@cortexkit/anthropic-auth-core 1.21.0 → 1.23.0

package/dist/claustrum-enrollment-registry.js

@@ -0,0 +1,194 @@
+import { homedir } from 'node:os';
+import { isAbsolute, join, resolve } from 'node:path';
+import { ClaustrumEnrollmentManager, getClaustrumEnrollmentPaths, } from './claustrum-enrollment.js';
+const REGISTRY_SYMBOL = Symbol.for('cortexkit.anthropic-auth.claustrum-enrollments.v2');
+const PENDING_POLL_MS = 5_000;
+const RETRY_POLL_MS = 60_000;
+const UNAVAILABLE_RETRY_MS = 5_000;
+export function getHostClaustrumEnrollmentPaths(host, env = process.env, cwd = process.cwd()) {
+    const configured = env[`${host.toUpperCase()}_ANTHROPIC_AUTH_CLAUSTRUM_ENROLLMENT_FILE`]?.trim();
+    const tokenPath = configured
+        ? isAbsolute(configured)
+            ? configured
+            : resolve(cwd, configured)
+        : join(env.XDG_STATE_HOME || join(homedir(), '.local', 'state'), 'cortexkit', 'anthropic-auth', `${host}-enrollment.json`);
+    return getClaustrumEnrollmentPaths(tokenPath);
+}
+function registry() {
+    const global = globalThis;
+    if (!global[REGISTRY_SYMBOL])
+        global[REGISTRY_SYMBOL] = new Map();
+    return global[REGISTRY_SYMBOL];
+}
+function notify(entry, status) {
+    entry.status = status;
+    for (const listener of entry.leases.values())
+        listener(status);
+}
+function schedule(entry, delayMs) {
+    if (entry.closed || entry.timer)
+        return;
+    entry.timer = entry.setTimeoutImpl(() => {
+        entry.timer = undefined;
+        void run(entry);
+    }, delayMs);
+    if (typeof entry.timer === 'object' &&
+        entry.timer &&
+        'unref' in entry.timer) {
+        entry.timer.unref();
+    }
+}
+function nextDelay(status, pollIntervalMs) {
+    if (pollIntervalMs === 0 ||
+        status.state === 'approved' ||
+        status.state === 'denied' ||
+        status.state === 'blocked') {
+        return undefined;
+    }
+    if (status.state === 'pending') {
+        return status.retryCode ? RETRY_POLL_MS : pollIntervalMs;
+    }
+    return UNAVAILABLE_RETRY_MS;
+}
+async function getClient(entry) {
+    if (entry.closed)
+        throw new Error('Claustrum enrollment registry is closed');
+    if (entry.client)
+        return entry.client;
+    if (!entry.clientPromise) {
+        entry.clientPromise = entry
+            .connect()
+            .then((client) => {
+            if (entry.closed) {
+                client.close();
+                throw new Error('Claustrum enrollment registry is closed');
+            }
+            entry.client = client;
+            return client;
+        })
+            .finally(() => {
+            entry.clientPromise = undefined;
+        });
+    }
+    return entry.clientPromise;
+}
+async function run(entry) {
+    if (entry.closed)
+        return;
+    if (entry.run)
+        return entry.run;
+    entry.run = (async () => {
+        let status;
+        try {
+            status = await entry.manager.reconcile();
+        }
+        catch {
+            status = {
+                state: 'unavailable',
+                proposedName: entry.proposedName,
+                // Unknown transport/storage errors may echo one-shot bearer material.
+                code: 'unavailable',
+            };
+            // A transport or filesystem failure is not a durable ceremony verdict. Keep
+            // retrying while the process is alive; only the manager persists protocol-terminal
+            // outcomes such as denied, superseded, or already_consumed.
+            if (entry.closed)
+                return;
+            notify(entry, status);
+            if (entry.pollIntervalMs !== 0)
+                schedule(entry, UNAVAILABLE_RETRY_MS);
+            return;
+        }
+        if (entry.closed)
+            return;
+        notify(entry, status);
+        const delay = nextDelay(status, entry.pollIntervalMs);
+        if (delay !== undefined)
+            schedule(entry, delay);
+    })().finally(() => {
+        entry.run = undefined;
+    });
+    return entry.run;
+}
+export function adoptClaustrumEnrollment(options) {
+    const key = resolve(options.paths.tokenPath);
+    const entries = registry();
+    let entry = entries.get(key);
+    if (entry && entry.proposedName !== options.proposedName) {
+        throw new Error('Claustrum enrollment path is already owned by a different consumer');
+    }
+    if (!entry) {
+        const connect = options.connect;
+        const setTimeoutImpl = options.setTimeoutImpl ?? setTimeout;
+        const clearTimeoutImpl = options.clearTimeoutImpl ?? clearTimeout;
+        const lazyClient = {
+            enrollPropose: async (input) => {
+                const current = entry;
+                const client = await getClient(current);
+                if (current.closed)
+                    throw new Error('Claustrum enrollment registry is closed');
+                return client.enrollPropose(input);
+            },
+            enrollPoll: async (input) => {
+                const current = entry;
+                const client = await getClient(current);
+                if (current.closed)
+                    throw new Error('Claustrum enrollment registry is closed');
+                // Once a poll has been sent, let the manager durably collect its one-shot
+                // approval even if release wins meanwhile. Only later calls are fenced.
+                return client.enrollPoll(input);
+            },
+        };
+        entry = {
+            key,
+            proposedName: options.proposedName,
+            leases: new Map(),
+            manager: new ClaustrumEnrollmentManager({
+                client: lazyClient,
+                paths: options.paths,
+                proposedName: options.proposedName,
+            }),
+            connect,
+            setTimeoutImpl,
+            clearTimeoutImpl,
+            pollIntervalMs: options.pollIntervalMs ?? PENDING_POLL_MS,
+            status: { state: 'idle' },
+            closed: false,
+        };
+        entries.set(key, entry);
+    }
+    const lease = Symbol(key);
+    entry.leases.set(lease, options.onStatus ?? (() => { }));
+    options.onStatus?.(entry.status);
+    void run(entry);
+    let released = false;
+    return {
+        status: () => entry?.status ?? { state: 'idle' },
+        reconcileNow: () => (entry ? run(entry) : Promise.resolve()),
+        resetTerminal: async () => {
+            if (!entry)
+                return 'idle';
+            const result = await entry.manager.resetTerminal();
+            if (result === 'reset') {
+                notify(entry, { state: 'idle' });
+                await run(entry);
+            }
+            return result;
+        },
+        release: () => {
+            if (released || !entry)
+                return;
+            released = true;
+            entry.leases.delete(lease);
+            if (entry.leases.size > 0)
+                return;
+            entry.closed = true;
+            if (entry.timer) {
+                entry.clearTimeoutImpl(entry.timer);
+                entry.timer = undefined;
+            }
+            entry.client?.close();
+            entries.delete(key);
+        },
+    };
+}

package/dist/claustrum-enrollment.d.ts

@@ -0,0 +1,70 @@
+import { type ClaustrumClientOptions as ClaustrumEnrollmentClientOptions, type EnrollmentPollOutcome, type EnrollmentTokenFile, writeEnrollmentTokenFile } from '@cortexkit/claustrum-client';
+export declare const CLAUSTRUM_OPENCODE_ENROLLMENT_NAME = "anthropic-auth-opencode";
+export declare const CLAUSTRUM_PI_ENROLLMENT_NAME = "anthropic-auth-pi";
+export interface ClaustrumEnrollmentClient {
+    enrollPropose(input: {
+        name: string;
+        requestSecretHash: string;
+    }): Promise<{
+        requestId: string;
+    }>;
+    enrollPoll(input: {
+        requestId: string;
+        requestSecret: string;
+    }): Promise<EnrollmentPollOutcome>;
+}
+export interface ClaustrumEnrollmentConnection extends ClaustrumEnrollmentClient {
+    close(): void;
+}
+export declare function connectClaustrumEnrollmentClient(options?: ClaustrumEnrollmentClientOptions): Promise<ClaustrumEnrollmentConnection>;
+export type ClaustrumEnrollmentStatus = {
+    state: 'idle';
+} | {
+    state: 'pending';
+    proposedName: string;
+    requestId?: string;
+    retryCode?: string;
+} | {
+    state: 'approved';
+    proposedName: string;
+    approvedName?: string;
+    tokenGeneration: number;
+} | {
+    state: 'denied';
+    proposedName: string;
+} | {
+    state: 'blocked';
+    proposedName: string;
+    code: string;
+} | {
+    state: 'unavailable';
+    proposedName: string;
+    code: string;
+} | {
+    state: 'busy';
+};
+export interface ClaustrumEnrollmentPaths {
+    statePath: string;
+    tokenPath: string;
+}
+export declare function getClaustrumEnrollmentPaths(tokenPath: string): ClaustrumEnrollmentPaths;
+export declare function readClaustrumEnrollmentStatus(paths: ClaustrumEnrollmentPaths, proposedName?: string): Promise<ClaustrumEnrollmentStatus>;
+/** Read fresh bearer material for a scoped operation; never publish this value. */
+export declare function readClaustrumEnrollmentToken(tokenPath: string): Promise<EnrollmentTokenFile>;
+export declare class ClaustrumEnrollmentManager {
+    #private;
+    constructor(options: {
+        client: ClaustrumEnrollmentClient;
+        paths: ClaustrumEnrollmentPaths;
+        proposedName: string;
+        now?: () => number;
+        mintSecret?: () => string;
+        writeTokenFile?: typeof writeEnrollmentTokenFile;
+    });
+    status(): Promise<ClaustrumEnrollmentStatus>;
+    resetTerminal(): Promise<ClaustrumEnrollmentResetResult>;
+    reconcile(): Promise<ClaustrumEnrollmentStatus>;
+}
+export type ClaustrumEnrollmentResetResult = 'reset' | 'idle' | 'refused-pending' | 'refused-approved' | 'busy';
+/** Reset local terminal metadata without connecting to the credential daemon. */
+export declare function resetClaustrumEnrollmentState(paths: ClaustrumEnrollmentPaths, proposedName: string): Promise<ClaustrumEnrollmentResetResult>;