@aliyunrds/ctxdb-shared 0.0.8 → 0.0.9-beta.0

package/dist/index.js

@@ -1196,88 +1196,28 @@ import { randomBytes as randomBytes3 } from "crypto";
 // src/credentials/local-credential-provider.ts
 import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
 import { homedir as homedir2 } from "os";
-import { join as join3 } from "path";
+import { join as join2 } from "path";
 
 // src/credentials/storage.ts
 import { constants, closeSync as closeSync2, existsSync as existsSync2, fstatSync, fsyncSync, lstatSync, mkdirSync as mkdirSync2, openSync as openSync2, readFileSync as readFileSync2, renameSync as renameSync2, unlinkSync, writeFileSync } from "fs";
 import { randomBytes, createHash } from "crypto";
 import { dirname as dirname2 } from "path";
 import { setTimeout as delay2 } from "timers/promises";
-
-// src/windows-private-storage.ts
-import { execFileSync } from "child_process";
-import { join as join2 } from "path";
-var SCRIPT = `
-$ErrorActionPreference = 'Stop'
-$path = $env:CTXDB_PRIVATE_STORAGE_PATH
-$sid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
-$item = Get-Item -LiteralPath $path -Force
-if (($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'reparse' }
-if ($env:CTXDB_PRIVATE_STORAGE_INITIALIZE -eq '1') {
-  if (-not $item.PSIsContainer) { throw 'not directory' }
-  $acl = [System.Security.AccessControl.DirectorySecurity]::new()
-  $acl.SetOwner($sid)
-  $acl.SetAccessRuleProtection($true, $false)
-  $rule = [System.Security.AccessControl.FileSystemAccessRule]::new($sid, 'FullControl', 'ContainerInherit,ObjectInherit', 'None', 'Allow')
-  $acl.AddAccessRule($rule)
-  Set-Acl -LiteralPath $path -AclObject $acl
-}
-$acl = Get-Acl -LiteralPath $path
-if ($acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value -ne $sid.Value) { throw 'owner' }
-$self = $false
-foreach ($rule in $acl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])) {
-  if ($rule.AccessControlType -eq 'Allow') {
-    if ($rule.IdentityReference.Value -ne $sid.Value) { throw 'other principal' }
-    if (($rule.FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -eq [System.Security.AccessControl.FileSystemRights]::FullControl) { $self = $true }
-  }
-}
-if (-not $self) { throw 'missing owner access' }
-Write-Output 'private'
-`;
-function checkWindowsPrivateStorage(path, initialize, run = execFileSync) {
-  const systemRoot = process.env.SystemRoot;
-  if (!systemRoot) throw new Error("Private Windows credential storage could not be verified.");
-  try {
-    const result = run(
-      join2(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
-      ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(SCRIPT, "utf16le").toString("base64")],
-      {
-        env: { ...process.env, CTXDB_PRIVATE_STORAGE_PATH: path, CTXDB_PRIVATE_STORAGE_INITIALIZE: initialize ? "1" : "0" },
-        encoding: "utf8",
-        windowsHide: true,
-        timeout: 1e4,
-        maxBuffer: 4096,
-        stdio: ["ignore", "pipe", "pipe"]
-      }
-    );
-    if (String(result).trim() !== "private") throw new Error();
-  } catch {
-    throw new Error("Private Windows credential storage could not be verified.");
-  }
-}
-
-// src/credentials/storage.ts
-function privatePath(path, directory = false) {
+function assertStoragePath(path, directory = false) {
   const s = lstatSync(path);
-  if (s.isSymbolicLink() || (directory ? !s.isDirectory() : !s.isFile())) throw new Error("credentials: storage is not private or is invalid");
-  if (process.platform === "win32") {
-    checkWindowsPrivateStorage(path, false);
-    return;
-  }
-  if (s.mode & 63 || process.getuid && s.uid !== process.getuid()) throw new Error("credentials: storage must be private and owner-only (run chmod 600 on credentials.json)");
+  if (s.isSymbolicLink() || (directory ? !s.isDirectory() : !s.isFile())) throw new Error("credentials: invalid storage path");
 }
 function prepareStorage(path) {
   const dir = dirname2(path);
   if (!existsSync2(dir)) {
     mkdirSync2(dir, { recursive: true, mode: 448 });
-    if (process.platform === "win32") checkWindowsPrivateStorage(dir, true);
   }
-  privatePath(dir, true);
+  assertStoragePath(dir, true);
 }
-function readPrivate(path) {
+function readCredentialFile(path) {
   if (!existsSync2(path)) return void 0;
-  privatePath(dirname2(path), true);
-  privatePath(path);
+  assertStoragePath(dirname2(path), true);
+  assertStoragePath(path);
   const fd = openSync2(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
   try {
     const stat = fstatSync(fd);
@@ -1289,7 +1229,7 @@ function readPrivate(path) {
 }
 function atomicCredentialWrite(path, value) {
   prepareStorage(path);
-  if (existsSync2(path)) privatePath(path);
+  if (existsSync2(path)) assertStoragePath(path);
   const temp = path + "." + randomBytes(12).toString("hex") + ".tmp";
   let fd;
   try {
@@ -1371,7 +1311,7 @@ var ACTIVE_CONTEXTDB_CREDENTIAL = "contextdb/active";
 
 // src/credentials/local-credential-provider.ts
 function defaultCredentialsPath() {
-  return join3(homedir2(), ".ctxdb", "credentials.json");
+  return join2(homedir2(), ".ctxdb", "credentials.json");
 }
 var object2 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var fail = (message) => {
@@ -1407,7 +1347,7 @@ function validate(key, raw) {
   if (raw.kind === "api-key") validateApi(raw, key === ACTIVE_CONTEXTDB_CREDENTIAL);
 }
 function readDocument(path) {
-  const bytes = readPrivate(path);
+  const bytes = readCredentialFile(path);
   if (bytes === void 0) return { version: 2, records: {} };
   let doc;
   try {
@@ -1592,7 +1532,7 @@ var OAuthCredentialError = class extends Error {
       login_required: "OAuth session needs login; run ctxdb login for this profile.",
       credential_busy: "OAuth credential is busy. If its previous process crashed, run ctxdb login for a new credential.",
       invalid_profile: "OAuth credential does not belong to this profile.",
-      unsafe_storage: "OAuth credential storage is not private or is invalid."
+      unsafe_storage: "OAuth credential storage is inaccessible or invalid."
     };
     super(messages[code]);
     this.name = "OAuthCredentialError";
@@ -1841,7 +1781,7 @@ function authorization(session) {
 }
 
 // src/oauth-profile.ts
-import { dirname as dirname4, join as join4, resolve } from "path";
+import { dirname as dirname4, join as join3, resolve } from "path";
 
 // src/auth-config.ts
 import { closeSync as closeSync3, existsSync as existsSync3, fsyncSync as fsyncSync2, mkdirSync as mkdirSync3, openSync as openSync3, readFileSync as readFileSync3, renameSync as renameSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "fs";
@@ -1993,7 +1933,7 @@ function oauthProfile(reference, configPath, profile, baseUrl) {
     reference,
     profile,
     configPath: path,
-    credentialsPath: join4(dirname4(path), "credentials.json"),
+    credentialsPath: join3(dirname4(path), "credentials.json"),
     baseUrl: normalizeCoreOrigin(baseUrl)
   };
 }
@@ -2060,10 +2000,10 @@ var OAuthProfileProvider = class {
 
 // src/login-bindings.ts
 import { randomBytes as randomBytes5 } from "crypto";
-import { dirname as dirname6, join as join6 } from "path";
+import { dirname as dirname6, join as join5 } from "path";
 
 // src/data-auth.ts
-import { dirname as dirname5, join as join5 } from "path";
+import { dirname as dirname5, join as join4 } from "path";
 function selectDataApiCredential(cfg, env = process.env) {
   const accessToken = env.CTXDB_ACCESS_TOKEN?.trim();
   if (accessToken) return { type: "access-token", value: accessToken };
@@ -2081,7 +2021,7 @@ var DataApiAuthorizationProvider = class {
     const c = this.context, raw = readAuthConfig(c.configPath), section = ownAuthProfile(raw, c.agent);
     const fallback = c.inheritDefaultKey && c.agent !== "default" ? ownAuthProfile(raw, "default") : {};
     if (c.managedCredentials) {
-      const active = readActiveCredentialSync(c.credentialsPath ?? join5(dirname5(c.configPath), "credentials.json"));
+      const active = readActiveCredentialSync(c.credentialsPath ?? join4(dirname5(c.configPath), "credentials.json"));
       if (active) {
         const baseUrl2 = c.baseUrlOverride ?? active.metadata.baseUrl;
         if (baseUrl2 !== c.baseUrl) throw new OAuthCredentialError("login_required");
@@ -2107,7 +2047,7 @@ function publicAuthenticationFromConfig(raw, path, agent, baseUrlOverride) {
     const oauthCredential = oauthProfileFromConfig(raw, path, agent, baseUrlOverride);
     return oauthCredential ? { baseUrl: oauthCredential.baseUrl, oauthCredential } : void 0;
   }
-  const r = new LocalCredentialProvider(join5(dirname5(path), "credentials.json")).readStoredRecord(section.credential_ref);
+  const r = new LocalCredentialProvider(join4(dirname5(path), "credentials.json")).readStoredRecord(section.credential_ref);
   if (!r || r.kind !== "api-key" || r.metadata.state !== "ready" || r.metadata.owner.distribution !== "public" || r.metadata.owner.agent !== agent || r.metadata.owner.loginId) {
     throw new AuthConfigError("credential_ref is missing, invalid or belongs to another Agent. Use setup --api-key/--login to choose a valid credential.");
   }
@@ -2287,7 +2227,7 @@ async function selectSetupAuthentication(path, agent, options, env = process.env
   }
 }
 function saveSetupKey(path, agent, raw, apiKey, baseUrl) {
-  const provider = new LocalCredentialProvider(join6(dirname6(path), "credentials.json"));
+  const provider = new LocalCredentialProvider(join5(dirname6(path), "credentials.json"));
   const previousRef = ownAuthProfile(raw, agent).credential_ref;
   const previous = typeof previousRef === "string" && /^[a-f0-9]{32}$/.test(previousRef) ? provider.snapshot(previousRef) : void 0;
   const expected = authSnapshot(raw, agent), ref = randomBytes5(16).toString("hex");
@@ -2339,7 +2279,7 @@ async function resetSetupBaseUrl(path, agent, env) {
   if (baseUrl === DEFAULT_DATA_BASE_URL) return;
   rejectAuthEnvironment(env);
   if (stored?.apiKey) {
-    const expected = authSnapshot(raw, agent), provider = new LocalCredentialProvider(join6(dirname6(path), "credentials.json"));
+    const expected = authSnapshot(raw, agent), provider = new LocalCredentialProvider(join5(dirname6(path), "credentials.json"));
     provider.transaction((tx) => withAuthConfigLock(path, () => {
       const current = readAuthConfig(path);
       assertAuthSnapshot(current, agent, expected);
@@ -2368,7 +2308,7 @@ function keyCandidate(agent, apiKey, baseUrl) {
   return { kind: "api-key", payload: { api_key: apiKey }, metadata: { base_url: baseUrl, owner: { distribution: "public", agent }, state: "ready", authorization_method: "api-key" } };
 }
 function updateAuthentication(path, task) {
-  return new LocalCredentialProvider(join6(dirname6(path), "credentials.json")).transaction((tx) => {
+  return new LocalCredentialProvider(join5(dirname6(path), "credentials.json")).transaction((tx) => {
     const created = [];
     try {
       return updateAuthConfig(path, (raw) => {
@@ -2566,9 +2506,9 @@ var AuthorizationService = class {
 };
 
 // src/authorization/public-target.ts
-import { dirname as dirname7, join as join7 } from "path";
+import { dirname as dirname7, join as join6 } from "path";
 function publicAuthorizationTarget(pending, revoke) {
-  const path = join7(dirname7(pending.path), "credentials.json"), store = new OAuthSessionStore(path), provider = new LocalCredentialProvider(path);
+  const path = join6(dirname7(pending.path), "credentials.json"), store = new OAuthSessionStore(path), provider = new LocalCredentialProvider(path);
   let reference, published = false;
   return {
     commit(candidate) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aliyunrds/ctxdb-shared",
-  "version": "0.0.8",
+  "version": "0.0.9-beta.0",
   "type": "module",
   "description": "Shared B-rule modules + memory/KB types for RDS ContextDatabase access layers (OpenClaw fork + Qoder hooks).",
   "license": "Apache-2.0",