rootandClaude Opus 5.5
b0e5d539ed
- GET /auth/totp/setup returns the pending secret and otpauth URL (created on first call, reused on refresh) for the console to render as a QR code. - Enabling TOTP issues 8 one-time recovery codes (argon2id hashes in admin_recovery_code); login accepts recoveryCode in place of totpCode, disable accepts either, and recovery_codes regenerates with the password. - Passkeys via @simplewebauthn/server: register/list/rename/delete under the console session, public login options/verify that reuse the login rate limit and session cookies. Challenges are one-time rows in webauthn_challenge; RP ID and origins come from WEBAUTHN_RP_ID / WEBAUTHN_ORIGINS, falling back to the request host. Signature counter regressions are rejected. SessionInfo gains passkeyEnabled. - --role rotate-master-key re-encrypts the secret table from SECRET_MASTER_KEY to SECRET_MASTER_KEY_NEW one row per transaction, skips rows already on the new key (resumable, swap keys to roll back), logs progress and audits secret.master_key_rotate. Secrets now record the master key fingerprint in kdf_params.kid. - Runbook: recovery codes, passkey configuration, rotation steps and rollback. Co-Authored-By: Claude Opus 5.5 <[email protected]>
91 lines
4.1 KiB
JSON
91 lines
4.1 KiB
JSON
{
|
|
"version": "0.2.0",
|
|
"workspace": [
|
|
"./packages/adapters",
|
|
"./packages/agent",
|
|
"./packages/contracts",
|
|
"./packages/db",
|
|
"./packages/domain",
|
|
"./packages/mapping",
|
|
"./packages/tasks",
|
|
"./packages/testkit",
|
|
"./apps/server",
|
|
"./apps/web"
|
|
],
|
|
"nodeModulesDir": "auto",
|
|
"imports": {
|
|
"@biomejs/biome": "npm:@biomejs/[email protected]",
|
|
"@earendil-works/pi-agent-core": "npm:@earendil-works/[email protected]",
|
|
"@earendil-works/pi-agent-core/": "npm:/@earendil-works/[email protected]/",
|
|
"@earendil-works/pi-ai": "npm:@earendil-works/[email protected]",
|
|
"@earendil-works/pi-ai/": "npm:/@earendil-works/[email protected]/",
|
|
"@hono/swagger-ui": "npm:@hono/[email protected]",
|
|
"@simplewebauthn/server": "npm:@simplewebauthn/[email protected]",
|
|
"@hono/zod-openapi": "npm:@hono/[email protected]",
|
|
"@types/node": "npm:@types/[email protected]",
|
|
"@types/nunjucks": "npm:@types/[email protected]",
|
|
"@types/pg": "npm:@types/[email protected]",
|
|
"@xmldom/xmldom": "npm:@xmldom/[email protected]",
|
|
"cheerio": "npm:[email protected]",
|
|
"fast-xml-parser": "npm:[email protected]",
|
|
"hash-wasm": "npm:[email protected]",
|
|
"hono": "npm:[email protected]",
|
|
"hono/": "npm:/[email protected]/",
|
|
"kysely": "npm:[email protected]",
|
|
"kysely/": "npm:/[email protected]/",
|
|
"nunjucks": "npm:[email protected]",
|
|
"openworkflow": "npm:[email protected]",
|
|
"openworkflow/": "npm:/[email protected]/",
|
|
"pg": "npm:[email protected]",
|
|
"pino": "npm:[email protected]",
|
|
"pino-pretty": "npm:[email protected]",
|
|
"playwright-core": "npm:[email protected]",
|
|
"postgres": "npm:[email protected]",
|
|
"typebox": "npm:[email protected]",
|
|
"typescript": "npm:[email protected]",
|
|
"vitest": "npm:[email protected]",
|
|
"vitest/": "npm:/[email protected]/",
|
|
"xpath": "npm:[email protected]",
|
|
"yaml": "npm:[email protected]",
|
|
"zod": "npm:[email protected]"
|
|
},
|
|
"compilerOptions": {
|
|
"strict": true,
|
|
"noUncheckedIndexedAccess": true,
|
|
"noImplicitOverride": true,
|
|
"noFallthroughCasesInSwitch": true,
|
|
"verbatimModuleSyntax": true
|
|
},
|
|
"tasks": {
|
|
"dev": {
|
|
"description": "同时起 server(4380)与 web(5180)",
|
|
"dependencies": ["dev:server", "dev:web"]
|
|
},
|
|
"dev:server": "cd apps/server && deno task dev",
|
|
"dev:web": "cd apps/web && deno task dev",
|
|
"db:up": "docker compose -f docker-compose.dev.yml up -d --wait",
|
|
"db:migrate": "deno run -A --env-file=.env packages/db/scripts/migrate.ts latest",
|
|
"db:reset": "deno run -A --env-file=.env packages/db/scripts/migrate.ts reset",
|
|
"gen:types": "deno run -A --env-file=.env packages/db/scripts/gen-types.ts",
|
|
"types": "mkdir -p types && deno types > types/deno.d.ts",
|
|
"typecheck": "deno task types && deno task typecheck:tsc && deno task typecheck:deno",
|
|
"typecheck:tsc": "deno task --members -j 1 typecheck",
|
|
"typecheck:deno": "deno check apps/server/src/main.ts packages/contracts/src/index.ts packages/db/src/index.ts packages/db/scripts/migrate.ts packages/db/scripts/gen-types.ts packages/db/migrations/*.ts packages/domain/src/index.ts packages/mapping/src/index.ts packages/tasks/src/index.ts packages/agent/src/index.ts packages/adapters/src/index.ts packages/testkit/src/index.ts",
|
|
"lint": "deno run -A npm:@biomejs/biome check .",
|
|
"fmt": "deno run -A npm:@biomejs/biome check --write .",
|
|
"test": "deno task --members -j 1 test",
|
|
"test:web:smoke": {
|
|
"description": "前端全页面冒烟(Playwright):需要已启动的后端 + web 与已初始化的管理员,见 README",
|
|
"command": "deno run -A apps/web/scripts/smoke.mjs"
|
|
},
|
|
"check:tokens": "cd apps/web && deno task check:tokens",
|
|
"check:copy": {
|
|
"description": "文案标点检查(规范见 docs/design/glossary.md「标点」);--fix 自动修正,--strict 有违规即失败",
|
|
"command": "deno run -A scripts/check-copy-punctuation.mjs"
|
|
},
|
|
"build": "cd apps/web && deno task build && cd ../server && deno task compile",
|
|
"ci": "deno task typecheck && deno task lint && deno task test && deno task check:tokens && deno task check:copy && deno task build",
|
|
"gen:tokens": "cd apps/web && deno task gen:tokens"
|
|
}
|
|
}
|