owner-claim.mjs

Mints, hashes and reads the local owner admin token, and builds a one-click claim-link page for entering owner on a deployment.

Operator tooling › owner-claim.mjs

What it does

Reads or mints a random 32-byte token at ~/.grafted-wars/owner-token, restricted to the owning user (mode 0600), and never prints its value. Hashes that token with SHA-256 so deploy-prod.mjs and deploy-staging.mjs can pass the digest to a deployed worker as ADMIN_CLAIM_HASH without the plaintext token ever leaving this machine. Builds a static HTML page at ~/rocket-showroom/grafted-wars-enter.html holding one #claim=<token> link per base URL given, for opening once in a browser to claim owner on that deployment.

Usage

The first command run on a fresh machine:

node scripts/owner-claim.mjs mint

Options

Flag	Value	What it does	Default
--force	no value	Valid after mint. Mints a new token even when one already exists at ~/.grafted-wars/owner-token, overwriting it — every claim link and ADMIN_CLAIM_HASH issued from the old token stops working once a deployment picks up the new one.	Off; mint reuses an existing token rather than replacing it
--library	no value	Not a flag a person types. When another script imports this module instead of running it from the command line, process.argv[1] no longer ends in owner-claim.mjs, so the module treats its own argv as ['--library'] and runs no subcommand — it only exports ownerClaimHash() for the importer to call. Passing it by hand on the command line has the same effect: no subcommand runs.	Set internally when the module is imported, not by a caller

Inputs and outputs

Reads and writes ~/.grafted-wars/owner-token — the plaintext token, mode 0600, never printed. The page subcommand additionally reads that token and writes ~/rocket-showroom/grafted-wars-enter.html, printing how many links it wrote but never the claim URLs themselves, since each URL carries the token in its fragment. Every subcommand prints its result to stdout or stderr; none of them reach the network.

Exit code	Meaning
0	mint, hash, or page completed
2	No token exists yet and hash or page was run before mint; page was run with no base URL; or the command given is not mint, hash, or page

Examples

First-time setup, mint the token this deployment's owner will claim with:

node scripts/owner-claim.mjs mint

Build a claim-link page for the two hostnames deploy-prod.mjs binds, to claim owner once production is live:

node scripts/owner-claim.mjs page https://grafted-wars.com https://www.grafted-wars.com

Print the hash to paste into a deployment pushed by some means other than deploy-prod.mjs or deploy-staging.mjs, which otherwise compute and pass it automatically:

node scripts/owner-claim.mjs hash

Notes

The token file lives outside the repository and outside any deployment, at ~/.grafted-wars/owner-token. Losing it means every claim link and hash derived from it stop working. The claim-link page saved on this machine is the only backup, which is why its own footer says to bookmark that local page rather than a claim link.

Re-minting with --force only changes the token on this machine. A deployment keeps trusting the previous token's hash until it is redeployed. Both deploy-prod.mjs and deploy-staging.mjs read the token fresh and pass the new ADMIN_CLAIM_HASH on their next run; setting that var by some other means has the same effect. Until then, an old claim link still works against the deployed worker.

page's printed line deploy config needs: ADMIN_CLAIM_HASH=<hash> is informational only in the normal flow: deploy-prod.mjs and deploy-staging.mjs already compute this value themselves by calling this module as a library. It matters only when a deployment is pushed by hand.

The exported ownerClaimHash(), which both deploy scripts import, throws ADMIN_CLAIM_HASH_MALFORMED if ADMIN_CLAIM_HASH is set in the environment but is not a 64-character hex digest. That failure is reachable only through those scripts — this file's own mint, hash and page subcommands never call it.

Source

scripts/owner-claim.mjs — part of Operator tooling