@blogic-cz/agent-tools 1.6.19 → 1.7.0

package/src/api-tool/errors.ts

@@ -0,0 +1,41 @@
+import { Schema } from "effect";
+
+export const ErrorCode = Schema.Literals([
+  "CONFIG_INVALID",
+  "CREDENTIAL_UNAVAILABLE",
+  "UNAUTHORIZED",
+  "POLICY_DENIED",
+  "BUDGET_EXHAUSTED",
+  "DESTINATION_DENIED",
+  "UPSTREAM_FAILED",
+  "LIMIT_EXCEEDED",
+  "DEADLINE_EXCEEDED",
+  "DISCLOSURE_DENIED",
+  "GRANT_ALREADY_USED",
+  "GRANT_STORE_UNAVAILABLE",
+]);
+export class ApiError extends Schema.TaggedError<ApiError>()("ApiError", {
+  code: ErrorCode,
+  message: Schema.String,
+  hint: Schema.String,
+}) {}
+export type ErrorCode = typeof ErrorCode.Type;
+const hints: Record<ErrorCode, string> = {
+  CONFIG_INVALID: "Ask the operator to validate configuration and protected file permissions.",
+  CREDENTIAL_UNAVAILABLE: "Ask the operator to provision the profile credential.",
+  UNAUTHORIZED: "Obtain a valid unexpired caller grant from the operator.",
+  POLICY_DENIED: "Use an operator-approved profile, method and relative path.",
+  BUDGET_EXHAUSTED: "Ask the operator for a new grant with an appropriate budget.",
+  DESTINATION_DENIED: "Ask the operator to approve the exact HTTPS destination and addresses.",
+  UPSTREAM_FAILED: "Check the approved service with the operator. No upstream details are exposed.",
+  LIMIT_EXCEEDED: "Reduce request or response size within the configured limits.",
+  DEADLINE_EXCEEDED: "The bounded request deadline expired.",
+  DISCLOSURE_DENIED: "The response cannot be disclosed under this profile.",
+  GRANT_STORE_UNAVAILABLE:
+    "Restore protected durable grant storage. Retain existing markers and issue fresh grants after a failed startup.",
+  GRANT_ALREADY_USED: "Generate fresh caller grants before restarting. Retain grant-use markers.",
+};
+export const apiError = (code: ErrorCode): ApiError =>
+  new ApiError({ code, message: code, hint: hints[code] });
+export const safeError = (error: unknown): ApiError =>
+  error instanceof ApiError ? apiError(error.code) : apiError("UPSTREAM_FAILED");

package/src/api-tool/index.ts

@@ -0,0 +1,4 @@
+#!/usr/bin/env bun
+import { checkEffectVersion } from "#shared/effect-version";
+if (await checkEffectVersion()) await import("./main");
+else process.exitCode = 1;

package/src/api-tool/main.ts

@@ -0,0 +1,58 @@
+import { Command, Flag } from "effect/unstable/cli";
+import { BunRuntime, BunServices } from "@effect/platform-bun";
+import { Console, Effect } from "effect";
+import { createApiClient } from "./client";
+import { decode, ClientSchema, RequestSchema } from "./types";
+import { ApiError, apiError, safeError } from "./errors";
+import type { ApiRequest, ClientConfig } from "./types";
+import { VERSION } from "#shared";
+
+const requestCommand = Command.make(
+  "request",
+  {
+    config: Flag.String("config"),
+    profile: Flag.String("profile"),
+    path: Flag.String("path"),
+    method: Flag.String("method").pipe(Flag.withDefault("GET")),
+    query: Flag.String("query").pipe(Flag.withDefault("{}")),
+    body: Flag.String("body").pipe(Flag.withDefault("")),
+  },
+  (args) =>
+    Effect.gen(function* () {
+      const result = yield* Effect.tryPromise({
+        try: async () => {
+          let config: ClientConfig;
+          let request: ApiRequest;
+          try {
+            config = decode(ClientSchema, JSON.parse(await Bun.file(args.config).text()));
+            request = decode(RequestSchema, {
+              profile: args.profile,
+              method: args.method,
+              path: args.path,
+              query: JSON.parse(args.query),
+              ...(args.body ? { body: JSON.parse(args.body) } : {}),
+            });
+          } catch {
+            throw apiError("CONFIG_INVALID");
+          }
+          return createApiClient(config).request(request);
+        },
+        catch: safeError,
+      });
+      yield* Console.log(JSON.stringify(result));
+    }),
+).pipe(
+  Command.withDescription("Send a JSON REST request through an operator-owned credential proxy"),
+);
+const command = Command.make("api-tool", {}).pipe(Command.withSubcommands([requestCommand]));
+BunRuntime.runMain(
+  Command.run(command, { version: VERSION, renderErrors: false }).pipe(
+    Effect.provide(BunServices.layer),
+    Effect.tapError((error) =>
+      Console.error(
+        JSON.stringify(error instanceof ApiError ? safeError(error) : apiError("CONFIG_INVALID")),
+      ),
+    ),
+  ),
+  { disableErrorReporting: true },
+);

package/src/api-tool/proxy-entry.ts

@@ -0,0 +1,19 @@
+#!/usr/bin/env bun
+import { startProxy } from "./server";
+import { readPrivateFile } from "./store";
+import { safeError } from "./errors";
+
+if (Bun.argv.length !== 4 || Bun.argv[2] !== "--config") {
+  process.stderr.write("Usage: api-proxy --config /operator/private/operator.json\n");
+  process.exitCode = 1;
+} else {
+  try {
+    await startProxy(JSON.parse(await readPrivateFile(Bun.argv[3])));
+    process.stderr.write(
+      "Credential proxy listening. Verify operator identity separation before production use.\n",
+    );
+  } catch (error) {
+    process.stderr.write(`${JSON.stringify(safeError(error))}\n`);
+    process.exitCode = 1;
+  }
+}

package/src/api-tool/proxy.ts

@@ -0,0 +1,298 @@
+import { createHash } from "node:crypto";
+import { Schema } from "effect";
+import { apiError, safeError } from "./errors";
+import {
+  decode,
+  matchesPrefix,
+  relativePath,
+  RequestSchema,
+  validateOperator,
+  MAX_PATH_BYTES,
+  MAX_RESULT_ENVELOPE_BYTES,
+} from "./types";
+import type { ApiResult, Grant, Profile } from "./types";
+import { createCredentialRetention } from "./retention";
+import { beforeAbort } from "./transport";
+import type { Transport } from "./transport";
+
+export const capabilityDigest = (capability: string): string =>
+  createHash("sha256").update(capability).digest("hex");
+type Budget = {
+  grant: Grant;
+  requests: number;
+  bytes: number;
+  active: number;
+  startedAt: number;
+  revoked: boolean;
+};
+export function createProxy(options: {
+  config: unknown;
+  secrets: Readonly<Record<string, string>>;
+  transport: Transport;
+  now?: () => number;
+}) {
+  const config = validateOperator(options.config);
+  const now = options.now ?? Date.now;
+  const budgets = new Map(
+    config.grants.map((grant) => [
+      grant.digest,
+      { grant, requests: 0, bytes: 0, active: 0, startedAt: now(), revoked: grant.revoked },
+    ]),
+  );
+  let active = 0;
+  const secret = (ref: string): string => {
+    const value = Object.hasOwn(options.secrets, ref) ? options.secrets[ref] : undefined;
+    if (
+      !value ||
+      value.length > 16384 ||
+      /[\uD800-\uDFFF]/u.test(value) ||
+      value.includes("\r") ||
+      value.includes("\n") ||
+      value.includes(String.fromCharCode(0))
+    )
+      throw apiError("CREDENTIAL_UNAVAILABLE");
+    return value;
+  };
+  const references = (profile: Profile): readonly string[] => {
+    switch (profile.auth.kind) {
+      case "bearer":
+      case "apiKey":
+        return [profile.auth.secretRef];
+      case "basic":
+        return [profile.auth.usernameRef, profile.auth.passwordRef];
+      case "login":
+        return Object.values(profile.auth.fields);
+    }
+  };
+  if (Object.keys(options.secrets).length > 128) throw apiError("CONFIG_INVALID");
+  const initial = Object.keys(options.secrets).map(secret);
+  const basicCredentials = new Map<Profile, string>();
+  const loginBodies = new Map<Profile, string>();
+  for (const profile of Object.values(config.profiles)) {
+    for (const ref of references(profile)) secret(ref);
+    if (profile.auth.kind === "basic") {
+      const encoded = Buffer.from(
+        `${secret(profile.auth.usernameRef)}:${secret(profile.auth.passwordRef)}`,
+      ).toString("base64");
+      basicCredentials.set(profile, encoded);
+      initial.push(encoded);
+    }
+    if (profile.auth.kind === "login") {
+      const body = JSON.stringify(
+        Object.fromEntries(
+          Object.entries(profile.auth.fields).map(([field, ref]) => [field, secret(ref)]),
+        ),
+      );
+      if (Buffer.byteLength(profile.auth.path) + Buffer.byteLength(body) > profile.maxRequestBytes)
+        throw apiError("CONFIG_INVALID");
+      loginBodies.set(profile, body);
+    }
+  }
+  const retention = createCredentialRetention(initial);
+  const protectedOutput = (result: ApiResult): string => {
+    const serialized = JSON.stringify(result);
+    if (Buffer.byteLength(serialized) > MAX_RESULT_ENVELOPE_BYTES) throw apiError("LIMIT_EXCEEDED");
+    if (retention.protects(serialized)) throw apiError("DISCLOSURE_DENIED");
+    return serialized;
+  };
+  const admit = (budget: Budget, profile: Profile): void => {
+    const reserve = profile.maxRequestBytes + profile.maxResponseBytes;
+    const total = profile.auth.kind === "login" ? reserve * 2 : reserve;
+    if (budget.revoked || now() >= budget.grant.expiresAt) throw apiError("UNAUTHORIZED");
+    if (
+      now() - budget.startedAt >= budget.grant.lifetimeMs ||
+      budget.requests >= budget.grant.maxRequests ||
+      budget.bytes + total > budget.grant.maxBytes ||
+      budget.active >= budget.grant.maxConcurrent ||
+      active >= config.maxConcurrent
+    )
+      throw apiError("BUDGET_EXHAUSTED");
+    budget.requests++;
+    budget.bytes += total;
+    budget.active++;
+    active++;
+  };
+  const authorize = (capability: string): Budget => {
+    const budget = budgets.get(capabilityDigest(capability));
+    if (!budget || budget.revoked || now() >= budget.grant.expiresAt)
+      throw apiError("UNAUTHORIZED");
+    if (now() - budget.startedAt >= budget.grant.lifetimeMs) throw apiError("BUDGET_EXHAUSTED");
+    return budget;
+  };
+  const execute = async (
+    capability: string,
+    input: unknown,
+  ): Promise<{ result: ApiResult; serialized: string }> => {
+    const budget = authorize(capability);
+    if (
+      typeof input === "object" &&
+      input !== null &&
+      "path" in input &&
+      typeof input.path === "string" &&
+      input.path.length > MAX_PATH_BYTES
+    )
+      throw apiError("POLICY_DENIED");
+    const request = decode(RequestSchema, input);
+    const profile = Object.hasOwn(config.profiles, request.profile)
+      ? config.profiles[request.profile]
+      : undefined;
+    if (!profile || !budget.grant.profiles.includes(request.profile))
+      throw apiError("POLICY_DENIED");
+    relativePath(request.path);
+    if (
+      !(profile.methods ?? ["GET"]).includes(request.method) ||
+      !profile.pathPrefixes.some((prefix) => matchesPrefix(request.path, prefix)) ||
+      profile.deniedPathPrefixes.some((prefix) =>
+        matchesPrefix(request.path.toLowerCase(), prefix.toLowerCase()),
+      ) ||
+      (profile.auth.kind === "login" &&
+        matchesPrefix(request.path.toLowerCase(), profile.auth.path.toLowerCase())) ||
+      (request.method === "GET" && request.body !== undefined)
+    )
+      throw apiError("POLICY_DENIED");
+    const body = request.body === undefined ? "" : JSON.stringify(request.body);
+    const url = new URL(request.path, profile.origin);
+    for (const [key, value] of Object.entries(request.query ?? {}))
+      url.searchParams.append(key, value);
+    if (
+      Buffer.byteLength(body) + Buffer.byteLength(url.pathname + url.search) >
+      profile.maxRequestBytes
+    )
+      throw apiError("LIMIT_EXCEEDED");
+    admit(budget, profile);
+    const controller = new AbortController();
+    const timer = setTimeout(
+      () => controller.abort(),
+      Math.min(
+        profile.timeoutMs,
+        budget.grant.expiresAt - now(),
+        budget.grant.lifetimeMs - (now() - budget.startedAt),
+      ),
+    );
+    try {
+      const checkGrant = () => {
+        if (budget.revoked || now() >= budget.grant.expiresAt) throw apiError("UNAUTHORIZED");
+        if (now() - budget.startedAt >= budget.grant.lifetimeMs) throw apiError("BUDGET_EXHAUSTED");
+      };
+      const send = (target: URL, method: string, headers: Record<string, string>, data: string) => {
+        checkGrant();
+        return options.transport({
+          url: target,
+          method,
+          headers: {
+            "content-type": "application/json",
+            accept: "application/json",
+            ...headers,
+          },
+          body: data,
+          maxBytes: profile.maxResponseBytes,
+          signal: controller.signal,
+          allowedPrivateAddresses: profile.allowedPrivateAddresses,
+        });
+      };
+      const headers: Record<string, string> = {};
+      switch (profile.auth.kind) {
+        case "bearer":
+          headers.authorization = `Bearer ${secret(profile.auth.secretRef)}`;
+          break;
+        case "apiKey":
+          headers[profile.auth.header.toLowerCase()] = secret(profile.auth.secretRef);
+          break;
+        case "basic": {
+          const encoded = basicCredentials.get(profile);
+          if (encoded === undefined) throw apiError("CREDENTIAL_UNAVAILABLE");
+          headers.authorization = `Basic ${encoded}`;
+          break;
+        }
+        case "login": {
+          const auth = profile.auth;
+          const loginBody = loginBodies.get(profile);
+          if (loginBody === undefined) throw apiError("CREDENTIAL_UNAVAILABLE");
+          const reservation = retention.reserve();
+          let operation: Promise<string>;
+          try {
+            operation = send(new URL(profile.auth.path, profile.origin), "POST", {}, loginBody)
+              .then((result) => {
+                if (
+                  result.status < 200 ||
+                  result.status >= 300 ||
+                  Buffer.byteLength(result.body) > profile.maxResponseBytes
+                )
+                  throw apiError("UPSTREAM_FAILED");
+                const parsed = decode(
+                  Schema.Record(Schema.String, Schema.Json),
+                  JSON.parse(result.body),
+                );
+                const token = Object.hasOwn(parsed, auth.tokenField)
+                  ? parsed[auth.tokenField]
+                  : undefined;
+                if (
+                  typeof token !== "string" ||
+                  !token ||
+                  token.length > 16384 ||
+                  /[\uD800-\uDFFF]/u.test(token) ||
+                  token.includes("\r") ||
+                  token.includes("\n") ||
+                  token.includes(String.fromCharCode(0))
+                )
+                  throw apiError("UPSTREAM_FAILED");
+                reservation.retain(token);
+                return token;
+              })
+              .finally(reservation.release);
+          } catch (error) {
+            reservation.release();
+            throw error;
+          }
+          headers.authorization = `Bearer ${await beforeAbort(operation, controller.signal)}`;
+          break;
+        }
+      }
+      const response = await beforeAbort(
+        send(url, request.method, headers, body),
+        controller.signal,
+      );
+      if (response.status < 200 || response.status >= 300) throw apiError("UPSTREAM_FAILED");
+      if (Buffer.byteLength(response.body) > profile.maxResponseBytes)
+        throw apiError("LIMIT_EXCEEDED");
+      if (controller.signal.aborted) throw apiError("DEADLINE_EXCEEDED");
+      let data = response.body === "" ? null : decode(Schema.Json, JSON.parse(response.body));
+      if (profile.disclosure.kind === "fields" && response.body !== "") {
+        let object: Readonly<Record<string, typeof Schema.Json.Type>>;
+        try {
+          object = decode(Schema.Record(Schema.String, Schema.Json), data);
+        } catch {
+          throw apiError("DISCLOSURE_DENIED");
+        }
+        data = Object.fromEntries(
+          profile.disclosure.fields
+            .filter((field) => Object.hasOwn(object, field))
+            .map((field) => [field, object[field]]),
+        );
+      }
+      const result = { status: response.status, data };
+      const serialized = protectedOutput(result);
+      checkGrant();
+      return { result, serialized };
+    } catch (error) {
+      throw safeError(error);
+    } finally {
+      clearTimeout(timer);
+      budget.active--;
+      active--;
+    }
+  };
+  return {
+    authorize: (capability: string): void => {
+      authorize(capability);
+    },
+    revoke: (digest: string): void => {
+      const budget = budgets.get(digest);
+      if (budget) budget.revoked = true;
+    },
+    request: async (capability: string, input: unknown): Promise<ApiResult> =>
+      (await execute(capability, input)).result,
+    requestSerialized: async (capability: string, input: unknown): Promise<string> =>
+      (await execute(capability, input)).serialized,
+  };
+}

package/src/api-tool/retention.ts

@@ -0,0 +1,58 @@
+import { apiError } from "./errors";
+
+export const MAX_RETAINED_CREDENTIALS = 128;
+type RetainedCredential = {
+  readonly exact: readonly string[];
+  readonly urlEncoded: readonly string[];
+};
+export function createCredentialRetention(initial: readonly string[]) {
+  const values = new Map<string, RetainedCredential>();
+  let reserved = 0;
+  const add = (value: string): void => {
+    if (values.has(value)) return;
+    if (!value || value.length > 131_072 || values.size >= MAX_RETAINED_CREDENTIALS)
+      throw apiError("CONFIG_INVALID");
+    if (/[\uD800-\uDFFF]/u.test(value)) throw apiError("CONFIG_INVALID");
+    const base64 = Buffer.from(value).toString("base64").replace(/=+$/, "");
+    const variants = [value, base64, Buffer.from(value).toString("base64url")];
+    values.set(value, {
+      exact: variants.flatMap((encoded) => [encoded, JSON.stringify(encoded).slice(1, -1)]),
+      urlEncoded: [
+        encodeURIComponent(value),
+        new URLSearchParams({ "": value }).toString().slice(1),
+      ],
+    });
+  };
+  for (const value of initial) add(value);
+  return {
+    protects: (serialized: string): boolean => {
+      for (const { exact } of values.values()) {
+        if (exact.some((value) => serialized.includes(value))) return true;
+      }
+      const canonical = serialized.replace(/%[0-9a-f]{2}/gi, (escape) => escape.toUpperCase());
+      for (const { urlEncoded } of values.values()) {
+        if (urlEncoded.some((value) => canonical.includes(value))) return true;
+      }
+      return false;
+    },
+    reserve: () => {
+      if (values.size + reserved >= MAX_RETAINED_CREDENTIALS) throw apiError("BUDGET_EXHAUSTED");
+      reserved++;
+      let pending = true;
+      const release = (): void => {
+        if (pending) {
+          pending = false;
+          reserved--;
+        }
+      };
+      return {
+        release,
+        retain: (value: string): void => {
+          if (!pending) throw apiError("BUDGET_EXHAUSTED");
+          add(value);
+          release();
+        },
+      };
+    },
+  };
+}

package/src/api-tool/server.ts

@@ -0,0 +1,114 @@
+import { createServer as createHttpServer } from "node:http";
+import { createServer as createHttpsServer } from "node:https";
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { createProxy } from "./proxy";
+import { pinnedTransport } from "./transport";
+import type { Transport } from "./transport";
+import { apiError, safeError } from "./errors";
+import { claimGrants, readPrivateFile, readSecretStore } from "./store";
+import { validateOperator } from "./types";
+import type { OperatorConfig } from "./types";
+
+export function createRequestHandler(proxy: ReturnType<typeof createProxy>, maxConcurrent: number) {
+  let active = 0;
+  return (request: IncomingMessage, response: ServerResponse): void => {
+    const failure = (error: unknown): void => {
+      if (!response.destroyed) {
+        response.writeHead(400, {
+          "content-type": "application/json",
+          "cache-control": "no-store",
+        });
+        response.end(JSON.stringify({ code: safeError(error).code }));
+      }
+    };
+    if (
+      request.method !== "POST" ||
+      request.url !== "/request" ||
+      request.headers["content-type"] !== "application/json" ||
+      request.headers["content-encoding"] !== undefined ||
+      active >= maxConcurrent
+    ) {
+      request.resume();
+      failure(apiError("POLICY_DENIED"));
+      return;
+    }
+    const auth = request.headers.authorization;
+    if (!auth || !/^Bearer [A-Za-z0-9_-]{32,256}$/.test(auth)) {
+      request.resume();
+      failure(apiError("UNAUTHORIZED"));
+      return;
+    }
+    try {
+      proxy.authorize(auth.slice(7));
+    } catch (error) {
+      request.resume();
+      failure(error);
+      return;
+    }
+    active++;
+    const run = async (): Promise<void> => {
+      try {
+        const chunks: Buffer[] = [];
+        let bytes = 0;
+        for await (const chunk of request) {
+          const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+          bytes += buffer.length;
+          if (bytes > 1_000_000) throw apiError("LIMIT_EXCEEDED");
+          chunks.push(buffer);
+        }
+        let input: unknown;
+        try {
+          input = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+        } catch {
+          throw apiError("CONFIG_INVALID");
+        }
+        const serialized = await proxy.requestSerialized(auth.slice(7), input);
+        response.writeHead(200, {
+          "content-type": "application/json",
+          "cache-control": "no-store",
+        });
+        response.end(serialized);
+      } catch (error) {
+        failure(error);
+      } finally {
+        active--;
+      }
+    };
+    void run();
+  };
+}
+
+export async function startProxy(configValue: unknown, transport: Transport = pinnedTransport) {
+  const config: OperatorConfig = validateOperator(configValue);
+  const secrets = await readSecretStore(config.secretsFile);
+  const proxy = createProxy({ config, secrets, transport });
+  const handler = createRequestHandler(proxy, config.maxConcurrent);
+  const server =
+    config.listen.kind === "tls"
+      ? createHttpsServer(
+          {
+            cert: await readPrivateFile(config.listen.certFile),
+            key: await readPrivateFile(config.listen.keyFile),
+            minVersion: "TLSv1.2",
+          },
+          handler,
+        )
+      : createHttpServer(handler);
+  server.requestTimeout = 10000;
+  server.headersTimeout = 5000;
+  server.timeout = 70000;
+  server.maxConnections = config.maxConcurrent * 2;
+  await claimGrants(config);
+  try {
+    await new Promise<void>((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(config.listen.port, config.listen.host, () => {
+        server.removeListener("error", reject);
+        resolve();
+      });
+    });
+  } catch {
+    throw apiError("CONFIG_INVALID");
+  }
+  return server;
+}

package/src/api-tool/store.ts

@@ -0,0 +1,93 @@
+import { constants } from "node:fs";
+import { open, lstat } from "node:fs/promises";
+import { dirname, isAbsolute, join } from "node:path";
+import { Schema } from "effect";
+import { apiError } from "./errors";
+import { decode } from "./types";
+import type { OperatorConfig } from "./types";
+
+async function privateDirectory(path: string): Promise<void> {
+  const uid = process.getuid?.();
+  if (uid === undefined || !isAbsolute(path)) throw apiError("CONFIG_INVALID");
+  const stat = await lstat(path);
+  if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== uid || (stat.mode & 0o077) !== 0)
+    throw apiError("CONFIG_INVALID");
+}
+export async function readPrivateFile(path: string): Promise<string> {
+  try {
+    await privateDirectory(dirname(path));
+    const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+      const stat = await file.stat();
+      if (
+        !stat.isFile() ||
+        stat.uid !== process.getuid?.() ||
+        (stat.mode & 0o077) !== 0 ||
+        stat.size > 1_000_000
+      )
+        throw apiError("CONFIG_INVALID");
+      return await file.readFile("utf8");
+    } finally {
+      await file.close();
+    }
+  } catch {
+    throw apiError("CONFIG_INVALID");
+  }
+}
+export async function readSecretStore(path: string): Promise<Readonly<Record<string, string>>> {
+  try {
+    const secrets = decode(
+      Schema.Record(Schema.String, Schema.String),
+      JSON.parse(await readPrivateFile(path)),
+    );
+    if (
+      Object.values(secrets).some(
+        (value) =>
+          !value ||
+          value.length > 16384 ||
+          value.includes("\r") ||
+          value.includes("\n") ||
+          value.includes(String.fromCharCode(0)),
+      )
+    )
+      throw apiError("CREDENTIAL_UNAVAILABLE");
+    return secrets;
+  } catch {
+    throw apiError("CREDENTIAL_UNAVAILABLE");
+  }
+}
+export async function claimGrants(config: OperatorConfig): Promise<void> {
+  try {
+    await privateDirectory(config.grantUseDirectory);
+    await Promise.all(
+      config.grants.map(async (grant) => {
+        const file = await open(
+          join(config.grantUseDirectory, grant.digest),
+          constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW,
+          0o600,
+        );
+        try {
+          await file.writeFile("used\n");
+          await file.sync();
+        } finally {
+          await file.close();
+        }
+      }),
+    );
+    const directory = await open(
+      config.grantUseDirectory,
+      constants.O_RDONLY | constants.O_DIRECTORY,
+    );
+    try {
+      await directory.sync();
+    } finally {
+      await directory.close();
+    }
+  } catch (error) {
+    throw apiError(
+      typeof error === "object" && error !== null && "code" in error && error.code === "EEXIST"
+        ? "GRANT_ALREADY_USED"
+        : "GRANT_STORE_UNAVAILABLE",
+    );
+  }
+}