toolroll 0.5.0

package/dist/spend.js

@@ -0,0 +1,313 @@
+import { SUBSCRIPTION_CAPABLE, readAuthMode } from "./keys.js";
+/** How a provider's work is billed right now: an API key when Toolroll is set to use one, or when the CLI
+ * itself was last seen billing a key (a key helper, a Console login, Bedrock or Vertex, `codex login --with-api-key`);
+ * otherwise its plan. `db` supplies what was seen (provider_account); without it, the setting alone. */
+export function billingOf(provider, db) {
+    const base = provider.replace(/-(subscription|api)$/, "");
+    if (provider.endsWith("-api"))
+        return "api-key";
+    const setting = provider.endsWith("-subscription") ? "subscription"
+        : Object.hasOwn(SUBSCRIPTION_CAPABLE, provider) ? readAuthMode(provider) : "api-key";
+    if (setting === "api-key" || db === undefined)
+        return setting;
+    return seenBilling(db, base) ?? setting;
+}
+/** How a provider's CLI was last seen billing (provider_account), or null. */
+export function seenBilling(db, provider) {
+    const row = db.prepare("SELECT billing FROM provider_account WHERE provider = ?").get(provider);
+    return row?.["billing"] === "api-key" || row?.["billing"] === "subscription" ? row["billing"] : null;
+}
+/** How a Claude turn was really billed, from its own stream. Only a plan reports its usage windows (Claude Code 2.1
+ * does on every turn), so that is the one sign of the plan; a named key source or a cloud model id (Bedrock, Vertex)
+ * is a key, and so is "none" without windows (a gateway's bearer token or a cloud provider says "none" too). Null when
+ * the stream said nothing. */
+export function claudeBillingFrom(seen) {
+    if (seen.keySource !== null && seen.keySource !== "none")
+        return "api-key";
+    if (seen.model !== null && /^arn:|(^|\.)anthropic\.|@/.test(seen.model))
+        return "api-key";
+    if (seen.planWindows)
+        return "subscription";
+    return seen.keySource === "none" ? "api-key" : null;
+}
+/** How Claude bills on this computer when Toolroll gives it no key (teammate turns, drafts): as its keyless runs
+ * were last seen, and its plan until one has been. */
+export function claudeMachineBilling(db) {
+    return seenBilling(db, "claude") ?? "subscription";
+}
+/** Providers whose own output says what a turn cost (Claude's total_cost_usd; OpenRouter's usage.cost). */
+const REPORTS_COST = new Set(["claude", "openrouter", "anthropic-api", "openrouter-api"]);
+/** Whether API work on this provider can be priced: it reports its cost, or the catalogue has its prices. */
+export function canPrice(db, provider) {
+    return REPORTS_COST.has(provider) || ceilingPriceFor(db, provider) !== null;
+}
+const CLAUDE_FAMILIES = ["opus", "sonnet", "haiku", "fable"];
+const catalogSource = (provider) => provider === "claude" || provider === "claude-subscription" || provider === "anthropic-api" ? "claude"
+    : provider === "codex" || provider === "codex-subscription" ? "codex"
+        : provider === "gemini" ? "gemini"
+            : provider === "openrouter" || provider === "openrouter-api" ? "openrouter" : null;
+/** A model's catalogue price (US dollars per million tokens), or null when the catalogue doesn't list one. A
+ * Claude short name ("sonnet") is priced as the newest of its family, as the Claude CLI runs it. */
+export function priceFor(db, provider, model) {
+    const source = catalogSource(provider);
+    if (source === null || model === null || model === "" || model === "default")
+        return null;
+    const priced = (row) => row === undefined || row["input_usd"] == null || row["output_usd"] == null ? null
+        : { inputUsd: Number(row["input_usd"]), outputUsd: Number(row["output_usd"]), model: String(row["id"]) };
+    const exact = priced(db.prepare("SELECT id, input_usd, output_usd FROM model_seen WHERE source = ? AND id = ?").get(source, model));
+    if (exact !== null || source !== "claude" || !CLAUDE_FAMILIES.includes(model))
+        return exact;
+    return priced(db.prepare(`SELECT id, input_usd, output_usd FROM model_seen WHERE source = 'claude' AND id LIKE ? AND last_seen_at = (SELECT MAX(last_seen_at) FROM model_seen WHERE source = 'claude')
+    ORDER BY COALESCE(released_at, '') DESC, id DESC LIMIT 1`).get(`claude-${model}-%`));
+}
+/** The provider's highest listed price, for API work whose model the catalogue doesn't list (or that ran the CLI's
+ * default): a budget that stops work must never see it as free. */
+export function ceilingPriceFor(db, provider) {
+    const source = catalogSource(provider);
+    if (source === null)
+        return null;
+    const row = db.prepare(`SELECT MAX(input_usd) AS input_usd, MAX(output_usd) AS output_usd FROM model_seen WHERE source = ? AND input_usd IS NOT NULL AND output_usd IS NOT NULL
+    AND last_seen_at = (SELECT MAX(last_seen_at) FROM model_seen WHERE source = ?)`).get(source, source);
+    return row === undefined || row["input_usd"] == null || row["output_usd"] == null ? null
+        : { inputUsd: Number(row["input_usd"]), outputUsd: Number(row["output_usd"]), model: "highest listed price" };
+}
+/** What a piece of work cost, in micro-dollars: nothing on a subscription; otherwise reported, or tokens at the
+ * catalogue price (usd per million tokens times tokens is micro-dollars), or unpriced. */
+export function priceWork(db, work) {
+    if (work.billing === "subscription")
+        return { microusd: 0, source: "subscription", price: null };
+    if (work.costUsd !== null && Number.isFinite(work.costUsd))
+        return { microusd: Math.round(work.costUsd * 1_000_000), source: "reported", price: null };
+    if (work.tokensIn === null && work.tokensOut === null)
+        return { microusd: null, source: "unpriced", price: null };
+    const price = priceFor(db, work.provider, work.model) ?? ceilingPriceFor(db, work.provider);
+    if (price === null)
+        return { microusd: null, source: "unpriced", price: null };
+    return { microusd: Math.round((work.tokensIn ?? 0) * price.inputUsd + (work.tokensOut ?? 0) * price.outputUsd), source: "estimated", price };
+}
+export const SPEND_SCHEMA = `
+CREATE TABLE IF NOT EXISTS run_spend (
+  run         INTEGER PRIMARY KEY,
+  microusd    INTEGER,
+  source      TEXT NOT NULL CHECK (source IN ('reported', 'estimated', 'unpriced', 'subscription')),
+  billing     TEXT NOT NULL CHECK (billing IN ('subscription', 'api-key')),
+  -- 1 once the run's own evidence set it (a key it was given, what its CLI said); a later turn can only make it a key.
+  billing_fixed INTEGER NOT NULL DEFAULT 0,
+  price_model TEXT,
+  input_usd   REAL,
+  output_usd  REAL,
+  priced_at   TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS budget (
+  id          INTEGER PRIMARY KEY AUTOINCREMENT,
+  scope_kind  TEXT NOT NULL CHECK (scope_kind IN ('installation', 'project', 'person', 'teammate')),
+  scope_key   TEXT NOT NULL,
+  limit_microusd INTEGER NOT NULL CHECK (limit_microusd > 0),
+  hard_stop   INTEGER NOT NULL DEFAULT 1,
+  created_by  TEXT NOT NULL,
+  created_at  TEXT NOT NULL,
+  updated_by  TEXT NOT NULL,
+  updated_at  TEXT NOT NULL,
+  removed_by  TEXT,
+  removed_at  TEXT
+);
+CREATE UNIQUE INDEX IF NOT EXISTS budget_live ON budget (scope_kind, scope_key) WHERE removed_at IS NULL;
+CREATE TABLE IF NOT EXISTS provider_limit (
+  provider       TEXT NOT NULL,
+  window         TEXT NOT NULL,
+  used_percent   REAL NOT NULL,
+  window_minutes INTEGER,
+  resets_at      TEXT,
+  reached        INTEGER NOT NULL DEFAULT 0,
+  plan           TEXT,
+  observed_at    TEXT NOT NULL,
+  PRIMARY KEY (provider, window)
+);
+-- Spend that isn't a run, a teammate turn or a chat: a flow's Claude draft.
+CREATE TABLE IF NOT EXISTS side_spend (
+  id        INTEGER PRIMARY KEY AUTOINCREMENT,
+  kind      TEXT NOT NULL CHECK (kind IN ('draft')),
+  repo      TEXT,
+  provider  TEXT NOT NULL,
+  model     TEXT,
+  cost_usd  REAL,
+  billing   TEXT NOT NULL CHECK (billing IN ('subscription', 'api-key')),
+  at        TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS side_spend_at ON side_spend (at);
+CREATE TABLE IF NOT EXISTS provider_account (
+  provider    TEXT PRIMARY KEY,
+  billing     TEXT NOT NULL CHECK (billing IN ('subscription', 'api-key')),
+  observed_at TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS chat_turn_created ON chat_turn (created_at);
+CREATE INDEX IF NOT EXISTS mate_turn_created ON mate_turn (created_at);
+CREATE INDEX IF NOT EXISTS teammate_turn_at ON teammate_turn (at);
+`;
+/** The calendar month (UTC) `at` falls in: [start, end) as ISO strings, and its name (YYYY-MM). */
+export function monthOf(at) {
+    const from = new Date(Date.UTC(at.getUTCFullYear(), at.getUTCMonth(), 1));
+    const to = new Date(Date.UTC(at.getUTCFullYear(), at.getUTCMonth() + 1, 1));
+    return { from: from.toISOString(), to: to.toISOString(), name: from.toISOString().slice(0, 7) };
+}
+/** A month by its name (YYYY-MM), or null. */
+export function monthNamed(name) {
+    if (name === null || !/^\d{4}-(0[1-9]|1[0-2])$/.test(name))
+        return null;
+    return monthOf(new Date(`${name}-01T00:00:00.000Z`));
+}
+/** The teammate behind a filing: tasks a teammate files are filed as its name ("Maya (AI)", from its soul file), in
+ * its project. A later teammate with the same name and project wins, as it would read on the card. */
+/** A teammate's name as its soul file gives it ("Maya"), or null. */
+const soulName = (soul) => {
+    const front = /^---\s*\n([\s\S]*?)\n---/.exec(String(soul ?? ""));
+    return front === null ? null : /^name:\s*(.+?)\s*$/m.exec(front[1])?.[1] ?? null;
+};
+/** Every teammate's name by id (its handle when its soul file names none). */
+export function teammateNames(db) {
+    return new Map(db.prepare("SELECT id, handle, soul FROM teammate").all().map(row => [Number(row["id"]), soulName(row["soul"]) ?? String(row["handle"])]));
+}
+export function teammateFilers(db) {
+    const byName = new Map();
+    for (const row of db.prepare("SELECT id, repo, handle, soul FROM teammate ORDER BY id").all()) {
+        const name = soulName(row["soul"]);
+        for (const one of [String(row["handle"]), ...(name === null ? [] : [name])])
+            byName.set(`${String(row["repo"])}\n${one} (AI)`, Number(row["id"]));
+    }
+    return (repo, filedBy, kind) => kind !== "teammate" || repo === null || filedBy === null ? null : byName.get(`${repo}\n${filedBy}`) ?? null;
+}
+/** Who a task's work counts toward: its own filer, or, for a revision filed by automation (an automatic repair), the
+ * filer of the task it revises, up its ancestry (bounded). */
+export function filersOf(db) {
+    const memo = new Map();
+    const read = db.prepare("SELECT id, backend, repo, filed_by, filed_by_kind, revision_of FROM task_ref WHERE id = ?");
+    const source = db.prepare("SELECT id, backend, repo, filed_by, filed_by_kind, revision_of FROM task_ref WHERE backend = ? AND external_id = ? ORDER BY id DESC LIMIT 1");
+    return taskRef => {
+        const known = memo.get(taskRef);
+        if (known !== undefined)
+            return known;
+        let row = read.get(taskRef);
+        const repo = row?.["repo"] == null ? null : String(row["repo"]);
+        const seen = new Set();
+        while (row !== undefined && row["filed_by"] == null && row["revision_of"] != null && !seen.has(Number(row["id"])) && seen.size < 64) {
+            seen.add(Number(row["id"]));
+            row = source.get(row["backend"], row["revision_of"]);
+        }
+        const found = { repo, filedBy: row?.["filed_by"] == null ? null : String(row["filed_by"]), kind: row?.["filed_by_kind"] == null ? null : String(row["filed_by_kind"]) };
+        memo.set(taskRef, found);
+        return found;
+    };
+}
+/** Every piece of spend in [from, to): runs (by when they started), teammate turns and chat turns. `modeOf` says how
+ * a provider bills when a record doesn't (older rows): its current login or key. */
+export function spendItems(db, from, to, modeOf = provider => billingOf(provider, db)) {
+    const teammateOf = teammateFilers(db);
+    const filerOf = filersOf(db);
+    const text = (value) => value == null ? null : String(value);
+    const count = (value) => value == null ? null : Number(value);
+    const runs = db.prepare(`SELECT run.id, run.task_ref, run.provider, run.model, run.cost_usd, run.tokens_in, run.tokens_out, run.started_at, run.auth_mode,
+      r.external_id AS task, r.repo, r.filed_by, r.filed_by_kind, r.revision_of, s.microusd, s.source, s.billing
+    FROM run JOIN task_ref r ON r.id = run.task_ref LEFT JOIN run_spend s ON s.run = run.id
+    WHERE run.started_at >= ? AND run.started_at < ? ORDER BY run.id`).all(from, to);
+    const items = runs.map(row => {
+        const provider = String(row["provider"]);
+        const billing = row["billing"] === "subscription" || row["billing"] === "api-key" ? row["billing"]
+            : row["auth_mode"] === "subscription" || row["auth_mode"] === "api-key" ? row["auth_mode"] : modeOf(provider);
+        const settled = row["source"] != null;
+        const priced = settled ? null : priceWork(db, { provider, model: text(row["model"]), costUsd: count(row["cost_usd"]), tokensIn: count(row["tokens_in"]), tokensOut: count(row["tokens_out"]), billing });
+        // Most tasks name their filer; only an automation-filed revision walks to its source's.
+        const filer = row["filed_by"] == null && row["revision_of"] != null ? filerOf(Number(row["task_ref"]))
+            : { repo: text(row["repo"]), filedBy: text(row["filed_by"]), kind: text(row["filed_by_kind"]) };
+        const kind = filer.kind;
+        return {
+            at: String(row["started_at"]), kind: "run", microusd: settled ? count(row["microusd"]) : priced.microusd,
+            source: settled ? String(row["source"]) : priced.source,
+            project: text(row["repo"]),
+            person: kind === "person" || kind === "coordinator" ? filer.filedBy : null,
+            teammate: teammateOf(filer.repo, filer.filedBy, kind), provider, model: text(row["model"]),
+            tokensIn: count(row["tokens_in"]), tokensOut: count(row["tokens_out"]),
+            taskId: String(row["task"]), runId: Number(row["id"]), authMode: billing,
+        };
+    });
+    // A teammate's own turns get no key from Toolroll (teammates.ts claudeTurnRunner): they bill as this computer's
+    // Claude sign-in was seen billing when the turn ran (a plan, or a Console login, key helper or gateway).
+    for (const row of db.prepare(`SELECT t.at, t.teammate, t.model, t.cost_usd, t.tokens_in, t.tokens_out, t.billing, m.repo FROM teammate_turn t JOIN teammate m ON m.id = t.teammate
+      WHERE t.at >= ? AND t.at < ? ORDER BY t.id`).all(from, to)) {
+        const billing = row["billing"] === "api-key" ? "api-key" : "subscription";
+        const priced = priceWork(db, { provider: "claude", model: text(row["model"]), costUsd: count(row["cost_usd"]), tokensIn: count(row["tokens_in"]), tokensOut: count(row["tokens_out"]), billing });
+        items.push({ at: String(row["at"]), kind: "teammate", microusd: priced.microusd, source: priced.source, project: String(row["repo"]), person: null,
+            teammate: Number(row["teammate"]), provider: "claude", model: text(row["model"]),
+            tokensIn: count(row["tokens_in"]), tokensOut: count(row["tokens_out"]), taskId: null, runId: null, authMode: billing });
+    }
+    // A chat turn that mirrors a project chat's turn is that turn: counted once, as the project chat's. A task's chat
+    // counts toward the task's project.
+    for (const row of db.prepare(`SELECT created_at AS at, approver, provider, model, settled_microusd, tokens_in, tokens_out, NULL AS project
+      FROM chat_turn WHERE mate_turn IS NULL AND created_at >= ? AND created_at < ?
+    UNION ALL SELECT t.created_at, t.approver, COALESCE((SELECT c.provider FROM chat_turn c WHERE c.mate_turn = t.id ORDER BY c.id LIMIT 1), 'lead'),
+        (SELECT c.model FROM chat_turn c WHERE c.mate_turn = t.id ORDER BY c.id LIMIT 1), t.settled_microusd, t.tokens_in, t.tokens_out,
+        CASE th.scope_kind WHEN 'project' THEN th.scope_key WHEN 'task' THEN (SELECT r.repo FROM task_ref r WHERE r.external_id = th.scope_key ORDER BY r.id DESC LIMIT 1) END
+      FROM mate_turn t LEFT JOIN mate_thread th ON th.id = t.thread WHERE t.created_at >= ? AND t.created_at < ?`).all(from, to, from, to)) {
+        const provider = String(row["provider"]);
+        const subscription = provider.endsWith("-subscription") && modeOf(provider) === "subscription";
+        const settled = count(row["settled_microusd"]);
+        items.push({ at: String(row["at"]), kind: "chat", microusd: subscription ? 0 : settled, source: subscription ? "subscription" : settled === null ? "unpriced" : "reported",
+            project: text(row["project"]), person: text(row["approver"]), teammate: null, provider, model: text(row["model"]),
+            tokensIn: count(row["tokens_in"]), tokensOut: count(row["tokens_out"]), taskId: null, runId: null, authMode: subscription ? "subscription" : "api-key" });
+    }
+    // A flow's Claude drafts: like a teammate's turns, billed as the sign-in was.
+    for (const row of db.prepare("SELECT at, kind, repo, provider, model, cost_usd, billing FROM side_spend WHERE at >= ? AND at < ? ORDER BY id").all(from, to)) {
+        const billing = row["billing"] === "api-key" ? "api-key" : "subscription";
+        const priced = priceWork(db, { provider: String(row["provider"]), model: text(row["model"]), costUsd: count(row["cost_usd"]), tokensIn: null, tokensOut: null, billing });
+        items.push({ at: String(row["at"]), kind: "draft", microusd: priced.microusd, source: priced.source, project: text(row["repo"]), person: null, teammate: null,
+            provider: String(row["provider"]), model: text(row["model"]), tokensIn: null, tokensOut: null, taskId: null, runId: null, authMode: billing });
+    }
+    // A flow's Sort zone asks Jev on OpenRouter (the key's credit): what it cost is kept with its answer.
+    for (const row of db.prepare(`SELECT fs.started_at AS at, json_extract(fs.decision_json, '$.cost') AS cost, json_extract(fs.decision_json, '$.model') AS model, f.repo
+      FROM flow_step_run fs JOIN flow_card c ON c.id = fs.card JOIN flow f ON f.id = c.flow
+      WHERE fs.kind = 'sort' AND fs.decision_json IS NOT NULL AND fs.started_at >= ? AND fs.started_at < ? ORDER BY fs.started_at`).all(from, to)) {
+        const cost = typeof row["cost"] === "number" && Number.isFinite(row["cost"]) && row["cost"] >= 0 ? row["cost"] : null;
+        items.push({ at: String(row["at"]), kind: "sort", microusd: cost === null ? null : Math.round(cost * 1_000_000), source: cost === null ? "unpriced" : "reported",
+            project: text(row["repo"]), person: null, teammate: null, provider: "openrouter", model: text(row["model"]), tokensIn: null, tokensOut: null, taskId: null, runId: null, authMode: "api-key" });
+    }
+    return items;
+}
+/** Whether a piece of spend counts toward a budget. */
+export function countsToward(item, budget) {
+    if (budget.scope === "installation")
+        return true;
+    if (budget.scope === "project")
+        return item.project === budget.key;
+    if (budget.scope === "person")
+        return item.person === budget.key;
+    return item.teammate !== null && String(item.teammate) === budget.key;
+}
+const PROVIDER_WORDS = { claude: "Claude", codex: "Codex", gemini: "Gemini", openrouter: "OpenRouter" };
+/** Why work waits on a budget, in words. */
+export function budgetHoldWords(hold, month, teammateName) {
+    if (hold.over === null)
+        return "";
+    const label = budgetLabel(hold.over, teammateName);
+    return hold.why === "unpriced"
+        ? `${label} budget can't price ${PROVIDER_WORDS[hold.unpricedProvider ?? ""] ?? hold.unpricedProvider} work on a key yet. Open Settings → Models to load prices`
+        : `${label} budget is used up for ${month}`;
+}
+/** Each budget's month so far: what counted toward it, and how many pieces of work had no price. */
+export function budgetStates(budgets, items) {
+    return budgets.map(budget => {
+        const mine = items.filter(item => countsToward(item, budget));
+        const spent = mine.reduce((sum, item) => sum + (item.microusd ?? 0), 0);
+        return { ...budget, spentMicrousd: spent, unpriced: mine.filter(item => item.microusd === null && item.source === "unpriced" && (item.tokensIn !== null || item.kind !== "run")).length,
+            percent: Math.floor((spent / budget.limitMicrousd) * 100) };
+    });
+}
+/** A budget in words: "The shop project's", "alex's", "Maya's (teammate)", "The whole installation's". */
+export function budgetLabel(budget, teammateName) {
+    if (budget.scope === "installation")
+        return "The whole installation's";
+    if (budget.scope === "project")
+        return `The ${budget.key.split("/").filter(Boolean).pop() ?? budget.key} project's`;
+    if (budget.scope === "person")
+        return `${budget.key}'s`;
+    return `${teammateName ?? `Teammate ${budget.key}`}'s`;
+}
+export const usd = (microusd) => microusd === null ? "unpriced" : `$${(microusd / 1_000_000).toFixed(microusd !== 0 && Math.abs(microusd) < 10_000_000 ? 2 : 0)}`;

package/dist/sqlite-runtime.d.ts

@@ -0,0 +1,3 @@
+/** Keep native SQLite out of import-only UI/module graphs. Load the real
+ * driver only when a database operation needs it, as the main store does. */
+export declare function sqliteRuntime(): typeof import('node:sqlite');

package/dist/sqlite-runtime.js

@@ -0,0 +1,6 @@
+import { createRequire } from 'node:module';
+/** Keep native SQLite out of import-only UI/module graphs. Load the real
+ * driver only when a database operation needs it, as the main store does. */
+export function sqliteRuntime() {
+    return createRequire(import.meta.url)('node:sqlite');
+}

package/dist/sso-settings.d.ts

@@ -0,0 +1,33 @@
+import type { OidcSettings } from "./oidc.js";
+export declare const SSO_CALLBACK = "/login/sso/callback";
+/** A name for the button from the issuer, when none is given. */
+export declare function providerLabel(issuer: string): string;
+export declare function readSsoSettings(dir: string | null | undefined): OidcSettings | null;
+/**
+ * Save what the form sent. The client secret is kept when the field is left
+ * blank; rules come as rows (group, role, projects), blank groups dropped.
+ * `projects` for a row is "all" or the project paths chosen.
+ */
+export declare function saveSsoSettings(dir: string, form: {
+    issuer: string;
+    clientId: string;
+    clientSecret: string;
+    label: string;
+    scopes: string;
+    groupsClaim: string;
+    passwords: string;
+    rules: {
+        group: string;
+        role: string;
+        projects: string[];
+    }[];
+}, previous: OidcSettings | null): {
+    ok: true;
+    settings: OidcSettings;
+} | {
+    ok: false;
+    said: string;
+};
+export declare function removeSsoSettings(dir: string): void;
+/** What changed, for the ledger: never the secret itself, only that it changed. */
+export declare function ssoChangeWords(before: OidcSettings | null, after: OidcSettings | null): string;

package/dist/sso-settings.js

@@ -0,0 +1,103 @@
+/**
+ * Settings → Sign-in (v100): the identity provider this installation trusts,
+ * kept in `sign-in.json` beside the database (0600) with its client secret,
+ * never in the database. Group rules are ordered: a person's first matching
+ * group sets their role and projects.
+ */
+import { chmodSync, existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+const FILE = "sign-in.json";
+export const SSO_CALLBACK = "/login/sso/callback";
+const isAddress = (value) => {
+    try {
+        const url = new URL(value);
+        return url.protocol === "https:" || (url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname));
+    }
+    catch {
+        return false;
+    }
+};
+/** A name for the button from the issuer, when none is given. */
+export function providerLabel(issuer) {
+    const host = (() => { try {
+        return new URL(issuer).hostname;
+    }
+    catch {
+        return "";
+    } })();
+    return /okta\.com$|oktapreview\.com$/.test(host) ? "Okta" : /microsoftonline\.com$|microsoft\.com$/.test(host) ? "Microsoft"
+        : /accounts\.google\.com$/.test(host) ? "Google" : /auth0\.com$/.test(host) ? "Auth0" : /jumpcloud\.com$/.test(host) ? "JumpCloud" : "your identity provider";
+}
+export function readSsoSettings(dir) {
+    if (!dir)
+        return null;
+    const file = join(dir, FILE);
+    if (!existsSync(file))
+        return null;
+    try {
+        const value = JSON.parse(readFileSync(file, "utf8"));
+        if (typeof value.issuer !== "string" || typeof value.clientId !== "string" || !Array.isArray(value.rules))
+            return null;
+        return {
+            issuer: value.issuer, clientId: value.clientId, clientSecret: typeof value.clientSecret === "string" && value.clientSecret !== "" ? value.clientSecret : null,
+            label: typeof value.label === "string" && value.label !== "" ? value.label : providerLabel(value.issuer),
+            scopes: typeof value.scopes === "string" && value.scopes !== "" ? value.scopes : "openid email profile",
+            groupsClaim: typeof value.groupsClaim === "string" && value.groupsClaim !== "" ? value.groupsClaim : "groups",
+            rules: value.rules.filter((rule) => rule !== null && typeof rule === "object" && typeof rule.group === "string" && (rule.role === "operator" || rule.role === "viewer")
+                && (rule.projects === "all" || (Array.isArray(rule.projects) && rule.projects.every(one => typeof one === "string")))),
+            passwords: value.passwords === "operators" ? "operators" : "everyone",
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Save what the form sent. The client secret is kept when the field is left
+ * blank; rules come as rows (group, role, projects), blank groups dropped.
+ * `projects` for a row is "all" or the project paths chosen.
+ */
+export function saveSsoSettings(dir, form, previous) {
+    const issuer = form.issuer.trim().replace(/\/+$/, "");
+    if (!isAddress(issuer))
+        return { ok: false, said: "The issuer is the provider's https address, like https://acme.okta.com/oauth2/default." };
+    const clientId = form.clientId.trim();
+    if (clientId === "" || clientId.length > 200)
+        return { ok: false, said: "Enter the client ID the provider gave this app." };
+    const secret = form.clientSecret.trim() === "" ? previous?.clientSecret ?? null : form.clientSecret.trim();
+    const rules = [];
+    for (const row of form.rules) {
+        const group = row.group.trim();
+        if (group === "")
+            continue;
+        if (group.length > 200)
+            return { ok: false, said: "A group name is 200 characters at most." };
+        if (row.role !== "operator" && row.role !== "viewer")
+            return { ok: false, said: "Choose Operator or Viewer for each group." };
+        const projects = row.projects.includes("all") || row.projects.length === 0 && row.role === "operator" ? "all" : row.projects;
+        rules.push({ group, role: row.role, projects });
+    }
+    if (rules.length === 0)
+        return { ok: false, said: "Add at least one group, so someone can sign in." };
+    const scopes = form.scopes.trim() || "openid email profile";
+    if (!scopes.split(/\s+/).includes("openid"))
+        return { ok: false, said: "The scopes need openid." };
+    const settings = {
+        issuer, clientId, clientSecret: secret, label: form.label.trim().slice(0, 40) || providerLabel(issuer), scopes,
+        groupsClaim: form.groupsClaim.trim() || "groups", rules, passwords: form.passwords === "operators" ? "operators" : "everyone",
+    };
+    const file = join(dir, FILE);
+    writeFileSync(file, `${JSON.stringify(settings, null, 2)}\n`, { mode: 0o600 });
+    chmodSync(file, 0o600);
+    return { ok: true, settings };
+}
+export function removeSsoSettings(dir) {
+    rmSync(join(dir, FILE), { force: true });
+}
+/** What changed, for the ledger: never the secret itself, only that it changed. */
+export function ssoChangeWords(before, after) {
+    const rules = (settings) => settings.rules.map(rule => `${rule.group}: ${rule.role}${rule.projects === "all" ? ", all projects" : rule.projects.length === 0 ? ", no projects" : `, ${rule.projects.length} project${rule.projects.length === 1 ? "" : "s"}`}`).join("; ");
+    const words = (settings) => settings === null ? "off" : `${settings.label} (${settings.issuer}) · ${rules(settings)} · passwords: ${settings.passwords}`;
+    const secretChanged = before !== null && after !== null && before.clientSecret !== after.clientSecret ? " · client secret replaced" : "";
+    return `${words(before)} → ${words(after)}${secretChanged}`;
+}

package/dist/sso-ui.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Settings → Sign-in (v100): the identity provider, the groups that may sign
+ * in and what each may do, and who may still use a password. An instance
+ * operator's page; changes take their password.
+ */
+import type { OidcSettings } from "./oidc.js";
+export declare const SSO_CSS: string;
+export type SsoSettingsView = {
+    settings: OidcSettings | null;
+    /** The address to register with the provider as this app's sign-in redirect. */
+    redirect: string | null;
+    projects: {
+        path: string;
+        name: string;
+    }[];
+    /** Whether the person looking is linked to the provider already. */
+    linked: boolean;
+};
+export declare function ssoSettingsHtml(view: SsoSettingsView, csrf: string, notice: {
+    said?: string | null;
+    problem?: string | null;
+}): string;

package/dist/sso-ui.js

@@ -0,0 +1,39 @@
+const e = (value) => String(value ?? "").replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+export const SSO_CSS = `.sign-in{max-width:780px;min-width:0}.sign-in form{display:grid;gap:12px;margin:0}.sign-in label{display:grid;gap:6px}.sign-in input,.sign-in select{box-sizing:border-box;width:100%;max-width:100%;min-width:0}` +
+    `.sign-in .card{padding:16px 18px;margin:12px 0}.sign-in .card h2{font-size:1.05rem;margin:0 0 6px}.sign-in .redirect code{user-select:all;overflow-wrap:anywhere}.sign-in button{justify-self:start;min-height:44px}` +
+    `.sign-in .rules{display:grid;gap:8px}.sign-in .rule{display:grid;grid-template-columns:minmax(0,2fr) minmax(0,1fr) minmax(0,2fr);gap:8px;align-items:start}.sign-in .rule select[multiple]{min-height:5.5rem}` +
+    `.sign-in .row{display:flex;gap:12px;flex-wrap:wrap;align-items:center}.sign-in fieldset{border:0;padding:0;margin:0;display:grid;gap:6px}.sign-in fieldset label{display:flex;gap:8px;align-items:center}.sign-in fieldset input{width:auto}` +
+    `@media(max-width:600px){.sign-in .rule{grid-template-columns:1fr}.sign-in input,.sign-in select{font-size:16px}}`;
+const password = '<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>';
+function ruleRow(index, rule, projects) {
+    const chosen = rule === null ? [] : rule.projects === "all" ? ["all"] : rule.projects;
+    return `<div class="rule"><label>Group<input type="text" name="group-${index}" value="${e(rule?.group ?? "")}" placeholder="${index === 0 ? "for example: engineering" : ""}" autocomplete="off"></label>` +
+        `<label>Role<select name="role-${index}"><option value="operator"${rule?.role === "operator" ? " selected" : ""}>Operator</option><option value="viewer"${rule?.role === "viewer" ? " selected" : ""}>Viewer</option></select></label>` +
+        `<label>Projects<select name="projects-${index}" multiple><option value="all"${chosen.includes("all") ? " selected" : ""}>All projects</option>${projects.map(one => `<option value="${e(one.path)}"${chosen.includes(one.path) ? " selected" : ""}>${e(one.name)}</option>`).join("")}</select></label></div>`;
+}
+export function ssoSettingsHtml(view, csrf, notice) {
+    const s = view.settings;
+    const hidden = (fields) => Object.entries(fields).map(([k, v]) => `<input type="hidden" name="${e(k)}" value="${e(v)}">`).join("");
+    const rows = [...(s?.rules ?? []), null, null].slice(0, Math.max(3, (s?.rules.length ?? 0) + 1)).map((rule, index) => ruleRow(index, rule, view.projects)).join("");
+    const note = notice.problem ? `<p class="problem" role="alert">${e(notice.problem)}</p>` : notice.said ? `<p role="status">${e(notice.said)}</p>` : "";
+    const redirect = view.redirect === null
+        ? `<p class="meta">Open this page from the address people use (your https address) to see the redirect address to register.</p>`
+        : `<p class="redirect">Register this redirect address with the provider: <code>${e(view.redirect)}</code></p>`;
+    const form = `<form method="post" action="/settings/sign-in">${hidden({ csrf, action: "save" })}` +
+        `<label>Provider address (issuer)<input type="url" name="issuer" value="${e(s?.issuer ?? "")}" placeholder="https://acme.okta.com/oauth2/default" required inputmode="url" autocomplete="off"></label>` +
+        `<label>Client ID<input type="text" name="client-id" value="${e(s?.clientId ?? "")}" required autocomplete="off"></label>` +
+        `<label>Client secret<input type="password" name="client-secret" autocomplete="off" placeholder="${s?.clientSecret ? "Saved. Leave blank to keep it" : "Leave blank for a public client"}"></label>` +
+        `<details><summary>More</summary><label>Button says “Sign in with …”<input type="text" name="label" value="${e(s?.label ?? "")}" placeholder="Okta"></label>` +
+        `<label>Scopes<input type="text" name="scopes" value="${e(s?.scopes ?? "openid email profile")}"></label><label>Groups claim<input type="text" name="groups-claim" value="${e(s?.groupsClaim ?? "groups")}"></label></details>` +
+        `<h2>Who may sign in</h2><p class="meta">A person's first matching group sets their role and projects, again at every sign-in. No match, no entry. Use * for everyone.</p><div class="rules">${rows}</div>` +
+        `<fieldset><legend>Passwords</legend><label><input type="radio" name="passwords" value="everyone"${s?.passwords !== "operators" ? " checked" : ""}> Everyone may still use a password</label>` +
+        `<label><input type="radio" name="passwords" value="operators"${s?.passwords === "operators" ? " checked" : ""}> Only instance operators (a way in if the provider is down)</label></fieldset>` +
+        `${password}<button>${s === null ? "Turn on sign-in with the provider" : "Save"}</button></form>`;
+    const test = s === null ? "" : `<form method="post" action="/settings/sign-in" class="row">${hidden({ csrf, action: "test" })}<button class="secondary">Check the provider</button></form>`;
+    const link = s === null ? "" : view.linked
+        ? `<p class="meta">You sign in with ${e(s.label)}.</p>`
+        : `<section class="card"><h2>Your account</h2><p>Sign in with ${e(s.label)} as this account from now on.</p><p><a class="button-link" href="/login/sso?link=1">Link to ${e(s.label)}</a></p></section>`;
+    const off = s === null ? "" : `<details class="card"><summary>Turn off</summary><form method="post" action="/settings/sign-in">${hidden({ csrf, action: "remove" })}<p>People who signed in with ${e(s.label)} can't sign in until it's on again, unless they have a password.</p>${password}<button class="danger">Turn off sign-in with ${e(s.label)}</button></form></details>`;
+    return `<section class="sign-in">${note}<p>People sign in with your organisation's identity provider (Okta, Microsoft Entra, Google, anything that speaks OpenID Connect), and its groups decide what they may do.</p>` +
+        `${redirect}<section class="card">${form}</section>${test}${link}${off}</section>`;
+}

package/dist/storage.d.ts

@@ -0,0 +1,15 @@
+import type { Store } from "./store.js";
+export type StorageLine = {
+    what: string;
+    bytes: number;
+    count?: number;
+    note?: string;
+};
+/** Bytes a tree holds on disk (allocated blocks; links not followed). */
+export declare function treeBytes(path: string): number;
+export declare function storageReport(store: Store, databaseFile: string, now: Date, keepMs: number): {
+    folder: string;
+    total: number;
+    lines: StorageLine[];
+};
+export declare function bytesWords(bytes: number): string;

package/dist/storage.js

@@ -0,0 +1,84 @@
+/**
+ * Where Toolroll's disk goes (`toolroll storage`): the folder
+ * beside the database, by kind, and what storage retention takes care of.
+ * Build checkouts and staged releases are the big ones; the worker removes a
+ * finished task's clean checkout two days after it was let go, and a deploy
+ * keeps its last few releases.
+ */
+import { lstatSync, readdirSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+/** Bytes a tree holds on disk (allocated blocks; links not followed). */
+export function treeBytes(path) {
+    let total = 0;
+    const pending = [path];
+    while (pending.length > 0) {
+        const at = pending.pop();
+        let stat;
+        try {
+            stat = lstatSync(at);
+        }
+        catch {
+            continue;
+        }
+        total += typeof stat.blocks === "number" ? stat.blocks * 512 : stat.size;
+        if (!stat.isDirectory())
+            continue;
+        let names = [];
+        try {
+            names = readdirSync(at);
+        }
+        catch {
+            names = [];
+        }
+        for (const name of names)
+            pending.push(join(at, name));
+    }
+    return total;
+}
+export function storageReport(store, databaseFile, now, keepMs) {
+    const folder = dirname(databaseFile);
+    const base = basename(databaseFile);
+    let names = [];
+    try {
+        names = readdirSync(folder);
+    }
+    catch {
+        names = [];
+    }
+    const sizes = new Map(names.map(name => [name, treeBytes(join(folder, name))]));
+    const take = (match) => {
+        let bytes = 0;
+        for (const [name, size] of sizes)
+            if (match(name)) {
+                bytes += size;
+                sizes.delete(name);
+            }
+        return bytes;
+    };
+    const checkouts = store.listWorktrees();
+    const due = checkouts.filter(row => row.releasedAt !== null && row.runner === null && now.getTime() - Date.parse(row.releasedAt) >= keepMs).length;
+    let staged = 0;
+    try {
+        staged = readdirSync(join(folder, "staged-upgrades")).length;
+    }
+    catch {
+        staged = 0;
+    }
+    const lines = [
+        { what: "Database", bytes: take(name => name.startsWith(base)) },
+        { what: "Build checkouts", bytes: take(name => name === "worktrees"), count: checkouts.length,
+            note: due === 0 ? "none due for removal" : `${due} let go over ${Math.round(keepMs / 86_400_000)} days ago: removed on the next pass if their task is finished and they're clean` },
+        { what: "Staged releases", bytes: take(name => name === "staged-upgrades"), count: staged, note: "a deploy keeps the release it installed, the one before and the newest few" },
+        { what: "Evidence", bytes: take(name => name === "evidence"), note: "the audit record of every run; kept" },
+        { what: "Backups", bytes: take(name => name === "backups") },
+    ];
+    lines.push({ what: "Everything else", bytes: [...sizes.values()].reduce((sum, one) => sum + one, 0) });
+    return { folder, total: lines.reduce((sum, one) => sum + one.bytes, 0), lines };
+}
+export function bytesWords(bytes) {
+    if (bytes >= 1024 ** 3)
+        return `${(bytes / 1024 ** 3).toFixed(1)} GB`;
+    if (bytes >= 1024 ** 2)
+        return `${Math.round(bytes / 1024 ** 2)} MB`;
+    return `${Math.round(bytes / 1024)} KB`;
+}