@corenel/tools-node 0.3.0 → 0.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/auth.d.ts +110 -2
- package/dist/auth.d.ts.map +1 -1
- package/dist/auth.js +187 -34
- package/dist/auth.js.map +1 -1
- package/dist/index.d.ts +1 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +1 -1
- package/dist/index.js.map +1 -1
- package/package.json +3 -3
package/dist/auth.d.ts
CHANGED
|
@@ -40,7 +40,21 @@ export interface StoredCredential {
|
|
|
40
40
|
refreshToken?: string;
|
|
41
41
|
/** Epoch ms. Absent means the issuer did not say. */
|
|
42
42
|
expiresAt?: number;
|
|
43
|
-
/**
|
|
43
|
+
/**
|
|
44
|
+
* WHO this credential belongs to, as the sign-in reported it.
|
|
45
|
+
*
|
|
46
|
+
* Never an authorization input: nothing is granted on the strength of this
|
|
47
|
+
* string. It IS an identity input in one place -- a sidecar daemon compares
|
|
48
|
+
* it against what a same-machine client claims to be signed in as, and files
|
|
49
|
+
* a match under one synced directory instead of one per browser origin
|
|
50
|
+
* (@corenel/sidecar's hostIdentity.ts). That comparison decides a directory,
|
|
51
|
+
* not an access decision, and a mismatch simply keeps today's behaviour.
|
|
52
|
+
*
|
|
53
|
+
* Consequence worth stating: this is frequently an EMAIL ADDRESS. It lives in
|
|
54
|
+
* a 0600 file on purpose. It must not be logged, printed, or used to name a
|
|
55
|
+
* directory -- the rule that consumes it keys off a truncated digest for
|
|
56
|
+
* exactly that reason.
|
|
57
|
+
*/
|
|
44
58
|
account?: string;
|
|
45
59
|
/**
|
|
46
60
|
* The API base this credential was MINTED against.
|
|
@@ -67,13 +81,64 @@ export declare function writeAuthToken(token: string, stateDir?: string): Promis
|
|
|
67
81
|
* The credential record is REPLACED, not merged: a new sign-in may be a
|
|
68
82
|
* different account at a different host, and carrying the previous one's
|
|
69
83
|
* account or base onto it would report something nobody established.
|
|
84
|
+
*
|
|
85
|
+
* TWO FILES, AND A READER BETWEEN THEM. `resolveNodeCredential` borrows the
|
|
86
|
+
* account from auth.json only when auth.json describes the SAME token the
|
|
87
|
+
* token file holds -- which is right, and which means that during a RE-login
|
|
88
|
+
* the two disagree and the account reads as absent. That is fail-closed (a
|
|
89
|
+
* daemon files that handshake under its per-origin id, exactly as it did
|
|
90
|
+
* before any of this) but it is not free: the directory it mints then
|
|
91
|
+
* persists. So the window is made as small as two files allow. Both new
|
|
92
|
+
* contents are staged first, and the two renames happen back to back with no
|
|
93
|
+
* mkdir, no chmod and no JSON encoding between them -- microseconds rather
|
|
94
|
+
* than the duration of two file writes.
|
|
95
|
+
*
|
|
96
|
+
* It is not ZERO, and cannot be while the credential lives in two files. The
|
|
97
|
+
* honest fix is one file, which means changing what the gateway client and
|
|
98
|
+
* @corenel/cli have always read; the precedence comment at the top of this
|
|
99
|
+
* module is the record of why that has not been done.
|
|
100
|
+
*
|
|
101
|
+
* The credential file is renamed FIRST. Whichever order is chosen the
|
|
102
|
+
* intermediate state loses the account, so the tiebreak is which token a
|
|
103
|
+
* reader gets in that instant: credential-first leaves the token file holding
|
|
104
|
+
* the PREVIOUS token, which is the credential that was working a moment ago.
|
|
105
|
+
* Token-first would publish the new token with no account and no recorded
|
|
106
|
+
* base -- a state no sign-in ever produced.
|
|
70
107
|
*/
|
|
71
108
|
export declare function writeLoginCredential(token: string, opts?: {
|
|
72
109
|
apiBase?: string;
|
|
73
110
|
stateDir?: string;
|
|
74
111
|
account?: string;
|
|
75
112
|
}): Promise<void>;
|
|
113
|
+
/**
|
|
114
|
+
* A store read that says WHICH kind of nothing it found.
|
|
115
|
+
*
|
|
116
|
+
* "There is no credential" and "the credential could not be read" are the same
|
|
117
|
+
* `null` to every caller that only wants a token, and that is right for them:
|
|
118
|
+
* neither can be authenticated with. They are NOT the same to a caller that
|
|
119
|
+
* publishes a STATE off the answer. A daemon that re-reads its own sign-in
|
|
120
|
+
* treats a null as a logout -- and an antivirus lock, an EMFILE under load or a
|
|
121
|
+
* directory mode change then publishes a sign-out that never happened, which in
|
|
122
|
+
* the sidecar's case permanently mints a synced directory (see
|
|
123
|
+
* @corenel/sidecar's accountWatch.ts). So the distinction is carried here,
|
|
124
|
+
* where it is known, rather than guessed at by the caller.
|
|
125
|
+
*
|
|
126
|
+
* `unreadable` is true only for a store that EXISTS as far as the filesystem is
|
|
127
|
+
* concerned and could not be read: ENOENT is a clean absence and never sets it.
|
|
128
|
+
* A malformed credential file is also an absence, deliberately -- the writes
|
|
129
|
+
* are atomic renames, so a parse failure is a corrupt file rather than a
|
|
130
|
+
* half-written one, and corruption should send the user through sign-in rather
|
|
131
|
+
* than being retried forever.
|
|
132
|
+
*/
|
|
133
|
+
export interface CredentialRead<T> {
|
|
134
|
+
/** What was read, or null when there is nothing to read. */
|
|
135
|
+
value: T | null;
|
|
136
|
+
/** The store is there but could not be read. Never true alongside a value. */
|
|
137
|
+
unreadable: boolean;
|
|
138
|
+
}
|
|
76
139
|
export declare function readAuthToken(stateDir?: string): Promise<string | null>;
|
|
140
|
+
/** `readAuthToken`, keeping the absent/unreadable distinction. */
|
|
141
|
+
export declare function readAuthTokenRead(stateDir?: string): Promise<CredentialRead<string>>;
|
|
77
142
|
/** Remove the token file only. Prefer clearAllCredentials for anything a user
|
|
78
143
|
* would call signing out — see the warning there. */
|
|
79
144
|
export declare function clearAuthToken(stateDir?: string): Promise<void>;
|
|
@@ -81,6 +146,9 @@ export declare function clearAuthToken(stateDir?: string): Promise<void>;
|
|
|
81
146
|
* treated as absent rather than fatal — a corrupt credential should send the
|
|
82
147
|
* user through sign-in, not wedge the daemon. */
|
|
83
148
|
export declare function readCredentialFile(stateDir?: string): Promise<StoredCredential | null>;
|
|
149
|
+
/** `readCredentialFile`, keeping the absent/unreadable distinction. See
|
|
150
|
+
* CredentialRead for why a caller would want it. */
|
|
151
|
+
export declare function readCredentialFileRead(stateDir?: string): Promise<CredentialRead<StoredCredential>>;
|
|
84
152
|
/**
|
|
85
153
|
* Sign out of BOTH stores.
|
|
86
154
|
*
|
|
@@ -101,12 +169,24 @@ export interface ResolvedCredential {
|
|
|
101
169
|
expiresAt?: number;
|
|
102
170
|
/** True only when an expiry is known AND has passed. */
|
|
103
171
|
expired?: boolean;
|
|
104
|
-
/**
|
|
172
|
+
/** Who the credential belongs to. Never an authorization input; see
|
|
173
|
+
* StoredCredential.account, including why it must not be logged. */
|
|
105
174
|
account?: string;
|
|
106
175
|
/** The API this credential was minted against, when the sign-in recorded one.
|
|
107
176
|
* Absent for an older credential — read that as "not recorded", never as
|
|
108
177
|
* "the default". */
|
|
109
178
|
apiBase?: string;
|
|
179
|
+
/**
|
|
180
|
+
* At least one credential store is present and could not be read.
|
|
181
|
+
*
|
|
182
|
+
* Absent means every store was read cleanly, so a missing token or a missing
|
|
183
|
+
* `account` above really is an absence. Present, it is not: the answer is
|
|
184
|
+
* incomplete for a reason that is likely to pass (a file lock, EMFILE under
|
|
185
|
+
* load), and a caller that publishes a STATE off this must not read it as a
|
|
186
|
+
* sign-out. Nothing is granted on it either way -- an unreadable credential
|
|
187
|
+
* authenticates nothing and identifies nobody. See CredentialRead.
|
|
188
|
+
*/
|
|
189
|
+
unreadable?: true;
|
|
110
190
|
}
|
|
111
191
|
export interface ResolveCredentialOptions {
|
|
112
192
|
env?: NodeJS.ProcessEnv;
|
|
@@ -152,12 +232,40 @@ export interface ResolveApiBaseOptions {
|
|
|
152
232
|
* and the only symptom was a 401 or a 404 far from the login. Preferring the
|
|
153
233
|
* credential's own base makes the common case need no flag at all, while (1)
|
|
154
234
|
* keeps `--endpoint` meaning exactly what it says for local dev.
|
|
235
|
+
*
|
|
236
|
+
* A second change to (1): the sidecar's `daemon.json` can also carry an
|
|
237
|
+
* `endpoint`, and since the CLI's config-layering fix it is passed in here as
|
|
238
|
+
* `explicit` too (an operator who wrote it into the file chose it, same as
|
|
239
|
+
* typing the flag) -- so it now outranks (2) `CORENEL_API_BASE` as well. A
|
|
240
|
+
* container/CI operator relying on the env var to override a baked-in
|
|
241
|
+
* `daemon.json` endpoint at deploy time now silently no-ops: the file wins.
|
|
242
|
+
* Override it with `--endpoint` (still rung 1, and still per-invocation) or by
|
|
243
|
+
* editing the file itself, not the environment.
|
|
155
244
|
*/
|
|
156
245
|
export declare function resolveApiBase(opts?: ResolveApiBaseOptions): Promise<ResolvedApiBase>;
|
|
157
246
|
/** A token is a credential; printing one puts it in scrollback, shell history
|
|
158
247
|
* and any screen share. Four leading characters identify WHICH token this is
|
|
159
248
|
* without being usable if the output is pasted somewhere. */
|
|
160
249
|
export declare function maskToken(token: string): string;
|
|
250
|
+
/**
|
|
251
|
+
* Mask an account/identity string for output that might land in a support
|
|
252
|
+
* thread or a public issue tracker (`corenel doctor`'s REACHABILITY line) --
|
|
253
|
+
* as opposed to `corenel login`/`corenel auth`, which print it in full because
|
|
254
|
+
* they are interactive and purpose-built for exactly that question. Preserves
|
|
255
|
+
* the domain (still answers "is this the org/deployment I expected?") while
|
|
256
|
+
* hiding the local part: `sbaker@logikbug.com` -> `s***r@logikbug.com`.
|
|
257
|
+
*
|
|
258
|
+
* A one- or two-character local part is NOT masked by keeping its first and
|
|
259
|
+
* last character -- for length 1 that character IS the whole local part, and
|
|
260
|
+
* for length 2 it is BOTH characters, so that scheme would print it in full
|
|
261
|
+
* under the name of masking it. Those collapse to a fixed, content-free `**`
|
|
262
|
+
* instead. A value that is not email-shaped at all (no `@`, or an empty local
|
|
263
|
+
* or domain half) -- or is empty/absent -- degrades to a generic redacted
|
|
264
|
+
* marker rather than being printed raw. Never throws: this runs in a
|
|
265
|
+
* diagnostic command that exists for when things are already broken, and a
|
|
266
|
+
* masking helper crashing on an unexpected shape would be exactly backwards.
|
|
267
|
+
*/
|
|
268
|
+
export declare function maskAccount(account: string | undefined | null): string;
|
|
161
269
|
/** The IAuthTokenProvider for node. Resolves exactly what `auth` reports, which
|
|
162
270
|
* is the whole point: the status command must describe the credential the
|
|
163
271
|
* gateway will actually send. */
|
package/dist/auth.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../auth.ts"],"names":[],"mappings":"AAiDA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAW5D;2DAC2D;AAC3D,wBAAgB,UAAU,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE3D;AAED;iFACiF;AACjF,wBAAgB,UAAU,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE3D;AAED;0EAC0E;AAC1E,wBAAgB,aAAa,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE9D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,mEAAmE;AACnE,eAAO,MAAM,SAAS,kBAAkB,CAAC;AAEzC;+EAC+E;AAC/E,eAAO,MAAM,YAAY,qBAAqB,CAAC;AAE/C;gDACgD;AAChD,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB
|
|
1
|
+
{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../auth.ts"],"names":[],"mappings":"AAiDA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAW5D;2DAC2D;AAC3D,wBAAgB,UAAU,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE3D;AAED;iFACiF;AACjF,wBAAgB,UAAU,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE3D;AAED;0EAC0E;AAC1E,wBAAgB,aAAa,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE9D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,mEAAmE;AACnE,eAAO,MAAM,SAAS,kBAAkB,CAAC;AAEzC;+EAC+E;AAC/E,eAAO,MAAM,YAAY,qBAAqB,CAAC;AAE/C;gDACgD;AAChD,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA8BD,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAcpF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GACnE,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,cAAc,CAAC,CAAC;IAC/B,4DAA4D;IAC5D,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IAChB,8EAA8E;IAC9E,UAAU,EAAE,OAAO,CAAC;CACrB;AAOD,wBAAsB,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE7E;AAED,kEAAkE;AAClE,wBAAsB,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAS1F;AAED;sDACsD;AACtD,wBAAsB,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAErE;AAED;;iDAEiD;AACjD,wBAAsB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAE5F;AAED;qDACqD;AACrD,wBAAsB,sBAAsB,CAC1C,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,CA6B3C;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG1E;AAED,4BAA4B;AAC5B,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,YAAY,GAAG,iBAAiB,GAAG,MAAM,CAAC;AAEjF,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,gBAAgB,CAAC;IACzB,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wDAAwD;IACxD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;yEACqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;yBAEqB;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,kBAAkB,CAAC,CAwC7B;AAkBD;kDACkD;AAClD,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,KAAK,GAAG,YAAY,GAAG,SAAS,CAAC;AAE1E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,aAAa,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC;qEACiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,cAAc,CAAC,IAAI,GAAE,qBAA0B,GAAG,OAAO,CAAC,eAAe,CAAC,CAW/F;AAED;;8DAE8D;AAC9D,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI/C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,CAStE;AAED;;kCAEkC;AAClC,wBAAgB,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,kBAAkB,CAEnE"}
|
package/dist/auth.js
CHANGED
|
@@ -101,6 +101,40 @@ export const TOKEN_ENV = 'CORENEL_TOKEN';
|
|
|
101
101
|
/** The environment variable that names the API. Same spelling @corenel/cli's
|
|
102
102
|
* `apiBase()` reads, because two names for one decision is how they drift. */
|
|
103
103
|
export const API_BASE_ENV = 'CORENEL_API_BASE';
|
|
104
|
+
/**
|
|
105
|
+
* Write one 0600 file so that no reader ever sees a half-written one.
|
|
106
|
+
*
|
|
107
|
+
* A credential is read by OTHER processes while it is being written -- a
|
|
108
|
+
* running daemon re-reads it, the gateway client reads it per request -- and
|
|
109
|
+
* `writeFile` truncates before it fills. A reader landing mid-write gets an
|
|
110
|
+
* empty token file (read as signed out) or a JSON parse failure on auth.json
|
|
111
|
+
* (read as no credential at all). A rename over the top is atomic on POSIX and
|
|
112
|
+
* on NTFS, so a reader sees the old file or the new one.
|
|
113
|
+
*
|
|
114
|
+
* The temp file is created 0600 and chmod'ed before the rename, never after:
|
|
115
|
+
* the point is that the file is never readable at a weaker mode, not that it
|
|
116
|
+
* ends up at the right one.
|
|
117
|
+
*/
|
|
118
|
+
async function writeFilePrivateAtomic(path, contents) {
|
|
119
|
+
const tmp = `${path}.tmp-${process.pid.toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
|
|
120
|
+
await fs.writeFile(tmp, contents, { mode: 0o600 });
|
|
121
|
+
// Best-effort: non-POSIX filesystems reject it, and a failure must not lose
|
|
122
|
+
// a credential that is otherwise written correctly.
|
|
123
|
+
try {
|
|
124
|
+
await fs.chmod(tmp, 0o600);
|
|
125
|
+
}
|
|
126
|
+
catch { /* non-POSIX */ }
|
|
127
|
+
try {
|
|
128
|
+
await fs.rename(tmp, path);
|
|
129
|
+
}
|
|
130
|
+
catch (e) {
|
|
131
|
+
try {
|
|
132
|
+
await fs.rm(tmp, { force: true });
|
|
133
|
+
}
|
|
134
|
+
catch { /* nothing to clean */ }
|
|
135
|
+
throw e;
|
|
136
|
+
}
|
|
137
|
+
}
|
|
104
138
|
export async function writeAuthToken(token, stateDir) {
|
|
105
139
|
/* 0o700 on the DIRECTORY, not just 0o600 on the file. Without a mode, mkdir
|
|
106
140
|
* lands on the process umask -- typically 0o755, so the directory holding a
|
|
@@ -110,15 +144,10 @@ export async function writeAuthToken(token, stateDir) {
|
|
|
110
144
|
* applies the mode only to directories it actually CREATES, so this never
|
|
111
145
|
* tightens a pre-existing ~/.corenel a user set up deliberately. */
|
|
112
146
|
const dir = credentialDir(stateDir);
|
|
113
|
-
const path = tokenFilePath(stateDir);
|
|
114
147
|
await fs.mkdir(dir, { recursive: true, mode: 0o700 });
|
|
115
|
-
await
|
|
116
|
-
//
|
|
117
|
-
//
|
|
118
|
-
try {
|
|
119
|
-
await fs.chmod(path, 0o600);
|
|
120
|
-
}
|
|
121
|
-
catch { /* non-POSIX */ }
|
|
148
|
+
await writeFilePrivateAtomic(tokenFilePath(stateDir), token.trim() + '\n');
|
|
149
|
+
// Best-effort: non-POSIX filesystems reject it, and a failure here must not
|
|
150
|
+
// lose a token that is already written correctly.
|
|
122
151
|
try {
|
|
123
152
|
await fs.chmod(dir, 0o700);
|
|
124
153
|
}
|
|
@@ -136,6 +165,29 @@ export async function writeAuthToken(token, stateDir) {
|
|
|
136
165
|
* The credential record is REPLACED, not merged: a new sign-in may be a
|
|
137
166
|
* different account at a different host, and carrying the previous one's
|
|
138
167
|
* account or base onto it would report something nobody established.
|
|
168
|
+
*
|
|
169
|
+
* TWO FILES, AND A READER BETWEEN THEM. `resolveNodeCredential` borrows the
|
|
170
|
+
* account from auth.json only when auth.json describes the SAME token the
|
|
171
|
+
* token file holds -- which is right, and which means that during a RE-login
|
|
172
|
+
* the two disagree and the account reads as absent. That is fail-closed (a
|
|
173
|
+
* daemon files that handshake under its per-origin id, exactly as it did
|
|
174
|
+
* before any of this) but it is not free: the directory it mints then
|
|
175
|
+
* persists. So the window is made as small as two files allow. Both new
|
|
176
|
+
* contents are staged first, and the two renames happen back to back with no
|
|
177
|
+
* mkdir, no chmod and no JSON encoding between them -- microseconds rather
|
|
178
|
+
* than the duration of two file writes.
|
|
179
|
+
*
|
|
180
|
+
* It is not ZERO, and cannot be while the credential lives in two files. The
|
|
181
|
+
* honest fix is one file, which means changing what the gateway client and
|
|
182
|
+
* @corenel/cli have always read; the precedence comment at the top of this
|
|
183
|
+
* module is the record of why that has not been done.
|
|
184
|
+
*
|
|
185
|
+
* The credential file is renamed FIRST. Whichever order is chosen the
|
|
186
|
+
* intermediate state loses the account, so the tiebreak is which token a
|
|
187
|
+
* reader gets in that instant: credential-first leaves the token file holding
|
|
188
|
+
* the PREVIOUS token, which is the credential that was working a moment ago.
|
|
189
|
+
* Token-first would publish the new token with no account and no recorded
|
|
190
|
+
* base -- a state no sign-in ever produced.
|
|
139
191
|
*/
|
|
140
192
|
export async function writeLoginCredential(token, opts = {}) {
|
|
141
193
|
const cred = {
|
|
@@ -143,22 +195,61 @@ export async function writeLoginCredential(token, opts = {}) {
|
|
|
143
195
|
...(opts.account ? { account: opts.account } : {}),
|
|
144
196
|
...(opts.apiBase ? { apiBase: opts.apiBase } : {}),
|
|
145
197
|
};
|
|
146
|
-
const
|
|
147
|
-
|
|
148
|
-
|
|
198
|
+
const dir = credentialDir(opts.stateDir);
|
|
199
|
+
const credPath = credentialFilePath(opts.stateDir);
|
|
200
|
+
const tokPath = tokenFilePath(opts.stateDir);
|
|
201
|
+
await fs.mkdir(dir, { recursive: true, mode: 0o700 });
|
|
202
|
+
// Staged before either is published, so the publish is two renames and
|
|
203
|
+
// nothing else.
|
|
204
|
+
const credTmp = `${credPath}.tmp-${process.pid.toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
|
|
205
|
+
const tokTmp = `${tokPath}.tmp-${process.pid.toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
|
|
206
|
+
await fs.writeFile(credTmp, `${JSON.stringify(cred, null, 2)}\n`, { mode: 0o600 });
|
|
207
|
+
await fs.writeFile(tokTmp, `${cred.accessToken}\n`, { mode: 0o600 });
|
|
208
|
+
try {
|
|
209
|
+
await fs.chmod(credTmp, 0o600);
|
|
210
|
+
}
|
|
211
|
+
catch { /* non-POSIX */ }
|
|
149
212
|
try {
|
|
150
|
-
await fs.chmod(
|
|
213
|
+
await fs.chmod(tokTmp, 0o600);
|
|
151
214
|
}
|
|
152
215
|
catch { /* non-POSIX */ }
|
|
153
|
-
|
|
216
|
+
try {
|
|
217
|
+
await fs.rename(credTmp, credPath);
|
|
218
|
+
await fs.rename(tokTmp, tokPath);
|
|
219
|
+
}
|
|
220
|
+
catch (e) {
|
|
221
|
+
try {
|
|
222
|
+
await fs.rm(credTmp, { force: true });
|
|
223
|
+
}
|
|
224
|
+
catch { /* nothing to clean */ }
|
|
225
|
+
try {
|
|
226
|
+
await fs.rm(tokTmp, { force: true });
|
|
227
|
+
}
|
|
228
|
+
catch { /* nothing to clean */ }
|
|
229
|
+
throw e;
|
|
230
|
+
}
|
|
231
|
+
try {
|
|
232
|
+
await fs.chmod(dir, 0o700);
|
|
233
|
+
}
|
|
234
|
+
catch { /* non-POSIX */ }
|
|
235
|
+
}
|
|
236
|
+
/** ENOENT -- the store simply is not there -- as opposed to any other failure. */
|
|
237
|
+
function isMissing(err) {
|
|
238
|
+
return typeof err === 'object' && err !== null && err.code === 'ENOENT';
|
|
154
239
|
}
|
|
155
240
|
export async function readAuthToken(stateDir) {
|
|
241
|
+
return (await readAuthTokenRead(stateDir)).value;
|
|
242
|
+
}
|
|
243
|
+
/** `readAuthToken`, keeping the absent/unreadable distinction. */
|
|
244
|
+
export async function readAuthTokenRead(stateDir) {
|
|
156
245
|
try {
|
|
157
246
|
const t = (await fs.readFile(tokenFilePath(stateDir), 'utf8')).trim();
|
|
158
|
-
|
|
247
|
+
// An empty file is an absence, not a failure: that is what a half-finished
|
|
248
|
+
// sign-out or an interrupted write leaves, and there is nothing to retry.
|
|
249
|
+
return { value: t || null, unreadable: false };
|
|
159
250
|
}
|
|
160
|
-
catch {
|
|
161
|
-
return null;
|
|
251
|
+
catch (err) {
|
|
252
|
+
return { value: null, unreadable: !isMissing(err) };
|
|
162
253
|
}
|
|
163
254
|
}
|
|
164
255
|
/** Remove the token file only. Prefer clearAllCredentials for anything a user
|
|
@@ -173,33 +264,42 @@ export async function clearAuthToken(stateDir) {
|
|
|
173
264
|
* treated as absent rather than fatal — a corrupt credential should send the
|
|
174
265
|
* user through sign-in, not wedge the daemon. */
|
|
175
266
|
export async function readCredentialFile(stateDir) {
|
|
267
|
+
return (await readCredentialFileRead(stateDir)).value;
|
|
268
|
+
}
|
|
269
|
+
/** `readCredentialFile`, keeping the absent/unreadable distinction. See
|
|
270
|
+
* CredentialRead for why a caller would want it. */
|
|
271
|
+
export async function readCredentialFileRead(stateDir) {
|
|
176
272
|
let raw;
|
|
177
273
|
try {
|
|
178
274
|
raw = await fs.readFile(credentialFilePath(stateDir), 'utf8');
|
|
179
275
|
}
|
|
180
|
-
catch {
|
|
181
|
-
// ENOENT is the ordinary case
|
|
182
|
-
//
|
|
183
|
-
//
|
|
184
|
-
|
|
276
|
+
catch (err) {
|
|
277
|
+
// ENOENT is the ordinary case and is a clean absence. EACCES/EISDIR/EBUSY
|
|
278
|
+
// yield no usable credential either -- crashing the daemon over one helps
|
|
279
|
+
// nobody -- but they are REPORTED as unreadable, because a caller that
|
|
280
|
+
// publishes a state off this answer must not read them as a sign-out.
|
|
281
|
+
return { value: null, unreadable: !isMissing(err) };
|
|
185
282
|
}
|
|
186
283
|
try {
|
|
187
284
|
const parsed = JSON.parse(raw);
|
|
188
285
|
if (typeof parsed !== 'object' || parsed === null)
|
|
189
|
-
return null;
|
|
286
|
+
return { value: null, unreadable: false };
|
|
190
287
|
const c = parsed;
|
|
191
288
|
if (typeof c.accessToken !== 'string' || !c.accessToken)
|
|
192
|
-
return null;
|
|
289
|
+
return { value: null, unreadable: false };
|
|
193
290
|
return {
|
|
194
|
-
|
|
195
|
-
|
|
196
|
-
|
|
197
|
-
|
|
198
|
-
|
|
291
|
+
value: {
|
|
292
|
+
accessToken: c.accessToken,
|
|
293
|
+
...(typeof c.refreshToken === 'string' ? { refreshToken: c.refreshToken } : {}),
|
|
294
|
+
...(typeof c.expiresAt === 'number' ? { expiresAt: c.expiresAt } : {}),
|
|
295
|
+
...(typeof c.account === 'string' ? { account: c.account } : {}),
|
|
296
|
+
...(typeof c.apiBase === 'string' && c.apiBase ? { apiBase: c.apiBase } : {}),
|
|
297
|
+
},
|
|
298
|
+
unreadable: false,
|
|
199
299
|
};
|
|
200
300
|
}
|
|
201
301
|
catch {
|
|
202
|
-
return null;
|
|
302
|
+
return { value: null, unreadable: false };
|
|
203
303
|
}
|
|
204
304
|
}
|
|
205
305
|
/**
|
|
@@ -235,19 +335,33 @@ export async function resolveNodeCredential(opts = {}) {
|
|
|
235
335
|
const fromEnv = env[TOKEN_ENV]?.trim();
|
|
236
336
|
if (fromEnv)
|
|
237
337
|
return { token: fromEnv, source: 'env' };
|
|
238
|
-
const
|
|
239
|
-
const
|
|
338
|
+
const credRead = await readCredentialFileRead(stateDir);
|
|
339
|
+
const tokenRead = await readAuthTokenRead(stateDir);
|
|
340
|
+
const cred = credRead.value;
|
|
341
|
+
const fileToken = tokenRead.value;
|
|
342
|
+
/* Carried through whatever this resolves to, including a SUCCESSFUL resolve:
|
|
343
|
+
* a readable token file beside an unreadable auth.json answers with a token
|
|
344
|
+
* and no account, and a caller that publishes a sign-out off that missing
|
|
345
|
+
* account needs to know the difference. Omitted rather than set false, so an
|
|
346
|
+
* ordinary result is the same object it always was. */
|
|
347
|
+
const unreadable = credRead.unreadable || tokenRead.unreadable ? { unreadable: true } : {};
|
|
240
348
|
if (fileToken) {
|
|
241
349
|
// Metadata is borrowed ONLY when the credential file describes this same
|
|
242
350
|
// token. Two different tokens mean two different sign-ins, and attaching
|
|
243
351
|
// one's expiry to the other would report a freshness nobody established.
|
|
244
352
|
const same = cred && cred.accessToken === fileToken ? cred : null;
|
|
245
|
-
return
|
|
353
|
+
return {
|
|
354
|
+
...withExpiry({ token: fileToken, source: 'token-file', path: tokenFilePath(stateDir) }, same, now),
|
|
355
|
+
...unreadable,
|
|
356
|
+
};
|
|
246
357
|
}
|
|
247
358
|
if (cred) {
|
|
248
|
-
return
|
|
359
|
+
return {
|
|
360
|
+
...withExpiry({ token: cred.accessToken, source: 'credential-file', path: credentialFilePath(stateDir) }, cred, now),
|
|
361
|
+
...unreadable,
|
|
362
|
+
};
|
|
249
363
|
}
|
|
250
|
-
return { token: null, source: 'none' };
|
|
364
|
+
return { token: null, source: 'none', ...unreadable };
|
|
251
365
|
}
|
|
252
366
|
function withExpiry(base, cred, now) {
|
|
253
367
|
if (!cred)
|
|
@@ -274,6 +388,15 @@ function withExpiry(base, cred, now) {
|
|
|
274
388
|
* and the only symptom was a 401 or a 404 far from the login. Preferring the
|
|
275
389
|
* credential's own base makes the common case need no flag at all, while (1)
|
|
276
390
|
* keeps `--endpoint` meaning exactly what it says for local dev.
|
|
391
|
+
*
|
|
392
|
+
* A second change to (1): the sidecar's `daemon.json` can also carry an
|
|
393
|
+
* `endpoint`, and since the CLI's config-layering fix it is passed in here as
|
|
394
|
+
* `explicit` too (an operator who wrote it into the file chose it, same as
|
|
395
|
+
* typing the flag) -- so it now outranks (2) `CORENEL_API_BASE` as well. A
|
|
396
|
+
* container/CI operator relying on the env var to override a baked-in
|
|
397
|
+
* `daemon.json` endpoint at deploy time now silently no-ops: the file wins.
|
|
398
|
+
* Override it with `--endpoint` (still rung 1, and still per-invocation) or by
|
|
399
|
+
* editing the file itself, not the environment.
|
|
277
400
|
*/
|
|
278
401
|
export async function resolveApiBase(opts = {}) {
|
|
279
402
|
const explicit = opts.explicit?.trim();
|
|
@@ -299,6 +422,36 @@ export function maskToken(token) {
|
|
|
299
422
|
return '****';
|
|
300
423
|
return `${t.slice(0, 4)}…${t.slice(-2)} (${t.length} chars)`;
|
|
301
424
|
}
|
|
425
|
+
/**
|
|
426
|
+
* Mask an account/identity string for output that might land in a support
|
|
427
|
+
* thread or a public issue tracker (`corenel doctor`'s REACHABILITY line) --
|
|
428
|
+
* as opposed to `corenel login`/`corenel auth`, which print it in full because
|
|
429
|
+
* they are interactive and purpose-built for exactly that question. Preserves
|
|
430
|
+
* the domain (still answers "is this the org/deployment I expected?") while
|
|
431
|
+
* hiding the local part: `sbaker@logikbug.com` -> `s***r@logikbug.com`.
|
|
432
|
+
*
|
|
433
|
+
* A one- or two-character local part is NOT masked by keeping its first and
|
|
434
|
+
* last character -- for length 1 that character IS the whole local part, and
|
|
435
|
+
* for length 2 it is BOTH characters, so that scheme would print it in full
|
|
436
|
+
* under the name of masking it. Those collapse to a fixed, content-free `**`
|
|
437
|
+
* instead. A value that is not email-shaped at all (no `@`, or an empty local
|
|
438
|
+
* or domain half) -- or is empty/absent -- degrades to a generic redacted
|
|
439
|
+
* marker rather than being printed raw. Never throws: this runs in a
|
|
440
|
+
* diagnostic command that exists for when things are already broken, and a
|
|
441
|
+
* masking helper crashing on an unexpected shape would be exactly backwards.
|
|
442
|
+
*/
|
|
443
|
+
export function maskAccount(account) {
|
|
444
|
+
const s = (account ?? '').trim();
|
|
445
|
+
if (!s)
|
|
446
|
+
return '(no identity recorded)';
|
|
447
|
+
const at = s.indexOf('@');
|
|
448
|
+
if (at <= 0 || at === s.length - 1)
|
|
449
|
+
return '(unrecognized identity)';
|
|
450
|
+
const local = s.slice(0, at);
|
|
451
|
+
const domain = s.slice(at + 1);
|
|
452
|
+
const maskedLocal = local.length <= 2 ? '**' : `${local[0]}***${local[local.length - 1]}`;
|
|
453
|
+
return `${maskedLocal}@${domain}`;
|
|
454
|
+
}
|
|
302
455
|
/** The IAuthTokenProvider for node. Resolves exactly what `auth` reports, which
|
|
303
456
|
* is the whole point: the status command must describe the credential the
|
|
304
457
|
* gateway will actually send. */
|
package/dist/auth.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth.js","sourceRoot":"","sources":["../auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAEnE;;;;;;4DAM4D;AAE5D;2DAC2D;AAC3D,MAAM,UAAU,UAAU,CAAC,OAAe,OAAO,EAAE;IACjD,OAAO,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;AACpC,CAAC;AAED;iFACiF;AACjF,MAAM,UAAU,UAAU,CAAC,OAAe,OAAO,EAAE;IACjD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,aAAa,CAAC,OAAe,OAAO,EAAE;IACpD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,aAAa,CAAC,QAAiB;IAC7C,OAAO,QAAQ,IAAI,UAAU,EAAE,CAAC;AAClC,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,QAAiB;IAC7C,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,QAAiB;IAClD,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;AACpD,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC;AAEzC;+EAC+E;AAC/E,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAwB/C,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa,EAAE,QAAiB;IACnE;;;;;;wEAMoE;IACpE,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,wEAAwE;IACxE,wEAAwE;IACxE,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IAC9D,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAa,EACb,OAAkE,EAAE;IAEpE,MAAM,IAAI,GAAqB;QAC7B,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE;QACzB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC;IACF,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChF,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IAC9D,MAAM,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAiB;IACnD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtE,OAAO,CAAC,IAAI,IAAI,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;sDACsD;AACtD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAiB;IACpD,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;AAC7F,CAAC;AAED;;iDAEiD;AACjD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAiB;IACxD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,kEAAkE;QAClE,uEAAuE;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/D,MAAM,CAAC,GAAG,MAAiC,CAAC;QAC5C,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QACrE,OAAO;YACL,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,GAAG,CAAC,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAiB;IACzD,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;AAClG,CAAC;AA4BD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAiC,EAAE;IAEnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAE/B,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;IACvC,IAAI,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAEtD,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;IAEhD,IAAI,SAAS,EAAE,CAAC;QACd,yEAAyE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,IAAI,GAAG,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAClE,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,UAAU,CACf,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAC1F,IAAI,EACJ,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,UAAU,CACjB,IAAwB,EACxB,IAA6B,EAC7B,GAAiB;IAEjB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;IAC9E,OAAO;QACL,GAAG,IAAI;QACP,GAAG,CAAC,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC;AACJ,CAAC;AAmBD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA8B,EAAE;IACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IACvC,IAAI,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;IAChE,IAAI,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC;QACvC,GAAG,EAAE,EAAE;QACP,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACtE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACvD,CAAC;AAED;;8DAE8D;AAC9D,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IACjC,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC;AAC/D,CAAC;AAED;;kCAEkC;AAClC,MAAM,UAAU,aAAa,CAAC,QAAiB;IAC7C,OAAO,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;AACrG,CAAC"}
|
|
1
|
+
{"version":3,"file":"auth.js","sourceRoot":"","sources":["../auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAEnE;;;;;;4DAM4D;AAE5D;2DAC2D;AAC3D,MAAM,UAAU,UAAU,CAAC,OAAe,OAAO,EAAE;IACjD,OAAO,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;AACpC,CAAC;AAED;iFACiF;AACjF,MAAM,UAAU,UAAU,CAAC,OAAe,OAAO,EAAE;IACjD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,aAAa,CAAC,OAAe,OAAO,EAAE;IACpD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,aAAa,CAAC,QAAiB;IAC7C,OAAO,QAAQ,IAAI,UAAU,EAAE,CAAC;AAClC,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,QAAiB;IAC7C,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,QAAiB;IAClD,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;AACpD,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC;AAEzC;+EAC+E;AAC/E,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAsC/C;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,sBAAsB,CAAC,IAAY,EAAE,QAAgB;IAClE,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACjG,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,4EAA4E;IAC5E,oDAAoD;IACpD,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC;YAAC,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;QAC3E,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa,EAAE,QAAiB;IACnE;;;;;;wEAMoE;IACpE,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,MAAM,sBAAsB,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3E,4EAA4E;IAC5E,kDAAkD;IAClD,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAa,EACb,OAAkE,EAAE;IAEpE,MAAM,IAAI,GAAqB;QAC7B,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE;QACzB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC;IACF,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,uEAAuE;IACvE,gBAAgB;IAChB,MAAM,OAAO,GAAG,GAAG,QAAQ,QAAQ,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACzG,MAAM,MAAM,GAAG,GAAG,OAAO,QAAQ,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACvG,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IACjE,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACnC,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC;YAAC,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;QAC/E,IAAI,CAAC;YAAC,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;QAC9E,MAAM,CAAC,CAAC;IACV,CAAC;IACD,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;AAC/D,CAAC;AA6BD,kFAAkF;AAClF,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAK,GAA0B,CAAC,IAAI,KAAK,QAAQ,CAAC;AAClG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAiB;IACnD,OAAO,CAAC,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;AACnD,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAiB;IACvD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtE,2EAA2E;QAC3E,0EAA0E;QAC1E,OAAO,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;IACtD,CAAC;AACH,CAAC;AAED;sDACsD;AACtD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAiB;IACpD,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;AAC7F,CAAC;AAED;;iDAEiD;AACjD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAiB;IACxD,OAAO,CAAC,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;AACxD,CAAC;AAED;qDACqD;AACrD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,QAAiB;IAEjB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,0EAA0E;QAC1E,uEAAuE;QACvE,sEAAsE;QACtE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC7F,MAAM,CAAC,GAAG,MAAiC,CAAC;QAC5C,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,WAAW;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QACnG,OAAO;YACL,KAAK,EAAE;gBACL,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,GAAG,CAAC,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/E,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9E;YACD,UAAU,EAAE,KAAK;SAClB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC5C,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAiB;IACzD,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;AAClG,CAAC;AAwCD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAiC,EAAE;IAEnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAE/B,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;IACvC,IAAI,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAEtD,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC5B,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC;IAClC;;;;2DAIuD;IACvD,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAEpG,IAAI,SAAS,EAAE,CAAC;QACd,yEAAyE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,IAAI,GAAG,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAClE,OAAO;YACL,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC;YACnG,GAAG,UAAU;SACd,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO;YACL,GAAG,UAAU,CACX,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAC1F,IAAI,EACJ,GAAG,CACJ;YACD,GAAG,UAAU;SACd,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CACjB,IAAwB,EACxB,IAA6B,EAC7B,GAAiB;IAEjB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;IAC9E,OAAO;QACL,GAAG,IAAI;QACP,GAAG,CAAC,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC;AACJ,CAAC;AAmBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA8B,EAAE;IACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IACvC,IAAI,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;IAChE,IAAI,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC;QACvC,GAAG,EAAE,EAAE;QACP,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACtE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACvD,CAAC;AAED;;8DAE8D;AAC9D,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IACjC,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,WAAW,CAAC,OAAkC;IAC5D,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,CAAC;QAAE,OAAO,wBAAwB,CAAC;IACxC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,yBAAyB,CAAC;IACrE,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;IAC1F,OAAO,GAAG,WAAW,IAAI,MAAM,EAAE,CAAC;AACpC,CAAC;AAED;;kCAEkC;AAClC,MAAM,UAAU,aAAa,CAAC,QAAiB;IAC7C,OAAO,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;AACrG,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
export { NodeFileService } from './fileService';
|
|
2
|
-
export { corenelDir, sidecarDir, authTokenPath, credentialDir, tokenFilePath, credentialFilePath, writeAuthToken, readAuthToken, readCredentialFile, clearAuthToken, clearAllCredentials, resolveNodeCredential, nodeAuthToken, maskToken, TOKEN_ENV, writeLoginCredential, resolveApiBase, API_BASE_ENV, type StoredCredential, type CredentialSource, type ResolvedCredential, type ResolveCredentialOptions, type ApiBaseSource, type ResolvedApiBase, type ResolveApiBaseOptions, } from './auth';
|
|
2
|
+
export { corenelDir, sidecarDir, authTokenPath, credentialDir, tokenFilePath, credentialFilePath, writeAuthToken, readAuthToken, readAuthTokenRead, readCredentialFile, readCredentialFileRead, clearAuthToken, clearAllCredentials, resolveNodeCredential, nodeAuthToken, maskToken, maskAccount, TOKEN_ENV, writeLoginCredential, resolveApiBase, API_BASE_ENV, type StoredCredential, type CredentialSource, type ResolvedCredential, type ResolveCredentialOptions, type CredentialRead, type ApiBaseSource, type ResolvedApiBase, type ResolveApiBaseOptions, } from './auth';
|
|
3
3
|
export { nodePromptHost } from './promptHost';
|
|
4
4
|
export { migrateHomeLayout, type MigrationReport } from './migrateHome';
|
|
5
5
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EACL,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EACvF,cAAc,EAAE,aAAa,EAAE,kBAAkB,EAAE,cAAc,EAAE,mBAAmB,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EACL,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EACvF,cAAc,EAAE,aAAa,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,sBAAsB,EAC5F,cAAc,EAAE,mBAAmB,EACnC,qBAAqB,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EACvE,oBAAoB,EAAE,cAAc,EAAE,YAAY,EAClD,KAAK,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,KAAK,kBAAkB,EAAE,KAAK,wBAAwB,EACpG,KAAK,cAAc,EACnB,KAAK,aAAa,EAAE,KAAK,eAAe,EAAE,KAAK,qBAAqB,GACrE,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
/* @corenel/tools-node — node capabilities (the tools-web twin). */
|
|
2
2
|
export { NodeFileService } from './fileService';
|
|
3
|
-
export { corenelDir, sidecarDir, authTokenPath, credentialDir, tokenFilePath, credentialFilePath, writeAuthToken, readAuthToken, readCredentialFile, clearAuthToken, clearAllCredentials, resolveNodeCredential, nodeAuthToken, maskToken, TOKEN_ENV, writeLoginCredential, resolveApiBase, API_BASE_ENV, } from './auth';
|
|
3
|
+
export { corenelDir, sidecarDir, authTokenPath, credentialDir, tokenFilePath, credentialFilePath, writeAuthToken, readAuthToken, readAuthTokenRead, readCredentialFile, readCredentialFileRead, clearAuthToken, clearAllCredentials, resolveNodeCredential, nodeAuthToken, maskToken, maskAccount, TOKEN_ENV, writeLoginCredential, resolveApiBase, API_BASE_ENV, } from './auth';
|
|
4
4
|
export { nodePromptHost } from './promptHost';
|
|
5
5
|
export { migrateHomeLayout } from './migrateHome';
|
|
6
6
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EACL,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EACvF,cAAc,EAAE,aAAa,EAAE,kBAAkB,EAAE,cAAc,EAAE,mBAAmB,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EACL,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EACvF,cAAc,EAAE,aAAa,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,sBAAsB,EAC5F,cAAc,EAAE,mBAAmB,EACnC,qBAAqB,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EACvE,oBAAoB,EAAE,cAAc,EAAE,YAAY,GAInD,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAwB,MAAM,eAAe,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@corenel/tools-node",
|
|
3
|
-
"version": "0.3.
|
|
3
|
+
"version": "0.3.1",
|
|
4
4
|
"license": "Elastic-2.0",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"description": "Corenel node capabilities — the tools-web twin. A disk-backed FileService (the harness file tools + node PromptHost workspace) over node:fs, confined to a root. Shell/secrets/~/.corenel to follow.",
|
|
@@ -16,8 +16,8 @@
|
|
|
16
16
|
},
|
|
17
17
|
"dependencies": {
|
|
18
18
|
"@prompd/core": "0.5.0-beta.10",
|
|
19
|
-
"@corenel/
|
|
20
|
-
"@corenel/
|
|
19
|
+
"@corenel/protocol": "0.6.1",
|
|
20
|
+
"@corenel/harness": "0.6.1"
|
|
21
21
|
},
|
|
22
22
|
"devDependencies": {
|
|
23
23
|
"@types/node": "^24.13.1",
|