAU,CAAC,GAAW;QACpB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IACvD,CAAC;CACF;AAED,MAAM,UAAU,0BAA0B,CAAC,SAAsB,EAAE,KAAe;IAChF,OAAO,QAAQ,CAAC,IAAI,CAClB,CAAC,KAAK,SAAS,CAAC;QACd,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnB,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC;YAC9B,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,SAAS,KAAK,SAAS,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,oCAAoC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC,CAAC,EAAE,CACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,UAAkB,EAClB,eAAuB;IAEvB,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,SAAS,CAAC,KAAa,EAAE,SAAS,EAAE,QAAQ;YAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnB,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC;YAC9B,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;KACF,CAAC,CAAC;IACH,MAAM,QAAQ,CACZ,gBAAgB,CAAC,UAAU,CAAC,EAC5B,MAAM,EACN,iBAAiB,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CACpD,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnB,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,IAAY;IAC3C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,MAAM,IAAI,KAAK;QACd,KAA4B,CAAC,IAAI,KAAK,IAAI,CAC5C,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,cAAc,CAAC,SAAsB,EAAE,KAAiB;IAC/D,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,oCAAoC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC"}
+{"version":3,"file":"artifacts.js","sourceRoot":"","sources":["../src/artifacts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAM1D,MAAM,UAAU,mBAAmB,CAAC,MAAmC;IACrE,OAAO,MAAM,CAAC,IAAI,KAAK,KAAK;QAC1B,CAAC,CAAC,IAAI,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;QACpD,CAAC,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC/C,CAAC;AAED,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAc,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEjE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;QACrC,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAC;QAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,CAAC;CACH;AAeD,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,cAAc,EAC1B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,iBAAiB,CAmDnB"}
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAc,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGjE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;QACrC,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAC;QAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,CAAC;CACH;AAeD,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,cAAc,EAC1B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,iBAAiB,CA+DnB"}

package/dist/audit.js

@@ -1,3 +1,4 @@
+import { repositoryRelativePath } from "./harbor-task/paths.js";
 const thresholds = {
     easy: { implementationFiles: 1, changedLines: 20, passToPass: 0 },
     medium: { implementationFiles: 2, changedLines: 50, passToPass: 1 },
@@ -9,7 +10,9 @@ export function auditTaskDefinition(definition, goldPatch, testPatch) {
     const threshold = thresholds[definition.difficulty];
     const testPathSet = new Set(tests.files);
     const blockers = [];
-    const overlap = gold.files.filter((path) => testPathSet.has(path));
+    const protectedPaths = definition.testPaths.map((path) => repositoryRelativePath(definition, path));
+    const overlap = gold.files.filter((path) => testPathSet.has(path) ||
+        protectedPaths.some((protectedPath) => path === protectedPath || path.startsWith(`${protectedPath}/`)));
     if (overlap.length > 0) {
         blockers.push(`gold and held-out test patches overlap: ${overlap.join(", ")}`);
     }
@@ -19,9 +22,12 @@ export function auditTaskDefinition(definition, goldPatch, testPatch) {
     if (gold.changedLines < threshold.changedLines) {
         blockers.push(`${definition.difficulty} mode requires at least ${threshold.changedLines} changed implementation lines; found ${gold.changedLines}`);
     }
-    if (tests.files.length === 0) {
+    if (tests.files.length === 0 && definition.testSelection?.mode !== "base-only") {
         blockers.push("held-out test patch changes no files");
     }
+    if (definition.testSelection?.mode === "base-only" && testPatch.length > 0) {
+        blockers.push("base-only requires an empty test.patch");
+    }
     if (definition.passToPass.length < threshold.passToPass) {
         blockers.push(`${definition.difficulty} mode requires at least ${threshold.passToPass} pass-to-pass regression tests`);
     }

package/dist/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAYA,MAAM,UAAU,GAOZ;IACF,IAAI,EAAE,EAAE,mBAAmB,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE;IACjE,MAAM,EAAE,EAAE,mBAAmB,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE;IACnE,IAAI,EAAE,EAAE,mBAAmB,EAAE,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE;CACnE,CAAC;AAEF,MAAM,UAAU,mBAAmB,CACjC,UAA0B,EAC1B,SAAiB,EACjB,SAAiB;IAEjB,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC,2CAA2C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,mBAAmB,EAAE,CAAC;QACtD,QAAQ,CAAC,IAAI,CACX,GAAG,UAAU,CAAC,UAAU,2BAA2B,SAAS,CAAC,mBAAmB,gCAAgC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CACpI,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC,YAAY,EAAE,CAAC;QAC/C,QAAQ,CAAC,IAAI,CACX,GAAG,UAAU,CAAC,UAAU,2BAA2B,SAAS,CAAC,YAAY,wCAAwC,IAAI,CAAC,YAAY,EAAE,CACrI,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC;QACxD,QAAQ,CAAC,IAAI,CACX,GAAG,UAAU,CAAC,UAAU,2BAA2B,SAAS,CAAC,UAAU,gCAAgC,CACxG,CAAC;IACJ,CAAC;IACD,IACE,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,wBAAwB,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC5F,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,wBAAwB,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,EAC5F,CAAC;QACD,QAAQ,CAAC,IAAI,CACX,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,QAAQ,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC/B,QAAQ;QACR,OAAO,EAAE;YACP,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;YACtC,0BAA0B,EAAE,IAAI,CAAC,YAAY;YAC7C,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;SAC9B;KACF,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAe,EAAE,IAAY;IAC7D,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACvB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IACE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACjD,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EACjD,CAAC;YACD,YAAY,IAAI,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;AACjC,CAAC"}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAYhE,MAAM,UAAU,GAOZ;IACF,IAAI,EAAE,EAAE,mBAAmB,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE;IACjE,MAAM,EAAE,EAAE,mBAAmB,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE;IACnE,IAAI,EAAE,EAAE,mBAAmB,EAAE,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE;CACnE,CAAC;AAEF,MAAM,UAAU,mBAAmB,CACjC,UAA0B,EAC1B,SAAiB,EACjB,SAAiB;IAEjB,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,cAAc,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACvD,sBAAsB,CAAC,UAAU,EAAE,IAAI,CAAC,CACzC,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAC/B,CAAC,IAAI,EAAE,EAAE,CACP,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;QACrB,cAAc,CAAC,IAAI,CACjB,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,aAAa,GAAG,CAAC,CAClF,CACJ,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC,2CAA2C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,mBAAmB,EAAE,CAAC;QACtD,QAAQ,CAAC,IAAI,CACX,GAAG,UAAU,CAAC,UAAU,2BAA2B,SAAS,CAAC,mBAAmB,gCAAgC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CACpI,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC,YAAY,EAAE,CAAC;QAC/C,QAAQ,CAAC,IAAI,CACX,GAAG,UAAU,CAAC,UAAU,2BAA2B,SAAS,CAAC,YAAY,wCAAwC,IAAI,CAAC,YAAY,EAAE,CACrI,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,aAAa,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;QAC/E,QAAQ,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,UAAU,CAAC,aAAa,EAAE,IAAI,KAAK,WAAW,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3E,QAAQ,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC;QACxD,QAAQ,CAAC,IAAI,CACX,GAAG,UAAU,CAAC,UAAU,2BAA2B,SAAS,CAAC,UAAU,gCAAgC,CACxG,CAAC;IACJ,CAAC;IACD,IACE,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,wBAAwB,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC5F,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,wBAAwB,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,EAC5F,CAAC;QACD,QAAQ,CAAC,IAAI,CACX,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,QAAQ,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC/B,QAAQ;QACR,OAAO,EAAE;YACP,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;YACtC,0BAA0B,EAAE,IAAI,CAAC,YAAY;YAC7C,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;SAC9B;KACF,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAe,EAAE,IAAY;IAC7D,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACvB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IACE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACjD,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EACjD,CAAC;YACD,YAAY,IAAI,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;AACjC,CAAC"}

package/dist/auth/api-key-routes.d.ts

@@ -0,0 +1,17 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { type ApiKeyStore } from "./api-keys.js";
+import type { User } from "./users.js";
+export interface ApiKeyRoutesOptions {
+    readonly keys: ApiKeyStore;
+    readonly publicUrl: string;
+}
+export interface ApiKeyRoutes {
+    /** Answers /api/api-keys for a signed-in user. True when the response has been sent. */
+    handle(request: IncomingMessage, url: URL, response: ServerResponse, user: User): Promise<boolean>;
+}
+/**
+ * Personal API keys. Listing works from any session; minting and revoking require a browser
+ * session, so a leaked key cannot be used to issue further keys.
+ */
+export declare function createApiKeyRoutes(options: ApiKeyRoutesOptions): ApiKeyRoutes;
+//# sourceMappingURL=api-key-routes.d.ts.map

package/dist/auth/api-key-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-routes.d.ts","sourceRoot":"","sources":["../../src/auth/api-key-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAGjE,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAWvC,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B,wFAAwF;IACxF,MAAM,CACJ,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,IAAI,GACT,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,GAAG,YAAY,CA4C7E"}

package/dist/auth/api-key-routes.js

@@ -0,0 +1,57 @@
+import { z } from "zod";
+import { readBody, sendJson, trustedMutation } from "../api/http.js";
+import { API_KEY_SCOPES } from "./api-keys.js";
+const listRoute = /^\/api\/api-keys$/;
+const itemRoute = /^\/api\/api-keys\/(\d{1,18})$/;
+const createSchema = z
+    .object({
+    name: z.string().trim().min(1).max(80),
+    scope: z.enum(API_KEY_SCOPES).default("write"),
+})
+    .strict();
+/**
+ * Personal API keys. Listing works from any session; minting and revoking require a browser
+ * session, so a leaked key cannot be used to issue further keys.
+ */
+export function createApiKeyRoutes(options) {
+    const { keys } = options;
+    return {
+        async handle(request, url, response, user) {
+            const list = listRoute.test(url.pathname);
+            const item = itemRoute.exec(url.pathname);
+            if (!list && !item)
+                return false;
+            response.setHeader("cache-control", "no-store");
+            if (list && request.method === "GET") {
+                sendJson(response, 200, { keys: await keys.list(user.id) });
+                return true;
+            }
+            const mutation = (list && request.method === "POST") || (item && request.method === "DELETE");
+            if (!mutation)
+                return false;
+            if (user.apiKey) {
+                sendJson(response, 403, { error: "API keys are managed from a signed-in browser session" });
+                return true;
+            }
+            if (!trustedMutation(request, options.publicUrl, user)) {
+                sendJson(response, 403, { error: "Same-origin JSON request required" });
+                return true;
+            }
+            if (list) {
+                const parsed = createSchema.safeParse(JSON.parse((await readBody(request, 4 * 1024)).toString("utf8") || "{}"));
+                if (!parsed.success) {
+                    sendJson(response, 400, {
+                        error: "name is required (up to 80 characters); scope is read or write",
+                    });
+                    return true;
+                }
+                sendJson(response, 201, await keys.create(user.id, parsed.data));
+                return true;
+            }
+            const revoked = await keys.revoke(user.id, Number(item?.[1]));
+            sendJson(response, revoked ? 200 : 404, revoked ? { ok: true } : { error: "API key not found" });
+            return true;
+        },
+    };
+}
+//# sourceMappingURL=api-key-routes.js.map

package/dist/auth/api-key-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-routes.js","sourceRoot":"","sources":["../../src/auth/api-key-routes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAoB,MAAM,eAAe,CAAC;AAGjE,MAAM,SAAS,GAAG,mBAAmB,CAAC;AACtC,MAAM,SAAS,GAAG,+BAA+B,CAAC;AAClD,MAAM,YAAY,GAAG,CAAC;KACnB,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;CAC/C,CAAC;KACD,MAAM,EAAE,CAAC;AAiBZ;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA4B;IAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACzB,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI;YACvC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1C,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;gBAAE,OAAO,KAAK,CAAC;YACjC,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YAChD,IAAI,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACrC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC5D,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,QAAQ,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;YAC9F,IAAI,CAAC,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC5B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uDAAuD,EAAE,CAAC,CAAC;gBAC5F,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;gBACvD,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;gBACxE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CACnC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CACzE,CAAC;gBACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACpB,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;wBACtB,KAAK,EAAE,gEAAgE;qBACxE,CAAC,CAAC;oBACH,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBACjE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,QAAQ,CACN,QAAQ,EACR,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EACnB,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CACxD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/api-keys.d.ts

@@ -0,0 +1,47 @@
+import type { Database } from "../db/client.js";
+import type { ApiKeyRef, User } from "./users.js";
+export declare const API_KEY_PREFIX = "sbk_";
+export type ApiKeyScope = ApiKeyRef["scope"];
+export declare const API_KEY_SCOPES: readonly ApiKeyScope[];
+/** A key as the owner sees it after creation: everything but the secret. */
+export interface ApiKeyInfo {
+    readonly id: number;
+    readonly name: string;
+    readonly prefix: string;
+    readonly scope: ApiKeyScope;
+    readonly createdAt: string;
+    readonly lastUsedAt?: string;
+}
+export interface ApiKeyStore {
+    /** Mints a key; the returned secret is the only copy that will ever exist in plaintext. */
+    create(userId: number, input: {
+        name: string;
+        scope: ApiKeyScope;
+    }): Promise<{
+        key: ApiKeyInfo;
+        secret: string;
+    }>;
+    /** Active keys for a user, newest first. Revoked keys are not listed. */
+    list(userId: number): Promise<ApiKeyInfo[]>;
+    /** Revokes one of the user's keys; false when it is not theirs or is already revoked. */
+    revoke(userId: number, keyId: number): Promise<boolean>;
+    /** Resolves a presented secret to its owner, touching `last_used_at`; undefined when unknown or revoked. */
+    authenticate(secret: string): Promise<User | undefined>;
+}
+/** Thrown when a request presents an API key that does not resolve; answered with a 401. */
+export declare class ApiKeyError extends Error {
+    readonly status = 401;
+    constructor(message?: string);
+}
+/** The secret a request carries, from `Authorization: Bearer sbk_…` or `X-API-Key`; else undefined. */
+export declare function presentedApiKey(headers: {
+    authorization?: string | undefined;
+    "x-api-key"?: string | string[] | undefined;
+}): string | undefined;
+/** Read keys may only read: anything but GET/HEAD/OPTIONS is refused with this message. */
+export declare function apiKeyDenies(user: User, method: string | undefined): string | undefined;
+export declare function hashApiKey(secret: string): string;
+export declare function createApiKeyStore(db: Database, options?: {
+    now?: () => Date;
+}): ApiKeyStore;
+//# sourceMappingURL=api-keys.d.ts.map

package/dist/auth/api-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../src/auth/api-keys.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAElD,eAAO,MAAM,cAAc,SAAS,CAAC;AACrC,MAAM,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;AAC7C,eAAO,MAAM,cAAc,EAAE,SAAS,WAAW,EAAsB,CAAC;AAGxE,4EAA4E;AAC5E,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IAC1B,2FAA2F;IAC3F,MAAM,CACJ,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,WAAW,CAAA;KAAE,GAC1C,OAAO,CAAC;QACT,GAAG,EAAE,UAAU,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;IACH,yEAAyE;IACzE,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC5C,yFAAyF;IACzF,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,4GAA4G;IAC5G,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;CACzD;AAED,4FAA4F;AAC5F,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,MAAM,OAAO;gBACV,OAAO,SAAoB;CAGxC;AAED,uGAAuG;AACvG,wBAAgB,eAAe,CAAC,OAAO,EAAE;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;CAC7C,GAAG,MAAM,GAAG,SAAS,CAMrB;AAED,2FAA2F;AAC3F,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIvF;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CAAO,GAAG,WAAW,CAsD/F"}

package/dist/auth/api-keys.js

@@ -0,0 +1,102 @@
+import { createHash, randomBytes } from "node:crypto";
+import { and, desc, eq, isNull } from "drizzle-orm";
+import { apiKeys, users } from "../db/schema.js";
+export const API_KEY_PREFIX = "sbk_";
+export const API_KEY_SCOPES = ["read", "write"];
+const DISPLAY_PREFIX_LENGTH = API_KEY_PREFIX.length + 8;
+/** Thrown when a request presents an API key that does not resolve; answered with a 401. */
+export class ApiKeyError extends Error {
+    status = 401;
+    constructor(message = "invalid API key") {
+        super(message);
+    }
+}
+/** The secret a request carries, from `Authorization: Bearer sbk_…` or `X-API-Key`; else undefined. */
+export function presentedApiKey(headers) {
+    const explicit = headers["x-api-key"];
+    const header = Array.isArray(explicit) ? explicit[0] : explicit;
+    if (header?.trim())
+        return header.trim();
+    const bearer = headers.authorization?.replace(/^Bearer\s+/i, "").trim();
+    return bearer?.startsWith(API_KEY_PREFIX) ? bearer : undefined;
+}
+/** Read keys may only read: anything but GET/HEAD/OPTIONS is refused with this message. */
+export function apiKeyDenies(user, method) {
+    if (!user.apiKey || user.apiKey.scope === "write")
+        return undefined;
+    if (["GET", "HEAD", "OPTIONS"].includes(method ?? "GET"))
+        return undefined;
+    return "this API key is read-only";
+}
+export function hashApiKey(secret) {
+    return createHash("sha256").update(secret).digest("hex");
+}
+export function createApiKeyStore(db, options = {}) {
+    const now = options.now ?? (() => new Date());
+    return {
+        async create(userId, input) {
+            const secret = `${API_KEY_PREFIX}${randomBytes(32).toString("base64url")}`;
+            const [row] = await db
+                .insert(apiKeys)
+                .values({
+                userId,
+                name: input.name,
+                prefix: secret.slice(0, DISPLAY_PREFIX_LENGTH),
+                keyHash: hashApiKey(secret),
+                scope: input.scope,
+                createdAt: now(),
+            })
+                .returning();
+            if (!row)
+                throw new Error("api key insert returned no row");
+            return { key: infoFrom(row), secret };
+        },
+        async list(userId) {
+            const rows = await db
+                .select()
+                .from(apiKeys)
+                .where(and(eq(apiKeys.userId, userId), isNull(apiKeys.revokedAt)))
+                .orderBy(desc(apiKeys.createdAt), desc(apiKeys.id));
+            return rows.map(infoFrom);
+        },
+        async revoke(userId, keyId) {
+            const revoked = await db
+                .update(apiKeys)
+                .set({ revokedAt: now() })
+                .where(and(eq(apiKeys.id, keyId), eq(apiKeys.userId, userId), isNull(apiKeys.revokedAt)))
+                .returning({ id: apiKeys.id });
+            return revoked.length > 0;
+        },
+        async authenticate(secret) {
+            if (!secret.startsWith(API_KEY_PREFIX))
+                return undefined;
+            const [found] = await db
+                .select({ key: apiKeys, user: users })
+                .from(apiKeys)
+                .innerJoin(users, eq(users.id, apiKeys.userId))
+                .where(and(eq(apiKeys.keyHash, hashApiKey(secret)), isNull(apiKeys.revokedAt)));
+            if (!found)
+                return undefined;
+            await db.update(apiKeys).set({ lastUsedAt: now() }).where(eq(apiKeys.id, found.key.id));
+            return {
+                id: found.user.id,
+                githubId: found.user.githubId,
+                login: found.user.login,
+                ...(found.user.name ? { name: found.user.name } : {}),
+                ...(found.user.avatarUrl ? { avatarUrl: found.user.avatarUrl } : {}),
+                apiKey: { id: found.key.id, name: found.key.name, scope: found.key.scope },
+            };
+        },
+    };
+}
+function infoFrom(row) {
+    return {
+        id: row.id,
+        name: row.name,
+        prefix: row.prefix,
+        scope: row.scope,
+        createdAt: row.createdAt.toISOString(),
+        ...(row.lastUsedAt ? { lastUsedAt: row.lastUsedAt.toISOString() } : {}),
+    };
+}
+//# sourceMappingURL=api-keys.js.map

package/dist/auth/api-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../src/auth/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAGjD,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AAErC,MAAM,CAAC,MAAM,cAAc,GAA2B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACxE,MAAM,qBAAqB,GAAG,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;AA6BxD,4FAA4F;AAC5F,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,MAAM,GAAG,GAAG,CAAC;IACtB,YAAY,OAAO,GAAG,iBAAiB;QACrC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AAED,uGAAuG;AACvG,MAAM,UAAU,eAAe,CAAC,OAG/B;IACC,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAChE,IAAI,MAAM,EAAE,IAAI,EAAE;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,OAAO,MAAM,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,YAAY,CAAC,IAAU,EAAE,MAA0B;IACjE,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACpE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3E,OAAO,2BAA2B,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,EAAY,EAAE,UAAgC,EAAE;IAChF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK;YACxB,MAAM,MAAM,GAAG,GAAG,cAAc,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3E,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,OAAO,CAAC;iBACf,MAAM,CAAC;gBACN,MAAM;gBACN,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC;gBAC9C,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC;gBAC3B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,SAAS,EAAE,GAAG,EAAE;aACjB,CAAC;iBACD,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAC5D,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QACxC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,EAAE;iBACR,IAAI,CAAC,OAAO,CAAC;iBACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;iBACjE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YACtD,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK;YACxB,MAAM,OAAO,GAAG,MAAM,EAAE;iBACrB,MAAM,CAAC,OAAO,CAAC;iBACf,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;iBACzB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;iBACxF,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,MAAM;YACvB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC;gBAAE,OAAO,SAAS,CAAC;YACzD,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;iBACrB,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;iBACrC,IAAI,CAAC,OAAO,CAAC;iBACb,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;iBAC9C,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAClF,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC7B,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACxF,OAAO;gBACL,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;gBACjB,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;gBAC7B,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;gBACvB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE;aAC3E,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,GAAgC;IAChD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxE,CAAC;AACJ,CAAC"}