@aliyunrds/ctxdb 1.0.6 → 1.0.8-beta.0

package/dist/{chunk-ARZX2RLR.js → chunk-AAZLOCVB.js}

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+import {
+  DISTRIBUTION_MANIFEST
+} from "./chunk-R67JELM7.js";
 
 // src/lib/logger.ts
 import { appendFileSync, mkdirSync } from "fs";
@@ -43,21 +46,27 @@ ${s}`;
 import { readFileSync } from "fs";
 import { dirname as dirname2, join as join2 } from "path";
 import { fileURLToPath } from "url";
-function findPackageVersion() {
+var PACKAGE_NAMES = /* @__PURE__ */ new Set([
+  "@aliyunrds/ctxdb",
+  "@ali/ctxdb-internal"
+]);
+function findPackageIdentity() {
   let dir = dirname2(fileURLToPath(import.meta.url));
   for (let i = 0; i < 5; i++) {
     try {
       const pkg = JSON.parse(readFileSync(join2(dir, "package.json"), "utf-8"));
-      if (pkg.name === "@aliyunrds/ctxdb" && typeof pkg.version === "string") {
-        return pkg.version;
+      if (PACKAGE_NAMES.has(pkg.name) && typeof pkg.version === "string") {
+        return { name: pkg.name, version: pkg.version };
       }
     } catch {
     }
     dir = dirname2(dir);
   }
-  return "0.0.0";
+  return { name: "@aliyunrds/ctxdb", version: "0.0.0" };
 }
-var PACKAGE_VERSION = findPackageVersion();
+var PACKAGE_IDENTITY = findPackageIdentity();
+var PACKAGE_NAME = PACKAGE_IDENTITY.name;
+var PACKAGE_VERSION = PACKAGE_IDENTITY.version;
 
 // src/lib/http-client.ts
 var DEFAULT_TIMEOUT_MS = 3e4;
@@ -143,18 +152,23 @@ var HttpClient = class {
   userAgent;
   extraHeaders;
   fetchImpl;
+  authorizationProvider;
   constructor(opts) {
     this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
-    this.apiKey = opts.apiKey;
+    if (!opts.apiKey && !opts.authorizationProvider) {
+      throw new Error("HttpClient requires apiKey or authorizationProvider");
+    }
+    this.apiKey = opts.apiKey ?? "";
+    this.authorizationProvider = opts.authorizationProvider;
     this.timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     this.userAgent = opts.userAgent ?? `ctxdb-cli/${PACKAGE_VERSION}`;
     this.extraHeaders = { ...opts.extraHeaders ?? {} };
     const f = opts.fetchImpl ?? globalThis.fetch.bind(globalThis);
     this.fetchImpl = f;
   }
-  buildHeaders(contentType, requestHeaders = {}) {
+  async buildHeaders(authorization, contentType, requestHeaders = {}) {
     const h = {
-      Authorization: `Token ${this.apiKey}`,
+      Authorization: `${authorization.scheme} ${authorization.value}`,
       "User-Agent": this.userAgent,
       Connection: "close",
       ...this.extraHeaders,
@@ -164,7 +178,13 @@ var HttpClient = class {
     return h;
   }
   async doRequest(method, path, init = {}) {
-    let url = `${this.baseUrl}${path}`;
+    const authorization = this.authorizationProvider ? await this.authorizationProvider.resolve() : {
+      scheme: "Token",
+      value: this.apiKey,
+      baseUrl: this.baseUrl,
+      expiresAt: null
+    };
+    let url = `${authorization.baseUrl.replace(/\/+$/, "")}${path}`;
     if (init.params) {
       const qs = new URLSearchParams();
       for (const [k, v] of Object.entries(init.params)) {
@@ -187,7 +207,11 @@ var HttpClient = class {
       try {
         resp = await this.fetchImpl(url, {
           method,
-          headers: this.buildHeaders(init.contentType, init.headers),
+          headers: await this.buildHeaders(
+            authorization,
+            init.contentType,
+            init.headers
+          ),
           body: init.body,
           signal: controller.signal
         });
@@ -248,15 +272,42 @@ var HttpClient = class {
       headers: options.headers
     });
   }
-  putJson(path, body) {
+  putJson(path, body, params, options = {}) {
     return this.doRequest("PUT", path, {
       body: JSON.stringify(body),
-      contentType: "application/json"
+      contentType: "application/json",
+      params,
+      timeoutMs: options.timeoutMs,
+      headers: options.headers
+    });
+  }
+  patchJson(path, body, params, options = {}) {
+    return this.doRequest("PATCH", path, {
+      body: JSON.stringify(body),
+      contentType: "application/json",
+      params,
+      timeoutMs: options.timeoutMs,
+      headers: options.headers
     });
   }
   delete(path, params) {
     return this.doRequest("DELETE", path, { params });
   }
+  /**
+   * DELETE with a JSON body. ContextDB batch deletes use the
+   * `DELETE /v1/{resource}/batch` shape with an `{"ids": [...]}` body
+   * (server contract) — the plain `delete()` above only supports query
+   * params.
+   */
+  deleteJson(path, body, params, options = {}) {
+    return this.doRequest("DELETE", path, {
+      body: JSON.stringify(body),
+      contentType: "application/json",
+      params,
+      timeoutMs: options.timeoutMs,
+      headers: options.headers
+    });
+  }
   /**
    * POST multipart/form-data using runtime-native FormData.
    *
@@ -266,14 +317,7 @@ var HttpClient = class {
    * boundary itself.
    */
   postMultipart(path, fields = {}, files = {}, options = {}) {
-    const fd = new FormData();
-    for (const [name, value] of Object.entries(fields)) {
-      fd.append(name, value);
-    }
-    for (const [name, part] of Object.entries(files)) {
-      const blob = part.content instanceof Blob ? part.content : new Blob([part.content], { type: part.mimeType });
-      fd.append(name, blob, part.filename);
-    }
+    const fd = buildMultipartForm(fields, files);
     return this.doRequest("POST", path, {
       body: fd,
       params: options.params,
@@ -281,7 +325,28 @@ var HttpClient = class {
       headers: options.headers
     });
   }
+  /** PUT multipart/form-data with the same runtime-owned boundary as POST. */
+  putMultipart(path, fields = {}, files = {}, options = {}) {
+    const fd = buildMultipartForm(fields, files);
+    return this.doRequest("PUT", path, {
+      body: fd,
+      params: options.params,
+      timeoutMs: options.timeoutMs,
+      headers: options.headers
+    });
+  }
 };
+function buildMultipartForm(fields, files) {
+  const fd = new FormData();
+  for (const [name, value] of Object.entries(fields)) {
+    fd.append(name, value);
+  }
+  for (const [name, part] of Object.entries(files)) {
+    const blob = part.content instanceof Blob ? part.content : new Blob([part.content], { type: part.mimeType });
+    fd.append(name, blob, part.filename);
+  }
+  return fd;
+}
 function maybeJson(text) {
   try {
     return JSON.parse(text);
@@ -326,7 +391,7 @@ function parseErrorResponse(text, fallback) {
 import { homedir as homedir2 } from "os";
 import { delimiter, join as join3, sep } from "path";
 import { accessSync, constants, existsSync, statSync } from "fs";
-var SUPPORTED_AGENTS = ["qoder", "qoderwork", "qwenwork", "codex", "claude", "opencode", "hermes"];
+var SUPPORTED_AGENTS = ["qoder", "qoderwork", "qwenwork", "codex", "claude", "opencode", "hermes", "workbuddy"];
 function isBuiltinAgent(v) {
   return typeof v === "string" && SUPPORTED_AGENTS.includes(v);
 }
@@ -350,6 +415,8 @@ function agentHomeDir(agent, home = homedir2()) {
       return join3(home, ".config", "opencode");
     case "hermes":
       return join3(home, ".hermes");
+    case "workbuddy":
+      return join3(home, ".workbuddy");
   }
 }
 var AGENT_VARIANT_HOMES = {
@@ -501,9 +568,9 @@ function agentFromArgvWithFallback(argv = process.argv.slice(2), env = process.e
 }
 
 // src/lib/config.ts
-import { readFileSync as readFileSync2, existsSync as existsSync3, unlinkSync as unlinkSync2 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join4 } from "path";
+import { readFileSync as readFileSync3, existsSync as existsSync4, unlinkSync as unlinkSync3 } from "fs";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname5, join as join5 } from "path";
 
 // src/lib/secure-file.ts
 import {
@@ -604,16 +671,142 @@ function secureAtomicWrite(target, content, options = {}) {
 import { createHmac, randomBytes as randomBytes2 } from "crypto";
 var PROCESS_FINGERPRINT_KEY = randomBytes2(32);
 
+// src/credentials/local-credential-provider.ts
+import {
+  closeSync as closeSync2,
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync3,
+  openSync as openSync2,
+  readFileSync as readFileSync2,
+  statSync as statSync2,
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname4, join as join4 } from "path";
+import { setTimeout as delay } from "timers/promises";
+
+// src/credentials/types.ts
+var ACTIVE_CONTEXTDB_CREDENTIAL = "contextdb/active";
+
+// src/credentials/local-credential-provider.ts
+var DOCUMENT_VERSION = 1;
+var STALE_LOCK_MS = 10 * 60 * 1e3;
+function defaultCredentialsPath() {
+  return join4(homedir3(), ".ctxdb", "credentials.json");
+}
+function emptyDocument() {
+  return { version: DOCUMENT_VERSION, records: {} };
+}
+function normalizeOrigin(value, field) {
+  if (typeof value !== "string" || !value) {
+    throw new Error(`credentials: ${field} must be a non-empty URL`);
+  }
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error(`credentials: ${field} must be a valid URL`);
+  }
+  if (!["https:", "http:"].includes(url.protocol) || url.username || url.password || url.search || url.hash) {
+    throw new Error(`credentials: ${field} must be an HTTP(S) origin`);
+  }
+  return url.toString().replace(/\/$/, "");
+}
+function parseRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("credentials: record must be an object");
+  }
+  const raw = value;
+  if (raw.kind !== "api-key") {
+    throw new Error(`credentials: unsupported record kind ${String(raw.kind)}`);
+  }
+  const payload = raw.payload;
+  const metadata = raw.metadata;
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    throw new Error("credentials: api-key payload must be an object");
+  }
+  if (!metadata || typeof metadata !== "object" || Array.isArray(metadata)) {
+    throw new Error("credentials: api-key metadata must be an object");
+  }
+  const body = payload;
+  const meta = metadata;
+  if (typeof body.api_key !== "string" || !body.api_key) {
+    throw new Error("credentials: api_key must be a non-empty string");
+  }
+  if (meta.authorization_method !== "browser-loopback" && meta.authorization_method !== "device-code") {
+    throw new Error("credentials: authorization_method is invalid");
+  }
+  if (typeof meta.issued_at !== "string" || !Number.isFinite(Date.parse(meta.issued_at))) {
+    throw new Error("credentials: issued_at is invalid");
+  }
+  return {
+    kind: "api-key",
+    payload: {
+      apiKey: body.api_key,
+      baseUrl: normalizeOrigin(body.base_url, "base_url"),
+      loginServer: normalizeOrigin(body.login_server, "login_server")
+    },
+    metadata: {
+      authorizationMethod: meta.authorization_method,
+      issuedAt: meta.issued_at
+    }
+  };
+}
+function parseDocument(text) {
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch {
+    throw new Error("credentials: credentials.json is not valid JSON");
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error("credentials: document must be an object");
+  }
+  const document = raw;
+  if (document.version !== DOCUMENT_VERSION) {
+    throw new Error(`credentials: unsupported document version ${String(document.version)}`);
+  }
+  if (!document.records || typeof document.records !== "object" || Array.isArray(document.records)) {
+    throw new Error("credentials: records must be an object");
+  }
+  const records = document.records;
+  const unknown = Object.keys(records).filter((key) => key !== ACTIVE_CONTEXTDB_CREDENTIAL);
+  if (unknown.length > 0) {
+    throw new Error(`credentials: unsupported record key ${unknown[0]}`);
+  }
+  const active = records[ACTIVE_CONTEXTDB_CREDENTIAL];
+  return {
+    version: DOCUMENT_VERSION,
+    records: active === void 0 ? {} : { [ACTIVE_CONTEXTDB_CREDENTIAL]: parseRecord(active) }
+  };
+}
+function assertOwnerOnly(path) {
+  if (process.platform === "win32" || !existsSync3(path)) return;
+  const mode = statSync2(path).mode & 511;
+  if ((mode & 63) !== 0) {
+    throw new Error(`credentials: ${path} must be owner-only (run chmod 600)`);
+  }
+}
+function readDocument(path) {
+  if (!existsSync3(path)) return emptyDocument();
+  assertOwnerOnly(path);
+  return parseDocument(readFileSync2(path, "utf8"));
+}
+function readActiveCredentialSync(path = defaultCredentialsPath()) {
+  return readDocument(path).records[ACTIVE_CONTEXTDB_CREDENTIAL];
+}
+
 // src/lib/config.ts
 import {
   resolveDebugPolicy
 } from "@aliyunrds/ctxdb-shared";
 function defaultConfigPath() {
-  return join4(homedir3(), ".ctxdb", "ctxdb.json");
+  return join5(homedir4(), ".ctxdb", "ctxdb.json");
 }
-var DEFAULT_CONFIG_PATH = join4(homedir3(), ".ctxdb", "ctxdb.json");
+var DEFAULT_CONFIG_PATH = join5(homedir4(), ".ctxdb", "ctxdb.json");
 function configDir() {
-  return join4(homedir3(), ".ctxdb");
+  return join5(homedir4(), ".ctxdb");
 }
 var DEFAULT_BASE_URL = "https://context-database.aliyuncs.com";
 var DEFAULT_USER_ID = "default";
@@ -650,9 +843,9 @@ function coerceKbCatalogInjection(v) {
   return DEFAULT_KB_CATALOG_INJECTION;
 }
 function readRaw(path) {
-  if (!existsSync3(path)) return {};
+  if (!existsSync4(path)) return {};
   try {
-    const parsed = JSON.parse(readFileSync2(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync3(path, "utf-8"));
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
       return parsed;
     }
@@ -725,7 +918,15 @@ function load(options = {}) {
       );
     } catch {
     }
-    return applyEnv(configFromDisk({}), env);
+    const cfg2 = configFromDisk({});
+    const managed2 = !DISTRIBUTION_MANIFEST.capabilities.managedCredentials || options.managedCredentials === false ? void 0 : readActiveCredentialSync(
+      options.credentialsPath ?? join5(dirname5(path), "credentials.json")
+    );
+    if (managed2) {
+      cfg2.apiKey = managed2.payload.apiKey;
+      cfg2.baseUrl = managed2.payload.baseUrl;
+    }
+    return applyEnv(cfg2, env);
   }
   const agentRaw = agentRawFromFile(raw, agent);
   if (agent !== "default") {
@@ -738,7 +939,15 @@ function load(options = {}) {
       }
     }
   }
-  return applyEnv(configFromDisk(agentRaw), env);
+  const cfg = configFromDisk(agentRaw);
+  const managed = !DISTRIBUTION_MANIFEST.capabilities.managedCredentials || options.managedCredentials === false ? void 0 : readActiveCredentialSync(
+    options.credentialsPath ?? join5(dirname5(path), "credentials.json")
+  );
+  if (managed) {
+    cfg.apiKey = managed.payload.apiKey;
+    cfg.baseUrl = managed.payload.baseUrl;
+  }
+  return applyEnv(cfg, env);
 }
 function configToDisk(cfg) {
   return {
@@ -760,7 +969,7 @@ function configToDisk(cfg) {
 }
 function removeAgent(agent, path, options = {}) {
   const target = path ?? defaultConfigPath();
-  if (!existsSync3(target)) {
+  if (!existsSync4(target)) {
     return { removed: false, remainingAgents: [], fileDeleted: false };
   }
   const raw = readRaw(target);
@@ -779,7 +988,7 @@ function removeAgent(agent, path, options = {}) {
   const remaining = Object.keys(agents);
   if (remaining.length === 0 && !options.keepEmptyShell) {
     try {
-      unlinkSync2(target);
+      unlinkSync3(target);
       return { removed: true, remainingAgents: [], fileDeleted: true };
     } catch {
     }
@@ -795,12 +1004,14 @@ function save(cfg, path, options = {}) {
   const raw = readRaw(target);
   const validRaw = isV2Schema(raw) ? raw : {};
   const existingAgents = validRaw.agents && typeof validRaw.agents === "object" && !Array.isArray(validRaw.agents) ? { ...validRaw.agents } : {};
+  const serialized = configToDisk(cfg);
+  if (options.omitApiKey) delete serialized.api_key;
   const onDisk = {
     ...validRaw,
     version: 2,
     agents: {
       ...existingAgents,
-      [agent]: configToDisk(cfg)
+      [agent]: serialized
     }
   };
   delete onDisk.default_agent;
@@ -851,6 +1062,7 @@ export {
   setDebug,
   isDebug,
   debug,
+  PACKAGE_NAME,
   PACKAGE_VERSION,
   CtxdbError,
   HttpClient,

package/dist/{chunk-7EIJB5LA.js → chunk-BBTXHFMD.js}

@@ -2,7 +2,7 @@
 import {
   fetchKbCatalogBlock,
   recallTurn
-} from "./chunk-VHNHVMCA.js";
+} from "./chunk-WSMZOFZQ.js";
 
 // src/lib/user-prompt-submit-compose.ts
 async function composeUserPromptSubmit(cfg, agent, client, prompt, sessionId = null) {