@aliyunrds/ctxdb 1.0.7 → 1.0.8-beta.0

package/dist/{chunk-S5W4FQ7M.js → chunk-AAZLOCVB.js}

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+import {
+  DISTRIBUTION_MANIFEST
+} from "./chunk-R67JELM7.js";
 
 // src/lib/logger.ts
 import { appendFileSync, mkdirSync } from "fs";
@@ -43,21 +46,27 @@ ${s}`;
 import { readFileSync } from "fs";
 import { dirname as dirname2, join as join2 } from "path";
 import { fileURLToPath } from "url";
-function findPackageVersion() {
+var PACKAGE_NAMES = /* @__PURE__ */ new Set([
+  "@aliyunrds/ctxdb",
+  "@ali/ctxdb-internal"
+]);
+function findPackageIdentity() {
   let dir = dirname2(fileURLToPath(import.meta.url));
   for (let i = 0; i < 5; i++) {
     try {
       const pkg = JSON.parse(readFileSync(join2(dir, "package.json"), "utf-8"));
-      if (pkg.name === "@aliyunrds/ctxdb" && typeof pkg.version === "string") {
-        return pkg.version;
+      if (PACKAGE_NAMES.has(pkg.name) && typeof pkg.version === "string") {
+        return { name: pkg.name, version: pkg.version };
       }
     } catch {
     }
     dir = dirname2(dir);
   }
-  return "0.0.0";
+  return { name: "@aliyunrds/ctxdb", version: "0.0.0" };
 }
-var PACKAGE_VERSION = findPackageVersion();
+var PACKAGE_IDENTITY = findPackageIdentity();
+var PACKAGE_NAME = PACKAGE_IDENTITY.name;
+var PACKAGE_VERSION = PACKAGE_IDENTITY.version;
 
 // src/lib/http-client.ts
 var DEFAULT_TIMEOUT_MS = 3e4;
@@ -143,18 +152,23 @@ var HttpClient = class {
   userAgent;
   extraHeaders;
   fetchImpl;
+  authorizationProvider;
   constructor(opts) {
     this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
-    this.apiKey = opts.apiKey;
+    if (!opts.apiKey && !opts.authorizationProvider) {
+      throw new Error("HttpClient requires apiKey or authorizationProvider");
+    }
+    this.apiKey = opts.apiKey ?? "";
+    this.authorizationProvider = opts.authorizationProvider;
     this.timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     this.userAgent = opts.userAgent ?? `ctxdb-cli/${PACKAGE_VERSION}`;
     this.extraHeaders = { ...opts.extraHeaders ?? {} };
     const f = opts.fetchImpl ?? globalThis.fetch.bind(globalThis);
     this.fetchImpl = f;
   }
-  buildHeaders(contentType, requestHeaders = {}) {
+  async buildHeaders(authorization, contentType, requestHeaders = {}) {
     const h = {
-      Authorization: `Token ${this.apiKey}`,
+      Authorization: `${authorization.scheme} ${authorization.value}`,
       "User-Agent": this.userAgent,
       Connection: "close",
       ...this.extraHeaders,
@@ -164,7 +178,13 @@ var HttpClient = class {
     return h;
   }
   async doRequest(method, path, init = {}) {
-    let url = `${this.baseUrl}${path}`;
+    const authorization = this.authorizationProvider ? await this.authorizationProvider.resolve() : {
+      scheme: "Token",
+      value: this.apiKey,
+      baseUrl: this.baseUrl,
+      expiresAt: null
+    };
+    let url = `${authorization.baseUrl.replace(/\/+$/, "")}${path}`;
     if (init.params) {
       const qs = new URLSearchParams();
       for (const [k, v] of Object.entries(init.params)) {
@@ -187,7 +207,11 @@ var HttpClient = class {
       try {
         resp = await this.fetchImpl(url, {
           method,
-          headers: this.buildHeaders(init.contentType, init.headers),
+          headers: await this.buildHeaders(
+            authorization,
+            init.contentType,
+            init.headers
+          ),
           body: init.body,
           signal: controller.signal
         });
@@ -257,9 +281,33 @@ var HttpClient = class {
       headers: options.headers
     });
   }
+  patchJson(path, body, params, options = {}) {
+    return this.doRequest("PATCH", path, {
+      body: JSON.stringify(body),
+      contentType: "application/json",
+      params,
+      timeoutMs: options.timeoutMs,
+      headers: options.headers
+    });
+  }
   delete(path, params) {
     return this.doRequest("DELETE", path, { params });
   }
+  /**
+   * DELETE with a JSON body. ContextDB batch deletes use the
+   * `DELETE /v1/{resource}/batch` shape with an `{"ids": [...]}` body
+   * (server contract) — the plain `delete()` above only supports query
+   * params.
+   */
+  deleteJson(path, body, params, options = {}) {
+    return this.doRequest("DELETE", path, {
+      body: JSON.stringify(body),
+      contentType: "application/json",
+      params,
+      timeoutMs: options.timeoutMs,
+      headers: options.headers
+    });
+  }
   /**
    * POST multipart/form-data using runtime-native FormData.
    *
@@ -343,7 +391,7 @@ function parseErrorResponse(text, fallback) {
 import { homedir as homedir2 } from "os";
 import { delimiter, join as join3, sep } from "path";
 import { accessSync, constants, existsSync, statSync } from "fs";
-var SUPPORTED_AGENTS = ["qoder", "qoderwork", "qwenwork", "codex", "claude", "opencode", "hermes"];
+var SUPPORTED_AGENTS = ["qoder", "qoderwork", "qwenwork", "codex", "claude", "opencode", "hermes", "workbuddy"];
 function isBuiltinAgent(v) {
   return typeof v === "string" && SUPPORTED_AGENTS.includes(v);
 }
@@ -367,6 +415,8 @@ function agentHomeDir(agent, home = homedir2()) {
       return join3(home, ".config", "opencode");
     case "hermes":
       return join3(home, ".hermes");
+    case "workbuddy":
+      return join3(home, ".workbuddy");
   }
 }
 var AGENT_VARIANT_HOMES = {
@@ -518,9 +568,9 @@ function agentFromArgvWithFallback(argv = process.argv.slice(2), env = process.e
 }
 
 // src/lib/config.ts
-import { readFileSync as readFileSync2, existsSync as existsSync3, unlinkSync as unlinkSync2 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join4 } from "path";
+import { readFileSync as readFileSync3, existsSync as existsSync4, unlinkSync as unlinkSync3 } from "fs";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname5, join as join5 } from "path";
 
 // src/lib/secure-file.ts
 import {
@@ -621,16 +671,142 @@ function secureAtomicWrite(target, content, options = {}) {
 import { createHmac, randomBytes as randomBytes2 } from "crypto";
 var PROCESS_FINGERPRINT_KEY = randomBytes2(32);
 
+// src/credentials/local-credential-provider.ts
+import {
+  closeSync as closeSync2,
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync3,
+  openSync as openSync2,
+  readFileSync as readFileSync2,
+  statSync as statSync2,
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname4, join as join4 } from "path";
+import { setTimeout as delay } from "timers/promises";
+
+// src/credentials/types.ts
+var ACTIVE_CONTEXTDB_CREDENTIAL = "contextdb/active";
+
+// src/credentials/local-credential-provider.ts
+var DOCUMENT_VERSION = 1;
+var STALE_LOCK_MS = 10 * 60 * 1e3;
+function defaultCredentialsPath() {
+  return join4(homedir3(), ".ctxdb", "credentials.json");
+}
+function emptyDocument() {
+  return { version: DOCUMENT_VERSION, records: {} };
+}
+function normalizeOrigin(value, field) {
+  if (typeof value !== "string" || !value) {
+    throw new Error(`credentials: ${field} must be a non-empty URL`);
+  }
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error(`credentials: ${field} must be a valid URL`);
+  }
+  if (!["https:", "http:"].includes(url.protocol) || url.username || url.password || url.search || url.hash) {
+    throw new Error(`credentials: ${field} must be an HTTP(S) origin`);
+  }
+  return url.toString().replace(/\/$/, "");
+}
+function parseRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("credentials: record must be an object");
+  }
+  const raw = value;
+  if (raw.kind !== "api-key") {
+    throw new Error(`credentials: unsupported record kind ${String(raw.kind)}`);
+  }
+  const payload = raw.payload;
+  const metadata = raw.metadata;
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    throw new Error("credentials: api-key payload must be an object");
+  }
+  if (!metadata || typeof metadata !== "object" || Array.isArray(metadata)) {
+    throw new Error("credentials: api-key metadata must be an object");
+  }
+  const body = payload;
+  const meta = metadata;
+  if (typeof body.api_key !== "string" || !body.api_key) {
+    throw new Error("credentials: api_key must be a non-empty string");
+  }
+  if (meta.authorization_method !== "browser-loopback" && meta.authorization_method !== "device-code") {
+    throw new Error("credentials: authorization_method is invalid");
+  }
+  if (typeof meta.issued_at !== "string" || !Number.isFinite(Date.parse(meta.issued_at))) {
+    throw new Error("credentials: issued_at is invalid");
+  }
+  return {
+    kind: "api-key",
+    payload: {
+      apiKey: body.api_key,
+      baseUrl: normalizeOrigin(body.base_url, "base_url"),
+      loginServer: normalizeOrigin(body.login_server, "login_server")
+    },
+    metadata: {
+      authorizationMethod: meta.authorization_method,
+      issuedAt: meta.issued_at
+    }
+  };
+}
+function parseDocument(text) {
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch {
+    throw new Error("credentials: credentials.json is not valid JSON");
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error("credentials: document must be an object");
+  }
+  const document = raw;
+  if (document.version !== DOCUMENT_VERSION) {
+    throw new Error(`credentials: unsupported document version ${String(document.version)}`);
+  }
+  if (!document.records || typeof document.records !== "object" || Array.isArray(document.records)) {
+    throw new Error("credentials: records must be an object");
+  }
+  const records = document.records;
+  const unknown = Object.keys(records).filter((key) => key !== ACTIVE_CONTEXTDB_CREDENTIAL);
+  if (unknown.length > 0) {
+    throw new Error(`credentials: unsupported record key ${unknown[0]}`);
+  }
+  const active = records[ACTIVE_CONTEXTDB_CREDENTIAL];
+  return {
+    version: DOCUMENT_VERSION,
+    records: active === void 0 ? {} : { [ACTIVE_CONTEXTDB_CREDENTIAL]: parseRecord(active) }
+  };
+}
+function assertOwnerOnly(path) {
+  if (process.platform === "win32" || !existsSync3(path)) return;
+  const mode = statSync2(path).mode & 511;
+  if ((mode & 63) !== 0) {
+    throw new Error(`credentials: ${path} must be owner-only (run chmod 600)`);
+  }
+}
+function readDocument(path) {
+  if (!existsSync3(path)) return emptyDocument();
+  assertOwnerOnly(path);
+  return parseDocument(readFileSync2(path, "utf8"));
+}
+function readActiveCredentialSync(path = defaultCredentialsPath()) {
+  return readDocument(path).records[ACTIVE_CONTEXTDB_CREDENTIAL];
+}
+
 // src/lib/config.ts
 import {
   resolveDebugPolicy
 } from "@aliyunrds/ctxdb-shared";
 function defaultConfigPath() {
-  return join4(homedir3(), ".ctxdb", "ctxdb.json");
+  return join5(homedir4(), ".ctxdb", "ctxdb.json");
 }
-var DEFAULT_CONFIG_PATH = join4(homedir3(), ".ctxdb", "ctxdb.json");
+var DEFAULT_CONFIG_PATH = join5(homedir4(), ".ctxdb", "ctxdb.json");
 function configDir() {
-  return join4(homedir3(), ".ctxdb");
+  return join5(homedir4(), ".ctxdb");
 }
 var DEFAULT_BASE_URL = "https://context-database.aliyuncs.com";
 var DEFAULT_USER_ID = "default";
@@ -667,9 +843,9 @@ function coerceKbCatalogInjection(v) {
   return DEFAULT_KB_CATALOG_INJECTION;
 }
 function readRaw(path) {
-  if (!existsSync3(path)) return {};
+  if (!existsSync4(path)) return {};
   try {
-    const parsed = JSON.parse(readFileSync2(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync3(path, "utf-8"));
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
       return parsed;
     }
@@ -742,7 +918,15 @@ function load(options = {}) {
       );
     } catch {
     }
-    return applyEnv(configFromDisk({}), env);
+    const cfg2 = configFromDisk({});
+    const managed2 = !DISTRIBUTION_MANIFEST.capabilities.managedCredentials || options.managedCredentials === false ? void 0 : readActiveCredentialSync(
+      options.credentialsPath ?? join5(dirname5(path), "credentials.json")
+    );
+    if (managed2) {
+      cfg2.apiKey = managed2.payload.apiKey;
+      cfg2.baseUrl = managed2.payload.baseUrl;
+    }
+    return applyEnv(cfg2, env);
   }
   const agentRaw = agentRawFromFile(raw, agent);
   if (agent !== "default") {
@@ -755,7 +939,15 @@ function load(options = {}) {
       }
     }
   }
-  return applyEnv(configFromDisk(agentRaw), env);
+  const cfg = configFromDisk(agentRaw);
+  const managed = !DISTRIBUTION_MANIFEST.capabilities.managedCredentials || options.managedCredentials === false ? void 0 : readActiveCredentialSync(
+    options.credentialsPath ?? join5(dirname5(path), "credentials.json")
+  );
+  if (managed) {
+    cfg.apiKey = managed.payload.apiKey;
+    cfg.baseUrl = managed.payload.baseUrl;
+  }
+  return applyEnv(cfg, env);
 }
 function configToDisk(cfg) {
   return {
@@ -777,7 +969,7 @@ function configToDisk(cfg) {
 }
 function removeAgent(agent, path, options = {}) {
   const target = path ?? defaultConfigPath();
-  if (!existsSync3(target)) {
+  if (!existsSync4(target)) {
     return { removed: false, remainingAgents: [], fileDeleted: false };
   }
   const raw = readRaw(target);
@@ -796,7 +988,7 @@ function removeAgent(agent, path, options = {}) {
   const remaining = Object.keys(agents);
   if (remaining.length === 0 && !options.keepEmptyShell) {
     try {
-      unlinkSync2(target);
+      unlinkSync3(target);
       return { removed: true, remainingAgents: [], fileDeleted: true };
     } catch {
     }
@@ -812,12 +1004,14 @@ function save(cfg, path, options = {}) {
   const raw = readRaw(target);
   const validRaw = isV2Schema(raw) ? raw : {};
   const existingAgents = validRaw.agents && typeof validRaw.agents === "object" && !Array.isArray(validRaw.agents) ? { ...validRaw.agents } : {};
+  const serialized = configToDisk(cfg);
+  if (options.omitApiKey) delete serialized.api_key;
   const onDisk = {
     ...validRaw,
     version: 2,
     agents: {
       ...existingAgents,
-      [agent]: configToDisk(cfg)
+      [agent]: serialized
     }
   };
   delete onDisk.default_agent;
@@ -868,6 +1062,7 @@ export {
   setDebug,
   isDebug,
   debug,
+  PACKAGE_NAME,
   PACKAGE_VERSION,
   CtxdbError,
   HttpClient,

package/dist/{chunk-R2QS6ACP.js → chunk-BBTXHFMD.js}

@@ -2,7 +2,7 @@
 import {
   fetchKbCatalogBlock,
   recallTurn
-} from "./chunk-DPLMBHLU.js";
+} from "./chunk-WSMZOFZQ.js";
 
 // src/lib/user-prompt-submit-compose.ts
 async function composeUserPromptSubmit(cfg, agent, client, prompt, sessionId = null) {

package/dist/{chunk-QVXDI77N.js → chunk-CAXRYH6E.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   CtxdbError
-} from "./chunk-S5W4FQ7M.js";
+} from "./chunk-AAZLOCVB.js";
 
 // src/lib/kb.ts
 import {

package/dist/{chunk-DC5NWGDW.js → chunk-HF2CWTRU.js}

@@ -4,12 +4,12 @@ import {
   isConnectionError,
   resetCircuit,
   tripCircuit
-} from "./chunk-X2BX6LR6.js";
+} from "./chunk-NJJBT52C.js";
 import {
   CtxdbError,
   debug,
   isDebug
-} from "./chunk-S5W4FQ7M.js";
+} from "./chunk-AAZLOCVB.js";
 
 // src/lib/capture-orchestrator.ts
 import {

package/dist/{chunk-X2BX6LR6.js → chunk-NJJBT52C.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   configDir
-} from "./chunk-S5W4FQ7M.js";
+} from "./chunk-AAZLOCVB.js";
 
 // src/lib/circuit.ts
 import { statSync, writeFileSync, unlinkSync, mkdirSync, readdirSync, readFileSync } from "fs";

package/dist/chunk-R67JELM7.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+import {
+  define_CTXDB_DISTRIBUTION_MANIFEST_default
+} from "./chunk-VIG4SYLU.js";
+
+// src/lib/distribution-capabilities.ts
+var PUBLIC_DISTRIBUTION = {
+  id: "public",
+  packageName: "@aliyunrds/ctxdb",
+  packageRegistry: null,
+  capabilities: {
+    interactiveLogin: false,
+    managedCredentials: false
+  }
+};
+var DISTRIBUTION_MANIFEST = typeof define_CTXDB_DISTRIBUTION_MANIFEST_default === "undefined" ? PUBLIC_DISTRIBUTION : define_CTXDB_DISTRIBUTION_MANIFEST_default;
+
+export {
+  DISTRIBUTION_MANIFEST
+};

package/dist/{chunk-Z6OHSEF2.js → chunk-ULAWTBBC.js}

@@ -1,11 +1,13 @@
 #!/usr/bin/env node
+import {
+  DISTRIBUTION_MANIFEST
+} from "./chunk-R67JELM7.js";
 
 // src/lib/self-update.ts
 import { spawnSync } from "child_process";
 import { fileURLToPath } from "url";
 import { dirname } from "path";
 import semver from "semver";
-var PACKAGE_NAME = "@aliyunrds/ctxdb";
 var NPM_VIEW_TIMEOUT_MS = 1e4;
 function npmCommand(platform = process.platform) {
   return platform === "win32" ? "npm.cmd" : "npm";
@@ -17,6 +19,9 @@ function detectInstallMethod() {
   const dir = dirname(fileURLToPath(import.meta.url));
   return dir.includes("/node_modules/") || dir.includes("\\node_modules\\") ? "npm" : "unknown";
 }
+function registryArgs(registry) {
+  return registry ? ["--registry", registry] : [];
+}
 function checkLatestVersion(currentVersion, options = {}) {
   const current = semver.valid(currentVersion);
   if (!current) {
@@ -29,12 +34,18 @@ function checkLatestVersion(currentVersion, options = {}) {
   }
   const platform = options.platform ?? process.platform;
   const run = options.spawnSyncFn ?? spawnSync;
-  const result = run(npmCommand(platform), ["view", PACKAGE_NAME, "version"], {
-    encoding: "utf-8",
-    timeout: options.timeoutMs ?? NPM_VIEW_TIMEOUT_MS,
-    stdio: ["ignore", "pipe", "pipe"],
-    shell: platform === "win32"
-  });
+  const packageName = options.packageName ?? DISTRIBUTION_MANIFEST.packageName;
+  const registry = options.registry === void 0 ? DISTRIBUTION_MANIFEST.packageRegistry : options.registry;
+  const result = run(
+    npmCommand(platform),
+    ["view", packageName, "version", ...registryArgs(registry)],
+    {
+      encoding: "utf-8",
+      timeout: options.timeoutMs ?? NPM_VIEW_TIMEOUT_MS,
+      stdio: ["ignore", "pipe", "pipe"],
+      shell: platform === "win32"
+    }
+  );
   if (result.status !== 0 || !result.stdout?.trim()) {
     return {
       latest: null,
@@ -82,7 +93,9 @@ function runSelfUpdate(currentVersion, passthroughArgs = [], options = {}) {
       error: "ctxdb was not installed via npm. Update manually with your package manager."
     };
   }
-  const check = checkLatestVersion(currentVersion);
+  const packageName = options.packageName ?? DISTRIBUTION_MANIFEST.packageName;
+  const registry = options.registry === void 0 ? DISTRIBUTION_MANIFEST.packageRegistry : options.registry;
+  const check = checkLatestVersion(currentVersion, { packageName, registry });
   if (check.error) {
     return {
       ok: false,
@@ -98,13 +111,17 @@ function runSelfUpdate(currentVersion, passthroughArgs = [], options = {}) {
     );
     return { ok: true, updated: false, fromVersion: currentVersion };
   }
-  process.stderr.write(`ctxdb: updating ${PACKAGE_NAME} v${currentVersion} \u2192 v${check.latest}...
+  process.stderr.write(`ctxdb: updating ${packageName} v${currentVersion} \u2192 v${check.latest}...
 `);
-  const install = spawnSync(npmCommand(), ["install", "-g", `${PACKAGE_NAME}@${check.latest}`], {
-    stdio: "inherit",
-    encoding: "utf-8",
-    shell: process.platform === "win32"
-  });
+  const install = spawnSync(
+    npmCommand(),
+    ["install", "-g", `${packageName}@${check.latest}`, ...registryArgs(registry)],
+    {
+      stdio: "inherit",
+      encoding: "utf-8",
+      shell: process.platform === "win32"
+    }
+  );
   if (install.status !== 0) {
     return {
       ok: false,
@@ -153,10 +170,11 @@ var NOTIFICATION_THROTTLE_MS = 3 * SUCCESS_TTL_MS;
 var LOCK_STALE_AFTER_MS = 10 * 60 * 1e3;
 function versionCheckPaths(home = homedir()) {
   const cacheDir = join(home, ".ctxdb", "cache");
+  const distributionSuffix = DISTRIBUTION_MANIFEST.id === "public" ? "" : `-${DISTRIBUTION_MANIFEST.id}`;
   return {
     cacheDir,
-    statePath: join(cacheDir, "version-check.json"),
-    lockPath: join(cacheDir, "version-check.lock")
+    statePath: join(cacheDir, `version-check${distributionSuffix}.json`),
+    lockPath: join(cacheDir, `version-check${distributionSuffix}.lock`)
   };
 }
 function createInitialVersionCheckState(currentVersion) {

package/dist/chunk-VIG4SYLU.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+
+// <define:__CTXDB_DISTRIBUTION_MANIFEST__>
+var define_CTXDB_DISTRIBUTION_MANIFEST_default = { id: "public", packageName: "@aliyunrds/ctxdb", packageRegistry: null, capabilities: { interactiveLogin: false, managedCredentials: false } };
+
+export {
+  define_CTXDB_DISTRIBUTION_MANIFEST_default
+};

package/dist/{chunk-DPLMBHLU.js → chunk-WSMZOFZQ.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import {
   listKnowledgeBases
-} from "./chunk-QVXDI77N.js";
+} from "./chunk-CAXRYH6E.js";
 import {
   isConnectionError,
   resetCircuit,
   tripCircuit
-} from "./chunk-X2BX6LR6.js";
+} from "./chunk-NJJBT52C.js";
 import {
   CtxdbError
-} from "./chunk-S5W4FQ7M.js";
+} from "./chunk-AAZLOCVB.js";
 
 // src/lib/kb-catalog.ts
 function sanitizeKeyEntities(raw) {