@catalyst-cloud/cli 0.14.6 → 0.14.8

package/dist/daemon-authority-lifetime.js

@@ -0,0 +1,171 @@
+import { DaemonAuthorityError, readDaemonAuthority, } from "./daemon-authority.js";
+function sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal.aborted) {
+            reject(signal.reason);
+            return;
+        }
+        const abort = () => {
+            clearTimeout(timer);
+            signal.removeEventListener("abort", abort);
+            reject(signal.reason);
+        };
+        const timer = setTimeout(() => {
+            signal.removeEventListener("abort", abort);
+            resolve();
+        }, ms);
+        signal.addEventListener("abort", abort, { once: true });
+    });
+}
+/** One joined task owns fresh /me renewal; no config refresh/write or token publication shortcut.
+ * An expired/changed proof aborts peers through onFailure before waiting for held reader cleanup. */
+export async function createDaemonAuthorityLifetime(ctx, parent) {
+    const owned = new AbortController(), lifetime = AbortSignal.any([parent, owned.signal]);
+    let proof = await readDaemonAuthority(ctx, lifetime);
+    const scope = proof.scope;
+    let running;
+    let fault;
+    let report;
+    let notice;
+    const failures = [];
+    const fail = (error) => {
+        if (fault)
+            return;
+        fault = error;
+        // Callback starts synchronously so the supervisor aborts both feeds before drain waits.
+        if (report) {
+            try {
+                notice = report(error.kind === "identity"
+                    ? "identity_mismatch"
+                    : "authentication_required");
+            }
+            catch (error) {
+                notice = Promise.reject(error);
+            }
+            void notice.catch(() => { });
+        }
+        owned.abort(error);
+    };
+    const assertCurrent = () => {
+        if (fault)
+            throw fault;
+        try {
+            proof.assertCurrent();
+        }
+        catch (error) {
+            if (error instanceof DaemonAuthorityError)
+                fail(error);
+            throw error;
+        }
+    };
+    return {
+        scope,
+        assertCurrent,
+        async getToken() {
+            assertCurrent();
+            const selected = proof;
+            try {
+                const token = await selected.getToken();
+                // Renewal may replace proof during the await; the returned bearer still needs its own
+                // ORIGINAL proof expiry, not the replacement's later authority window.
+                selected.assertCurrent();
+                assertCurrent();
+                return token;
+            }
+            catch (error) {
+                if (error instanceof DaemonAuthorityError)
+                    fail(error);
+                throw error;
+            }
+        },
+        run(signal, onFailure) {
+            if (running)
+                throw new Error("daemon_authority_already_running");
+            report = onFailure;
+            // An earlier synchronous cache guard may already have latched a fault before run starts.
+            if (fault && !notice) {
+                try {
+                    notice = report(fault.kind === "identity"
+                        ? "identity_mismatch"
+                        : "authentication_required");
+                }
+                catch (error) {
+                    notice = Promise.reject(error);
+                }
+                void notice.catch(() => { });
+            }
+            const active = AbortSignal.any([lifetime, signal]);
+            running = (async () => {
+                let timer;
+                const expire = () => {
+                    if (!active.aborted)
+                        fail(new DaemonAuthorityError("authentication", "daemon_authority_expired"));
+                };
+                const arm = () => {
+                    if (timer !== undefined)
+                        clearTimeout(timer);
+                    const remaining = proof.expiresAt - ctx.now().getTime();
+                    if (remaining <= 0) {
+                        expire();
+                        return;
+                    }
+                    timer = setTimeout(expire, remaining);
+                };
+                try {
+                    assertCurrent();
+                    arm();
+                    while (!active.aborted) {
+                        await sleep(10_000, active);
+                        if (active.aborted)
+                            break;
+                        // Old proof's timer stays armed throughout the read and its cleanup ACK.
+                        const fresh = await readDaemonAuthority(ctx, active);
+                        if (active.aborted)
+                            break;
+                        if (JSON.stringify(fresh.scope) !== JSON.stringify(scope))
+                            throw new DaemonAuthorityError("identity", "daemon_authority_changed");
+                        fresh.assertCurrent();
+                        proof = fresh;
+                        arm();
+                    }
+                }
+                catch (error) {
+                    if (error instanceof AggregateError) {
+                        if (!active.aborted) {
+                            const primary = error.errors[0];
+                            fail(primary instanceof DaemonAuthorityError
+                                ? primary
+                                : new DaemonAuthorityError("authentication", "daemon_authority_cleanup_failed"));
+                        }
+                        failures.push(error);
+                        throw error;
+                    }
+                    if (!active.aborted)
+                        fail(error instanceof DaemonAuthorityError
+                            ? error
+                            : new DaemonAuthorityError("authentication", "daemon_authority_unavailable"));
+                    // Only an actual parent/owned cancellation is an ordinary requested stop. The proof
+                    // failure callback persists its reason; no automatic restart renews that latch.
+                }
+                finally {
+                    if (timer !== undefined)
+                        clearTimeout(timer);
+                    if (notice)
+                        await notice;
+                }
+            })();
+            void running.catch((error) => {
+                if (!failures.includes(error))
+                    failures.push(error);
+            });
+            return running;
+        },
+        async stop() {
+            owned.abort(new Error("daemon_authority_stop"));
+            if (running)
+                await running.catch(() => { });
+            if (failures.length)
+                throw new AggregateError(failures, "daemon_authority_cleanup_failed");
+        },
+    };
+}

package/dist/daemon-authority.js

@@ -0,0 +1,216 @@
+import { configPathFor, } from "./config.js";
+import { personCacheScope } from "./daemon-cache.js";
+import { ownedFetch } from "./owned-fetch.js";
+import { fetchMe } from "./transport.js";
+import { onboardFileSnapshot } from "./onboard-file-snapshot.js";
+export class DaemonAuthorityError extends Error {
+    kind;
+    constructor(kind, code) {
+        super(code);
+        this.kind = kind;
+        this.name = "DaemonAuthorityError";
+    }
+}
+const refused = (code) => new DaemonAuthorityError("authentication", code);
+const changed = () => new DaemonAuthorityError("identity", "daemon_authority_changed");
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value
+    : null;
+function currentConfig(ctx) {
+    let bytes;
+    try {
+        bytes = onboardFileSnapshot(configPathFor(ctx.home));
+    }
+    catch {
+        throw refused("daemon_config_unverified");
+    }
+    if (bytes === null)
+        throw refused("daemon_login_required");
+    let parsed;
+    try {
+        parsed = JSON.parse(bytes);
+    }
+    catch {
+        throw refused("daemon_config_unverified");
+    }
+    const config = object(parsed), user = object(config?.user);
+    if (!config ||
+        !user ||
+        typeof config.account !== "string" ||
+        typeof config.baseUrl !== "string" ||
+        typeof config.slug !== "string" ||
+        typeof config.name !== "string" ||
+        typeof config.joinedAt !== "string" ||
+        typeof config.lastSkillBundleVersion !== "string" ||
+        config.principal !== "service" ||
+        typeof user.id !== "string" ||
+        typeof user.label !== "string" ||
+        !(user.email === null || typeof user.email === "string") ||
+        !(user.linearUserId === null || typeof user.linearUserId === "string") ||
+        (user.role !== "owner" && user.role !== "admin" && user.role !== "member"))
+        throw refused("daemon_config_unverified");
+    let permissions = null;
+    if (config.permissions !== null) {
+        if (!Array.isArray(config.permissions) || config.permissions.length > 128)
+            throw refused("daemon_config_unverified");
+        permissions = [];
+        for (const permission of config.permissions) {
+            if (typeof permission !== "string")
+                throw refused("daemon_config_unverified");
+            permissions.push(permission);
+        }
+    }
+    let credential;
+    if (typeof config.key === "string" &&
+        config.key.length > 0 &&
+        config.auth === undefined)
+        credential = { key: config.key };
+    else {
+        const auth = object(config.auth);
+        if (config.key !== undefined ||
+            !auth ||
+            auth.kind !== "oauth" ||
+            typeof auth.sessionId !== "string" ||
+            typeof auth.accessToken !== "string" ||
+            !auth.accessToken.length ||
+            auth.accessToken.length > 8192 ||
+            typeof auth.refreshToken !== "string" ||
+            typeof auth.expiresAt !== "string")
+            throw refused("daemon_config_unverified");
+        credential = {
+            auth: {
+                kind: "oauth",
+                sessionId: auth.sessionId,
+                accessToken: auth.accessToken,
+                refreshToken: auth.refreshToken,
+                expiresAt: auth.expiresAt,
+            },
+        };
+    }
+    return {
+        ...credential,
+        account: config.account,
+        baseUrl: config.baseUrl,
+        slug: config.slug,
+        name: config.name,
+        principal: config.principal,
+        permissions,
+        joinedAt: config.joinedAt,
+        lastSkillBundleVersion: config.lastSkillBundleVersion,
+        user: {
+            id: user.id,
+            label: user.label,
+            email: user.email,
+            linearUserId: user.linearUserId,
+            role: user.role,
+        },
+    };
+}
+function currentToken(config, now) {
+    if (config.key && !config.auth)
+        return config.key;
+    if (!config.key &&
+        config.auth &&
+        Date.parse(config.auth.expiresAt) - now > 30_000)
+        return config.auth.accessToken;
+    // This reader never refreshes or writes the saved login. Renewal needs separately owned IO.
+    throw refused("daemon_login_refresh_required");
+}
+function scopeOf(config, me) {
+    let scope;
+    try {
+        scope = personCacheScope(config, me);
+    }
+    catch {
+        throw changed();
+    }
+    if (scope.permissions !== null && !scope.permissions.includes("mirror:feed"))
+        throw refused("daemon_feed_permission_required");
+    return scope;
+}
+function sameScope(a, b) {
+    return JSON.stringify(a) === JSON.stringify(b);
+}
+/** A read-only proof expires 30s after request ENTRY, not after a potentially slow response.
+ * The owner must stop peers at expiry and join this promise before releasing any writer lease.
+ * Cancellation can remain pending beyond the deadline until actual upstream IO acknowledges it. */
+export async function readDaemonAuthority(ctx, parent) {
+    if (parent.aborted)
+        throw parent.reason;
+    const enteredAt = ctx.now().getTime();
+    if (!Number.isSafeInteger(enteredAt))
+        throw refused("daemon_clock_invalid");
+    const config = currentConfig(ctx);
+    // Saved claims only preflight destination/credential shape; they never establish live authority.
+    scopeOf(config, config);
+    const bearer = currentToken(config, enteredAt);
+    const stopped = new AbortController();
+    const signal = AbortSignal.any([parent, stopped.signal]);
+    const request = ownedFetch(ctx.fetch, signal, { maxBodyBytes: 1024 * 1024 });
+    const timer = setTimeout(() => stopped.abort(refused("daemon_authority_expired")), 30_000);
+    let primary;
+    let failed = false;
+    let proof;
+    try {
+        const me = await fetchMe(config.baseUrl, bearer, request.fetch, 30_000);
+        if (signal.aborted)
+            throw signal.reason;
+        const scope = scopeOf(config, me);
+        const expiresAt = enteredAt + 30_000;
+        const assertCurrent = () => {
+            if (parent.aborted)
+                throw parent.reason;
+            const current = currentConfig(ctx);
+            if (!sameScope(scope, scopeOf(current, me)))
+                throw changed();
+            const now = ctx.now().getTime();
+            currentToken(current, now);
+            // No saved-file read follows the final clock/parent boundary.
+            if (parent.aborted)
+                throw parent.reason;
+            if (!Number.isSafeInteger(now) || now < enteredAt || now >= expiresAt)
+                throw refused("daemon_authority_expired");
+        };
+        assertCurrent();
+        proof = Object.freeze({
+            scope,
+            expiresAt,
+            assertCurrent,
+            async getToken() {
+                assertCurrent();
+                const current = currentConfig(ctx);
+                if (!sameScope(scope, scopeOf(current, me)))
+                    throw changed();
+                // A saved rotation is not proof about that new bearer. Use only the /me-verified token
+                // until a separately owned fresh read replaces this proof.
+                assertCurrent();
+                return bearer;
+            },
+        });
+    }
+    catch (error) {
+        primary = signal.aborted
+            ? signal.reason
+            : error instanceof DaemonAuthorityError
+                ? error
+                : refused("daemon_authority_unavailable");
+        failed = true;
+    }
+    finally {
+        clearTimeout(timer);
+        // The wrapper joins entered headers, readers and FIRST cancel; a timeout is never an ACK.
+        try {
+            await request.settle();
+        }
+        catch (cleanup) {
+            throw new AggregateError(failed ? [primary, cleanup] : [cleanup], "daemon_authority_cleanup_failed");
+        }
+    }
+    if (failed)
+        throw primary;
+    if (!proof)
+        throw refused("daemon_authority_unverified");
+    // Even natural-response cleanup can be slow; publication checks the ORIGINAL expiry again.
+    proof.assertCurrent();
+    return proof;
+}