shadok-ai 0.15.37 → 0.15.38

package/README.md

@@ -392,7 +392,7 @@ know before opening it up:
 - **That password is the `admin` account.** With it set, the login page gains a
   user field — leave it blank to sign in as the admin. An admin can then invite
   other people from the **Users** panel: each invitation is a single-use link,
-  valid 7 days, on which the invitee chooses their own password, so the admin
+  valid 48 hours, on which the invitee chooses their own password, so the admin
   never learns it — and redeeming the link signs them in straight away. The ⋯
   menu names who you are and lets you sign out. Two roles: `admin` manages
   accounts, `member` does everything
@@ -414,11 +414,30 @@ know before opening it up:
     new device, sign in with the password, choose *use a code*, register. A
     password alone never registers a passkey — that is what stops a stolen
     password from enrolling the thief's phone.
-  - **Lost password or lost device**: another admin clicks *reset access* on your
-    row (confirming with their own passkey). Your password and every passkey are
-    removed and they hand you a fresh invitation link, on which you choose a new
-    password and register the device you have. Nobody can reset themselves. An
-    admin can also hand a member a *device code* directly.
+  - **Lost something**: another admin opens *recover access…* on your row and
+    picks what you lost (always confirming with their own passkey). Nobody can
+    recover themselves.
+    - *lost password* — one admin; you get a link (48 h), choose a new password,
+      then confirm with one of your passkeys, which are all kept;
+    - *lost passkey* — a **second admin approves** from their Security panel; you
+      then get a device code (48 h) to register a new device;
+    - *lost everything* — password and passkeys are wiped **24 hours** later, or
+      as soon as a second admin approves; you, the asker or any admin can cancel
+      it meanwhile.
+    Making or unmaking an admin also needs a second admin's approval. A device
+    code for someone who has no passkey yet is still one admin's act. Every
+    session opened before a recovery stops working — including one on the lost
+    device; removing a passkey or demoting an admin does the same.
+  - While it is on, inviting, deleting an account and changing a role also ask
+    the admin for their passkey.
+  - **Security panel** (🛡 in the header, a badge when something is new): what
+    was done to your account — invited, made admin, reset, a passkey added or
+    removed, a recovery asked about you — and, for admins, the whole log, the
+    requests waiting for their approval, and their own requests with the link or
+    code to hand over once done. On anything you don't recognise,
+    **This wasn't me** ends your other sessions, removes a passkey you did not
+    add, and flags it to every admin. There is no mail yet: this panel is the
+    channel, so keep an eye on its badge.
   - While it is on, the instance password (`admin`) **cannot sign in to the
     browser** — it lives in every agent's environment and no one could reset it;
     use a named account. Agents, Telegram and peers keep working (they never use

package/dist/accounts.d.ts

@@ -13,10 +13,13 @@ export interface Account {
     /** Absent until an invitation is redeemed. */
     passwordHash?: string;
     createdAt: number;
-    /** Present only while the invitation is outstanding. */
+    /** Present only while the invitation is outstanding. `reason: "password"`
+     *  marks a level-1 reset: the passkeys were kept, so redeeming the link sets
+     *  a password and then asks for one of them. */
     invite?: {
         token: string;
         expiresAt: number;
+        reason?: "password";
     };
     /** Registered passkeys — the second factor (see `src/twofactor.ts`). */
     passkeys?: Passkey[];
@@ -27,6 +30,10 @@ export interface Account {
         expiresAt: number;
         by: string;
     };
+    /** A session cookie issued before this instant is refused. Set when access
+     *  is reset, a passkey removed or an admin demoted: without it a session
+     *  opened before the reset (a stolen one, a lost phone's) outlived it. */
+    sessionsAfter?: number;
 }
 export interface Passkey {
     /** Credential id, base64url. */
@@ -86,10 +93,13 @@ export declare function signSession(user: string, issuedAt: number, secret: Buff
 export declare function readSessionFull(token: string, secret: Buffer, now: number, maxAgeMs: number): {
     user: string;
     mfa: boolean;
+    issuedAt: number;
 } | null;
 export declare function readSession(token: string, secret: Buffer, now: number, maxAgeMs: number): string | null;
-/** A week: long enough to hand the link over by another channel, short enough
- *  that a forgotten one stops working. */
+/** Is a session issued at `issuedAt` still good for this account? */
+export declare function sessionAlive(issuedAt: number, acct: Pick<Account, "sessionsAfter">): boolean;
+/** 48 hours: enough to hand the link over by another channel, short enough
+ *  that a link left lying in a chat stops working. Was a week. */
 export declare const INVITE_TTL_MS: number;
 export declare function newInvite(now: number): {
     token: string;

package/dist/accounts.js

@@ -124,7 +124,7 @@ export function readSessionFull(token, secret, now, maxAgeMs) {
         return null;
     try {
         const user = Buffer.from(u, "base64url").toString("utf8");
-        return user ? { user, mfa: mfa === "1" } : null;
+        return user ? { user, mfa: mfa === "1", issuedAt } : null;
     }
     catch {
         return null;
@@ -133,9 +133,13 @@ export function readSessionFull(token, secret, now, maxAgeMs) {
 export function readSession(token, secret, now, maxAgeMs) {
     return readSessionFull(token, secret, now, maxAgeMs)?.user ?? null;
 }
-/** A week: long enough to hand the link over by another channel, short enough
- *  that a forgotten one stops working. */
-export const INVITE_TTL_MS = 7 * 24 * 3600 * 1000;
+/** Is a session issued at `issuedAt` still good for this account? */
+export function sessionAlive(issuedAt, acct) {
+    return !acct.sessionsAfter || issuedAt >= acct.sessionsAfter;
+}
+/** 48 hours: enough to hand the link over by another channel, short enough
+ *  that a link left lying in a chat stops working. Was a week. */
+export const INVITE_TTL_MS = 48 * 3600 * 1000;
 export function newInvite(now) {
     return { token: randomBytes(24).toString("base64url"), expiresAt: now + INVITE_TTL_MS };
 }

package/dist/accounts.js.map

@@ -1 +1 @@
-{"version":3,"file":"accounts.js","sourceRoot":"","sources":["../src/accounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAwCzC,wEAAwE;AACxE,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC,SAAS,SAAS;IAChB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAe;IAC1C,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;IACtB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AAED;oEACoE;AACpE,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACxC,OAAO,UAAU,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,IAAY;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/C,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,OAAO,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAKhC;IACC,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;IAC9F,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IACxD,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,IAAI,KAAK,eAAe;YAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,eAAe,yCAAyC,EAAE,CAAC;QAC5F,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,IAAI,EAAE,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,CAAC;IACjF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,oDAAoD;IACtD,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC/B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;6EAK6E;AAC7E,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,QAAgB,EAAE,MAAc,EAAE,GAAG,GAAG,KAAK;IACrF,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,OAAO,GAAG,IAAI,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAa,EACb,MAAc,EACd,GAAW,EACX,QAAgB;IAEhB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC;IACtB,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAChD,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,GAAG,GAAG,QAAQ,GAAG,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,MAAc,EAAE,GAAW,EAAE,QAAgB;IACtF,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;AACrE,CAAC;AAED;0CAC0C;AAC1C,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAElD,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,aAAa,EAAE,CAAC;AAC1F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,OAA4B,EAC5B,KAAa,EACb,GAAW;IAEX,oEAAoE;IACpE,8EAA8E;IAC9E,wEAAwE;IACxE,IAAI,CAAC,OAAO;QACV,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iFAAiF,EAAE,CAAC;IACjH,IAAI,CAAC,OAAO,CAAC,MAAM;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wDAAwD,EAAE,CAAC;IACxF,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IACtF,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kDAAkD,EAAE,CAAC;IAClF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAC1B,MAA0B,EAC1B,WAA+B,EAC/B,OAA2B;IAE3B,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,MAAc;IAC9D,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAChE,OAAO,GAAG,EAAE,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACvF,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,MAAc;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChF,2EAA2E;IAC3E,6DAA6D;IAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"accounts.js","sourceRoot":"","sources":["../src/accounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AA8CzC,wEAAwE;AACxE,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC,SAAS,SAAS;IAChB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAe;IAC1C,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;IACtB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AAED;oEACoE;AACpE,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACxC,OAAO,UAAU,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,IAAY;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/C,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,OAAO,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAKhC;IACC,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;IAC9F,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IACxD,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,IAAI,KAAK,eAAe;YAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,eAAe,yCAAyC,EAAE,CAAC;QAC5F,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,IAAI,EAAE,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,CAAC;IACjF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,oDAAoD;IACtD,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC/B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;6EAK6E;AAC7E,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,QAAgB,EAAE,MAAc,EAAE,GAAG,GAAG,KAAK;IACrF,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,OAAO,GAAG,IAAI,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAa,EACb,MAAc,EACd,GAAW,EACX,QAAgB;IAEhB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC;IACtB,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAChD,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,GAAG,GAAG,QAAQ,GAAG,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,KAAK,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,MAAc,EAAE,GAAW,EAAE,QAAgB;IACtF,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;AACrE,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,IAAoC;IACjF,OAAO,CAAC,IAAI,CAAC,aAAa,IAAI,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC;AAC/D,CAAC;AAED;kEACkE;AAClE,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE9C,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,aAAa,EAAE,CAAC;AAC1F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,OAA4B,EAC5B,KAAa,EACb,GAAW;IAEX,oEAAoE;IACpE,8EAA8E;IAC9E,wEAAwE;IACxE,IAAI,CAAC,OAAO;QACV,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iFAAiF,EAAE,CAAC;IACjH,IAAI,CAAC,OAAO,CAAC,MAAM;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wDAAwD,EAAE,CAAC;IACxF,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IACtF,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kDAAkD,EAAE,CAAC;IAClF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAC1B,MAA0B,EAC1B,WAA+B,EAC/B,OAA2B;IAE3B,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,MAAc;IAC9D,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAChE,OAAO,GAAG,EAAE,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACvF,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,MAAc;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChF,2EAA2E;IAC3E,6DAA6D;IAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/admin-requests.d.ts

@@ -0,0 +1,78 @@
+export type RequestKind = "passkey-reset" | "full-reset" | "promote" | "demote";
+export interface AdminRequest {
+    id: string;
+    kind: RequestKind;
+    target: string;
+    /** The admin who asked. */
+    by: string;
+    createdAt: number;
+    /** The second admin, once approved. */
+    approvedBy?: string;
+    /** full-reset only: when it takes effect on its own. */
+    effectiveAt?: number;
+    /** Set when it took effect / was cancelled or refused; the row then only
+     *  lingers so its asker can read the outcome. */
+    doneAt?: number;
+    outcome?: "applied" | "cancelled" | "refused" | "expired";
+    /** Who cancelled or refused. */
+    closedBy?: string;
+    /** What the asker hands over once applied: a reset link or a device code. */
+    handover?: {
+        kind: "link" | "code";
+        value: string;
+        expiresAt: number;
+    };
+}
+/** An unapproved request dies after this. */
+export declare const REQUEST_TTL_MS: number;
+/** Level 3's waiting time. */
+export declare const FULL_RESET_DELAY_MS: number;
+/** A closed row stays this long so its outcome (and handover) can be read. */
+export declare const CLOSED_KEEP_MS: number;
+type Verdict = {
+    ok: true;
+} | {
+    ok: false;
+    error: string;
+};
+interface Who {
+    name: string;
+    role: string;
+}
+interface Acct {
+    name: string;
+    role: string;
+}
+export declare function newRequest(kind: RequestKind, target: string, by: string, now: number): AdminRequest;
+export declare const isOpen: (r: AdminRequest) => boolean;
+/** May `actor` ask for this? */
+export declare function askVerdict(o: {
+    actor: Who | null;
+    kind: RequestKind;
+    target: string;
+    accounts: Acct[];
+}): Verdict;
+/** May `approver` approve this request now? */
+export declare function approveVerdict(r: AdminRequest | undefined, approver: Who | null, now: number): Verdict;
+/**
+ * May `who` cancel it? The asker, any OTHER admin (the 24 h of level 3 are
+ * worth what the other admins' attention is worth), or the target themself —
+ * a request made behind their back is precisely what they must be able to stop.
+ */
+export declare function cancelVerdict(r: AdminRequest | undefined, who: Who | null): Verdict;
+/** Open full-resets whose 24 h are over: to apply now. */
+export declare function dueRequests(list: AdminRequest[], now: number): AdminRequest[];
+/** Close open requests that ran out without approval. */
+export declare function expire(list: AdminRequest[], now: number): AdminRequest[];
+/** Add a request, replacing an open one of the same kind on the same target,
+ *  and dropping closed rows past their keep window. */
+export declare function upsertRequest(list: AdminRequest[], r: AdminRequest, now: number): AdminRequest[];
+/** What the Security panel shows a viewer: what they may approve, and what they asked. */
+export declare function requestsFor(viewer: Who, list: AdminRequest[], now: number): {
+    waiting: AdminRequest[];
+    mine: AdminRequest[];
+};
+export declare function describeRequest(r: AdminRequest): string;
+export declare function loadRequests(): AdminRequest[];
+export declare function saveRequests(list: AdminRequest[]): void;
+export {};

package/dist/admin-requests.js

@@ -0,0 +1,137 @@
+/**
+ * Two-admin requests — 2FA v2 (spec docs/superpowers/specs/2026-10-28-2fa-v2-recovery-design.md
+ * §§ 4–5). What one admin may no longer do alone while two-factor is on:
+ *
+ * - `passkey-reset` (level 2): let someone who lost their passkey register a
+ *   new device — a second admin approves, then a device code is issued;
+ * - `full-reset` (level 3): wipe password and passkeys — effective 24 h after
+ *   the ask, or at once when a second admin approves;
+ * - `promote` / `demote`: make or unmake an admin.
+ *
+ * Stored beside the accounts (`~/.shadok-ai/users/<key>.requests.json`, 600).
+ * No timer anywhere: a due request is APPLIED by whoever next reads the list
+ * (`dueRequests`), so a restart loses nothing and nothing has to stay alive.
+ */
+import { randomBytes } from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { instanceKey } from "./paths.js";
+/** An unapproved request dies after this. */
+export const REQUEST_TTL_MS = 48 * 3600 * 1000;
+/** Level 3's waiting time. */
+export const FULL_RESET_DELAY_MS = 24 * 3600 * 1000;
+/** A closed row stays this long so its outcome (and handover) can be read. */
+export const CLOSED_KEEP_MS = 7 * 24 * 3600 * 1000;
+export function newRequest(kind, target, by, now) {
+    return {
+        id: randomBytes(12).toString("base64url"),
+        kind,
+        target,
+        by,
+        createdAt: now,
+        ...(kind === "full-reset" ? { effectiveAt: now + FULL_RESET_DELAY_MS } : {}),
+    };
+}
+export const isOpen = (r) => r.doneAt == null;
+/** May `actor` ask for this? */
+export function askVerdict(o) {
+    if (!o.actor || o.actor.role !== "admin")
+        return { ok: false, error: "only an admin can ask for this" };
+    if (o.actor.name === o.target)
+        return { ok: false, error: "not for yourself — ask another admin" };
+    const t = o.accounts.find((a) => a.name === o.target);
+    if (!t)
+        return { ok: false, error: `no such account: ${o.target}` };
+    if (o.kind === "promote" && t.role === "admin")
+        return { ok: false, error: `${o.target} is already an admin` };
+    if (o.kind === "demote" && t.role !== "admin")
+        return { ok: false, error: `${o.target} is not an admin` };
+    return { ok: true };
+}
+/** May `approver` approve this request now? */
+export function approveVerdict(r, approver, now) {
+    if (!r || !isOpen(r))
+        return { ok: false, error: "no such open request" };
+    if (!approver || approver.role !== "admin")
+        return { ok: false, error: "only an admin can approve" };
+    if (approver.name === r.by)
+        return { ok: false, error: "you asked for it — a SECOND admin must approve" };
+    if (approver.name === r.target)
+        return { ok: false, error: "it concerns you — another admin must approve" };
+    if (r.approvedBy)
+        return { ok: false, error: "already approved" };
+    if (r.kind !== "full-reset" && now - r.createdAt > REQUEST_TTL_MS)
+        return { ok: false, error: "this request has expired" };
+    return { ok: true };
+}
+/**
+ * May `who` cancel it? The asker, any OTHER admin (the 24 h of level 3 are
+ * worth what the other admins' attention is worth), or the target themself —
+ * a request made behind their back is precisely what they must be able to stop.
+ */
+export function cancelVerdict(r, who) {
+    if (!r || !isOpen(r))
+        return { ok: false, error: "no such open request" };
+    if (!who)
+        return { ok: false, error: "sign in first" };
+    if (who.name === r.by || who.name === r.target || who.role === "admin")
+        return { ok: true };
+    return { ok: false, error: "only an admin, the asker or the person concerned can cancel this" };
+}
+/** Open full-resets whose 24 h are over: to apply now. */
+export function dueRequests(list, now) {
+    return list.filter((r) => isOpen(r) && r.kind === "full-reset" && r.effectiveAt != null && now >= r.effectiveAt);
+}
+/** Close open requests that ran out without approval. */
+export function expire(list, now) {
+    return list.map((r) => isOpen(r) && r.kind !== "full-reset" && now - r.createdAt > REQUEST_TTL_MS
+        ? { ...r, doneAt: now, outcome: "expired" }
+        : r);
+}
+/** Add a request, replacing an open one of the same kind on the same target,
+ *  and dropping closed rows past their keep window. */
+export function upsertRequest(list, r, now) {
+    return [
+        ...list.filter((x) => !(isOpen(x) && x.kind === r.kind && x.target === r.target) && !(x.doneAt != null && now - x.doneAt > CLOSED_KEEP_MS)),
+        r,
+    ];
+}
+/** What the Security panel shows a viewer: what they may approve, and what they asked. */
+export function requestsFor(viewer, list, now) {
+    const waiting = viewer.role === "admin"
+        ? list.filter((r) => approveVerdict(r, viewer, now).ok)
+        : [];
+    const mine = list.filter((r) => r.by === viewer.name).sort((a, b) => b.createdAt - a.createdAt);
+    // Every OTHER admin can see (and cancel) an open full reset they did not ask
+    // for, even though approving it is one click away in `waiting` already.
+    return { waiting, mine };
+}
+export function describeRequest(r) {
+    switch (r.kind) {
+        case "passkey-reset": return `${r.by} asks to let ${r.target} register a new device (lost passkey)`;
+        case "full-reset": return `${r.by} asks for a FULL reset of ${r.target} (password and passkeys)`;
+        case "promote": return `${r.by} asks to make ${r.target} admin`;
+        case "demote": return `${r.by} asks to make ${r.target} member`;
+    }
+}
+// ── Storage ──────────────────────────────────────────────────────────────────
+function requestsFile() {
+    return path.join(os.homedir(), ".shadok-ai", "users", instanceKey() + ".requests.json");
+}
+export function loadRequests() {
+    try {
+        const v = JSON.parse(fs.readFileSync(requestsFile(), "utf8"));
+        return Array.isArray(v) ? v.filter((r) => r && typeof r.id === "string") : [];
+    }
+    catch {
+        return [];
+    }
+}
+export function saveRequests(list) {
+    const f = requestsFile();
+    fs.mkdirSync(path.dirname(f), { recursive: true });
+    fs.writeFileSync(f, JSON.stringify(list, null, 2), { mode: 0o600 });
+    fs.chmodSync(f, 0o600);
+}
+//# sourceMappingURL=admin-requests.js.map

package/dist/admin-requests.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-requests.js","sourceRoot":"","sources":["../src/admin-requests.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAyBzC,6CAA6C;AAC7C,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC/C,8BAA8B;AAC9B,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACpD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAMnD,MAAM,UAAU,UAAU,CAAC,IAAiB,EAAE,MAAc,EAAE,EAAU,EAAE,GAAW;IACnF,OAAO;QACL,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QACzC,IAAI;QACJ,MAAM;QACN,EAAE;QACF,SAAS,EAAE,GAAG;QACd,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,GAAG,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAe,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC;AAE5D,gCAAgC;AAChC,MAAM,UAAU,UAAU,CAAC,CAA6E;IACtG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;IACxG,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;IACnG,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACpE,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,MAAM,sBAAsB,EAAE,CAAC;IAC/G,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,MAAM,kBAAkB,EAAE,CAAC;IAC1G,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,cAAc,CAAC,CAA2B,EAAE,QAAoB,EAAE,GAAW;IAC3F,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAC1E,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;IACrG,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC;IAC1G,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC;IAC5G,IAAI,CAAC,CAAC,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAClE,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,GAAG,GAAG,CAAC,CAAC,SAAS,GAAG,cAAc;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;IAC3H,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,CAA2B,EAAE,GAAe;IACxE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAC1E,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IACvD,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC5F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kEAAkE,EAAE,CAAC;AAClG,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,WAAW,CAAC,IAAoB,EAAE,GAAW;IAC3D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,WAAW,IAAI,IAAI,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC;AACnH,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,MAAM,CAAC,IAAoB,EAAE,GAAW;IACtD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACpB,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,GAAG,GAAG,CAAC,CAAC,SAAS,GAAG,cAAc;QACxE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,SAAkB,EAAE;QACpD,CAAC,CAAC,CAAC,CACN,CAAC;AACJ,CAAC;AAED;uDACuD;AACvD,MAAM,UAAU,aAAa,CAAC,IAAoB,EAAE,CAAe,EAAE,GAAW;IAC9E,OAAO;QACL,GAAG,IAAI,CAAC,MAAM,CACZ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,cAAc,CAAC,CAC5H;QACD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,WAAW,CAAC,MAAW,EAAE,IAAoB,EAAE,GAAW;IACxE,MAAM,OAAO,GACX,MAAM,CAAC,IAAI,KAAK,OAAO;QACrB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QACvD,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;IAChG,6EAA6E;IAC7E,wEAAwE;IACxE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,CAAe;IAC7C,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,eAAe,EAAE,OAAO,GAAG,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,MAAM,uCAAuC,CAAC;QACpG,KAAK,YAAY,EAAE,OAAO,GAAG,CAAC,CAAC,EAAE,6BAA6B,CAAC,CAAC,MAAM,0BAA0B,CAAC;QACjG,KAAK,SAAS,EAAE,OAAO,GAAG,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,MAAM,QAAQ,CAAC;QAChE,KAAK,QAAQ,EAAE,OAAO,GAAG,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,MAAM,SAAS,CAAC;IAClE,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF,SAAS,YAAY;IACnB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,gBAAgB,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAoB;IAC/C,MAAM,CAAC,GAAG,YAAY,EAAE,CAAC;IACzB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC"}

package/dist/security-events.d.ts

@@ -0,0 +1,76 @@
+export type SecEventKind = "invited" | "invite-redeemed" | "removed" | "role-changed" | "access-reset" | "passkey-added" | "passkey-removed" | "device-code" | "two-factor" | "request" | "not-me";
+export interface SecEvent {
+    id: string;
+    at: number;
+    kind: SecEventKind;
+    /** Who did it (an account name, or "admin" for the instance password). */
+    actor: string;
+    /** Whose account it concerns. */
+    target: string;
+    /** Kind-specific detail: the new role, a passkey's label, "on"/"off". */
+    detail?: string;
+    /** The passkey concerned, so "this wasn't me" can remove it. */
+    passkeyId?: string;
+    /** For a `not-me`: the event it disowns. */
+    about?: string;
+    /** For a `request` event: the two-admin request it reports on, so "this
+     *  wasn't me" can cancel it while it is still open. */
+    requestId?: string;
+    /** Who has opened it in the panel. */
+    seenBy?: string[];
+    /** Already disowned by its target — the button is spent. */
+    disowned?: boolean;
+}
+/** Bounds: the log is an audit trail, not an archive. */
+export declare const MAX_EVENTS = 500;
+export declare const MAX_AGE_MS: number;
+export declare function appendEvent(list: SecEvent[], ev: Omit<SecEvent, "id" | "at">, now: number, id?: string): SecEvent[];
+/**
+ * Which events concern the viewer as a TARGET, i.e. what they need to hear
+ * about: anything someone else did to their account, and every passkey added
+ * or removed on it even by "themselves" — whoever holds their password and a
+ * code IS "themselves" to the server, which is exactly the case to catch.
+ */
+export declare function aboutYou(e: SecEvent, viewer: string): boolean;
+export interface Inbox {
+    /** Events about the viewer, newest first. */
+    aboutYou: (SecEvent & {
+        unread: boolean;
+    })[];
+    /** Admins only: every event, newest first. Empty for a member. */
+    log: (SecEvent & {
+        unread: boolean;
+    })[];
+    /** What needs the viewer: unread notices about them, and — for an admin —
+     *  unread "this wasn't me" flags. */
+    badge: number;
+}
+export declare function inboxFor(viewer: {
+    name: string;
+    role: string;
+}, events: SecEvent[]): Inbox;
+/** Mark everything the viewer can see as seen by them. */
+export declare function markSeen(events: SecEvent[], viewer: {
+    name: string;
+    role: string;
+}): SecEvent[];
+/**
+ * What "this wasn't me" undoes for an event, or why it cannot. Every case ends
+ * the account's other sessions; a passkey nobody admits to adding is removed.
+ * Only the event's TARGET may disown it, once.
+ */
+export declare function notMeEffect(e: SecEvent | undefined, viewer: string): {
+    ok: true;
+    removePasskey?: string;
+    cancelRequest?: string;
+} | {
+    ok: false;
+    error: string;
+};
+/** One line a person reads, for the panel. */
+export declare function describeEvent(e: SecEvent): string;
+export declare function loadEvents(): SecEvent[];
+export declare function saveEvents(list: SecEvent[]): void;
+/** Record one event. Never throws: losing an audit line must not fail the
+ *  action it describes (the console line beside each call still exists). */
+export declare function recordEvent(ev: Omit<SecEvent, "id" | "at">): SecEvent | null;

package/dist/security-events.js

@@ -0,0 +1,115 @@
+/**
+ * The Security panel's events — what happened to accounts and second factors,
+ * kept per instance beside the accounts (`~/.shadok-ai/users/<key>.events.json`,
+ * 600). Spec: docs/superpowers/specs/2026-10-28-2fa-v2-recovery-design.md § 6.
+ *
+ * No mail sender exists, so this is THE channel that tells someone what was
+ * done to their account, and the place they can say "this wasn't me". Pure
+ * cores (`appendEvent`, `inboxFor`, `notMeEffect`) are tested; the file I/O is
+ * the thin part.
+ */
+import { randomBytes } from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { instanceKey } from "./paths.js";
+/** Bounds: the log is an audit trail, not an archive. */
+export const MAX_EVENTS = 500;
+export const MAX_AGE_MS = 90 * 24 * 3600 * 1000;
+export function appendEvent(list, ev, now, id) {
+    const row = { id: id ?? randomBytes(9).toString("base64url"), at: now, ...ev };
+    return [...list.filter((e) => now - e.at <= MAX_AGE_MS), row].slice(-MAX_EVENTS);
+}
+/**
+ * Which events concern the viewer as a TARGET, i.e. what they need to hear
+ * about: anything someone else did to their account, and every passkey added
+ * or removed on it even by "themselves" — whoever holds their password and a
+ * code IS "themselves" to the server, which is exactly the case to catch.
+ */
+export function aboutYou(e, viewer) {
+    if (e.target !== viewer || e.kind === "not-me")
+        return false;
+    if (e.kind === "passkey-added" || e.kind === "passkey-removed")
+        return true;
+    return e.actor !== viewer;
+}
+export function inboxFor(viewer, events) {
+    const mark = (e) => ({ ...e, unread: !(e.seenBy ?? []).includes(viewer.name) });
+    const newest = [...events].sort((a, b) => b.at - a.at);
+    const mine = newest.filter((e) => aboutYou(e, viewer.name)).map(mark);
+    const admin = viewer.role === "admin";
+    const log = admin ? newest.map(mark) : [];
+    const flags = admin ? log.filter((e) => e.kind === "not-me" && e.unread).length : 0;
+    return { aboutYou: mine, log, badge: mine.filter((e) => e.unread).length + flags };
+}
+/** Mark everything the viewer can see as seen by them. */
+export function markSeen(events, viewer) {
+    const visible = (e) => viewer.role === "admin" || aboutYou(e, viewer.name);
+    return events.map((e) => visible(e) && !(e.seenBy ?? []).includes(viewer.name) ? { ...e, seenBy: [...(e.seenBy ?? []), viewer.name] } : e);
+}
+/**
+ * What "this wasn't me" undoes for an event, or why it cannot. Every case ends
+ * the account's other sessions; a passkey nobody admits to adding is removed.
+ * Only the event's TARGET may disown it, once.
+ */
+export function notMeEffect(e, viewer) {
+    if (!e || !aboutYou(e, viewer))
+        return { ok: false, error: "no such notice for you" };
+    if (e.disowned)
+        return { ok: false, error: "already reported" };
+    return {
+        ok: true,
+        ...(e.kind === "passkey-added" && e.passkeyId ? { removePasskey: e.passkeyId } : {}),
+        ...(e.requestId ? { cancelRequest: e.requestId } : {}),
+    };
+}
+/** One line a person reads, for the panel. */
+export function describeEvent(e) {
+    const by = e.actor === e.target ? "you" : e.actor;
+    switch (e.kind) {
+        case "invited": return `${e.actor} invited ${e.target}${e.detail ? " as " + e.detail : ""}`;
+        case "invite-redeemed": return `${e.target} set their password from an invitation or reset link`;
+        case "removed": return `${e.actor} removed the account ${e.target}`;
+        case "role-changed": return `${e.actor} made ${e.target} ${e.detail ?? "?"}`;
+        case "access-reset": return `${e.actor} reset ${e.target}'s access (password and passkeys removed)`;
+        case "passkey-added": return `a passkey${e.detail ? " “" + e.detail + "”" : ""} was registered on ${e.target}'s account (by ${by})`;
+        case "passkey-removed": return `a passkey was removed from ${e.target}'s account (by ${by})`;
+        case "device-code": return `${e.actor} issued a device code for ${e.target}`;
+        case "two-factor": return `${e.actor} turned two-factor sign-in ${e.detail ?? ""}`.trim();
+        case "request": return e.detail ?? `a request about ${e.target}`;
+        case "not-me": return `⚠ ${e.actor} reported “this wasn't me”: ${e.detail ?? ""}`.trim();
+    }
+}
+// ── Storage ──────────────────────────────────────────────────────────────────
+function eventsFile() {
+    return path.join(os.homedir(), ".shadok-ai", "users", instanceKey() + ".events.json");
+}
+export function loadEvents() {
+    try {
+        const v = JSON.parse(fs.readFileSync(eventsFile(), "utf8"));
+        return Array.isArray(v) ? v.filter((e) => e && typeof e.id === "string") : [];
+    }
+    catch {
+        return [];
+    }
+}
+export function saveEvents(list) {
+    const f = eventsFile();
+    fs.mkdirSync(path.dirname(f), { recursive: true });
+    fs.writeFileSync(f, JSON.stringify(list, null, 2), { mode: 0o600 });
+    fs.chmodSync(f, 0o600);
+}
+/** Record one event. Never throws: losing an audit line must not fail the
+ *  action it describes (the console line beside each call still exists). */
+export function recordEvent(ev) {
+    try {
+        const list = appendEvent(loadEvents(), ev, Date.now());
+        saveEvents(list);
+        return list[list.length - 1];
+    }
+    catch (err) {
+        console.log(`security: could not record ${ev.kind} — ${err.message}`);
+        return null;
+    }
+}
+//# sourceMappingURL=security-events.js.map

package/dist/security-events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-events.js","sourceRoot":"","sources":["../src/security-events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAsCzC,yDAAyD;AACzD,MAAM,CAAC,MAAM,UAAU,GAAG,GAAG,CAAC;AAC9B,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEhD,MAAM,UAAU,WAAW,CAAC,IAAgB,EAAE,EAA+B,EAAE,GAAW,EAAE,EAAW;IACrG,MAAM,GAAG,GAAa,EAAE,EAAE,EAAE,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;IACzF,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,IAAI,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC;AACnF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,CAAW,EAAE,MAAc;IAClD,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC;AAC5B,CAAC;AAYD,MAAM,UAAU,QAAQ,CAAC,MAAsC,EAAE,MAAkB;IACjF,MAAM,IAAI,GAAG,CAAC,CAAW,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC;IACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;AACrF,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,QAAQ,CAAC,MAAkB,EAAE,MAAsC;IACjF,MAAM,OAAO,GAAG,CAAC,CAAW,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACrF,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACtB,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CACjH,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,CAAuB,EACvB,MAAc;IAEd,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;IACtF,IAAI,CAAC,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAChE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,aAAa,CAAC,CAAW;IACvC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAClD,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,SAAS,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC5F,KAAK,iBAAiB,EAAE,OAAO,GAAG,CAAC,CAAC,MAAM,sDAAsD,CAAC;QACjG,KAAK,SAAS,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,wBAAwB,CAAC,CAAC,MAAM,EAAE,CAAC;QACpE,KAAK,cAAc,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC7E,KAAK,cAAc,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,MAAM,2CAA2C,CAAC;QACpG,KAAK,eAAe,EAAE,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC,MAAM,kBAAkB,EAAE,GAAG,CAAC;QACpI,KAAK,iBAAiB,EAAE,OAAO,8BAA8B,CAAC,CAAC,MAAM,kBAAkB,EAAE,GAAG,CAAC;QAC7F,KAAK,aAAa,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,6BAA6B,CAAC,CAAC,MAAM,EAAE,CAAC;QAC7E,KAAK,YAAY,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,8BAA8B,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1F,KAAK,SAAS,EAAE,OAAO,CAAC,CAAC,MAAM,IAAI,mBAAmB,CAAC,CAAC,MAAM,EAAE,CAAC;QACjE,KAAK,QAAQ,EAAE,OAAO,KAAK,CAAC,CAAC,KAAK,+BAA+B,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IAC3F,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,cAAc,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5D,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAgB;IACzC,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;IACvB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AAED;4EAC4E;AAC5E,MAAM,UAAU,WAAW,CAAC,EAA+B;IACzD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACvD,UAAU,CAAC,IAAI,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,CAAC,IAAI,MAAO,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}