tinybeeai 0.0.0-stage → 0.16.1

package/dist/flows/ticketReview.js

@@ -0,0 +1,249 @@
+// ticket_review: score the ticket, search code by keywords, review it like QA in refinement.
+import { getLlmFor } from '../agent/llm.js';
+import { runStage } from '../stages/index.js';
+import { listMemory } from '../agent/memory.js';
+import { gate } from '../agent/rules.js';
+import { addStep, finishRun, setDesigned, setImpact, setTicketFacts, setVerdict, startRun } from '../agent/runs.js';
+import { githubFor, githubMode } from '../integrations/github.js';
+import { issueApi, parseIssueRef } from '../integrations/github-issues.js';
+import { recordIssueTimeline } from '../links.js';
+import { jiraFor } from '../integrations/jira.js';
+import { linearFor } from '../integrations/linear.js';
+import { registerHandler } from '../queue.js';
+import { backfillLimitOf } from '../monitor/backfill.js';
+import { eventOf, guarded, loadWatch, renderTicketComment, noteModelFallback } from './common.js';
+import { watchRepos } from '../repos.js';
+import { designTestCases, designedDetail } from './testDesign.js';
+import { checkExistingTests, recordImpactSteps } from './impact.js';
+import { contextNote, contextStepDetail, hasContext, readTicketContext, scrubDiscussionEcho } from './ticketContext.js';
+import { lastReview, settleAnswered } from './answers.js';
+export const SCORE_FLOOR = 30;
+const STOP = new Set([
+    'the',
+    'and',
+    'for',
+    'with',
+    'from',
+    'that',
+    'this',
+    'when',
+    'should',
+    'into',
+    'onto',
+    'top',
+    'add',
+    'apply',
+    'make',
+    'allow',
+    'user',
+    'users',
+    'able',
+    'can',
+    'new',
+    'use',
+]);
+export function keywords(t, max = 3) {
+    const words = `${t.title} ${t.labels?.join(' ') ?? ''}`
+        .toLowerCase()
+        .split(/[^a-z0-9]+/)
+        .filter((w) => w.length > 3 && !STOP.has(w));
+    return [...new Set(words)].slice(0, max);
+}
+async function fetchTicket(watch, key, id, tracker) {
+    if (tracker === 'github') {
+        const ref = parseIssueRef(key);
+        if (!ref)
+            throw new Error(`not a GitHub issue key: ${key}`);
+        return issueApi(ref.full).getIssue(ref.number);
+    }
+    return tracker === 'linear' ? linearFor(watch).getIssue(id || key) : jiraFor(watch).getIssue(key);
+}
+registerHandler('ticket_review', async (job) => {
+    const watch = loadWatch(job.watchId);
+    if (watch.paused)
+        return;
+    const ev = eventOf(job);
+    // A backfilled review that waited in the queue while the backfill was turned off (limit 0) is dropped, so it spends no model call.
+    if (ev.backfill === true && !ev.requestedBy && backfillLimitOf(watch) === 0)
+        return;
+    const run = startRun(watch.id, 'ticket_review', ev);
+    await guarded(run.id, async () => {
+        const ref = ev.ticket;
+        const ticket = ev.inlineTicket ?? (ref ? await fetchTicket(watch, ref.key, ref.id, ref.tracker) : undefined);
+        if (!ticket)
+            throw new Error('event has no ticket reference');
+        addStep(run.id, 'Read the ticket', `${ticket.key}: ${ticket.title}`);
+        setTicketFacts(run.id, { hasAcceptanceCriteria: Boolean(ticket.acceptanceCriteria?.trim()) });
+        if (ev.ticket?.change?.field === 'command')
+            addStep(run.id, 'Review requested', `/localdost review by ${ev.ticket.change.value || 'a maintainer'}`, 'info');
+        // KAT-393: a person answered under the ticket. This review is the second look: it says which questions of the last one are answered now.
+        const answered = ev.ticket?.change?.field === 'answer' ? ev.answers : undefined;
+        if (answered && ticket.state === 'closed') {
+            addStep(run.id, 'The ticket is closed', `${ticket.key} was closed before this review started, so it is not reviewed again.`, 'info');
+            setVerdict(run.id, {
+                outcome: 'info',
+                headline: `${ticket.key} was closed, so it is not reviewed again`,
+                summary: `${ticket.key} was closed after someone answered under it, so localdost did not review it again.`,
+                risk: 'low',
+                findings: [],
+                openQuestions: [],
+                testIdeas: [],
+                testsAtRisk: [],
+                confidence: 0.9,
+            });
+            finishRun(run.id, 'done', null);
+            return;
+        }
+        const before = answered ? lastReview(watch.id, ticket.key, run.id) : undefined;
+        const asked = before?.verdict?.openQuestions ?? [];
+        if (answered)
+            addStep(run.id, 'Someone answered', `${answered.by.join(', ')} wrote under ${ticket.key} after the last review, which left ${asked.length === 1 ? '1 question' : `${asked.length} questions`} open. This review checks which are answered now.`, 'info');
+        const issue = ticket.tracker === 'github' ? parseIssueRef(ticket.key) : null;
+        if (issue && githubMode() !== 'demo') {
+            // Timeline links (cross-references, sub-issues, blocking) feed traceability; a failure only warns.
+            try {
+                const n = await recordIssueTimeline(watch, issue.full, issue.number);
+                if (n)
+                    addStep(run.id, 'Linked issues and PRs', `${n} new link${n === 1 ? '' : 's'} from the timeline`);
+            }
+            catch (err) {
+                addStep(run.id, 'Timeline read failed', String(err), 'warn');
+            }
+        }
+        const llm = getLlmFor(watch, runStage(run));
+        const score = await llm.score(ticket);
+        addStep(run.id, 'Actionability score', `${score}/100`, score < SCORE_FLOOR ? 'warn' : 'ok');
+        // A person who asks for the review gets one, thin or not; the review then names what is missing (KAT-98). So does a person who answers.
+        if (score < SCORE_FLOOR && (ev.requestedBy || answered))
+            addStep(run.id, 'Reviewing anyway', ev.requestedBy ? 'A person asked for this review.' : 'A person answered, so the ticket may be ready now.');
+        if (score < SCORE_FLOOR && !ev.requestedBy && !answered) {
+            setVerdict(run.id, {
+                outcome: 'info',
+                headline: `${ticket.key} is too thin to review yet (${score}/100); it goes in the daily digest`,
+                summary: `${ticket.key} has too little detail for a QA review. It will appear in the digest so someone can flesh it out.`,
+                risk: 'low',
+                findings: [],
+                openQuestions: ['What behaviour should change, and how will we know it works?'],
+                testIdeas: [],
+                testsAtRisk: [],
+                confidence: 0.6,
+            });
+            // A ticket review says nothing about the shop's health, so it leaves the dot's status alone (KAT-74).
+            finishRun(run.id, 'done', null);
+            return;
+        }
+        // Comments, parent, sub-issues and the stored links of a GitHub issue go to the review (KAT-389). Best effort.
+        // It runs after the thin-ticket check, which ignores it, so a ticket that stops there makes no GitHub read for it.
+        let context = null;
+        if (issue && githubMode() !== 'demo') {
+            try {
+                // The author of the ticket and the people the poll checked for write access may answer, whatever their role in the repo.
+                context = await readTicketContext(watch, ticket, {}, answered ? [ticket.reporter ?? '', ...answered.by].filter(Boolean) : []);
+            }
+            catch (err) {
+                addStep(run.id, 'Discussion read failed', String(err), 'warn');
+            }
+            if (context)
+                addStep(run.id, 'Read the discussion', contextStepDetail(context), context.unread.length ? 'warn' : 'info');
+        }
+        let codeHits = [];
+        const words = keywords(ticket);
+        const appRepos = watchRepos(watch).filter((r) => r.role === 'app');
+        if (appRepos.length && words.length) {
+            try {
+                // Every app repo of the dot: a ticket can touch any of them. Paths carry the repo when there are several.
+                const several = appRepos.length > 1;
+                const perRepo = await Promise.all(appRepos.map(async (r) => {
+                    const gh = githubFor(watch, { repo: r });
+                    const hits = (await Promise.all(words.map((w) => gh.searchCode(w).catch(() => [])))).flat();
+                    return several ? hits.map((h) => ({ ...h, path: `${r.owner}/${r.name}:${h.path}` })) : hits;
+                }));
+                const seen = new Set();
+                codeHits = perRepo
+                    .flat()
+                    .filter((h) => !seen.has(h.path) && seen.add(h.path))
+                    .slice(0, 15);
+                addStep(run.id, 'Searched the code', `${words.join(', ')}: ${codeHits.length} files`);
+            }
+            catch (err) {
+                addStep(run.id, 'Code search failed', String(err), 'warn');
+            }
+        }
+        const analysis = noteModelFallback(run.id, await llm.analyze({
+            task: 'ticket_review',
+            watch,
+            event: ev,
+            ticket,
+            codeHits,
+            memory: listMemory(watch.id),
+            ...(hasContext(context) ? { context } : {}),
+            ...(answered && before && asked.length ? { rereview: { questions: asked, answerers: answered.by, since: before.createdAt } } : {}),
+        }));
+        // A copy of a comment never lands in the posted review: a short quote stays, a pasted comment is cut.
+        const scrubbed = scrubDiscussionEcho(analysis, context, ticket);
+        // The answers the review reports are checked here: they must name a question of the last review and a writer the review may trust.
+        const trusted = new Set([ticket.reporter ?? '', ...(answered?.by ?? []), ...(context?.comments.filter((c) => !c.outsider).map((c) => c.author) ?? [])]
+            .filter(Boolean)
+            .map((l) => l.toLowerCase()));
+        const verdict = answered && asked.length ? settleAnswered(scrubbed, asked, trusted) : scrubbed;
+        if (answered && asked.length)
+            addStep(run.id, verdict.answeredQuestions?.length ? 'Questions answered' : 'No question answered yet', verdict.answeredQuestions?.length
+                ? `${verdict.answeredQuestions.length} of ${asked.length} questions of the last review are answered now.`
+                : `None of the ${asked.length} questions of the last review is answered by the new comments.`, verdict.answeredQuestions?.length ? 'ok' : 'info');
+        setVerdict(run.id, verdict);
+        addStep(run.id, 'Review written', verdict.headline, verdict.outcome === 'needs_attention' ? 'warn' : 'ok');
+        // Impact on existing tests (KAT-304): which cases and specs of the dot this ticket changes, from any ticket. It runs
+        // before the comment so the comment can list the specs to update. Best effort: a failure leaves a warning step.
+        let impact = null;
+        try {
+            addStep(run.id, 'Checking existing tests', 'The dot is looking for tests of any ticket that this ticket changes.');
+            impact = await checkExistingTests(watch, ticket, run.id);
+        }
+        catch (err) {
+            addStep(run.id, 'Existing tests check failed', String(err?.message ?? err).slice(0, 200), 'warn');
+        }
+        if (impact) {
+            setImpact(run.id, impact.summary);
+            recordImpactSteps(run.id, impact);
+        }
+        await gate({
+            kind: 'ticket_comment',
+            target: `${ticket.tracker}:${ticket.key}`,
+            title: `QA review for ${ticket.key}`,
+            body: renderTicketComment(verdict, run.id, impact?.items, {
+                key: ticket.key,
+                tracker: ticket.tracker,
+                ...(ticket.reporter ? { reporter: ticket.reporter } : {}),
+            }, contextNote(context)),
+            meta: {
+                key: ticket.key,
+                ticketId: ticket.id,
+                tracker: ticket.tracker,
+                url: ticket.url,
+                ticketReview: true,
+                ...(issue ? { repo: issue.full, issue: issue.number } : {}),
+            },
+        }, watch, run.id);
+        // Test designer (KAT-164): draft manual cases from this review's own analysis, one model call. It runs
+        // after the comment draft, so a slow model never holds the review back.
+        // Best effort: a failure here leaves a warning step and never blocks the review comment below.
+        let designed;
+        addStep(run.id, 'Designing test cases', 'The comment draft is ready. The dot is drafting manual test cases from this review.');
+        try {
+            designed = await designTestCases(watch, ticket, verdict);
+        }
+        catch (err) {
+            designed = null;
+            addStep(run.id, 'Test design failed', `Could not save designed test cases: ${String(err?.message ?? err).slice(0, 200)}`, 'warn');
+        }
+        if (designed) {
+            setDesigned(run.id, designed);
+            if (designed.error)
+                addStep(run.id, 'Test design failed', designed.error, 'warn');
+            else
+                addStep(run.id, 'Designed test cases', designedDetail(designed), 'ok');
+        }
+        finishRun(run.id, 'done', null);
+    });
+});
+//# sourceMappingURL=ticketReview.js.map

package/dist/flows/ticketReview.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ticketReview.js","sourceRoot":"","sources":["../../src/flows/ticketReview.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACpH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAClG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACxH,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE1D,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAE9B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC;IACnB,KAAK;IACL,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,KAAK;IACL,KAAK;IACL,KAAK;CACN,CAAC,CAAC;AAEH,MAAM,UAAU,QAAQ,CAAC,CAAS,EAAE,GAAG,GAAG,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE;SACpD,WAAW,EAAE;SACb,KAAK,CAAC,YAAY,CAAC;SACnB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,KAAY,EAAE,GAAW,EAAE,EAAU,EAAE,OAAoB;IACpF,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;QAC5D,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACpG,CAAC;AAED,eAAe,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;IAC7C,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO;IACzB,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACxB,mIAAmI;IACnI,IAAI,EAAE,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC,WAAW,IAAI,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO;IACpF,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;IACpD,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;QAC/B,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC;QACtB,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7G,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACrE,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,qBAAqB,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9F,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,cAAc,EAAE,EAAE,MAAM,CAAC,CAAC;QAC5J,yIAAyI;QACzI,MAAM,QAAQ,GAAG,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,IAAI,QAAQ,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,sBAAsB,EAAE,GAAG,MAAM,CAAC,GAAG,sEAAsE,EAAE,MAAM,CAAC,CAAC;YACrI,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE;gBACjB,OAAO,EAAE,MAAM;gBACf,QAAQ,EAAE,GAAG,MAAM,CAAC,GAAG,0CAA0C;gBACjE,OAAO,EAAE,GAAG,MAAM,CAAC,GAAG,oFAAoF;gBAC1G,IAAI,EAAE,KAAK;gBACX,QAAQ,EAAE,EAAE;gBACZ,aAAa,EAAE,EAAE;gBACjB,SAAS,EAAE,EAAE;gBACb,WAAW,EAAE,EAAE;gBACf,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;YACH,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/E,MAAM,KAAK,GAAG,MAAM,EAAE,OAAO,EAAE,aAAa,IAAI,EAAE,CAAC;QACnD,IAAI,QAAQ;YACV,OAAO,CACL,GAAG,CAAC,EAAE,EACN,kBAAkB,EAClB,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,GAAG,sCAAsC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,YAAY,mDAAmD,EAC3M,MAAM,CACP,CAAC;QACJ,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7E,IAAI,KAAK,IAAI,UAAU,EAAE,KAAK,MAAM,EAAE,CAAC;YACrC,mGAAmG;YACnG,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBACrE,IAAI,CAAC;oBAAE,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,uBAAuB,EAAE,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,oBAAoB,CAAC,CAAC;YAC1G,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,sBAAsB,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,qBAAqB,EAAE,GAAG,KAAK,MAAM,EAAE,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5F,wIAAwI;QACxI,IAAI,KAAK,GAAG,WAAW,IAAI,CAAC,EAAE,CAAC,WAAW,IAAI,QAAQ,CAAC;YACrD,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,kBAAkB,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,oDAAoD,CAAC,CAAC;QACjJ,IAAI,KAAK,GAAG,WAAW,IAAI,CAAC,EAAE,CAAC,WAAW,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxD,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE;gBACjB,OAAO,EAAE,MAAM;gBACf,QAAQ,EAAE,GAAG,MAAM,CAAC,GAAG,+BAA+B,KAAK,oCAAoC;gBAC/F,OAAO,EAAE,GAAG,MAAM,CAAC,GAAG,mGAAmG;gBACzH,IAAI,EAAE,KAAK;gBACX,QAAQ,EAAE,EAAE;gBACZ,aAAa,EAAE,CAAC,8DAA8D,CAAC;gBAC/E,SAAS,EAAE,EAAE;gBACb,WAAW,EAAE,EAAE;gBACf,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;YACH,sGAAsG;YACtG,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QAED,+GAA+G;QAC/G,mHAAmH;QACnH,IAAI,OAAO,GAAyB,IAAI,CAAC;QACzC,IAAI,KAAK,IAAI,UAAU,EAAE,KAAK,MAAM,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,yHAAyH;gBACzH,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAChI,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,wBAAwB,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,OAAO;gBAAE,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,qBAAqB,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC3H,CAAC;QAED,IAAI,QAAQ,GAAwC,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;QACnE,IAAI,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,0GAA0G;gBAC1G,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;gBACpC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;oBACvB,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;oBACzC,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBAC5F,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC9F,CAAC,CAAC,CACH,CAAC;gBACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;gBAC/B,QAAQ,GAAG,OAAO;qBACf,IAAI,EAAE;qBACN,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;qBACpD,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,mBAAmB,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,MAAM,QAAQ,CAAC,CAAC;YACxF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,oBAAoB,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,iBAAiB,CAChC,GAAG,CAAC,EAAE,EACN,MAAM,GAAG,CAAC,OAAO,CAAC;YAChB,IAAI,EAAE,eAAe;YACrB,KAAK;YACL,KAAK,EAAE,EAAE;YACT,MAAM;YACN,QAAQ;YACR,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,QAAQ,IAAI,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnI,CAAC,CACH,CAAC;QACF,sGAAsG;QACtG,MAAM,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAChE,mIAAmI;QACnI,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;aAC3H,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAC/B,CAAC;QACF,MAAM,OAAO,GAAG,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC/F,IAAI,QAAQ,IAAI,KAAK,CAAC,MAAM;YAC1B,OAAO,CACL,GAAG,CAAC,EAAE,EACN,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,0BAA0B,EACrF,OAAO,CAAC,iBAAiB,EAAE,MAAM;gBAC/B,CAAC,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC,MAAM,OAAO,KAAK,CAAC,MAAM,iDAAiD;gBACzG,CAAC,CAAC,eAAe,KAAK,CAAC,MAAM,gEAAgE,EAC/F,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAClD,CAAC;QACJ,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,gBAAgB,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,KAAK,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAE3G,qHAAqH;QACrH,gHAAgH;QAChH,IAAI,MAAM,GAAmD,IAAI,CAAC;QAClE,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,yBAAyB,EAAE,sEAAsE,CAAC,CAAC;YACnH,MAAM,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,6BAA6B,EAAE,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/G,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAClC,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,IAAI,CACR;YACE,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,EAAE;YACzC,KAAK,EAAE,iBAAiB,MAAM,CAAC,GAAG,EAAE;YACpC,IAAI,EAAE,mBAAmB,CACvB,OAAO,EACP,GAAG,CAAC,EAAE,EACN,MAAM,EAAE,KAAK,EACb;gBACE,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D,EACD,WAAW,CAAC,OAAO,CAAC,CACrB;YACD,IAAI,EAAE;gBACJ,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,YAAY,EAAE,IAAI;gBAClB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D;SACF,EACD,KAAK,EACL,GAAG,CAAC,EAAE,CACP,CAAC;QAEF,uGAAuG;QACvG,wEAAwE;QACxE,+FAA+F;QAC/F,IAAI,QAAqD,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,sBAAsB,EAAE,qFAAqF,CAAC,CAAC;QAC/H,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,GAAG,IAAI,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,oBAAoB,EAAE,uCAAuC,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/I,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAC9B,IAAI,QAAQ,CAAC,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,oBAAoB,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;;gBAC7E,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,qBAAqB,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;QAC9E,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/flows/ticks.js

@@ -0,0 +1,73 @@
+// issue_comment.edited intake: a tester ticks items in the sticky comment's "What to test"
+// list, and the ticks become manual results on the run (docs/PR-REVIEW-QA.md section 5.1).
+// Edits by bots (the App itself included) and by users without write access are ignored.
+import { list } from '../db.js';
+import { addStep, setVerdict } from '../agent/runs.js';
+import { githubFor } from '../integrations/github.js';
+import { checklistId, commentHead, tickedIds } from '../review/render.js';
+import { findRepo, primaryRepo, repoId } from '../repos.js';
+export const WRITE_ASSOCIATIONS = ['OWNER', 'MEMBER', 'COLLABORATOR'];
+/** Applies the ticks of an edited sticky comment to the reviewed run at the comment's head. */
+export async function applyChecklistEdit(edit) {
+    if (edit.senderIsBot)
+        return { applied: false, reason: 'edit made by a bot' };
+    const watches = list('watches').filter((w) => !w.archived && findRepo(w, edit.repo)?.role === 'app');
+    if (!watches.length)
+        return { applied: false, reason: 'no dot watches this repo' };
+    const head = commentHead(edit.body);
+    const ticked = tickedIds(edit.body);
+    for (const watch of watches) {
+        // A two-repo dot can hold the same PR number, head and item ids in both repos: only the review whose
+        // trigger repo is the edited comment's repo takes the ticks (KAT-107). A run stored before triggers
+        // carried a repo belongs to the dot's first app repo.
+        const editRepo = repoId(edit.repo.owner, edit.repo.name);
+        const firstApp = primaryRepo(watch)?.id;
+        const run = list('runs', { watchId: watch.id, kind: 'pr_check' }, { orderBy: 'createdAt DESC', limit: 200 }).find((r) => {
+            if (r.trigger?.pr?.number !== edit.pr || !r.verdict?.qa || (head && !r.verdict.qa.head.startsWith(head)))
+                return false;
+            const t = r.trigger.repo;
+            return (t ? repoId(t.owner, t.name) : firstApp) === editRepo;
+        });
+        if (!run?.verdict?.qa)
+            continue;
+        // Permission: the GitHub permission API for the sender. The payload association describes the author of the
+        // sticky comment (the App or the PAT owner), not the editor, so it is only a fallback in demo mode, where there
+        // is no API to ask. A live client that cannot answer fails closed (KAT-63).
+        const gh = githubFor(watch, { repo: edit.repo });
+        let allowed = await gh.writePermission(edit.sender).catch(() => null);
+        if (allowed === null) {
+            if (gh.mode !== 'demo') {
+                addStep(run.id, 'Ignored checklist edit', `Could not confirm that ${edit.sender || 'the editor'} has write access to ${edit.repo.owner}/${edit.repo.name}.`, 'warn');
+                return { applied: false, reason: 'write access could not be checked', runId: run.id };
+            }
+            allowed = WRITE_ASSOCIATIONS.includes(edit.association);
+        }
+        if (!allowed) {
+            addStep(run.id, 'Ignored checklist edit', `${edit.sender || 'Someone'} has no write access to ${edit.repo.owner}/${edit.repo.name}.`, 'warn');
+            return { applied: false, reason: 'editor has no write access', runId: run.id };
+        }
+        const qa = run.verdict.qa;
+        let changed = 0;
+        const whatToTest = qa.whatToTest.map((t) => {
+            const on = ticked.has(checklistId(t));
+            if (on && t.resultSource !== 'ci' && !(t.result === 'passed' && t.resultSource === 'manual')) {
+                changed++;
+                return { ...t, result: 'passed', resultSource: 'manual' };
+            }
+            if (!on && t.resultSource === 'manual') {
+                changed++;
+                const { result: _r, resultSource: _s, ...rest } = t;
+                return rest;
+            }
+            return t;
+        });
+        if (!changed)
+            return { applied: false, reason: 'no checklist change', runId: run.id, ticked: ticked.size };
+        setVerdict(run.id, { ...run.verdict, qa: { ...qa, whatToTest } });
+        const done = whatToTest.filter((t) => t.resultSource === 'manual').length;
+        addStep(run.id, 'Checklist updated on the PR', `${edit.sender || 'A tester'} marked ${done} of ${whatToTest.length} items tested.`, 'ok');
+        return { applied: true, reason: 'ticks saved', runId: run.id, ticked: done };
+    }
+    return { applied: false, reason: 'no reviewed run for this comment' };
+}
+//# sourceMappingURL=ticks.js.map

package/dist/flows/ticks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ticks.js","sourceRoot":"","sources":["../../src/flows/ticks.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,2FAA2F;AAC3F,yFAAyF;AACzF,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAoB,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAE1E,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE5D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;AAStE,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAiB;IACxD,IAAI,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC9E,MAAM,OAAO,GAAG,IAAI,CAAQ,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC;IAC5G,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IACnF,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEpC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,qGAAqG;QACrG,oGAAoG;QACpG,sDAAsD;QACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAY,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACjI,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YACvH,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;YACzB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC;QAC/D,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;YAAE,SAAS;QAEhC,4GAA4G;QAC5G,gHAAgH;QAChH,4EAA4E;QAC5E,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACjD,IAAI,OAAO,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACtE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,IAAI,EAAE,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACvB,OAAO,CACL,GAAG,CAAC,EAAE,EACN,wBAAwB,EACxB,0BAA0B,IAAI,CAAC,MAAM,IAAI,YAAY,wBAAwB,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,EACjH,MAAM,CACP,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;YACxF,CAAC;YACD,OAAO,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,wBAAwB,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,SAAS,2BAA2B,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,MAAM,CAAC,CAAC;YAC9I,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;QACjF,CAAC;QAED,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAe,EAAE;YACtD,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YACtC,IAAI,EAAE,IAAI,CAAC,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAC7F,OAAO,EAAE,CAAC;gBACV,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;YAC5D,CAAC;YACD,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;gBACvC,OAAO,EAAE,CAAC;gBACV,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;gBACpD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAC3G,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,6BAA6B,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,UAAU,WAAW,IAAI,OAAO,UAAU,CAAC,MAAM,gBAAgB,EAAE,IAAI,CAAC,CAAC;QAC1I,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;AACxE,CAAC"}

package/dist/hive/admin.js

@@ -0,0 +1,122 @@
+// Operator and edge routes (docs/tinybee/06-infra-ops.md): the staging cleanup deletes test tenants and
+// their tunnels, the tunnel count guards the Cloudflare budget, and the edge Worker asks which tenant a
+// slug belongs to. Admin routes need HIVE_ADMIN_TOKEN; without it they do not exist (404).
+import { timingSafeEqual } from 'node:crypto';
+import { hiveConfig, hiveLog } from './config.js';
+import { hiveDb } from './db.js';
+import { relayMetrics } from './relay.js';
+import { pushMetrics } from './push.js';
+import { storeManifestDoc } from './updates.js';
+import { UPDATE_CHANNELS } from '../tinybee/update-manifest.js';
+import { HiveError } from './errors.js';
+import { bearerOf } from './session.js';
+import { tenantBySlug, normalizeSlug } from './tenants.js';
+import { tunnelProvider } from './tunnel/provider.js';
+export const TUNNEL_WARN_AT = 40;
+function requireAdmin(req) {
+    const want = hiveConfig.adminToken;
+    if (!want)
+        throw new HiveError(404, 'not_found', 'Not found.');
+    const got = bearerOf(req) ?? '';
+    const a = Buffer.from(got);
+    const b = Buffer.from(want);
+    if (a.length !== b.length || !timingSafeEqual(a, b))
+        throw new HiveError(401, 'admin_token', 'This route needs the Hive admin token.');
+}
+/**
+ * Deletes every tenant whose slug starts with `prefix` (at least four characters, so `t` cannot wipe a stage),
+ * revoking its tunnel first. The owning user goes too when nothing else is left of them. Dry runs list only.
+ */
+export async function cleanupTenants(prefix, opts = {}) {
+    const p = String(prefix ?? '')
+        .trim()
+        .toLowerCase();
+    if (p.length < 4 || !/^[a-z0-9][a-z0-9-]*$/.test(p))
+        throw new HiveError(400, 'bad_prefix', 'The prefix must be at least four slug characters.');
+    const db = hiveDb();
+    const max = opts.max ?? 200;
+    const rows = db
+        .prepare(`SELECT id, slug, userId FROM tenants WHERE slug LIKE ? ESCAPE '\\' ORDER BY createdAt LIMIT ?`)
+        .all(`${p.replace(/[%_\\]/g, '\\$&')}%`, max);
+    const report = { prefix: p, tenants: rows.map((r) => r.slug), bees: 0, tunnelsRevoked: 0, tunnelErrors: [], users: 0 };
+    if (opts.dryRun)
+        return report;
+    const provider = tunnelProvider();
+    for (const t of rows) {
+        const bees = db.prepare('SELECT COUNT(*) AS n FROM bees WHERE tenantId = ?').get(t.id);
+        try {
+            await provider.revoke({ id: t.id, slug: t.slug });
+            report.tunnelsRevoked += 1;
+        }
+        catch (err) {
+            report.tunnelErrors.push({ slug: t.slug, error: err instanceof Error ? err.message : String(err) });
+            hiveLog.warn(`cleanup: tunnel for ${t.slug} not revoked: ${err instanceof Error ? err.message : err}`);
+            continue; // keep the tenant so the next run retries the tunnel
+        }
+        db.exec('BEGIN');
+        try {
+            db.prepare('DELETE FROM pair_nonces WHERE tenantId = ?').run(t.id);
+            db.prepare('DELETE FROM install_codes WHERE tenantId = ?').run(t.id);
+            db.prepare('DELETE FROM bees WHERE tenantId = ?').run(t.id);
+            db.prepare('DELETE FROM tenants WHERE id = ?').run(t.id);
+            db.prepare('DELETE FROM refresh_tokens WHERE userId = ?').run(t.userId);
+            db.prepare('DELETE FROM users WHERE id = ? AND NOT EXISTS (SELECT 1 FROM tenants WHERE userId = ?)').run(t.userId, t.userId);
+            db.exec('COMMIT');
+        }
+        catch (err) {
+            db.exec('ROLLBACK');
+            throw err;
+        }
+        report.bees += bees.n;
+        report.users += 1;
+    }
+    return report;
+}
+export async function tunnelReport() {
+    const provider = tunnelProvider();
+    const count = provider.count ? await provider.count() : null;
+    const row = hiveDb().prepare("SELECT COUNT(DISTINCT tenantId) AS n FROM bees WHERE status IN ('provisioning','online')").get();
+    return {
+        provider: provider.name,
+        count,
+        cap: hiveConfig.tunnelCap,
+        warnAt: TUNNEL_WARN_AT,
+        tenantsWithBees: row.n,
+        ok: count === null || count <= TUNNEL_WARN_AT,
+    };
+}
+export async function adminRoutes(app) {
+    app.delete('/admin/tenants', async (req) => {
+        requireAdmin(req);
+        const q = req.query;
+        return cleanupTenants(q.prefix ?? '', { dryRun: q.dryRun === '1' || q.dryRun === 'true' });
+    });
+    // Counts only (docs 06 section 7): tenants per plan and status, relay calls and tokens in the last day.
+    app.get('/admin/metrics', async (req, reply) => {
+        requireAdmin(req);
+        return reply.header('cache-control', 'no-store').send({ ...relayMetrics(), push: pushMetrics() });
+    });
+    // A release publishes the signed Bee manifest for a channel (scripts/tinybee-sign-manifest.mjs makes it).
+    app.put('/admin/updates/bee/:channel', async (req, reply) => {
+        requireAdmin(req);
+        const channel = req.params.channel;
+        if (!UPDATE_CHANNELS.includes(channel))
+            throw new HiveError(404, 'no_manifest', 'No such update channel.');
+        return reply.code(201).send(storeManifestDoc(channel, req.body));
+    });
+    app.get('/admin/tunnels', async (req, reply) => {
+        requireAdmin(req);
+        const r = await tunnelReport();
+        return reply.header('cache-control', 'no-store').send(r);
+    });
+    // The edge Worker's lookup: slug -> tenant id, so a session for one tenant cannot open another's hostname.
+    // Public data (the slug is in the hostname), cached a minute at the edge; the Worker keeps its own KV copy.
+    app.get('/edge/tenants/:slug', async (req, reply) => {
+        const slug = normalizeSlug(req.params.slug);
+        const t = tenantBySlug(slug);
+        if (!t)
+            throw new HiveError(404, 'tenant_not_found', 'No account has this address.');
+        return reply.header('cache-control', 'public, max-age=60').send({ tenantId: t.id, slug: t.slug, status: t.status });
+    });
+}
+//# sourceMappingURL=admin.js.map

package/dist/hive/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../src/hive/admin.ts"],"names":[],"mappings":"AAAA,wGAAwG;AACxG,wGAAwG;AACxG,2FAA2F;AAC3F,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,eAAe,EAAsB,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAQjC,SAAS,YAAY,CAAC,GAAmB;IACvC,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,wCAAwC,CAAC,CAAC;AACzI,CAAC;AAWD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,OAA2C,EAAE;IAChG,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;SAC3B,IAAI,EAAE;SACN,WAAW,EAAE,CAAC;IACjB,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,YAAY,EAAE,mDAAmD,CAAC,CAAC;IACjJ,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;IACpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC;IAC5B,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CAAC,+FAA+F,CAAC;SACxG,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,CAA2B,CAAC;IAC1E,MAAM,MAAM,GAAkB,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACtI,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAC/B,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAkB,CAAC;QACxG,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAClD,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACpG,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,IAAI,iBAAiB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YACvG,SAAS,CAAC,qDAAqD;QACjE,CAAC;QACD,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjB,IAAI,CAAC;YACH,EAAE,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACnE,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrE,EAAE,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC5D,EAAE,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACzD,EAAE,CAAC,OAAO,CAAC,6CAA6C,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACxE,EAAE,CAAC,OAAO,CAAC,wFAAwF,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YAC7H,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACpB,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC;QACtB,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAaD,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,0FAA0F,CAAC,CAAC,GAAG,EAAmB,CAAC;IAChJ,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,IAAI;QACvB,KAAK;QACL,GAAG,EAAE,UAAU,CAAC,SAAS;QACzB,MAAM,EAAE,cAAc;QACtB,eAAe,EAAE,GAAG,CAAC,CAAC;QACtB,EAAE,EAAE,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI,cAAc;KAC9C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAoB;IACpD,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzC,YAAY,CAAC,GAAG,CAAC,CAAC;QAClB,MAAM,CAAC,GAAG,GAAG,CAAC,KAA6C,CAAC;QAC5D,OAAO,cAAc,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;IACH,wGAAwG;IACxG,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC7C,YAAY,CAAC,GAAG,CAAC,CAAC;QAClB,OAAO,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,YAAY,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;IACpG,CAAC,CAAC,CAAC;IACH,0GAA0G;IAC1G,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC1D,YAAY,CAAC,GAAG,CAAC,CAAC;QAClB,MAAM,OAAO,GAAI,GAAG,CAAC,MAA8B,CAAC,OAAO,CAAC;QAC5D,IAAI,CAAE,eAAqC,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,yBAAyB,CAAC,CAAC;QAClI,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAwB,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC7C,YAAY,CAAC,GAAG,CAAC,CAAC;QAClB,MAAM,CAAC,GAAG,MAAM,YAAY,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,2GAA2G;IAC3G,4GAA4G;IAC5G,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAClD,MAAM,IAAI,GAAG,aAAa,CAAE,GAAG,CAAC,MAA2B,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,kBAAkB,EAAE,8BAA8B,CAAC,CAAC;QACrF,OAAO,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACtH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/hive/auth.js

@@ -0,0 +1,130 @@
+// Sign-up and sign-in (FR-H1): an email one-time code, or a Google ID token, becomes a user row, a
+// one-hour session JWT and a seven-day refresh token. Codes are stored hashed, expire after ten
+// minutes, allow five tries, and an address can ask for five codes per quarter hour.
+import { createHash, randomBytes, randomInt, timingSafeEqual } from 'node:crypto';
+import { hiveDb, newId, nowIso } from './db.js';
+import { HiveError } from './errors.js';
+import { mailer } from './mail.js';
+import { ACCESS_TOKEN_TTL_SEC, signSession } from './jwt.js';
+import { hiveConfig } from './config.js';
+import { ensureTenant, tenantOfUser, tenantView } from './tenants.js';
+export const OTP_TTL_SEC = 10 * 60;
+export const OTP_MAX_ATTEMPTS = 5;
+export const OTP_RATE_LIMIT = { count: 5, windowSec: 15 * 60 };
+export const REFRESH_TTL_SEC = 7 * 24 * 60 * 60;
+const sha = (v) => createHash('sha256').update(v).digest('hex');
+/** Lower-cased, trimmed, and checked for the one shape every mail sender accepts. */
+export function normalizeEmail(raw) {
+    const email = typeof raw === 'string' ? raw.trim().toLowerCase() : '';
+    if (!/^[^\s@]+@[^\s@]+\.[^\s@]{2,}$/.test(email) || email.length > 254)
+        throw new HiveError(400, 'invalid_email', 'Enter a valid email address.');
+    return email;
+}
+export const userView = (u) => ({ id: u.id, email: u.email, name: u.name, createdAt: u.createdAt });
+export function userById(id) {
+    return hiveDb().prepare('SELECT * FROM users WHERE id = ?').get(id);
+}
+function userByEmail(email) {
+    return hiveDb().prepare('SELECT * FROM users WHERE email = ?').get(email);
+}
+function upsertUser(email, patch = {}) {
+    const d = hiveDb();
+    const now = nowIso();
+    const have = userByEmail(email);
+    if (have) {
+        d.prepare('UPDATE users SET lastSignInAt = ?, name = COALESCE(?, name), googleSub = COALESCE(?, googleSub) WHERE id = ?').run(now, patch.name ?? null, patch.googleSub ?? null, have.id);
+    }
+    else {
+        d.prepare('INSERT INTO users (id, email, name, googleSub, createdAt, lastSignInAt) VALUES (?, ?, ?, ?, ?, ?)').run(newId('usr'), email, patch.name ?? null, patch.googleSub ?? null, now, now);
+    }
+    return userByEmail(email);
+}
+/** Step 1 of email sign-in. Returns when the code is on its way; the code itself is only in the mail (or the local log). */
+export async function startOtp(rawEmail, now = Date.now()) {
+    const email = normalizeEmail(rawEmail);
+    const d = hiveDb();
+    const since = now - OTP_RATE_LIMIT.windowSec * 1000;
+    const recent = d.prepare('SELECT COUNT(*) AS n FROM otps WHERE email = ? AND createdAt > ?').get(email, since);
+    if (recent.n >= OTP_RATE_LIMIT.count)
+        throw new HiveError(429, 'otp_rate_limited', 'Too many codes were sent to this address. Wait 15 minutes, then try again.');
+    const code = String(randomInt(0, 1_000_000)).padStart(6, '0');
+    // One live code per address: a new request replaces the old code.
+    d.prepare('UPDATE otps SET usedAt = ? WHERE email = ? AND usedAt IS NULL').run(now, email);
+    d.prepare('INSERT INTO otps (id, email, codeHash, expiresAt, attempts, createdAt) VALUES (?, ?, ?, ?, 0, ?)').run(newId('otp'), email, sha(code), now + OTP_TTL_SEC * 1000, now);
+    await mailer().sendOtp({ to: email, code, expiresInMin: OTP_TTL_SEC / 60 });
+    // Local development has no mail: the code rides along so the PWA flow works on one laptop. Never on staging or prod.
+    return { email, expiresInSec: OTP_TTL_SEC, ...(hiveConfig.env === 'local' || hiveConfig.env === undefined ? { devCode: code } : {}) };
+}
+/** Step 2: the code becomes a session. A wrong code counts a try; the fifth wrong try burns the code. */
+export function verifyOtp(rawEmail, rawCode, now = Date.now()) {
+    const email = normalizeEmail(rawEmail);
+    const code = typeof rawCode === 'string' ? rawCode.replace(/\s+/g, '') : '';
+    if (!/^\d{6}$/.test(code))
+        throw new HiveError(400, 'otp_invalid', 'Enter the 6-digit code from the email.');
+    const d = hiveDb();
+    const row = d.prepare('SELECT id, codeHash, expiresAt, attempts FROM otps WHERE email = ? AND usedAt IS NULL ORDER BY createdAt DESC LIMIT 1').get(email);
+    if (!row)
+        throw new HiveError(400, 'otp_invalid', 'That code is wrong or has expired. Ask for a new one.');
+    if (row.expiresAt <= now) {
+        d.prepare('UPDATE otps SET usedAt = ? WHERE id = ?').run(now, row.id);
+        throw new HiveError(400, 'otp_expired', 'That code has expired. Ask for a new one.');
+    }
+    const a = Buffer.from(sha(code));
+    const b = Buffer.from(row.codeHash);
+    if (a.length !== b.length || !timingSafeEqual(a, b)) {
+        const attempts = row.attempts + 1;
+        d.prepare('UPDATE otps SET attempts = ?, usedAt = CASE WHEN ? >= ? THEN ? ELSE NULL END WHERE id = ?').run(attempts, attempts, OTP_MAX_ATTEMPTS, now, row.id);
+        if (attempts >= OTP_MAX_ATTEMPTS)
+            throw new HiveError(400, 'otp_invalid', 'Too many wrong tries. Ask for a new code.');
+        throw new HiveError(400, 'otp_invalid', `That code is wrong. ${OTP_MAX_ATTEMPTS - attempts} tries left.`);
+    }
+    d.prepare('UPDATE otps SET usedAt = ? WHERE id = ?').run(now, row.id);
+    return issueSession(withTenant(upsertUser(email)), now);
+}
+/** A verified Google identity becomes the same session an email code does. */
+export function signInWithGoogle(identity, now = Date.now()) {
+    if (!identity.emailVerified)
+        throw new HiveError(400, 'google_email_unverified', 'This Google account has no verified email address.');
+    const email = normalizeEmail(identity.email);
+    return issueSession(withTenant(upsertUser(email, { name: identity.name ?? null, googleSub: identity.sub })), now);
+}
+/** Phase 8: a sign-in makes the tenant (address from the email) when the person has none. A refresh never does. */
+function withTenant(user) {
+    ensureTenant(user.id, user.email);
+    return user;
+}
+export function issueSession(user, now = Date.now()) {
+    const tenant = tenantOfUser(user.id);
+    const accessToken = signSession({ sub: user.id, email: user.email, tenant_id: tenant?.id ?? null, slug: tenant?.slug ?? null, scopes: ['tenant:owner'] }, { now });
+    const refreshToken = `tbr.${randomBytes(32).toString('base64url')}`;
+    hiveDb()
+        .prepare('INSERT INTO refresh_tokens (id, userId, tokenHash, expiresAt, createdAt) VALUES (?, ?, ?, ?, ?)')
+        .run(newId('rt'), user.id, sha(refreshToken), now + REFRESH_TTL_SEC * 1000, now);
+    return { accessToken, refreshToken, expiresIn: ACCESS_TOKEN_TTL_SEC, user: userView(user), tenant: tenant ? tenantView(tenant) : null };
+}
+/** Trades a refresh token for a new pair. The old one is revoked: a token used twice means it leaked. */
+export function refreshSession(rawToken, now = Date.now()) {
+    const token = typeof rawToken === 'string' ? rawToken.trim() : '';
+    if (!token)
+        throw new HiveError(400, 'refresh_invalid', 'The refresh token is missing.');
+    const d = hiveDb();
+    const row = d.prepare('SELECT id, userId, expiresAt, revokedAt FROM refresh_tokens WHERE tokenHash = ?').get(sha(token));
+    if (!row || row.revokedAt !== null || row.expiresAt <= now) {
+        // A revoked token used again: sign out every session of that user.
+        if (row && row.revokedAt !== null)
+            d.prepare('UPDATE refresh_tokens SET revokedAt = ? WHERE userId = ? AND revokedAt IS NULL').run(now, row.userId);
+        throw new HiveError(401, 'refresh_invalid', 'Sign in again.');
+    }
+    d.prepare('UPDATE refresh_tokens SET revokedAt = ? WHERE id = ?').run(now, row.id);
+    const user = userById(row.userId);
+    if (!user)
+        throw new HiveError(401, 'refresh_invalid', 'Sign in again.');
+    return issueSession(user, now);
+}
+export function signOut(rawToken, now = Date.now()) {
+    const token = typeof rawToken === 'string' ? rawToken.trim() : '';
+    if (!token)
+        return;
+    hiveDb().prepare('UPDATE refresh_tokens SET revokedAt = ? WHERE tokenHash = ? AND revokedAt IS NULL').run(now, sha(token));
+}
+//# sourceMappingURL=auth.js.map