toolroll 0.5.0

package/dist/coordinator.js

@@ -0,0 +1,447 @@
+/**
+ * The coordinator principal (MCP gateway spec v6; DESIGN.md §9b).
+ *
+ * A coordinator is the ONE credential the MCP surface accepts: minted by
+ * an operator password ceremony, hashed at rest, repo-scoped at the mint,
+ * rate-limited, revocable — and able to do exactly one thing: file a
+ * proposal through the canonical door. What it files is an ordinary
+ * UNAPPROVED task; admission is the operator's existing scope ceremony,
+ * and the quarantine (sealScopeApproval's mode-kind refusal + the claim
+ * primitive's exclusion) keeps every pre-seal road shut.
+ *
+ * The brand: `VerifiedCoordinator` is disjoint from the operator's
+ * `VerifiedAuthor` by construction, and its maker is module-private —
+ * the exported-cast mistake is named in the spec and not repeated here.
+ * Steering and every operator-speech surface cannot accept this type.
+ */
+import { createHash, randomBytes } from "node:crypto";
+import { canonicalRepos } from "./runner.js";
+import { fileTaskProposal } from "./proposal.js";
+import { describeScope } from "./scope.js";
+import { reportSummaryFor } from "./mate-tools.js";
+import { taskWorkSummaryOf } from "./work-summary.js";
+import { assignmentOf, assignmentBrief } from "./assignment.js";
+/** Module-private: the ONLY maker, reachable only through the token
+ * verification below. Never exported, never a cast at a call site. */
+function verified(row) {
+    return row;
+}
+const NAME = /^[a-z0-9-]{1,32}$/;
+const CID_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
+const KEY = /^[\x21-\x7e]{8,64}$/;
+function hashSecret(token) {
+    return createHash("sha256").update(token, "utf8").digest("hex");
+}
+function mintCid() {
+    const bytes = randomBytes(12);
+    let cid = "";
+    for (const b of bytes)
+        cid += CID_ALPHABET[b % CID_ALPHABET.length];
+    return cid;
+}
+export function mintCoordinator(store, input) {
+    const days = input.days ?? 90;
+    if (!Number.isInteger(days) || days < 1 || days > 365)
+        return { ok: false, reason: "bad-rate" };
+    const expiresAt = new Date(input.now.getTime() + days * 86_400_000).toISOString();
+    const name = input.name.normalize("NFC");
+    if (!NAME.test(name))
+        return { ok: false, reason: "bad-name" };
+    const perHour = input.perHour ?? 6;
+    if (!Number.isInteger(perHour) || perHour < 1 || perHour > 60)
+        return { ok: false, reason: "bad-rate" };
+    if (input.repos.length === 0)
+        return { ok: false, reason: "no-repos" };
+    const repos = canonicalRepos(input.repos);
+    const token = (input.newToken ?? (() => randomBytes(32).toString("base64url")))();
+    return store.transact(() => {
+        for (let attempt = 0; attempt < 5; attempt += 1) {
+            const cid = (input.newCid ?? mintCid)();
+            try {
+                store.handle
+                    .prepare(`INSERT INTO coordinator_credential (cid, name, credential_hash, repos, per_hour, created_by, created_at, expires_at)
+             VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
+                    .run(cid, name, hashSecret(token), JSON.stringify(repos), perHour, input.by, input.now.toISOString(), expiresAt);
+                return { ok: true, cid, token, repos };
+            }
+            catch (error) {
+                const said = String(error);
+                // The live-name unique index answers "taken"; a cid collision
+                // (astronomically rare) retries with a fresh one.
+                if (said.includes("coordinator_live_name"))
+                    return { ok: false, reason: "name-taken" };
+                if (!said.includes("PRIMARY KEY") && !said.includes("UNIQUE"))
+                    throw error;
+            }
+        }
+        return { ok: false, reason: "name-taken" };
+    });
+}
+/** The token IS the identity — no name travels with it. Verified against
+ * the stored hash; the caller re-runs this INSIDE any mutating
+ * transaction (the startup check is a courtesy; the txn check is law). */
+export function authenticateCoordinator(store, token) {
+    const row = store.handle
+        .prepare("SELECT * FROM coordinator_credential WHERE credential_hash = ?")
+        .get(hashSecret(token));
+    if (row === undefined)
+        return { ok: false, reason: "unknown" };
+    if (row["revoked_at"] !== null)
+        return { ok: false, reason: "revoked" };
+    // v101: a credential made with an expiry stops at it (one made before expiry existed lives until it's renewed or revoked).
+    if (row["expires_at"] != null && Date.parse(String(row["expires_at"])) <= Date.now())
+        return { ok: false, reason: "expired" };
+    return {
+        ok: true,
+        who: verified({
+            cid: String(row["cid"]),
+            name: String(row["name"]),
+            repos: JSON.parse(String(row["repos"])),
+            perHour: Number(row["per_hour"]),
+        }),
+    };
+}
+export function revokeCoordinator(store, cid, by, now) {
+    return store.transact(() => {
+        const row = store.handle.prepare("SELECT revoked_at FROM coordinator_credential WHERE cid = ?").get(cid);
+        if (row === undefined)
+            return { ok: false, reason: "unknown" };
+        if (row["revoked_at"] !== null)
+            return { ok: false, reason: "already-revoked" };
+        store.handle
+            .prepare("UPDATE coordinator_credential SET revoked_at = ? WHERE cid = ?")
+            .run(now.toISOString(), cid);
+        // The revocation event rides the SAME transaction as the state change,
+        // and the credential's pending proposals expire with it (mate arc v3).
+        store.handle
+            .prepare("INSERT INTO coordinator_event (cid, kind, detail, created_at) VALUES (?, 'revoked', ?, ?)")
+            .run(cid, `by ${by}`, now.toISOString());
+        store.sweepCoordinatorProposals(now, cid);
+        return { ok: true };
+    });
+}
+export function listCoordinators(store) {
+    return store.handle
+        .prepare(`SELECT c.*, (SELECT MAX(e.created_at) FROM coordinator_event e WHERE e.cid = c.cid AND e.kind = 'filed') AS last_filed
+         FROM coordinator_credential c ORDER BY c.created_at, c.cid`)
+        .all()
+        .map(row => ({
+        cid: String(row["cid"]),
+        name: String(row["name"]),
+        repos: JSON.parse(String(row["repos"])),
+        perHour: Number(row["per_hour"]),
+        createdBy: String(row["created_by"]),
+        createdAt: String(row["created_at"]),
+        revokedAt: row["revoked_at"] === null ? null : String(row["revoked_at"]),
+        lastFiledAt: row["last_filed"] === null ? null : String(row["last_filed"]),
+        expiresAt: row["expires_at"] == null ? null : String(row["expires_at"]),
+    }));
+}
+/** What each artifact kind IS on the wire — evidence metadata carries a
+ * media type so a client knows what it would be asking for (round-2 f4). */
+const MEDIA_BY_KIND = {
+    diff: "text/x-diff",
+    "terminal-diff": "text/x-diff",
+    "diff-stat": "application/json",
+    status: "text/plain",
+    "park-payload": "application/json",
+    plan: "text/markdown",
+    handoff: "application/json",
+    "revision-brief": "text/markdown",
+    "base-tree": "text/plain",
+};
+/** Outstanding = filed by this cid, scope UNSEALED (missing seal or a
+ * stale digest both count), task not done/cancelled — `failed` COUNTS:
+ * dead unsealed filings pressure cleanup, not silence. */
+const OUTSTANDING_SQL = `
+  SELECT COUNT(*) AS n FROM task_ref
+    JOIN task ON task.id = task_ref.external_id AND task_ref.backend = 'built-in'
+    LEFT JOIN task_scope ON task_scope.task_id = task_ref.external_id
+   WHERE task_ref.coordinator_cid IS NOT NULL
+     AND task.state NOT IN ('done','cancelled')
+     AND (task_scope.task_id IS NULL
+          OR task_scope.approved_at IS NULL
+          OR task_scope.approved_digest IS NOT task_scope.digest)`;
+export const PER_CID_OUTSTANDING = 10;
+export const GLOBAL_OUTSTANDING = 50;
+/**
+ * The one write the MCP surface owns, as ONE transaction: authenticate →
+ * revocation re-check → replay lookup → rate window → caps → the
+ * canonical door → the cid stamp → idempotency + event rows. The rate
+ * window reads the event ledger (filings are events, so the window and
+ * the audit cannot disagree), and a replay charges no slot.
+ */
+export function fileCoordinatorProposal(store, token, input, now) {
+    if (!KEY.test(input.idempotencyKey)) {
+        return { ok: false, reason: "bad-key", message: "idempotency_key is 8–64 printable ASCII characters" };
+    }
+    const digest = createHash("sha256")
+        .update(JSON.stringify({ repo: input.repo, title: input.title, intent: input.intent ?? null, ...(input.deliverable === undefined ? {} : { deliverable: input.deliverable }) }), "utf8")
+        .digest("hex");
+    return store.transact(() => {
+        // The law lives here: the token re-verifies INSIDE the transaction.
+        const auth = authenticateCoordinator(store, token);
+        if (!auth.ok) {
+            return auth.reason === "revoked" || auth.reason === "expired"
+                ? { ok: false, reason: "revoked", message: auth.reason === "expired" ? "this credential expired — ask the operator for a new one" : "this credential was revoked — ask the operator for a new one" }
+                : { ok: false, reason: "unauthenticated", message: "no live coordinator credential matches this token" };
+        }
+        const { who } = auth;
+        const replay = store.handle
+            .prepare("SELECT request_digest, task_id FROM mcp_idempotency WHERE cid = ? AND key = ?")
+            .get(who.cid, input.idempotencyKey);
+        if (replay !== undefined) {
+            if (String(replay["request_digest"]) !== digest) {
+                return {
+                    ok: false,
+                    reason: "idempotency-conflict",
+                    message: "this idempotency_key was already used for a DIFFERENT request — mint a new key",
+                };
+            }
+            return { ok: true, id: String(replay["task_id"]), replayed: true };
+        }
+        const windowStart = new Date(now.getTime() - 3_600_000).toISOString();
+        const filedRow = store.handle
+            .prepare("SELECT COUNT(*) AS n, MIN(created_at) AS oldest FROM coordinator_event WHERE cid = ? AND kind = 'filed' AND created_at > ?")
+            .get(who.cid, windowStart);
+        // Filings and proposals share the hourly window in BOTH directions
+        // (v3 review, finding 2).
+        const filed = Number(filedRow?.["n"] ?? 0) + store.coordinatorProposalsSince(who.cid, new Date(windowStart));
+        if (filed >= who.perHour) {
+            const oldest = String(filedRow?.["oldest"] ?? now.toISOString());
+            const slotMs = new Date(oldest).getTime() + 3_600_000 - now.getTime();
+            const minutes = Math.max(1, Math.ceil(slotMs / 60_000));
+            return {
+                ok: false,
+                reason: "rate-limited",
+                message: `rate-limited: ${filed} filed in the last hour — next slot in ${minutes}m`,
+            };
+        }
+        const mine = Number(store.handle.prepare(`${OUTSTANDING_SQL} AND task_ref.coordinator_cid = ?`).get(who.cid)?.["n"] ?? 0);
+        if (mine >= PER_CID_OUTSTANDING) {
+            return {
+                ok: false,
+                reason: "outstanding-cap",
+                message: `${mine} of your filings are still waiting on approval or dismissal — the operator resolves them before more file`,
+            };
+        }
+        const everyone = Number(store.handle.prepare(OUTSTANDING_SQL).get()?.["n"] ?? 0);
+        if (everyone >= GLOBAL_OUTSTANDING) {
+            return {
+                ok: false,
+                reason: "global-cap",
+                message: `${everyone} coordinator filings are unresolved across the installation — the backlog resolves before more file`,
+            };
+        }
+        // The canonical door: the credential's repo allowlist IS the ceiling,
+        // and (since the empty-repo fix) a repo must be named inside it.
+        const made = fileTaskProposal(store, {
+            title: input.title,
+            repo: input.repo,
+            ...(input.intent === undefined
+                ? {}
+                : {
+                    goal: input.intent,
+                    // v39: a coordinator's intent is provisional pending the
+                    // operator's own review (the quarantine already refuses to
+                    // auto-approve anything a coordinator wrote) — a placeholder
+                    // criterion names that review as the outstanding work,
+                    // rather than blocking the filing on a rubric a remote
+                    // caller has no real standing to author.
+                    acceptance: [
+                        { id: "c1", statement: "The operator has reviewed this filing's intent and written a real rubric before approving it.", how: null, evidence: ["manual-review"] },
+                    ],
+                }),
+            ...(input.deliverable === undefined ? {} : { deliverable: input.deliverable }),
+            filedVia: `mcp:${who.name}`, filedBy: { name: store.handle.prepare("SELECT created_by FROM coordinator_credential WHERE cid = ?").get(who.cid)?.["created_by"] ?? null, kind: "coordinator" },
+            admittedRepos: who.repos,
+        }, now);
+        if (!made.ok)
+            return { ok: false, reason: made.reason, message: made.message };
+        // The branded door's OWN write: the authoritative linkage column. No
+        // other filer sets it; provenance is a join, never string parsing.
+        store.handle
+            .prepare("UPDATE task_ref SET coordinator_cid = ? WHERE backend = 'built-in' AND external_id = ? AND coordinator_cid IS NULL")
+            .run(who.cid, made.id);
+        store.handle
+            .prepare("INSERT INTO mcp_idempotency (cid, key, request_digest, task_id, created_at) VALUES (?, ?, ?, ?, ?)")
+            .run(who.cid, input.idempotencyKey, digest, made.id, now.toISOString());
+        store.handle
+            .prepare("INSERT INTO coordinator_event (cid, kind, task_id, created_at) VALUES (?, 'filed', ?, ?)")
+            .run(who.cid, made.id, now.toISOString());
+        return { ok: true, id: made.id, replayed: false };
+    });
+}
+// ---- credential-scoped reads (MCP spec v6: the allowlist intersected IN
+// SQL, before aggregation, ordering, LIMIT, and counts; repo-null rows
+// excluded from every result; a foreign ref answers not-found) ----------
+function inClause(repos) {
+    return { sql: repos.map(() => "?").join(","), args: [...repos] };
+}
+export function statusFor(store, who, now) {
+    const { sql, args } = inClause(who.repos);
+    const dayAgo = new Date(now.getTime() - 24 * 3_600_000).toISOString();
+    const one = (query, extra = []) => Number(store.handle.prepare(query).get(...args, ...extra)?.["n"] ?? 0);
+    // "Waits on you" = the board's attention lanes over this allowlist:
+    // unsealed scopes + open decisions on live runs.
+    const unsealed = one(`SELECT COUNT(*) AS n FROM task_ref JOIN task ON task.id = task_ref.external_id AND task_ref.backend = 'built-in'
+      LEFT JOIN task_scope ON task_scope.task_id = task_ref.external_id
+      WHERE task_ref.repo IN (${sql}) AND task.state = 'queued'
+        AND (task_scope.task_id IS NULL OR task_scope.approved_at IS NULL OR task_scope.approved_digest IS NOT task_scope.digest)`);
+    const questions = one(`SELECT COUNT(*) AS n FROM decision JOIN run ON run.id = decision.run
+      JOIN task_ref ON task_ref.id = run.task_ref AND task_ref.backend = 'built-in'
+      WHERE task_ref.repo IN (${sql}) AND decision.answered_at IS NULL AND decision.state IN ('open','expired')`);
+    // "Running" is lease-based liveness, never `outcome IS NULL` (review
+    // finding 6): a live, unexpired, newest-generation claim.
+    const running = one(`SELECT COUNT(DISTINCT claim.task_ref) AS n FROM claim
+      JOIN task_ref ON task_ref.id = claim.task_ref AND task_ref.backend = 'built-in'
+      WHERE task_ref.repo IN (${sql}) AND claim.released_at IS NULL AND claim.expires_at > ?
+        AND claim.lease_generation = (SELECT MAX(newest.lease_generation) FROM claim AS newest WHERE newest.task_ref = claim.task_ref)`, [now.toISOString()]);
+    const incidents = one(`SELECT COUNT(*) AS n FROM incident JOIN run ON run.id = incident.run
+      JOIN task_ref ON task_ref.id = run.task_ref AND task_ref.backend = 'built-in'
+      WHERE task_ref.repo IN (${sql}) AND incident.resolved_at IS NULL`);
+    const picks = one(`SELECT COUNT(*) AS n FROM contest JOIN task_ref ON task_ref.id = contest.task_ref AND task_ref.backend = 'built-in'
+      WHERE task_ref.repo IN (${sql}) AND contest.state = 'pick-wait'`);
+    const builtToday = one(`SELECT COUNT(*) AS n FROM run JOIN task_ref ON task_ref.id = run.task_ref AND task_ref.backend = 'built-in'
+      WHERE task_ref.repo IN (${sql}) AND run.outcome = 'built' AND run.finished_at > ?`, [dayAgo]);
+    const failedToday = one(`SELECT COUNT(*) AS n FROM run JOIN task_ref ON task_ref.id = run.task_ref AND task_ref.backend = 'built-in'
+      WHERE task_ref.repo IN (${sql}) AND run.outcome = 'failed' AND run.finished_at > ?`, [dayAgo]);
+    const repos = store.handle
+        .prepare(`SELECT task_ref.repo AS repo,
+              SUM(CASE WHEN task.state = 'queued' THEN 1 ELSE 0 END) AS queued,
+              SUM(CASE WHEN task.state = 'running' THEN 1 ELSE 0 END) AS running
+         FROM task_ref JOIN task ON task.id = task_ref.external_id AND task_ref.backend = 'built-in'
+        WHERE task_ref.repo IN (${sql}) GROUP BY task_ref.repo ORDER BY task_ref.repo`)
+        .all(...args)
+        .map(row => ({ repo: String(row["repo"]), queued: Number(row["queued"]), running: Number(row["running"]) }));
+    return {
+        waitsOnYou: unsealed + questions + incidents + picks,
+        waits: { approvals: unsealed, questions, incidents, picks },
+        running,
+        builtToday,
+        failedToday,
+        repos,
+    };
+}
+export function listTasksFor(store, who, filter, now) {
+    const limit = Math.min(Math.max(filter.limit ?? 20, 1), 50);
+    const repos = filter.repo === undefined ? [...who.repos] : who.repos.includes(filter.repo) ? [filter.repo] : [];
+    if (repos.length === 0)
+        return { tasks: [], nextCursor: null };
+    const { sql, args } = inClause(repos);
+    const rows = store.handle
+        .prepare(`SELECT task_ref.id AS rid, task.id AS tid, task.title AS title, task.state AS state, task_ref.repo AS repo, task_ref.filed_via AS via,
+              EXISTS(SELECT 1 FROM claim WHERE claim.task_ref = task_ref.id AND claim.released_at IS NULL AND claim.expires_at > ?
+                AND claim.lease_generation = (SELECT MAX(newest.lease_generation) FROM claim AS newest WHERE newest.task_ref = claim.task_ref)) AS live,
+              EXISTS(SELECT 1 FROM task_scope WHERE task_scope.task_id = task.id AND task_scope.approved_at IS NOT NULL AND task_scope.approved_digest = task_scope.digest) AS sealed
+         FROM task_ref JOIN task ON task.id = task_ref.external_id AND task_ref.backend = 'built-in'
+        WHERE task_ref.repo IN (${sql})
+          AND (? IS NULL OR task.state = ?)
+          AND task_ref.id > ?
+        ORDER BY task_ref.id LIMIT ?`)
+        .all(now.toISOString(), ...args, filter.state ?? null, filter.state ?? null, filter.cursor ?? 0, limit + 1);
+    const chipOf = (state, live, sealed) => {
+        if (live)
+            return "building";
+        if (state === "queued")
+            return sealed ? "ready to build" : "waiting for approval";
+        if (state === "running")
+            return "running";
+        if (state === "done")
+            return "built";
+        if (state === "failed")
+            return "failed";
+        return state;
+    };
+    const page = rows.slice(0, limit).map(row => ({
+        ref: String(row["tid"]),
+        title: String(row["title"]),
+        state: String(row["state"]),
+        chip: chipOf(String(row["state"]), Number(row["live"]) === 1, Number(row["sealed"]) === 1),
+        repo: String(row["repo"]),
+        filedVia: row["via"] === null ? null : String(row["via"]),
+    }));
+    const nextCursor = rows.length > limit ? Number(rows[limit - 1]?.["rid"] ?? 0) : null;
+    return { tasks: page, nextCursor };
+}
+export function taskDetailFor(store, who, taskId, evidenceRoot, now = new Date()) {
+    const { sql, args } = inClause(who.repos);
+    const row = store.handle
+        .prepare(`SELECT task_ref.id AS rid, task.id AS tid, task.title AS title, task.state AS state, task_ref.repo AS repo
+         FROM task_ref JOIN task ON task.id = task_ref.external_id AND task_ref.backend = 'built-in'
+        WHERE task.id = ? AND task_ref.repo IN (${sql})`)
+        .get(taskId, ...args);
+    // A foreign or absent ref is the SAME answer: not-found — existence
+    // outside the allowlist is not this credential's to learn.
+    if (row === undefined)
+        return null;
+    const rid = Number(row["rid"]);
+    const scope = store.getScope(taskId);
+    const attempts = store.handle
+        .prepare(`SELECT outcome, provider, model, started_at, finished_at, cost_usd FROM run
+        WHERE task_ref = ? ORDER BY id`)
+        .all(rid)
+        .map(one => ({
+        outcome: one["outcome"] === null ? null : String(one["outcome"]),
+        provider: String(one["provider"]),
+        model: one["model"] === null ? null : String(one["model"]),
+        startedAt: String(one["started_at"]),
+        finishedAt: one["finished_at"] === null ? null : String(one["finished_at"]),
+        durationMs: one["finished_at"] === null
+            ? null
+            : new Date(String(one["finished_at"])).getTime() - new Date(String(one["started_at"])).getTime(),
+        // Integer micro-USD, never a float (review finding 6); null = unmeasured.
+        costMicrousd: one["cost_usd"] === null ? null : Math.round(Number(one["cost_usd"]) * 1_000_000),
+    }));
+    const measured = attempts.filter(one => one.costMicrousd !== null);
+    const waits = [];
+    const question = store.handle
+        .prepare(`SELECT 1 AS hit FROM decision JOIN run ON run.id = decision.run
+        WHERE run.task_ref = ? AND decision.answered_at IS NULL AND decision.state IN ('open','expired') LIMIT 1`)
+        .get(rid);
+    if (question !== undefined)
+        waits.push("a question waits on the operator");
+    if (!store.scopeSealed(taskId))
+        waits.push("the scope waits on the operator's signature");
+    const latestRun = store.handle.prepare("SELECT MAX(id) AS top FROM run WHERE task_ref = ?").get(rid);
+    const evidence = latestRun?.["top"] === null || latestRun?.["top"] === undefined
+        ? []
+        : store.handle
+            .prepare("SELECT id, kind, bytes_original, sha256, capture_status FROM artifact WHERE run = ? ORDER BY id")
+            .all(Number(latestRun["top"]))
+            .map(one => ({
+            // Opaque metadata only — no filesystem paths, no bodies (spec v6).
+            id: Number(one["id"]),
+            kind: String(one["kind"]),
+            bytes: Number(one["bytes_original"]),
+            sha256: String(one["sha256"]),
+            captureStatus: one["capture_status"] === null ? null : String(one["capture_status"]),
+            mediaType: MEDIA_BY_KIND[String(one["kind"])] ?? "text/plain",
+        }));
+    const deliverable = store.refForId(rid)?.deliverable ?? "branch";
+    return {
+        ref: String(row["tid"]),
+        work: taskWorkSummaryOf(store, taskId, now, { principal: "coordinator", repos: who.repos }),
+        assignment: assignmentBrief(assignmentOf(store, taskId, now, { principal: "coordinator", repos: who.repos }, evidenceRoot)),
+        title: String(row["title"]),
+        state: String(row["state"]),
+        repo: String(row["repo"]),
+        deliverable,
+        report: reportSummaryFor(store, evidenceRoot, rid),
+        filedBy: store.coordinatorProvenanceOf(taskId)?.label ?? null,
+        scope: {
+            sealed: store.scopeSealed(taskId),
+            goal: scope?.goal ?? null,
+            // The scope in the console's own words — fallback chain included.
+            words: scope === null ? [] : describeScope(scope),
+        },
+        waits,
+        attempts,
+        cost: {
+            totalMicrousd: measured.reduce((sum, one) => sum + (one.costMicrousd ?? 0), 0),
+            measuredRuns: measured.length,
+            totalRuns: attempts.length,
+        },
+        evidence,
+    };
+}

package/dist/credentials-ui.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Settings → Sessions & tokens (v101): where you're signed in (sign any of
+ * them out), and your API tokens (make one, revoke one). An instance operator
+ * can see and end everyone's.
+ */
+import type { ApiTokenRow, WebSessionRow } from "./store.js";
+export declare const CREDENTIALS_CSS: string;
+/** "Chrome on macOS", from a user agent, for a person to recognise a session. */
+export declare function deviceWords(agent: string | null): string;
+export type CredentialsView = {
+    who: string;
+    everyone: boolean;
+    canSeeEveryone: boolean;
+    sessions: (WebSessionRow & {
+        here: boolean;
+    })[];
+    tokens: ApiTokenRow[];
+    now: number;
+};
+export declare function credentialsHtml(view: CredentialsView, csrf: string, notice: {
+    said?: string | null;
+    problem?: string | null;
+}): string;
+/** The token, once: a focused page with no script. */
+export declare function tokenShownHtml(name: string, token: string, access: "read" | "act", expiresAt: string): string;

package/dist/credentials-ui.js

@@ -0,0 +1,48 @@
+import { TOKEN_DAYS } from "./api-tokens.js";
+const e = (value) => String(value ?? "").replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+export const CREDENTIALS_CSS = `.credentials{max-width:820px;min-width:0}.credentials .card{padding:14px 16px;margin:12px 0}.credentials h2{font-size:1.05rem;margin:0 0 8px}` +
+    `.credentials .rows{display:grid;gap:0;border:1px solid var(--so-line);border-radius:10px;overflow:hidden}.credentials .row-item{display:flex;align-items:center;justify-content:space-between;gap:12px;padding:10px 14px;border-bottom:1px solid var(--so-line)}` +
+    `.credentials .row-item:last-child{border-bottom:0}.credentials .row-item p{margin:0}.credentials .row-item .meta{font-size:.85rem}.credentials form{margin:0}.credentials button{min-height:40px;white-space:nowrap}` +
+    `.credentials .create{display:grid;gap:10px}.credentials .create label{display:grid;gap:6px}.credentials .create input,.credentials .create select{box-sizing:border-box;width:100%}.credentials .badge-here{font-size:.75rem;padding:1px 6px;border-radius:999px;background:var(--so-success-soft);color:var(--so-success);margin-left:6px}` +
+    `@media(max-width:600px){.credentials .row-item{flex-wrap:wrap}.credentials .create input,.credentials .create select{font-size:16px}}`;
+/** "Chrome on macOS", from a user agent, for a person to recognise a session. */
+export function deviceWords(agent) {
+    if (agent === null || agent === "")
+        return "Unknown device";
+    const browser = /Edg\//.test(agent) ? "Edge" : /Firefox\//.test(agent) ? "Firefox" : /Chrome\//.test(agent) ? "Chrome" : /Safari\//.test(agent) ? "Safari" : /curl|node|undici|python|Go-http/i.test(agent) ? "A script" : "A browser";
+    const system = /iPhone|iPad/.test(agent) ? "iPhone or iPad" : /Android/.test(agent) ? "Android" : /Mac OS X|Macintosh/.test(agent) ? "macOS" : /Windows/.test(agent) ? "Windows" : /Linux/.test(agent) ? "Linux" : null;
+    return system === null ? browser : `${browser} on ${system}`;
+}
+const when = (value, now) => {
+    if (value === null)
+        return "never";
+    const at = typeof value === "number" ? value : Date.parse(value);
+    const minutes = Math.round((now - at) / 60_000);
+    return minutes < 1 ? "just now" : minutes < 60 ? `${minutes} min ago` : minutes < 60 * 24 ? `${Math.round(minutes / 60)} h ago` : new Date(at).toISOString().slice(0, 10);
+};
+export function credentialsHtml(view, csrf, notice) {
+    const hidden = (fields) => Object.entries(fields).map(([k, v]) => `<input type="hidden" name="${e(k)}" value="${e(v)}">`).join("");
+    const post = (fields, label, style = "secondary") => `<form method="post" action="/settings/sessions">${hidden({ csrf, ...fields, ...(view.everyone ? { everyone: "1" } : {}) })}<button class="${style}">${label}</button></form>`;
+    const note = notice.problem ? `<p class="problem" role="alert">${e(notice.problem)}</p>` : notice.said ? `<p role="status">${e(notice.said)}</p>` : "";
+    const toggle = view.canSeeEveryone ? `<p class="meta"><a href="/settings/sessions${view.everyone ? "" : "?everyone=1"}">${view.everyone ? "Show only mine" : "Show everyone's"}</a></p>` : "";
+    const sessions = view.sessions.length === 0 ? `<p class="meta">No one else is signed in.</p>` : `<div class="rows">${view.sessions.map(one => `<div class="row-item" data-session="${e(one.idHash.slice(0, 12))}"><div><p>${view.everyone ? `<strong>${e(one.account)}</strong> · ` : ""}${e(deviceWords(one.agent))}${one.here ? `<span class="badge-here">This browser</span>` : ""}</p>` +
+        `<p class="meta">${one.ssoAt === null ? "Password" : "Identity provider"} · ${e(one.address ?? "unknown address")} · active ${e(when(one.lastSeen, view.now))} · signed in ${e(when(one.createdAt, view.now))}</p></div>` +
+        `${one.here ? "" : post({ action: "end-session", session: one.idHash }, "Sign out")}</div>`).join("")}</div>`;
+    const others = view.sessions.filter(one => !one.here && one.account === view.who).length;
+    const endOthers = others > 0 && !view.everyone ? post({ action: "end-others" }, `Sign out everywhere else (${others})`) : "";
+    const live = view.tokens.filter(one => one.revokedAt === null && Date.parse(one.expiresAt) > view.now);
+    const tokens = live.length === 0 ? `<p class="meta">No API tokens.</p>` : `<div class="rows">${live.map(one => `<div class="row-item" data-token="${e(one.id)}"><div><p>${view.everyone ? `<strong>${e(one.account)}</strong> · ` : ""}${e(one.name)} · ${one.access === "act" ? "Can act" : "Read only"}</p>` +
+        `<p class="meta">Expires ${e(one.expiresAt.slice(0, 10))} · last used ${e(when(one.lastUsedAt, view.now))}</p></div>${post({ action: "revoke-token", token: one.id }, "Revoke")}</div>`).join("")}</div>`;
+    const create = `<details class="card"><summary>New API token</summary><form method="post" action="/settings/sessions" class="create">${hidden({ csrf, action: "create-token" })}` +
+        `<label>Name<input type="text" name="name" maxlength="60" required placeholder="for example: CI"></label>` +
+        `<label>It can<select name="access"><option value="read">Read (tasks, results, the ledger)</option><option value="act">Act as you (file and manage work; never approve)</option></select></label>` +
+        `<label>Expires in<select name="days">${TOKEN_DAYS.map(days => `<option value="${days}"${days === 90 ? " selected" : ""}>${days} days</option>`).join("")}</select></label>` +
+        `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label><button>Make the token</button></form></details>`;
+    return `<section class="credentials">${note}${toggle}<h2>Signed in</h2>${sessions}${endOthers}<h2 style="margin-top:1.5rem">API tokens</h2>` +
+        `<p class="meta">For scripts and CI: send <code>Authorization: Bearer &lt;token&gt;</code>. A token can't approve anything.</p>${tokens}${view.everyone ? "" : create}</section>`;
+}
+/** The token, once: a focused page with no script. */
+export function tokenShownHtml(name, token, access, expiresAt) {
+    return `<h1>${e(name)}</h1><div class="card"><p>Your API token, shown once. Only a hash is kept, so copy it now.</p><p class="mono secret-value">${e(token)}</p>` +
+        `<p class="meta">${access === "act" ? "It acts as you (never approves)" : "It reads"} until ${e(expiresAt.slice(0, 10))}. Revoke it any time on Sessions &amp; tokens.</p></div><p class="meta"><a href="/settings/sessions">Back to Sessions &amp; tokens</a></p>`;
+}