@almadar/shell-node 0.0.0-stage → 1.0.0

package/dist/chunk-VQVAHUAX.js

@@ -0,0 +1,183 @@
+import { readFile, mkdir, writeFile, rename } from 'fs/promises';
+import { join, dirname } from 'path';
+import { EntityRowSchema, runRowWrite } from '@almadar/core';
+import { AsyncLocalStorage } from 'async_hooks';
+import { installCredentialScopeStorage, CREDENTIAL_MASTER_KEY_ENV, CREDENTIAL_PREVIOUS_MASTER_KEY_ENV, CredentialVault, installCredentialStore } from '@almadar/shell-runtime';
+import { lookup } from 'dns/promises';
+import { request } from 'https';
+import { isIP } from 'net';
+
+// src/credential-rows.ts
+var CREDENTIALS_FILE_ENV = "ALMADAR_CREDENTIALS_FILE";
+var DEFAULT_CREDENTIALS_FILE = ".almadar/dev-credentials.json";
+var CREDENTIAL_ROWS_ENTITY = "AlmadarIntegrationCredential";
+function credentialsFilePath(env = process.env, cwd = process.cwd()) {
+  const named = env[CREDENTIALS_FILE_ENV];
+  return named !== void 0 && named !== "" ? named : join(cwd, DEFAULT_CREDENTIALS_FILE);
+}
+var gates = /* @__PURE__ */ new Map();
+function gateOf(path) {
+  const held = gates.get(path);
+  if (held !== void 0) return held;
+  const gate = { tail: Promise.resolve() };
+  gates.set(path, gate);
+  return gate;
+}
+function isMissing(error) {
+  return "code" in error && error.code === "ENOENT";
+}
+function fileCredentialRows(path) {
+  const gate = gateOf(path);
+  const read = async () => {
+    let text;
+    try {
+      text = await readFile(path, "utf8");
+    } catch (error) {
+      if (error instanceof Error && isMissing(error)) return [];
+      throw error;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(text);
+    } catch (error) {
+      throw new Error(`credential file ${path} is not JSON: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const rows = EntityRowSchema.array().safeParse(parsed);
+    if (!rows.success) throw new Error(`credential file ${path} is not an array of rows: ${rows.error.message}`);
+    const at = rows.data.findIndex((row) => typeof row.id !== "string");
+    if (at >= 0) throw new Error(`credential file ${path}: row ${at} carries no id`);
+    return rows.data;
+  };
+  const write = async (rows) => {
+    await mkdir(dirname(path), { recursive: true });
+    const temporary = `${path}.tmp`;
+    await writeFile(temporary, JSON.stringify(rows, null, 2));
+    await rename(temporary, path);
+  };
+  const change = (work) => {
+    const next = gate.tail.then(async () => {
+      const { rows, result, changed } = work(await read());
+      if (changed) await write(rows);
+      return result;
+    });
+    gate.tail = next.then(
+      () => void 0,
+      () => void 0
+    );
+    return next;
+  };
+  return {
+    async list() {
+      await gate.tail;
+      return read();
+    },
+    create: (row) => change((rows) => ({ rows: [...rows, row], result: void 0, changed: true })),
+    update: (id, data) => change((rows) => ({
+      rows: rows.map((row) => row.id === id ? { ...row, ...data, id } : row),
+      result: void 0,
+      changed: rows.some((row) => row.id === id)
+    })),
+    delete: (id) => change((rows) => {
+      const written = runRowWrite(rows, { kind: "delete", entityType: CREDENTIAL_ROWS_ENTITY, id });
+      const removed = written.outcome.kind === "deleted";
+      return { rows: written.rows, result: removed, changed: removed };
+    })
+  };
+}
+function nodeCredentialScope() {
+  return new AsyncLocalStorage();
+}
+var installed = false;
+function installNodeHostPorts() {
+  if (installed) return;
+  installed = true;
+  installCredentialScopeStorage(nodeCredentialScope());
+}
+async function installNodeCredentialVault(options) {
+  const env = options.env ?? process.env;
+  const master = env[CREDENTIAL_MASTER_KEY_ENV];
+  if (master === void 0) return null;
+  const previous = env[CREDENTIAL_PREVIOUS_MASTER_KEY_ENV];
+  const vault = await CredentialVault.open(
+    new options.kernel.CredentialVault(master, previous === void 0 || previous === "" ? void 0 : previous),
+    fileCredentialRows(credentialsFilePath(env, options.cwd))
+  );
+  installCredentialStore(vault);
+  return vault;
+}
+var IO_TIMEOUT_MS = 5e3;
+async function systemResolve(host) {
+  return lookup(host, { all: true });
+}
+var TokenPostRefusal = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TokenPostRefusal";
+  }
+};
+function urlOf(endpoint) {
+  try {
+    return new URL(endpoint);
+  } catch {
+    throw new TokenPostRefusal("the token endpoint is not a url");
+  }
+}
+function createNodeTokenPost(options) {
+  const send = options.request ?? request;
+  const resolve = options.resolve ?? systemResolve;
+  return async ({ endpoint, headers, body }) => {
+    const url = urlOf(endpoint);
+    if (url.protocol !== "https:") throw new TokenPostRefusal("the token endpoint must be https");
+    if (!options.egressAllows(endpoint)) throw new TokenPostRefusal(`${url.host} is not an origin the program declares in egress`);
+    const host = url.hostname.replace(/^\[/, "").replace(/\]$/, "");
+    const addresses = isIP(host) !== 0 ? [{ address: host, family: isIP(host) }] : await resolve(host);
+    if (addresses.length === 0) throw new TokenPostRefusal(`${host} has no addresses`);
+    const private_ = addresses.find((entry) => !options.isPublicAddress(entry.address));
+    if (private_ !== void 0) throw new TokenPostRefusal(`${host} resolves to ${private_.address}, not a public address`);
+    const checked = addresses[0];
+    const payload = Buffer.from(body, "utf8");
+    const requestHeaders = {};
+    for (const [name, value] of headers) requestHeaders[name] = value;
+    requestHeaders["Content-Length"] = payload.length;
+    requestHeaders["Connection"] = "close";
+    return new Promise((settle, reject) => {
+      const req = send(
+        {
+          method: "POST",
+          protocol: "https:",
+          host,
+          port: url.port === "" ? 443 : Number(url.port),
+          path: `${url.pathname}${url.search}`,
+          headers: requestHeaders,
+          timeout: IO_TIMEOUT_MS,
+          servername: isIP(host) === 0 ? host : void 0,
+          lookup: (_name, lookupOptions, callback) => {
+            if (lookupOptions.all === true) callback(null, [{ address: checked.address, family: checked.family }]);
+            else callback(null, checked.address, checked.family);
+          }
+        },
+        (response) => {
+          const status = response.statusCode ?? 0;
+          if (status >= 300 && status < 400) {
+            response.resume();
+            reject(new TokenPostRefusal(`the token endpoint answered a redirect (${status}); redirects are not followed`));
+            req.destroy();
+            return;
+          }
+          const chunks = [];
+          response.on("data", (chunk) => chunks.push(chunk));
+          response.on("end", () => settle({ status, body: Buffer.concat(chunks).toString("utf8") }));
+          response.on("error", () => reject(new TokenPostRefusal("the token endpoint response failed")));
+        }
+      );
+      req.on("timeout", () => {
+        reject(new TokenPostRefusal("the token endpoint timed out"));
+        req.destroy();
+      });
+      req.on("error", (error) => reject(new TokenPostRefusal(`could not reach the token endpoint${error.code !== void 0 ? ` (${error.code})` : ""}`)));
+      req.end(payload);
+    });
+  };
+}
+
+export { DEFAULT_CREDENTIALS_FILE, TokenPostRefusal, createNodeTokenPost, credentialsFilePath, fileCredentialRows, installNodeCredentialVault, installNodeHostPorts };