@agentdocumentformat/cli 0.7.7 → 0.8.0

package/dist/chunks/{chunk-6VQEXLE2.mjs → chunk-BHY7QDCM.mjs}

@@ -17,19 +17,23 @@ __export(auth_flow_exports, {
   AUTH_POLL_INTERVAL_MS: () => AUTH_POLL_INTERVAL_MS,
   AUTH_PROVIDERS: () => AUTH_PROVIDERS,
   AUTH_PROVIDER_LABELS: () => AUTH_PROVIDER_LABELS,
+  CLAUDE_AUTH_TIMEOUT_MS: () => CLAUDE_AUTH_TIMEOUT_MS,
   RELAY_CALLBACK_TIMEOUT_MS: () => RELAY_CALLBACK_TIMEOUT_MS,
   browserLaunchCommand: () => browserLaunchCommand,
   daemonIsLocal: () => daemonIsLocal,
   loginChatGpt: () => loginChatGpt,
+  loginClaude: () => loginClaude,
   loginGrok: () => loginGrok,
   normalizeAuthProvider: () => normalizeAuthProvider,
   openBrowser: () => openBrowser,
+  submitClaudeCode: () => submitClaudeCode,
   waitForAuth: () => waitForAuth
 });
 import { spawn as nodeSpawn } from "child_process";
-var AUTH_PROVIDERS = ["chatgpt", "grok"], AUTH_PROVIDER_LABELS = {
+var AUTH_PROVIDERS = ["chatgpt", "grok", "claude"], AUTH_PROVIDER_LABELS = {
   chatgpt: "ChatGPT",
-  grok: "Grok"
+  grok: "Grok",
+  claude: "Claude"
 }, RELAY_CALLBACK_TIMEOUT_MS = 300 * 1e3, AUTH_POLL_INTERVAL_MS = 2e3, LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
 function normalizeAuthProvider(value) {
   switch (value?.toLowerCase()) {
@@ -40,6 +44,9 @@ function normalizeAuthProvider(value) {
     case "grok":
     case "xai":
       return "grok";
+    case "claude":
+    case "claude-code":
+      return "claude";
     default:
       return null;
   }
@@ -63,7 +70,7 @@ function openBrowser(url, deps = {}) {
   } catch {
   }
 }
-var CANCELLED = { ok: !1, error: "Sign-in cancelled", cancelled: !0 };
+var CLAUDE_AUTH_TIMEOUT_MS = 660 * 1e3, CANCELLED = { ok: !1, error: "Sign-in cancelled", cancelled: !0 };
 function isRecord(value) {
   return typeof value == "object" && value !== null && !Array.isArray(value);
 }
@@ -107,6 +114,35 @@ async function loginGrok(deps, opts) {
   let userCode = typeof data.userCode == "string" ? data.userCode : "", verificationUri = typeof data.verificationUriComplete == "string" && data.verificationUriComplete ? data.verificationUriComplete : typeof data.verificationUri == "string" ? data.verificationUri : "", expiresInSec = typeof data.expiresIn == "number" && data.expiresIn > 0 ? data.expiresIn : 900;
   return opts.onStart({ userCode, verificationUri, expiresInSec, raw: data }), deps.signal?.aborted ? CANCELLED : (verificationUri && (deps.openBrowser ?? openBrowser)(verificationUri), waitForAuth(deps, "grok", expiresInSec * 1e3));
 }
+async function loginClaude(deps, opts) {
+  let before = await deps.request("GET", "/auth/claude/status");
+  if (isRecord(before) && before.installed === !1) {
+    let installUrl = typeof before.installUrl == "string" ? before.installUrl : "";
+    return { ok: !1, error: `Claude Code is not installed on the daemon host.${installUrl ? ` Install it from ${installUrl}, then sign in again.` : ""}`, notInstalled: !0, installUrl };
+  }
+  let data = await deps.request("POST", "/auth/claude/start"), url = isRecord(data) && typeof data.url == "string" ? data.url : "";
+  if (opts.onStart({ url, raw: data }), opts.wait === !1 && !deps.signal?.aborted) return { ok: !1, error: "Sign-in started; not waiting for it", detached: !0 };
+  let outcome = deps.signal?.aborted ? CANCELLED : await waitForClaude(deps);
+  return !outcome.ok && (outcome.cancelled || outcome.timedOut) && await deps.request("POST", "/auth/claude/cancel").catch(() => {
+  }), outcome;
+}
+async function submitClaudeCode(deps, code) {
+  await deps.request("POST", "/auth/claude/code", { code: code.trim() });
+}
+async function waitForClaude(deps) {
+  let sleep = deps.sleep ?? ((ms) => abortableSleep(ms, deps.signal)), deadline = Date.now() + CLAUDE_AUTH_TIMEOUT_MS;
+  for (; Date.now() < deadline; ) {
+    if (await sleep(AUTH_POLL_INTERVAL_MS), deps.signal?.aborted) return CANCELLED;
+    let status = await deps.request("GET", "/auth/claude/status");
+    if (deps.signal?.aborted) return CANCELLED;
+    if (isRecord(status) && status.flowPending !== !0) {
+      if (typeof status.flowError == "string" && status.flowError) return { ok: !1, error: status.flowError };
+      if (status.authenticated === !0) return { ok: !0, email: typeof status.email == "string" ? status.email : void 0, raw: status };
+      if (status.installed === !1) return { ok: !1, error: "Claude Code is not installed on the daemon host." };
+    }
+  }
+  return { ok: !1, error: "Timed out waiting for Claude sign-in", timedOut: !0 };
+}
 async function waitForAuth(deps, provider, timeoutMs) {
   let sleep = deps.sleep ?? ((ms) => abortableSleep(ms, deps.signal)), deadline = Date.now() + timeoutMs;
   for (; Date.now() < deadline; ) {
@@ -140,5 +176,7 @@ export {
   openBrowser,
   loginChatGpt,
   loginGrok,
+  loginClaude,
+  submitClaudeCode,
   auth_flow_exports
 };

package/dist/chunks/chunk-C2S64Y6F.mjs

@@ -0,0 +1,203 @@
+import { createRequire as __adfCreateRequire } from 'node:module';
+import { fileURLToPath as __adfFileURLToPath } from 'node:url';
+import { dirname as __adfDirname } from 'node:path';
+const require = __adfCreateRequire(import.meta.url);
+const __filename = __adfFileURLToPath(import.meta.url);
+const __dirname = __adfDirname(__filename);
+import {
+  getUserDataPath
+} from "./chunk-PAK5JCO2.mjs";
+import {
+  protectSecretFile
+} from "./chunk-LTX74NU6.mjs";
+import {
+  __require
+} from "./chunk-M2RX3S2T.mjs";
+
+// src/main/providers/subscription-token-store.ts
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, unlinkSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readdirSync } from "fs";
+import { join as join2 } from "path";
+
+// src/main/utils/credential-cipher.ts
+import { randomBytes, createCipheriv, createDecipheriv } from "crypto";
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
+import { join } from "path";
+var AES_GCM_PREFIX = "aesgcm:", SAFE_STORAGE_PREFIX = "safe:", KEY_FILE_NAME = "credential.key", KEY_BYTES = 32, IV_BYTES = 12, TAG_BYTES = 16, cachedKey = null, cachedKeyPath = null;
+function getSafeStorage() {
+  try {
+    return __require("electron").safeStorage ?? null;
+  } catch {
+    return null;
+  }
+}
+function credentialKeyPath() {
+  let dir = getUserDataPath();
+  return existsSync(dir) || mkdirSync(dir, { recursive: !0 }), join(dir, KEY_FILE_NAME);
+}
+function readKeyFile(path) {
+  try {
+    let key = Buffer.from(readFileSync(path, "utf-8").trim(), "base64");
+    return key.length === KEY_BYTES ? key : null;
+  } catch {
+    return null;
+  }
+}
+function getCredentialKey() {
+  let path = credentialKeyPath();
+  if (cachedKey && cachedKeyPath === path) return cachedKey;
+  let key = existsSync(path) ? readKeyFile(path) : null;
+  if (key && protectSecretFile(path), !key && existsSync(path) && console.warn(`[Credentials] Key file at ${path} is unreadable \u2014 regenerating. Stored credentials will need re-authentication.`), !key) {
+    let generated = randomBytes(KEY_BYTES);
+    try {
+      writeFileSync(path, generated.toString("base64"), { mode: 384, flag: "wx" }), protectSecretFile(path), key = generated;
+    } catch (err) {
+      if (err.code === "EEXIST")
+        key = readKeyFile(path), key || (writeFileSync(path, generated.toString("base64"), { mode: 384 }), protectSecretFile(path), key = generated);
+      else
+        throw err;
+    }
+  }
+  return cachedKey = key, cachedKeyPath = path, key;
+}
+function encryptCredential(value) {
+  let iv = randomBytes(IV_BYTES), cipher = createCipheriv("aes-256-gcm", getCredentialKey(), iv), ciphertext = Buffer.concat([cipher.update(value, "utf-8"), cipher.final()]), tag = cipher.getAuthTag();
+  return `${AES_GCM_PREFIX}${iv.toString("base64")}.${tag.toString("base64")}.${ciphertext.toString("base64")}`;
+}
+function decryptAesGcm(raw, logPrefix) {
+  let parts = raw.slice(AES_GCM_PREFIX.length).split(".");
+  if (parts.length !== 3)
+    return console.warn(`${logPrefix} Malformed encrypted credential payload`), null;
+  try {
+    let iv = Buffer.from(parts[0], "base64"), tag = Buffer.from(parts[1], "base64");
+    if (iv.length !== IV_BYTES || tag.length !== TAG_BYTES)
+      return console.warn(`${logPrefix} Malformed encrypted credential payload`), null;
+    let decipher = createDecipheriv("aes-256-gcm", getCredentialKey(), iv);
+    return decipher.setAuthTag(tag), Buffer.concat([
+      decipher.update(Buffer.from(parts[2], "base64")),
+      decipher.final()
+    ]).toString("utf-8");
+  } catch {
+    return console.warn(`${logPrefix} Could not decrypt credential \u2014 the key file may have been regenerated. Sign in again.`), null;
+  }
+}
+function decryptCredential(raw, logPrefix = "[Credentials]") {
+  if (raw.startsWith(AES_GCM_PREFIX))
+    return decryptAesGcm(raw, logPrefix);
+  if (raw.startsWith(SAFE_STORAGE_PREFIX)) {
+    let safeStorage = getSafeStorage();
+    if (!safeStorage?.isEncryptionAvailable())
+      return console.warn(`${logPrefix} Credential is safeStorage-encrypted and this process has no Electron keychain access. Start ADF Studio once to migrate it, or sign in here.`), null;
+    try {
+      return safeStorage.decryptString(Buffer.from(raw.slice(SAFE_STORAGE_PREFIX.length), "base64"));
+    } catch (err) {
+      return console.warn(`${logPrefix} Failed to decrypt safeStorage credential:`, err), null;
+    }
+  }
+  return raw;
+}
+
+// src/main/providers/subscription-token-store.ts
+var STUDIO_FILE = "auth.json", DAEMON_FILE = "auth.daemon.json", REPLACED_FILE_PATTERN = /^auth\.replaced(\.[\w-]+)?\.json$/;
+function getSafeStorage2() {
+  try {
+    return __require("electron").safeStorage ?? null;
+  } catch {
+    return null;
+  }
+}
+function isElectronSurface() {
+  return getSafeStorage2() !== null;
+}
+function createSubscriptionTokenStore(dirName) {
+  let logTag = `[${dirName} Auth]`;
+  function getDir() {
+    let dir = join2(getUserDataPath(), dirName);
+    return existsSync2(dir) || mkdirSync2(dir, { recursive: !0 }), dir;
+  }
+  function getStorePath() {
+    return join2(getDir(), isElectronSurface() ? STUDIO_FILE : DAEMON_FILE);
+  }
+  function encryptValue(value) {
+    let safeStorage = getSafeStorage2();
+    if (safeStorage?.isEncryptionAvailable()) {
+      let encrypted = safeStorage.encryptString(value);
+      return SAFE_STORAGE_PREFIX + encrypted.toString("base64");
+    }
+    return safeStorage && console.warn(`${logTag} safeStorage unavailable \u2014 falling back to key-file encryption`), encryptCredential(value);
+  }
+  function decryptValue(raw) {
+    return decryptCredential(raw, logTag);
+  }
+  function adoptLegacyFile(ownPath) {
+    let legacyPath = join2(getDir(), STUDIO_FILE);
+    if (existsSync2(legacyPath))
+      try {
+        let raw = readFileSync2(legacyPath, "utf-8");
+        if (raw.startsWith(SAFE_STORAGE_PREFIX)) {
+          console.warn(
+            `${logTag} ${STUDIO_FILE} is encrypted by ADF Studio and cannot be used here \u2014 log in from this surface to create its own session`
+          );
+          return;
+        }
+        writeFileSync2(ownPath, raw, { mode: 384 }), console.log(`${logTag} Adopted legacy shared token file into ${DAEMON_FILE}`);
+      } catch (err) {
+        console.warn(`${logTag} Failed to adopt legacy token file:`, err);
+      }
+  }
+  function readTokens() {
+    let path = getStorePath();
+    if (!existsSync2(path) && !isElectronSurface() && adoptLegacyFile(path), !existsSync2(path)) return null;
+    try {
+      let raw = readFileSync2(path, "utf-8"), decrypted = decryptValue(raw);
+      return decrypted ? JSON.parse(decrypted) : null;
+    } catch (err) {
+      return console.warn(`${logTag} Failed to read tokens:`, err), null;
+    }
+  }
+  function writeTokens(tokens) {
+    let path = getStorePath(), value = encryptValue(JSON.stringify(tokens));
+    if (!value.startsWith(SAFE_STORAGE_PREFIX) && existsSync2(path)) {
+      let existing = null;
+      try {
+        existing = readFileSync2(path, "utf-8");
+      } catch {
+      }
+      if (existing?.startsWith(SAFE_STORAGE_PREFIX))
+        throw new Error(
+          `${logTag} refusing to overwrite a keychain-encrypted session with weaker key-file encryption. Log out (clearing the stored session) and log in again from this surface.`
+        );
+    }
+    writeFileSync2(path, value, { mode: 384 });
+  }
+  function clearTokens() {
+    let path = getStorePath();
+    if (existsSync2(path))
+      try {
+        unlinkSync(path);
+      } catch {
+      }
+  }
+  function signedIn(accountId) {
+    if (!accountId) return;
+    let names;
+    try {
+      names = readdirSync(getDir()).filter((name) => REPLACED_FILE_PATTERN.test(name));
+    } catch (err) {
+      console.warn(`${logTag} Could not list the sessions set aside after the sign-in:`, err instanceof Error ? err.message : err);
+      return;
+    }
+    for (let name of names)
+      try {
+        let path = join2(getDir(), name);
+        if (JSON.parse(decryptValue(readFileSync2(path, "utf-8")) ?? "null")?.account_id !== accountId) continue;
+        unlinkSync(path), console.log(`${logTag} Deleted ${name}: ${accountId} signed in again, so the session set aside for it is no longer needed`);
+      } catch (err) {
+        console.warn(`${logTag} Could not check ${name} after the sign-in:`, err instanceof Error ? err.message : err);
+      }
+  }
+  return { readTokens, writeTokens, clearTokens, signedIn };
+}
+
+export {
+  createSubscriptionTokenStore
+};